When the REST API (or Automation) throws an Exception, the exception stack trace is sent:
- if the org.nuxeo.rest.stack.enable=true parameter is present
- if the caller set the accepted media type to application/json+nxentity
The second one means that anybody can have the whole stack trace if the accepted media type is correctly set to application/json+nxentity.
Make sure that the whole stack trace is only sent if the parameter org.nuxeo.rest.stack.enable is set to true.