A REST API returns errors with detailed messages: '{"error": "User with id 12345 not found in table users_v2 of schema prod_main"}'. A security engineer recommends changing this. Why?

• A.Detailed error messages break the HTTP contract: a 404 body must stay empty, the JSON structure of errors is reserved for 5xx codes (an RFC 7231 rule), and clients fail to parse a message that names internal tables. Errors should return a numeric code only, with the table and schema details moved into the Warning header for debugging by all consumers, including the browser console of any public site calling the API
• B.The message exposes personal data under data protection law: the user id 12345 (an identifier of a natural person) is repeated in the response body, and the log aggregator stores it unmasked. Errors should return a redacted identifier with only the last two digits, while the full detail is written to the response header X-Debug-Info for support staff, auditors, and all internal tooling that relays the header downstream
• C.Messages like that break caching: a body naming a table (users_v2) varies per request, and shared caches then store each variant separately. Errors should use one static message for each status, with the detail in a cookie (a Set-Cookie value scoped to the API domain): all clients read it on the next call