diff --git a/frigate/test/http_api/test_debug_replay_api.py b/frigate/test/http_api/test_debug_replay_api.py
index a0bf4b4e5..45c2c5478 100644
--- a/frigate/test/http_api/test_debug_replay_api.py
+++ b/frigate/test/http_api/test_debug_replay_api.py
@@ -61,7 +61,9 @@ class TestDebugReplayAPI(BaseTestHttp):
         self.assertEqual(resp.status_code, 400)
         body = resp.json()
         self.assertFalse(body["success"])
-        self.assertIn("missing", body["message"])
+        # Message is hard-coded so we don't echo exception text back to clients
+        # (CodeQL: information exposure through an exception).
+        self.assertEqual(body["message"], "Invalid debug replay parameters")
 
     def test_start_returns_409_when_session_already_active(self):
         with patch(