Fix security vulnerabilities

dist/functions/server/web-pages/grab-page-server-res.js

@@ -1,5 +1,6 @@
 import _ from "lodash";
 import { log } from "../../../utils/log";
+import isDevelopment from "../../../utils/is-development";
 export default async function grabPageServerRes({ url, query, routeParams, server_function, props, }) {
     const default_props = {
         url: url
@@ -14,9 +15,7 @@ export default async function grabPageServerRes({ url, query, routeParams, serve
                     "searchParams",
                     "hash",
                     "href",
-                    "password",
                     "protocol",
-                    "username",
                 ]),
             }
             : null,
@@ -36,8 +35,12 @@ export default async function grabPageServerRes({ url, query, routeParams, serve
     }
     catch (error) {
         log.error(`Page ${url?.pathname} Server Error => ${error.message}\n`, error);
+        // Error details can leak internals, so only expose them in
+        // development. They are always logged above.
         return _.merge(default_props, {
-            error: error.message,
+            error: isDevelopment()
+                ? error.message
+                : "Internal Server Error",
         });
     }
 }