Medium severityJavaScript / TypeScriptSensitive Data ExposureMEDIUM confidence
Sensitive Data In URL Query
A secret or PII value is placed in a URL query string, where it leaks via server logs, browser history, and Referer headers.
Standards mapping
Vulnerable vs. safe
Flagged by this check
const resetLink = "https://example.com/reset?token=abc123def456";Passes - the safe pattern
const safeLink = "https://example.com/reset?token=${resetToken}";Why it matters & how to fix it
A secret or PII value is placed in a URL query string, where it leaks via server logs, browser history, and Referer headers. Send sensitive data in a request body or Authorization header over TLS instead.
References
Rule ID integsec-js-sensitive-data-in-url-query - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Sensitive Data ExposureError Stack In Response
- JavaScript / TypeScript - Sensitive Data ExposurePII PHI In Logs
- JavaScript / TypeScript - Sensitive Data ExposureSecret In Logs
- JavaScript / TypeScript - Sensitive Data ExposureSensitive Data Client Storage
- Python - Sensitive Data ExposureFlask Traceback In Response
- Python - Sensitive Data ExposureHardcoded PII Literal