skills.rest
riandeoliveira
riandeoliveiraCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

testing-for-sensitive-data-exposure

Scan web assets and API responses for sensitive data exposure.

Updated Jan 29, 2024
Search Tags:#security testing#cache-control#secret scanning#sensitive data exposure#api overexposure#tls configuration#pii leakage
One-click install
npx skills add https://github.com/riandeoliveira/aspnet-template --skill testing-for-sensitive-data-exposure-riandeoliveira
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: testing-for-sensitive-data-exposure
Source: https://github.com/riandeoliveira/aspnet-template/tree/main/.claude/skills/testing-for-sensitive-data-exposure
Command: npx skills add https://github.com/riandeoliveira/aspnet-template --skill testing-for-sensitive-data-exposure-riandeoliveira

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, urllib3, re, json, argparse, datetime, and includes scripts (resource) and references (resource) components.

What problem does it solve?

It helps security testers identify when applications unintentionally disclose sensitive information such as API keys, PII, credentials, and internal details through client assets, API responses, transport misconfiguration, browser storage, and source control artifacts.

Core Features & Use Cases

  • Secret and credential discovery: Scans client-side JavaScript for hardcoded secret patterns and probes common exposed configuration files (e.g., .env, .git/config).
  • API data over-exposure checks: Detects sensitive field leakage in JSON responses for both authenticated and unauthenticated scenarios (e.g., password/SSN/financial fields).
  • Transmission and storage safety validation: Verifies HTTPS enforcement and HSTS presence, checks Cache-Control for sensitive endpoints, and validates that sensitive data is not cached or stored unsafely in the browser.
  • Assessment workflow automation: Produces a structured JSON report combining secret findings, exposure indicators, error verbosity signals, and TLS/header checks.

Quick Start

Run the testing agent against a target base URL with an optional Bearer token to generate a data exposure report: python3 scripts/agent.py https://target.example.com --token YOUR_BEARER_TOKEN -o data_exposure_report.json

Frequently Asked Questions about testing-for-sensitive-data-exposure

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan for sensitive data exposure and hardcoded secrets in client-side JavaScript?▼

To scan for sensitive data exposure, this tool probes client-side assets and exposed configuration files like .env and .git/config using regex-based secret detection. It identifies hardcoded credentials and API keys during authorized web security assessments.

How do I detect PII leakage and data over-exposure in JSON API responses?▼

To detect PII leakage in API responses, the tool performs sensitive field pattern matching on JSON response bodies. It checks both authenticated and unauthenticated scenarios for excessive response fields like passwords, SSNs, or financial data.

Can I validate TLS configuration, HSTS presence, and Cache-Control headers for sensitive endpoints?▼

Yes, you can validate TLS configuration by checking for HTTPS enforcement and HSTS presence. The tool verifies Cache-Control no-store guidance to ensure sensitive endpoints are not cached or stored unsafely in the browser.

What is the best way to automate a sensitive data exposure assessment and generate a report?▼

The best way to automate sensitive data exposure assessments is running the Python script against a target base URL with an optional Bearer token. It generates a structured JSON report combining secret findings, exposure indicators, and header checks.

Does this sensitive data scanner require authenticated HTTP request capabilities to find exposed secrets?▼

Authenticated HTTP request capability is required to thoroughly test API data over-exposure and validate sensitive field leakage. You can pass a Bearer token to the script to assess both authenticated and unauthenticated response scenarios.

What limitations should I expect when checking for sensitive data exposure using regex-based secret detection?▼

When using regex-based secret detection for sensitive data exposure, limitations include potential false positives from pattern matching and reliance on client-side access. It targets authorized web and API security assessments rather than deep server-side code reviews.

Related Skills

Explore More Software Engineering Skills→
scholarclawscholarclaw
5

paper-search

Search academic papers via the scholar.club API with formatted or raw responses.

Official
Intermediate
oioio-spaceoioio-space

secret-guard

Scan staged Git diffs for credentials, PII, and sensitive data.

Community
Advanced
dapperdiversdapperdivers
1

web-recon

Identify exposed services, technologies, directories, and TLS configurations on web applications.

Community
Advanced
armanzeroeightarmanzeroeight
29

secrets-detector

Detect hardcoded secrets and API keys in source code repositories.

Community
Intermediate