# Mass Enumeration / Data Harvesting

> Detects API endpoints that expose lists without pagination limits, enabling automated data harvesting.

- Skill: `zakirkun/mass-enumeration-data-harvesting` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/mass-enumeration-data-harvesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/mass-enumeration-data-harvesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/mass-enumeration-data-harvesting

---


# Mass Enumeration / Data Harvesting

## Overview
APIs that return unbounded lists or allow scraping of all records enable attackers to harvest user databases, email lists, phone numbers, and other sensitive data. This is especially critical for:
- User listing endpoints
- Search APIs with no result limits
- Sequential ID enumeration

## Remediation
- Enforce maximum page size (e.g., 100 records per page)
- Rate limit list endpoints per user/IP
- Require authentication for all list endpoints
- Use opaque cursors instead of offset-based pagination