Redact HTTP error stack traces by default #2026

Default configuration proposal

Change the default of http.error.excludeStackTraces to true so HTTP error responses use the existing redaction marker unless diagnostic stack traces are explicitly enabled.

The option already exists through #536 and PR #1461. This proposal changes its default, rather than adding another hiding mechanism. On main 0c481c0, the fallback in GlobalErrorWebExceptionHandler is false.

Expected behavior

• Omitted property: use the existing REDACTED FOR SECURITY REASONS marker.
• Explicit true: continue redacting.
• Explicit false: continue returning diagnostic stack traces.

Keep status codes, messages, request IDs, and the response schema unchanged. This proposal only concerns the stackTrace field; it does not introduce a general error-message redaction policy.

Compatibility and validation

This is a behavior change for deployments that omit the option. Document the migration path: set http.error.excludeStackTraces: false to retain the previous diagnostic response behavior.

Tests with the real WebFlux error handler confirm the current default and exercise omitted, explicit-true, and explicit-false configurations. No additional vulnerability or CVE claim is made.