Error disclosure
Check API error information disclosure
Force error surfaces and inspect them for credentials, upstream addresses, or internal paths.
How this check works
An API error information disclosure check sends malformed requests on purpose, then reads the error text. A leak can expose credentials, upstream URLs, or internal paths.
01Probe
Send several malformed requests that should fail.
02Inspect
Read error bodies and headers for secrets and internals.
03Conclude
Mark a leak when credentials, upstream URLs, or paths appear.
What this check does
LMSpeed sends several bad requests and inspects the error bodies. The check looks for secrets and internals, not just an HTTP status code.
Why it matters
Error text is often less guarded than success responses. A leak here can reveal the real upstream or a key that should stay private.
Success paths can look clean while errors leak the real upstream, a file path, or a key. This check sends several malformed requests on purpose. Public reports redact the secret and still say a leak happened.
- How to read the result
- Success responses can look clean while errors leak the real upstream. Public reports redact the secret but still say a leak happened.
- When to run this check
- Run this on any new relay before you point production traffic at it. It is cheap and often finds the most concrete risk.
Recent reports
Public reports that included this check.
- sub.callai.onegpt-5.6-solNormalReport timeAug 18
- sub.callai.onegpt-5.6-solNormalReport timeAug 18
- ai.databyte.co.iddatabyte-m1NormalReport timeAug 18
- ai.databyte.co.iddeepseek-v4-flashNormalReport timeAug 18
- ai.databyte.co.idMiniMax-M3NormalReport timeAug 18
- tokengate-cqt9ivzs.manus.spaceclaude-opus-5High riskReport timeAug 17
FAQ
What is API error information disclosure?
It is when an error response reveals internals such as credentials, upstream URLs, file paths, or proxy fields.
Why trigger errors on purpose?
Many leaks only appear when the request is invalid. A healthy success path can hide the same internals.
Does LMSpeed store leaked secrets in the public report?
No. Public reports are redacted. The report can say a leak happened without publishing the secret.