Sensitive Data Guidelines

1. Identify High-Risk APIs

• Focus on APIs flagged under Shadow, Privilege, and UnAuth categories.
• Prioritize APIs with large PII counts, especially those exposing data in Response.Body.

2. Trace Sensitive Data Flow

• Identify where and how PII is collected (e.g., Request.Body).
• Check for unnecessary exposure or propagation in responses.

3. Classify and Label

• Label parameters based on type (email, phone, token, etc.) using platform insights.
• Prioritize remediation based on risk severity and business impact.

Recommendations for Reducing PII Exposure

🚫 Eliminate Unnecessary PII

• Audit both request and response payloads regularly.
• Remove PII not essential for functionality or compliance.

🔒 Avoid PII in URL Path or Query Parameters

• Do not transmit sensitive data (e.g., emails, tokens) via Request.Path or Request.Query.
• Use encrypted POST bodies instead.

🧹 Limit Sensitive Data in Responses

• Exclude unnecessary PII from client responses.
• Avoid echoing sensitive data like passwords or PINs.

🧑‍💼 Apply Role-Based Access Control (RBAC)

• Ensure that only authorized users or roles can access APIs exposing sensitive data.

🕵️ Monitor Shadow & Unauthenticated APIs

• Continuously scan and inventory all APIs.
• Secure or disable undocumented or unused endpoints.

🧷 Mask, Tokenize, or Encrypt PII

• Use field-level masking in logs and API responses.
• Encrypt or tokenize sensitive data in transit and at rest.

Compliance & Best Practices

• Ensure alignment with regulations such as GDPR, HIPAA, CCPA, PCI-DSS, etc.
• Conduct regular sensitive data discovery and audits using AppSentinels.
• Enable alerts for:
  • Abnormal PII flow patterns
  • Unusual access behaviors
  • New exposure instances