Session 7d: Audit fixes - rate limiting, error leak, parallel parlays, analyze cache, bundle analyzer

src/routes/shareCard.js

@@ -182,7 +182,11 @@ router.post('/', async (req, res) => {
   try {
     svg = renderer.buildSvg(type, format, payload);
   } catch (err) {
-    return res.status(400).json({ error: 'render failed', detail: err.message });
+    // SEC-2 (Session 7d): don't echo err.message to public callers — the
+    // SVG renderer may surface file paths or upstream library detail.
+    // Log to stderr for ops, return a generic 400 to the caller.
+    console.error('[VYNDR] shareCard render failed:', err?.message);
+    return res.status(400).json({ error: 'render failed' });
   }
 
   // Optional SVG-only mode (no rasterization)
@@ -203,7 +207,8 @@ router.post('/', async (req, res) => {
       res.set('X-Degraded', 'svg-fallback');
       return res.send(svg);
     }
-    return res.status(500).json({ error: 'rasterize failed', detail: err.message });
+    console.error('[VYNDR] shareCard rasterize failed:', err?.message);
+    return res.status(500).json({ error: 'rasterize failed' });
   }
 
   // Write cache (best-effort; ignore failures so the response still flies)