When you serialize/dehydrate async results (queries, promises, RSC/RPC payloads), treat error objects as sensitive and do not transport raw server error details to the client/shared layer. Use a default redaction policy and make the behavior explicitly configurable and documented.
Apply this rule:
shouldRedactError) rather than hard-coding framework-specific assumptions.digest field used for correlation): either preserve it intentionally for logging/correlation or redact it to prevent client exposure.Example pattern:
function shouldRedactError(error: unknown): boolean {
// default: redact to prevent leaking server-side details
return true
}
function dehydratePromise(promise: Promise<unknown>) {
return promise.catch((error) => {
if (shouldRedactError(error)) throw new Error('redacted')
throw error
})
}