Medium severityGoSensitive Data ExposureMEDIUM confidence
Sensitive Data In URL
A secret or PII/PHI field is placed into URL query parameters (CWE-598/CWE-359).
Standards mapping
Vulnerable vs. safe
Flagged by this check
v.Set("password", password)Passes - the safe pattern
v.Set("page", page)Why it matters & how to fix it
A secret or PII/PHI field is placed into URL query parameters (CWE-598/CWE-359). Query strings are logged by servers, proxies, and browser history and are sent in the Referer header, exposing the value. Send sensitive data in the request body over TLS (POST) or an Authorization header, never in the URL.
References
Rule ID integsec-go-sensitive-data-in-url - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Sensitive Data ExposureError Stack In Response
- JavaScript / TypeScript - Sensitive Data ExposurePII PHI In Logs
- JavaScript / TypeScript - Sensitive Data ExposureSecret In Logs
- JavaScript / TypeScript - Sensitive Data ExposureSensitive Data Client Storage
- JavaScript / TypeScript - Sensitive Data ExposureSensitive Data In URL Query
- Python - Sensitive Data ExposureFlask Traceback In Response