When true, the error stack trace is included in the response body. Never enable this in production — pass a config-derived boolean (e.g. config.get('NODE_ENV') === 'development'), never read process.env directly (AI_GUIDELINES §4.1). Defaults to false.

Note the stack is the secondary disclosure: the primary one is the error message, which for a failed query carries the SQL and its bound parameter values. Masking that is maskInternalErrors' job.

The two compose safely, and masking wins: an error masked by ErrorHandlerOptions.maskInternalErrors carries no stack in the body even when this option is true, because a stack begins with the very message that was masked. Set maskInternalErrors: false to see the stack of an internal error.