The quiet ways checkouts leak

The leaks below come from decisions that were sensible when they were made, and were never revisited. Each has one line of prevention. None is exotic.

Analytics, chat widgets, tag managers and pixels run with the same permissions as your own code. They can read what the customer types, change what the page shows, and call your API as the signed-in customer. A cookie marked HttpOnly stays unreadable, but the request still goes out with it.

A list endpoint returns the whole customer record because that was easier to write. The response carries the email, the phone and the internal notes. The screen shows a name.

The same shape shows up in ids. An endpoint that answers for any customer id has no owner check. Ownership is the fix, not obscurity.

A staging copy gets built for a launch, then forgotten. It carries a real export of production data, a weak login and no monitoring. Nobody is watching it.

Old subdomains behave the same way. The demo host, the preview branch and the admin panel from the last redesign are all still answering. Nobody removed them.

Logs are written to help engineers and end up holding customer data. A request body with a home address. A support export with everything in it. An error report with a token.

More people can read the logs than can read the database. Contractors, dashboards and a third-party log service all see them. That is the leak.

Little of this trips an alarm. No door is forced, no ransom note arrives, and the product keeps working. The data leaves quietly.

Somebody has to go and look. Monitoring rarely fires for a page that works. A test is that look.

All of this sits under one subject on the report card. Security is graded first, and data exposure is one of its six sub-categories. Each finding arrives with a fix plan.

The point is not the list. None of these leaks looks like an incident until somebody reads the logs. Somebody has to look.

• List every host and subdomain you own, including the forgotten ones.
• Open the payment page and read every script it loads.
• Pick one list endpoint and read what the response actually returns.
• Search your logs for an email address and see what comes back.
• Write down who can read those logs today.

It needs an afternoon and somebody willing to look. None of it needs a budget.

The examples in these notes are illustrative. Nothing here describes a client engagement.