# Excessive Data Exposure in API Responses

> Detects API endpoints that return more data than required, including sensitive fields that clients should not receive.

- Skill: `zakirkun/excessive-data-exposure-in-api-responses` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/excessive-data-exposure-in-api-responses`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/excessive-data-exposure-in-api-responses/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/excessive-data-exposure-in-api-responses

---


# Excessive Data Exposure

## Overview
APIs that return complete database objects rely on the frontend to filter sensitive fields. This is a common vulnerability (OWASP API3) where:
- Password hashes returned in user objects
- Internal IDs, audit timestamps exposed
- Admin-only fields visible to all users
- Credit card details partially exposed

## Remediation
- Use Data Transfer Objects (DTOs) that explicitly define what fields to return
- Never return entire database models directly
- Use field-level serialization control (`@JsonIgnore`, `exclude`, `select`)