Some exceptions will have a null message. Should we include exception class name as well, or is that giving too much away according to security experts?