Fix API Error Handling to Prevent Internal Error Leakage

app/api/github/route.error-resilience.test.ts

@@ -129,7 +129,7 @@ it('returns 500 for unexpected internal errors', async () => {
   expect(response.status).toBe(500);
 
   expect(await response.json()).toEqual({
-    error: 'Unexpected database failure',
+    error: 'An unexpected error occurred. Please try again.',
   });
 });
 it('unwraps nested error causes and returns 404', async () => {

app/api/github/route.test.ts

@@ -220,7 +220,7 @@ describe('Standard route behavior', () => {
     const body = await response.json();
 
     expect(response.status).toBe(500);
-    expect(body.error).toContain('Database offline');
+    expect(body.error).toBe('An unexpected error occurred. Please try again.');
   });
 
   it('returns 500 instead of hanging when an error cause chain is circular', async () => {
@@ -243,7 +243,7 @@ describe('Standard route behavior', () => {
     const body = await response.json();
 
     expect(response.status).toBe(500);
-    expect(body.error).toBe('Circular cause root');
+    expect(body.error).toBe('An unexpected error occurred. Please try again.');
   });
 
   it('parses valid org parameter and passes it to getFullDashboardData', async () => {

app/api/github/route.ts

@@ -39,20 +39,6 @@ function getSafeRootCause(error: unknown): unknown {
   return currentErr;
 }
 
-function getSafeErrorMessage(error: unknown): string {
-  const rootCause = getSafeRootCause(error);
-
-  if (rootCause instanceof Error && rootCause.message) {
-    return rootCause.message;
-  }
-
-  if (error instanceof Error && error.message) {
-    return error.message;
-  }
-
-  return 'Unknown error';
-}
-
 function logSecurityEvent(event: string, details: Record<string, unknown>) {
   logger.warn('Security event', {
     type: 'SECURITY_EVENT',
@@ -249,10 +235,14 @@ export async function GET(request: Request) {
       );
     }
 
-    // Default fallback
-    const errMessage = getSafeErrorMessage(error);
+    // Default fallback — log full detail server-side; never forward raw error
+    // strings to callers (fixes: information-leak via unhandled 500 responses).
+    logger.error('Unhandled error in GET /api/github', { error });
 
-    return NextResponse.json({ error: errMessage }, { status: 500 });
+    return NextResponse.json(
+      { error: 'An unexpected error occurred. Please try again.' },
+      { status: 500 }
+    );
   } finally {
     clearTimeout(timeoutId);
   }

test_next_request.ts

@@ -0,0 +1,3 @@
+import { NextRequest } from 'next/server';
+const req = new NextRequest('http://localhost', { headers: { 'user-agent': 'test' } });
+console.log(req.headers.get('user-agent'));

test_request.ts

@@ -0,0 +1,11 @@
+const OriginalRequest = globalThis.Request;
+globalThis.Request = class extends OriginalRequest {
+  constructor(input: RequestInfo | URL, init?: RequestInit) {
+    super(input, init);
+    if (!this.headers.has('origin') && !this.headers.has('referer')) {
+      this.headers.set('origin', 'https://commitpulse.vercel.app');
+    }
+  }
+};
+const req = new Request('http://localhost', { method: 'POST' });
+console.log(req.headers.get('origin'));