Security Test: Data leak¶

Description¶

Default Severity: high

When an API accidentally makes up its mind to share secrets, it's like leaving your house keys on the front door—attackers can easily find them and misuse them. Developers often inadvertently embed sensitive details, like private keys, tokens, or passwords, into their code and then forget to hide or remove them from the public part of the API. This vulnerability is dangerous because it lets malicious actors gain unauthorized access, potentially taking over systems or stealing data. Being careful with how and where sensitive information is stored can help avoid these high-stake slip-ups.

Reference:

• https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html

Configuration¶

Identifier: information_disclosure/data_leak

Examples¶

All configuration available:

checks:
  information_disclosure/data_leak:
    skip: false # default
    options:
      blacklist: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶