Medium severityJavaSensitive Data ExposureMEDIUM confidence

PII Secret In URL

A URL or query string embeds a secret or PII/PHI parameter (ssn, dob, password, token, card number, MRN, etc.) in cleartext (CWE-598/CWE-359).

Standards mapping

CWE: CWE-598: Use of GET Request Method With Sensitive Query Strings CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
OWASP Top 10: A02:2021 - Cryptographic Failures
OWASP ASVS: V8.3.1 (L1)V8.3.4 (L2)

Vulnerable vs. safe

Flagged by this check

String u = "https://api.example.com/lookup?ssn=000-00-0000";

Passes - the safe pattern

String ok = "https://api.example.com/lookup?id=42";

Why it matters & how to fix it

A URL or query string embeds a secret or PII/PHI parameter (ssn, dob, password, token, card number, MRN, etc.) in cleartext (CWE-598/CWE-359). Query strings are logged by servers, proxies, and browser history. Pass sensitive values in the request body over TLS (or as a short-lived opaque reference), never in the URL.

References

https://cwe.mitre.org/data/definitions/598.html

Rule ID integsec-java-pii-secret-in-url - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks