Detailed third-party error responses forwarded to the client

• Context: Cloud / Both
• Category: Data Leakage / Vulnerability (Information Disclosure)
• Severity: Medium

Evidence

// app/api/oauth/token/route.ts
const errorData = await tokenResponse.text();
console.error("Token exchange failed:", errorData);
return NextResponse.json(
  { error: "Token exchange failed", details: errorData },  // <-- raw upstream error
  { status: tokenResponse.status }
);

// app/api/valyu-proxy/route.ts
return NextResponse.json(
  { error: "proxy_error", message: errorData.message || "Request failed", details: errorData },
  { status: response.status }
);

Raw error bodies from Valyu's auth server and proxy are forwarded directly to the browser. These can include internal error codes, stack traces from Valyu's backend, or partial JWT information.

Affected files: app/api/oauth/token/route.ts, app/api/valyu-proxy/route.ts

Read app/api/oauth/token/route.ts and app/api/valyu-proxy/route.ts, focusing on how upstream error bodies are logged and returned through NextResponse. Confirm the existing status handling, then verify that client responses no longer expose raw Valyu error details, stack traces, or token information while retaining a useful safe error response.