@pquerner in NestJS, use the disableErrorMessages option on ValidationPipe:

app.useGlobalPipes(
  new ValidationPipe({
    disableErrorMessages: process.env.NODE_ENV === 'production',
  })
);

this returns a 400 Bad Request with no constraint details in the response body when enabled. validation still runs and rejects invalid input, it just strips the error messages from the response.

if you're not using NestJS, catch the validation errors and return a generic message:

const errors = await validate(dto);
if (errors.length > 0) {
  throw new HttpException('Validation failed', 400);
}

ref: NestJS ValidationPipe docs