I noticed that when a plugin_lang_get() attempts to fetch a string that doesn't exist, the error message discloses the full path to the MantisBT instance on the server. I suspect this happens in other errors as well. See attached image.