Fix stack trace / exception detail exposure in Flask API error responses

[Copilot]

CodeQL alert #27 (py/stack-trace-exposure, CWE-209/497): raw exception details were being serialized into HTTP error responses, leaking internal implementation information to callers.

Changes — Services/asl_model_training_hub/flask_app/app.py

• Replace all str(e) / e.stderr values in user-facing JSON message fields with static, generic strings
• Server-side logger.error(...) calls are untouched — full exception detail remains in logs

# Before — leaks internals
except Exception as e:
    logger.error(f"Error in start_model: {str(e)}")
    return jsonify({"status": "error", "message": str(e)}), 500

# After — safe
except Exception as e:
    logger.error(f"Error in start_model: {str(e)}")
    return jsonify({"status": "error", "message": "An internal error occurred"}), 500

Affected handlers: list_models, start_model (×2), stop_model, run_inference (×2).

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

This PR mitigates information disclosure in the ASL Model Training Hub Flask API by removing raw exception details from JSON error responses, addressing a CodeQL finding for stack trace/exception detail exposure.

Changes:

• Replace user-facing message fields that previously included str(e) with static, generic error strings.
• Remove e.stderr from the inference error response body while keeping detailed server-side logging intact.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.