/**
 * Pass: info-disclosure-stacktrace (CWE-209, category: security)
 *
 * Detects exception stack traces / messages being returned to remote clients
 * via an HTTP response handler. This leaks framework internals, file paths,
 * SQL fragments, and class names — useful reconnaissance for an attacker.
 *
 * Detection per language:
 *   Java:
 *     - `e.printStackTrace(response.getWriter())` / `.printStackTrace(out)`
 *       where `out` is a response writer.
 *     - `response.getWriter().write(e.toString())`
 *     - `response.getWriter().println(e.getMessage())`
 *     - `new ResponseEntity<>(e.getStackTrace(), …)`
 *
 *   Python:
 *     - `return traceback.format_exc()` from a handler-like function
 *     - `flask.jsonify(error=traceback.format_exc())`
 *     - Bare `return str(e)` / `return {"error": str(e)}` in handler
 *
 *   JS/TS:
 *     - `res.send(err.stack)` / `res.json({error: err.stack})`
 *     - `res.json(err)` (whole error object)
 *     - `res.status(N).send(err.message + err.stack)` / similar
 *
 *   Go:
 *     - `http.Error(w, err.Error()+debug.Stack(), 500)` — narrow
 *     - `fmt.Fprintln(w, err)` in an HTTP handler
 *
 * Negative guard: if the consumer is a logger (`console.error`,
 * `logger.error`, `log.Error`), do NOT fire — logging stack traces
 * server-side is not a leak.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface InfoDisclosureStacktraceResult {
    findings: Array<{
        line: number;
        api: string;
        language: string;
    }>;
}
export declare class InfoDisclosureStacktracePass implements AnalysisPass<InfoDisclosureStacktraceResult> {
    readonly name = "info-disclosure-stacktrace";
    readonly category: "security";
    run(ctx: PassContext): InfoDisclosureStacktraceResult;
    private makeFinding;
}
//# sourceMappingURL=info-disclosure-stacktrace-pass.d.ts.map