M6:2024: Inadequate Privacy Controls

Collection, retention, or third-party sharing of personal data beyond what the app discloses to the user, including data harvested by embedded SDKs.

Detected by reviewing the app's data collection and third-party SDK traffic for personal-data exposure beyond what the app discloses.

M6:2024 maps to CWE-200, CWE-359.

TurboPentest's automated black-box pentest actively probes for Exposure of Sensitive Information to an Unauthorized Actor using Vuln Scanner's exposure templates (exposed configuration files, admin panels, API keys, .env and .git paths), with no source code required. Connecting a GitHub repo adds white-box confirmation from IntegSec's Opengrep SAST rule pack, which carries 8 dedicated rules for this weakness. For AI/LLM targets, Paladin AI additionally probes model responses for sensitive-information disclosure, such as leaked system prompts, training-data fragments, or credentials surfaced in generated output.