Excessive Data Exposure
APIs that return more data than necessary rely on clients to filter sensitive information. Attackers can intercept responses and access sensitive fields that were intended to be hidden by the frontend.
Overview
APIs often return complete data objects, relying on the frontend to display only relevant fields. Attackers bypass the frontend entirely and inspect raw API responses, gaining access to sensitive data like internal IDs, email addresses, financial information, or implementation details that the UI was designed to hide.
Impact
Sensitive data disclosure, PII leakage, internal implementation details exposed, accelerated attack development.
Examples
Over-Exposed User API
GET /api/users/me returns:
{"id":1,"email":"user@test.com","password_hash":"$2b$...","ssn":"123-45-6789","role":"user","internal_notes":"VIP customer"}Remediation
Return only the minimum required data, use response schemas/DTOs, never rely on client-side filtering, and implement field-level access control.
Implement response DTOs that whitelist returned fields
Never return database objects directly
Apply field-level authorization in API responses
Review API responses for sensitive data leakage
Related SuperClue scanner checks
These scanner checks look for signs of Excessive Data Exposure. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works