Bug: DELETE /questions/:id leaks error.message in 500 response

[vipul674]

Bug Description

The DELETE /api/questions/:id endpoint returns error.message in its 500 error response:

res.status(500).json({ message: 'Server error', error: error.message })

This leaks internal implementation details (stack traces, database errors, file paths) to clients in production, which is a security risk.

Steps to Reproduce

Trigger a 500 error in the delete handler (e.g., invalid MongoDB ObjectId that somehow bypasses validation). The response will include the internal error message.

Expected Behavior

500 responses should return a generic error message without internal details:

res.status(500).json({ message: 'Server error' })

Actual Behavior

The raw error.message is sent to the client.

Impact

• Information disclosure: attackers can learn about database structure, internal file paths, or library versions
• Other endpoints in the same file (e.g., GET, PUT) correctly omit error.message — this is the only inconsistent handler

Suggested Fix

Remove error: error.message from the 500 response on line 371:

// Before
res.status(500).json({ message: 'Server error', error: error.message })

// After
res.status(500).json({ message: 'Server error' })

Environment

• Node.js + Express + MongoDB
• Reproducible on latest main

Labels

bug, good first issue

[anshhika-shukla]

Hello,

I would like to work on this issue under SSoC 2026. I have reviewed the requirements and I am interested.
can you please assign this to me ?

[vipul674]

@Ashmita1206 I would like to work on this under GSSoC'26. Please assign it to me.

[vishakhaojha57]

Hii can u please assign this issue to me ?