SecurityException Status Codes

What are other things?
If there are exceptions that the framework throws, and the status code is incorrect,
we should fix the status code.
But developers should catch other exceptions if needed, and handle properly.

Yes, when the framework Exception Handler catches Exceptions,
the default HTTP status code will be 500.

In my opinion, changing the default 500 to 4xx does nothing for security,
and 4xx is probably incorrect in most cases. Because 4xx means errors in client side,
but most exceptions caused by server side.

Can you show the exact requirement coming from the US Federal Government?
I don't get why the US Federal Government says such nonsense.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper