Software Engineering › Key terms › Y12 Secure Software Architecture › Excessive data exposure
Excessive data exposure
Term Y12 Secure Software Architecture
Definition
An API weakness where more data than intended is returned (the whole database row instead of the needed fields).
Example: Send name only, not the password hash.
Found in: 2025 HSC marking guidelines, school notes.
Where it is used in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Multiple choice: 2025 Q5 answer: Exposure of more data than intended
- Short answer: Define, outline or explain it and tie it to the scenario.
Where it has appeared in the paper
Secure Software Architecture (Part A). Part letters follow each paper’s own layout.
Related past questions
- 2025 HSC Q5 (1 mark): API vulnerabilities Secure Software Architecture (Part A) · 1 mark
These are the questions the flashcard set links to this term. Open each one and compare your answer with its marking criteria.
Study links
- Flashcard: Excessive data exposure in Secure Software Architecture (Year 12) · study that set
- Memorise: Defensive data input handling: validation, sanitisation, error handling
- Notes: Safe APIs to minimise vulnerabilities (Secure Software Architecture (Year 12))
How to use it in an answer
A model sentence
“An API weakness where more data than intended is returned (the whole database row instead of the needed fields).” Then apply it: Send name only, not the password hash.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
- Identify: Recognise and name. (2025 HSC Q5 (1 mark): API vulnerabilities)
Technique for the question types
- Multiple choice: Read all four options, rule out wrong ones, pick one; no penalty for guessing so never leave blank.
- Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.
Common mistakes
- Use the term exactly as the syllabus words it, then link it to the scenario in the question; the 2025 feedback repeatedly rewards using the stimulus.
- Answer the command word: outline gives main points only, explain gives a reason or cause, discuss gives both sides.
Related terms
Same group in the syllabus: Defensive data input handling · Input validation · Sanitisation · Error handling · Application programming interface (API) · Memory management · Session management · Exception management