wrdn-data-exfil

Name: wrdn-data-exfil
Availability: InStock
Author: Sentry

Trace untrusted input to response, log, and export sinks.

56|3|Updated Apr 24, 2026

Search Tags:#security #logging #code-review #serialization #web-application #data-exfiltration #data-leak

Ready to run

npx skills add https://github.com/getsentry/warden-skills --skill wrdn-data-exfil

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: wrdn-data-exfil
Source: https://github.com/getsentry/warden-skills/tree/main/skills/wrdn-data-exfil
Command: npx skills add https://github.com/getsentry/warden-skills --skill wrdn-data-exfil

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps teams identify data leakage risks where user-controlled input ends up in responses, logs, or exported artifacts, enabling quicker remediation and safer data handling.

Core Features & Use Cases

Trace sources (request bodies, headers, payloads) to sinks (response bodies, logs, exports) to surface unintended data disclosures.
Enforce clean serialization boundaries by flagging serializers that expose sensitive fields, verbose error details, or wholesale request data in responses or logs.
Use during code reviews and CI checks to validate per-resource data exposure and ensure explicit allowlists or DTO filtering are in place.

Quick Start

Run a diff-based scan to surface potential data-exfil leaks in responses, logs, and exports.

Frequently Asked Questions about wrdn-data-exfil

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect data exfiltration paths from untrusted input in web applications?▼

Detect data-exfiltration paths by tracing untrusted input from request bodies and headers to sinks like response payloads, logs, and exports. This enforces strict source-to-sink tracing to surface unintended data disclosures during code reviews.

How do I prevent sensitive data leaks in Django or Flask API serializers?▼

Prevent sensitive data leaks in serializers by enforcing clean serialization boundaries. Flag serializers that expose sensitive fields, verbose error details, or wholesale request data, ensuring explicit allowlists or DTO filtering are applied.

Can I scan code diffs in CI to validate per-resource data exposure?▼

Yes, you can run diff-based scans during CI checks to validate per-resource data exposure. This surfaces potential data-exfil leaks in responses, logs, and exports by tracing untrusted input through your web application frameworks.

What is source-to-sink tracing for data leakage risks?▼

Source-to-sink tracing for data leakage risks is the process of tracking untrusted input from sources like payloads to sinks like error messages or downloadable artifacts. It requires per-field filtering to validate and remediate unintended data disclosures.

Does this data leak detection work with FastAPI, Next.js, and Express?▼

Yes, data leak detection applies to code paths across frameworks like FastAPI, Next.js, and Express. It traces untrusted input through sinks such as response payloads, logs, and exports to identify data-exfiltration risks.