Data inside the page

Data embedded in a page for the app's own use is readable by every visitor.

What it is

Frameworks embed JSON in the page so the app can start quickly, for example __NEXT_DATA__. Whatever your server puts in that JSON reaches every browser.

Why it matters

Email addresses, names and ids in that JSON are public. A page that works for a signed in user can include records of other users by mistake.

How Tenty checks it

Tenty reads this from the page and the script files every visitor receives. The check runs on every scan, and the finding names the place where it appears. Tenty reads the embedded JSON and looks for email addresses, leaving out role addresses such as hello@ and support@. The report shows each address masked. Tenty rates the finding medium and possible.

How to fix it

Return only the fields the page needs from your server functions. Fetch private data after sign in, through an authenticated request.

How to reproduce

curl -sS 'https://YOUR-APP/' | grep -o '[A-Za-z0-9._%+-]*@[A-Za-z0-9.-]*'

The addresses in the answer are the ones in the finding.