diff --git a/dashcaddy-api/routes/apps/restore.js b/dashcaddy-api/routes/apps/restore.js
index 81e1434..ec0f423 100644
--- a/dashcaddy-api/routes/apps/restore.js
+++ b/dashcaddy-api/routes/apps/restore.js
@@ -293,7 +293,11 @@ module.exports = function({ docker, caddy, servicesStateManager, asyncHandler, e
         throw err;
       }
     } catch (err) {
-      errorResponse(res, 500, err.message);
+      // P0-5 fix: was `errorResponse(res, 500, err.message)` which leaks internal
+      // error details (paths, stack traces, library error codes) to the client.
+      // Log the actual error server-side and return a generic message.
+      log.error('apps-revert', 'Revert failed', { error: err.message, stack: err.stack });
+      errorResponse(res, 500, 'Revert failed');
     }
   }, 'apps-revert'));