scan.now
Premium Scan a site

Find Stack Traces and Sensitive Error Disclosures

Enter a public page. Scan.now checks its returned content for recognised stack traces, fatal errors and detailed runtime exceptions.

Enter the exact public page to inspect. No form is submitted and no data is modified.

A registered account is required to run this test. Finding status, evidence, affected locations and remediation are Premium-only. How active scanning works · Acceptable use

What detailed errors reveal to an attacker

A production exception page can disclose framework versions, source paths, class and method names, database libraries, query fragments and internal service boundaries. That information turns a blind attack into a map and can occasionally include credentials or personal data embedded in request context.

Scan.now checks the returned page for recognised stack traces, fatal errors and runtime exception formats across common platforms. It does not deliberately trigger failures, mutate parameters or request debug endpoints; it evaluates the ordinary response you asked it to inspect.

Put this result in context

This scanner answers one part of the review. Continue with SQL Injection Scanner for discover get inputs and reproduce sql indicators, then Path Traversal Scanner for verify whether path-like parameters return local files. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.

For the background behind these signals, read Website Security: What a Vulnerability Scan Looks For and How to Fix It and What Is a Vulnerability Scan? Types, Limits and What the Results Mean. The Stack trace or runtime exception exposed check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.

Runtime signatures and response details

The check is deliberately bounded to the signals below.

Coverage areaWhat the scanner examines
Stack-trace formatsPython, Java, .NET and common web-runtime trace shapes are recognised in the visible response.
Fatal runtime messagesFile paths and line-number error formats associated with production debug output are checked.
Baseline response onlyThe scanner does not cause an exception, so it can safely identify errors already exposed on that page.

Recognised disclosures and clean responses

A scan result is evidence with a boundary, not a guarantee about every route.

Detailed error exposed

Replace the public response immediately and inspect it for secrets, personal data and internal locations before treating it as merely informational.

No recognised trace

The ordinary response did not match known detailed-error formats. Other error routes, API formats and failures reached only with special input remain.

Expected technical content

Documentation and developer blogs may intentionally contain stack-trace examples. Confirm whether the matched text represents a live exception.

Generic public errors and private diagnostics

Use the recommendations below to address confirmed findings and strengthen the surrounding control.

  1. Use a production exception handler

    Return a stable generic message and status while logging the full exception only to an access-controlled system.

  2. Disable debug mode

    Ensure production environment settings cannot expose interactive debuggers, source excerpts or detailed framework pages.

  3. Add a correlation ID

    Give support and developers a request identifier that links the generic public error to the private log entry.

  4. Scrub sensitive context

    Do not log passwords, tokens, cookies, payment data or full request bodies alongside the exception.

  5. Test failure paths

    Integration tests should deliberately raise representative errors and assert that the response contains no stack, file path or framework detail.

How it works

  1. Enter the page to inspect

    Use the exact public response where an error or unexpected output has been observed.

  2. Known disclosure patterns are matched

    The ordinary HTML is checked for stack traces, fatal errors and detailed runtime exceptions.

  3. Separate live errors from examples

    The report supplies the matched class of evidence so a developer can confirm context and remove exposure.

What this tool checks

1 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Exposed files and information disclosure

1 check

The ones that most often decide the grade:

Medium Stack trace or runtime exception exposedThe page exposes a stack trace or detailed runtime exception.

Related tools

Continue the review with four checks that cover adjacent parts of the same attack surface.

All tools
Active Security SQL Injection Vulnerability Scanner

Discover GET inputs and reproduce SQL indicators
Active Security Path Traversal Scanner

Verify whether path-like parameters return local files
Active Security API Surface Scanner

Inventory API hints, OpenAPI documents and route counts
Websites Website Vulnerability Scanner

Headers, TLS, cookies, exposed files

Guides for this tool

Background reading written to go with these results.

13 min read · Updated Sep 13, 2026 Website Security: What a Vulnerability Scan Looks For and How to Fix It

A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...

Read the guide
8 min read · Updated Sep 12, 2026 What Is a Vulnerability Scan? Types, Limits and What the Results Mean

A vulnerability scan checks a system against a list of known weaknesses and reports what matches. The types of scan, the difference...

Read the guide
8 min read · Updated Sep 14, 2026 Passive vs Active Scanning: What Each Can Find and When Each Is Appropriate

Passive scanning observes normal responses; active scanning sends crafted requests to trigger flaws. The boundary, why it matters...

Read the guide
9 min read · Updated Sep 18, 2026 How to Read a Security Scan Report: Severity, False Positives and What to Fix First

A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...

Read the guide

Frequently asked questions

Why are stack traces dangerous if there is no password in them?

They reveal code structure, filesystem paths, dependencies and internal calls that help an attacker choose and refine the next request.

Should production return no error information at all?

It should return a useful but generic message, the correct status code and a correlation ID. Detailed diagnostics belong in protected logs.

Can this scanner find an interactive debug console?

It may recognise error text on the entered page, but it does not seek or interact with debug consoles. Disable them by production configuration and network policy.

Could documentation cause a false positive?

Yes. A page teaching debugging can contain authentic-looking trace text. Context decides whether the trace is live application output.