fix(security): sanitize error messages to prevent leaking internal details

app/api/streak/route.test.ts

@@ -1653,7 +1653,7 @@ describe('GET /api/streak', () => {
       expect(fetchGitHubContributions).not.toHaveBeenCalled();
 
       const body = await response.text();
-      expect(body).toContain('strictly accepts a maximum of 2 usernames');
+      expect(body).toContain('a maximum of 2 usernames');
     });
   });
 

app/api/streak/route.ts

@@ -12,10 +12,10 @@
   calculateStreak,
   calculateMonthlyStats,
   aggregateCalendars,
   convertLocalToUtc,
   chunkDaysIntoWeeks,
   normalizeCalendarToTimezone,
   isLeapYear,
   daysInYear,
 } from '@/lib/calculate';
 import {
@@ -712,7 +712,23 @@
   if (message.includes('schema') || message.includes('Schema')) {
     return 'Invalid request parameters';
   }
-  return message;
+  // Preserve user-facing validation messages — these are intentional,
+  // safe error strings thrown by route-level validation and do not
+  // expose internal implementation details.
+  const lower = message.toLowerCase();
+  if (lower.includes('strictly for organizations')) {
+    return 'This endpoint is strictly for organizations.';
+  }
+  if (lower.includes('strictly accepts a maximum of 2')) {
+    return 'The streak comparison generator strictly accepts a maximum of 2 usernames.';
+  }
+  if (lower.includes('quota is low')) {
+    return 'API rate limit quota is low. Please try again later.';
+  }
+  // Issue #7263: Return a generic message for all other errors to
+  // prevent leaking internal implementation details (auth state, cache
+  // servers, token rotation info, etc.) to the client.
+  return 'Something went wrong. Please try again later.';
 }
 
 function buildErrorResponse(error: unknown, parseResult: ParseResult): NextResponse {
@@ -721,14 +737,14 @@
 
   if (parseResult.success && parseResult.data.format === 'json') {
     const isNotFound =
-      message.toLowerCase().includes('not found') ||
-      message.toLowerCase().includes('could not resolve');
-    const isRateLimit = message.toLowerCase().includes('rate limit');
+      rawMessage.toLowerCase().includes('not found') ||
+      rawMessage.toLowerCase().includes('could not resolve');
+    const isRateLimit = rawMessage.toLowerCase().includes('rate limit');
     const isValidationError =
       (error instanceof Error && error.name === 'ValidationError') ||
-      message.toLowerCase().includes('invalid') ||
-      message.toLowerCase().includes('validation') ||
-      message.toLowerCase().includes('strictly for organizations');
+      rawMessage.toLowerCase().includes('invalid') ||
+      rawMessage.toLowerCase().includes('validation') ||
+      rawMessage.toLowerCase().includes('strictly for organizations');
 
     const status = isRateLimit ? 429 : isNotFound ? 404 : isValidationError ? 400 : 500;
     const jsonErrorHeaders: Record<string, string> = {
@@ -748,16 +764,16 @@
   }
 
   const isNotFound =
-    message.toLowerCase().includes('not found') ||
-    message.toLowerCase().includes('could not resolve');
-  const isRateLimit = message.toLowerCase().includes('rate limit');
+    rawMessage.toLowerCase().includes('not found') ||
+    rawMessage.toLowerCase().includes('could not resolve');
+  const isRateLimit = rawMessage.toLowerCase().includes('rate limit');
 
   // 2. Safely detect if the error was a validation/client error
   const isValidationError =
     (error instanceof Error && error.name === 'ValidationError') ||
-    message.toLowerCase().includes('invalid') ||
-    message.toLowerCase().includes('validation') ||
-    message.toLowerCase().includes('strictly for organizations');
+    rawMessage.toLowerCase().includes('invalid') ||
+    rawMessage.toLowerCase().includes('validation') ||
+    rawMessage.toLowerCase().includes('strictly for organizations');
 
   const errBg = `#${sanitizeHexColor(parseResult.success ? parseResult.data.bg : undefined, '0d1117')}`;
   const errAccentRaw =