ResteasyConstraintViolation.getPath() provides some internals of the server-side implementation due to Bean Validation. This is not always desirable.
Therefore, it would be fine to have a context param (e.g. resteasy.violations.hide.path) in web.xml, so that in a production environment this parameter will replace each path entry with an empty string or e.g. "-".