Contents
What is excessive data exposure?
Excessive data exposure occurs when an API endpoint returns more fields in its response payload than the client application needs or requests. Unlike a data breach, this often happens by design — the API was built to return a comprehensive object, and the developer simply ignores the extra fields in the UI layer.
The problem: those extra fields are still transmitted, still logged, and still accessible to anyone who inspects the network traffic — including malicious actors, misconfigured proxies, or third-party analytics scripts running on the same page.
OWASP API3:2023Real-world example: POS system API
While integrating a point-of-sale system for a retail client, we observed a standard product lookup request returning the following response. The application displayed only the product name and price — but every page load transmitted the full object to the browser:
Every visitor's browser received cost prices, supplier contacts, staff email addresses, and warehouse locations with every product page load. None of this was visible to the user — but all of it was readable in the browser's developer tools with no authentication required.
Business Impact: HighWhy this matters for Singapore SMEs
For larger enterprises, security teams typically audit API contracts before deployment. For Singapore SMEs using off-the-shelf software or low-code platforms, this audit rarely happens. Our findings across multiple integrations show this pattern is prevalent in point-of-sale systems, inventory management APIs, HR and payroll platforms, e-commerce backends, and WhatsApp Business API wrappers.
From a PDPA perspective, unnecessarily transmitting employee email addresses, supplier contacts, or customer data in API responses — even if not rendered on screen — may constitute a compliance risk if that data is intercepted or captured by third-party services such as analytics, CDN logs, or browser extensions.
PDPA RelevanceRecommendations
For businesses and developers integrating APIs into their workflows:
If you are using a third-party SaaS product and cannot modify the API response directly, consider a middleware proxy layer that filters fields before they reach the client. We have built this pattern for several clients as part of our customised automation work.