I get that leaking security information might not be great, and I understand I am not a developer, so it might just be hard, but...

I tend to think devs should try to present permission issues as permission issues.