DemocracyLab / DemocracyLab/CivicTechExchange
Application Leaks Sensitive Details Unnecessarily via API Calls
Open
Back End
bug
- Dominant language
- JavaScript
- Stars
- 105
- Forks
- 71
- PR merge metrics
- No merged PRs in 30d
Description
Application leaks sensitive/personal details unnecessarily via API calls. Further investigation is needed to determine the extent and all the instances.
Example: In the API call: `https://www.democracylab.org/api/team`, fields like **application_text** are returned. This field publicly reveals the application form details for contributors of a project.
Contributor guide
Assessment
This issue has not been assessed yet.