Error disclosure
Check API error information disclosure
Force error surfaces and inspect them for credentials, upstream addresses, or internal paths.
How this check works
An API error information disclosure check sends malformed requests on purpose, then reads the error text. A leak can expose credentials, upstream URLs, or internal paths.
01Probe
Send several malformed requests that should fail.
02Inspect
Read error bodies and headers for secrets and internals.
03Conclude
Mark a leak when credentials, upstream URLs, or paths appear.
- How to read the result
- Success responses can look clean while errors leak the real upstream. Public reports redact the secret but still say a leak happened.
- When to run this check
- Run this on any new relay before you point production traffic at it. It is cheap and often finds the most concrete risk.
Recent reports
Public reports that included this check.
- sub.callai.onegpt-5.6-solNormalReport timeAug 18
- sub.callai.onegpt-5.6-solNormalReport timeAug 18
- ai.databyte.co.iddatabyte-m1NormalReport timeAug 18
- ai.databyte.co.iddeepseek-v4-flashNormalReport timeAug 18
- ai.databyte.co.idMiniMax-M3NormalReport timeAug 18
- tokengate-cqt9ivzs.manus.spaceclaude-opus-5High riskReport timeAug 17
FAQ
What is API error information disclosure?
It is when an error response reveals internals such as credentials, upstream URLs, file paths, or proxy fields.
Why trigger errors on purpose?
Many leaks only appear when the request is invalid. A healthy success path can hide the same internals.
Does LMSpeed store leaked secrets in the public report?
No. Public reports are redacted. The report can say a leak happened without publishing the secret.