From 4aae3eec223d8367470e393ebecb213c708c5264 Mon Sep 17 00:00:00 2001
From: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Date: Tue, 30 Jun 2026 06:40:58 -0700
Subject: [PATCH] fix(security): avoid rendering error stacks (#5624)

Integrated into release/v3.8.43 (drift-shed: cherry-picked the real change onto the release tip; stale-base drift dropped).
---
 src/app/error.tsx                       |  1 -
 tests/unit/error-boundary-stack.test.ts | 12 ++++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 tests/unit/error-boundary-stack.test.ts

diff --git a/src/app/error.tsx b/src/app/error.tsx
index 110735353b..0b1327185c 100644
--- a/src/app/error.tsx
+++ b/src/app/error.tsx
@@ -40,7 +40,6 @@ export default function Error({ error, reset }: ErrorProps) {
           aria-label="Error details"
         >
           {error.message}
-          {error.stack && `\n\n${error.stack}`}
         </pre>
       )}
       <div className="flex gap-3">
diff --git a/tests/unit/error-boundary-stack.test.ts b/tests/unit/error-boundary-stack.test.ts
new file mode 100644
index 0000000000..7adbd8852c
--- /dev/null
+++ b/tests/unit/error-boundary-stack.test.ts
@@ -0,0 +1,12 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+const repoRoot = join(import.meta.dirname, "../..");
+
+test("app error boundary does not render stack traces", async () => {
+  const source = await readFile(join(repoRoot, "src/app/error.tsx"), "utf8");
+
+  assert.doesNotMatch(source, /error\.stack/);
+});