Data Exposure
Plaintext Password Exposure Check
Detect if passwords or suspicious strings appear in your HTML code. Learn how to protect sensitive data from accidental leaks.
What this test checks
This test detects whether plaintext passwords (or suspicious strings) appear in your site's HTML code, whether in comments, data attributes, JavaScript variables, or visible text. Accidental exposure can reveal test credentials, temporary passwords, or even API keys. Such leaks can compromise the integrity of your site and users.
Our recommendation
Ensure that no password or sensitive data is present in your site's source code. Use environment variables to store passwords and API keys. Regularly scan your code with secret detection tools (e.g., GitGuardian, truffleHog) to prevent leaks. Limit the display of sensitive information in logs and errors.
Security tests
Read more
Sensitive Files