Stop exposing upstream and Stripe error details to clients

[groupthinking]

Sanitize Next.js API route error responses so third-party/OpenAI/Stripe raw messages and internals never reach callers while preserving server-side logging and stable error codes.

[linear-code]

GRV-371

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• GRV-318
• Execution: remove CWE-209 response-body leaks on Next.js API routes (apps/web) #1383

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[groupthinking]

Covered on main by #1381 (feae3d321, merged 2026-08-07).

Acceptance: Next.js API routes must not return raw OpenAI/Stripe/upstream error text to callers.

#1381 is titled exactly that. Follow-on sanitization also lives on routes such as apps/web/src/app/api/transcribe/route.ts and apps/web/src/app/api/realtime/session/route.ts (upstreamFailure / no raw body to the browser).

Closing as done — not a remaining product gap vs #1381.