When an exception occurs in a .NET application, the exception output also includes the path and file name of the code file that resided on the developer's machine. This shares some information that is useful in debugging, but also may present a security issue as shown in the following example:
In the above image the directory D:\talks comes from the developers machine and not the end user's.
Suppose I have a Visual Studio Solution file that has a PFX file with the password part of the name:
Example: d:\my secret project\Obscure FOSS project\Signer-PW-Is-test123.pfx
Of course test123 isn't the real pfx password, but what if it was a more sensitive password that was used for other purposes (say domain admin).
Question:
Where is this string "Signer-PW-Is-test123.pfx" stored in the .NET DLL or exe?
Is it stored in the OBJ file?
How can I purge this data, or anonymize the information so that I don't leak what's unnecessary but still make it possible for engineers to debug the application.