---
title: Avoid sensitive data in URL query parameters
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Avoid sensitive data in URL query parameters
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Avoid sensitive data in URL query parameters

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `dart-security/sensitive-data-in-url`

**Language:** Dart

**Severity:** Warning

**Category:** Security

**CWE**: [598](https://cwe.mitre.org/data/definitions/598.html)

## Description{% #description %}

Placing credentials such as passwords, API keys, or client secrets in URL query parameters exposes them in server logs, browser history, referrer headers, and network monitoring. Pass credentials in a POST body or an Authorization header instead of the query string.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```dart
void main() {
  final login = 'https://api.example.com/login?password=hunter2';
  final upper = 'https://api.example.com/login?PASSWORD=hunter2';
  final apiKey = 'https://example.com/v1?api_key=secretkey';
  final clientSecret = 'https://example.com/oauth?client_secret=s3cr3t';
}
```

## Compliant Code Examples{% #compliant-code-examples %}

```dart
void main() {
  // No sensitive parameter
  final url = 'https://api.example.com/users?page=1&sort=name';
  final resetPath = 'https://example.com/account/reset-password';
  final search = 'https://example.com/search?q=token';

  // Token parameters are intentionally out of scope (magic links, OAuth)
  final magic = 'https://app.example.com/login?token=abc123';
  final oauth = 'https://app.example.com/oauth?access_token=xyz&state=1';

  // Interpolated / templated values are not hardcoded secrets
  final template = 'https://api.example.com/v1?api_key={apiKey}';
  final interpolated = 'https://api.example.com/v1?password=$password';
}
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}