Map the data path
- Identify endpoints, exports and services that handle sensitive records.
- Connect data classes to identities, applications, owners and external exposure.
- Include partner and legacy routes that sit outside the expected catalogue.
Sensitive Data Exposure
Find and validate APIs and responses that expose PII, payment data, credentials or other sensitive information.
ReachabilityExploitabilityBusiness impact
What this covers
Prove where data crosses a boundary it should not.
Sensitive-data exposure is a question of identity, object access, response behaviour and downstream flow—not a keyword search.
Test the boundary
- Validate object-level and function-level authorisation across roles and tenants.
- Check for excessive response data, unintended fields, unauthenticated access and export abuse.
- Confirm whether an exposed response can be repeated, enumerated or chained.
Evidence delivered
- Redacted request and response proof with the affected data class.
- The identity, object and trust boundary that failed.
- Blast-radius context, responsible owner and a testable remediation condition.
Test the security question
Test the use case