A REST API returns errors with detailed messages: '{"error": "User with id 12345 not found in table users_v2 of schema prod_main"}'. A security engineer recommends changing this. Why?

• A.Detailed error messages are required by REST specification
• B.Detailed database error messages leak: table names, schema names, database type, internal ID structures, and that a specific user ID does/does not exist. This information aids reconnaissance, confirms user enumeration, and reveals backend architecture. API errors should be generic client-facing messages ('User not found') with internal error codes for support, while detailed errors are logged server-side only
• C.Detailed errors are acceptable since the API requires authentication
• D.Error messages only matter for 500-level errors, not 404s