exploiting-excessive-data-exposure-in-api

What problem does it solve?

Detects and helps remediate excessive data exposure where APIs return more fields than the client needs, leaking PII, internal identifiers, debug info, or other sensitive business data that should remain server-side.

Core Features & Use Cases

• Field enumeration: Recursively discovers all fields in JSON responses and counts total surface area returned by endpoints.
• PII and pattern detection: Uses regex-based detection for emails, SSNs, credit cards, tokens, IPs, and other common sensitive data patterns.
• Schema comparison & GraphQL analysis: Compares responses to OpenAPI specs and performs GraphQL introspection to identify over-fetchable fields.
• Use Case: Ideal for penetration tests of mobile banking or multi-client APIs where the frontend displays a subset of data but the API may expose sensitive fields.

Quick Start

Run the included agent.py against a target API URL with a valid Bearer token to produce a JSON report of exposed fields and PII matches.