Should API routes avoid returning cwd and raw error messages?