diff --git a/internal/credential/attributes.go b/internal/credential/attributes.go
index b94af11..805e508 100644
--- a/internal/credential/attributes.go
+++ b/internal/credential/attributes.go
@@ -130,7 +130,7 @@ func GetCredentialsConfig(secrets *structpb.Struct, attrs *CredentialAttributes,
 
 	cfg, err := awsutil.NewCredentialsConfig(opts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus(err.Error())
+		return nil, errors.BadRequestStatus("%s", err.Error())
 	}
 
 	return cfg, nil
diff --git a/internal/errors/error.go b/internal/errors/error.go
index 5a23182..80cb4f3 100644
--- a/internal/errors/error.go
+++ b/internal/errors/error.go
@@ -73,7 +73,7 @@ func InvalidArgumentError(msg string, f map[string]string) error {
 		sort.Strings(fieldMsgs)
 		msg = fmt.Sprintf("%s: [%s]", msg, strings.Join(fieldMsgs, ", "))
 	}
-	return BadRequestStatus(msg)
+	return BadRequestStatus("%s", msg)
 }
 
 // ParseAWSError converts an aws service error into a RPC status. This method
diff --git a/plugin/service/host/plugin.go b/plugin/service/host/plugin.go
index f87e6f9..0468df5 100644
--- a/plugin/service/host/plugin.go
+++ b/plugin/service/host/plugin.go
@@ -93,7 +93,7 @@ func (p *HostPlugin) OnCreateCatalog(ctx context.Context, req *pb.OnCreateCatalo
 
 	persistedProto, err := catalogState.toProto()
 	if err != nil {
-		return nil, errors.BadRequestStatus(err.Error())
+		return nil, errors.BadRequestStatus("%s", err.Error())
 	}
 
 	return &pb.OnCreateCatalogResponse{
@@ -227,7 +227,7 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 
 	persistedProto, err := catalogState.toProto()
 	if err != nil {
-		return nil, errors.BadRequestStatus(err.Error())
+		return nil, errors.BadRequestStatus("%s", err.Error())
 	}
 
 	return &pb.OnUpdateCatalogResponse{
diff --git a/plugin/service/storage/plugin.go b/plugin/service/storage/plugin.go
index 70595e0..4887641 100644
--- a/plugin/service/storage/plugin.go
+++ b/plugin/service/storage/plugin.go
@@ -244,7 +244,7 @@ func (p *StoragePlugin) OnCreateStorageBucket(ctx context.Context, req *pb.OnCre
 
 	persistedProto, err := storageState.toProto()
 	if err != nil {
-		return nil, errors.BadRequestStatus(err.Error())
+		return nil, errors.BadRequestStatus("%s", err.Error())
 	}
 
 	return &pb.OnCreateStorageBucketResponse{
@@ -373,7 +373,7 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 
 	persistedProto, err := storageState.toProto()
 	if err != nil {
-		return nil, errors.BadRequestStatus(err.Error())
+		return nil, errors.BadRequestStatus("%s", err.Error())
 	}
 
 	return &pb.OnUpdateStorageBucketResponse{