Description

The API transmits sensitive personally identifiable information (PII) over a non encrypted channel.

What are considered sensitive personally identifiable information (PII)?

Sensitive PII is information that, if inadvertently disclosed, could have significant consequences for the data subject. Sensitive PII data can encompass a wide range of information, including:

• Health information, which includes medical records or insurance information.
• Government information, which includes social security information or other government related data.
• Proprietary information, which includes secrets or intellectual property (IP).

Note: Datadog is only able to detect certain types of PII.

Rationale

This finding works by identifying an API that both:

• Replies with sensitive PII, meaning any detected PII type other than email addresses or phone numbers (for example, government identification numbers, health records, or other sensitive personal data).
• Uses an HTTP connection, sending data in the clear over the wire

Remediation

• Validate whether the API is intended to return PII.
• Implement the HTTP Strict Transport Security (HSTS) header to instruct the user’s browser to always request the site over HTTPS.