You're right - exposing a server username in error output is a serious security flaw. Stop leaking credentials by redacting usernames from logs and messages, and tighten error handling so stack traces don't reveal sensitive data. Use safe defaults, scrub any user-visible data, and enable proper access controls around verbose errors. If this happened in production, rotate affected credentials and report to security so a fix lands quickly.