Excessive data exposure

Term

Jump to a topic

See every item in the sequence

Definition

An API weakness where more data than intended is returned (the whole database row instead of the needed fields).

Example: Send name only, not the password hash.

Found in: 2025 HSC marking guidelines, school notes.

Where you'll use it in the test

Syllabus area: Y12 Secure Software Architecture.

Question types it can appear in

Multiple choice: 2025 Q5 answer: Exposure of more data than intended
Short answer: Define, outline or explain it and tie it to the scenario.

Where it has appeared in the paper

Secure Software Architecture (Part A). Part letters follow each paper’s own layout.

How to use it

A model sentence

General advice, built from the definition and example above

“An API weakness where more data than intended is returned (the whole database row instead of the needed fields).” Then apply it: Send name only, not the password hash.

In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.

Command words used with it

From the linked past questions

Identify: Recognise and name. (2025 HSC Q5 (1 mark): API vulnerabilities)

Go deeper

Flashcard: Excessive data exposure in Secure Software Architecture (Year 12) · study that set
Memorise: Defensive data input handling: validation, sanitisation, error handling
Notes: Safe APIs to minimise vulnerabilities (Secure Software Architecture (Year 12))
Full term page: every question, note and marking comment for Excessive data exposure

Check yourself

Explain “Excessive data exposure” in one sentence, give an example, and name a question type that could test it.

Reveal the answer