Excessive Data Exposure Anti-Pattern

Severity: High

Summary

Excessive Data Exposure occurs when APIs return more data than necessary for client functionality. This happens when endpoints serialize raw database objects or model classes without filtering sensitive fields. Attackers intercept API responses to access exposed PII, credentials, and internal system details, even when client-side UI hides this data.

The Anti-Pattern

Never serialize and return entire database objects or internal models. This exposes all object properties, including sensitive ones, assuming the client will filter what it needs.

BAD Code Example

# VULNERABLE: Returns the entire raw database user object.
from flask import jsonify

class User: