The point of having custom exception types is to convey more information than is available in standard types. But custom exception types must be public for that to work.

If a method throws a non-public exception, the best you can do on the caller’s side is to catch the closest public base of the class. However, you lose all the information that the new exception type carries.

Noncompliant Code Example

internal class MyException : Exception   // Noncompliant
{
  // ...
}

Compliant Solution

public class MyException : Exception
{
  // ...
}

Exceptions

This rule ignores Exception types that are not derived directly from System.Exception, System.SystemException, or System.ApplicationException.

See

• OWASP Top 10 2017 Category A10 - Insufficient Logging & Monitoring