Worked solution: turn off public diagnostics

Change the starter's config.mjs to:

export const debug = false;

Do not modify the server, browser display or checks. The supplied solution folder contains the same app infrastructure with only this configuration difference.

Run the solution

Stop any lesson server using port 3000. From the repository root:

cd exercises/06-security-misconfiguration/solution
node checks.mjs
node server.mjs

Checks should all pass. Open http://127.0.0.1:3000 and try both buttons. Working status remains 200. Simulated failure remains 503 with a generic message and SERVICE_UNAVAILABLE, but no diagnostics. Stop with Ctrl+C.

Why this works

The server reads the boolean at startup and omits diagnostics before building the HTTP response. No internal details reach the browser. Merely suppressing them in app.js would still send them over the network and would fail the direct HTTP checks.

The original diagnostic path and service name are fictional. In a real system, analogous details may help someone map internal infrastructure. We remove the unnecessary disclosure while preserving honest failure reporting. The simulated service failure itself is deliberately not repaired.

Debugging is legitimate during development; access to diagnostic information needs appropriate control. This one setting is not complete production hardening, authentication or logging design. CVE Lite CLI does not detect this configuration flaw.