I am using [Exception shielding][1] pattern.

**First of all**: application logs all information that I need (as developer) to the database, file...

**Second**: application returns a message that does not contain sensitive internal information to the client.

Private information (shielded) that application can collect:

- client environment variables (url, ip, language...)
- place of error(s): stack
- my business variables (custom error handling)

I have decided to separate unhandled exceptions and custom handling ones and I have logging templates for every type of exceptions


  [1]: http://msdn.microsoft.com/en-us/library/ff649391.aspx