Information Disclosure Review of Error and Authorisation Responses
Check that error responses do not leak resource existence, internals or sensitive values
A per-endpoint disclosure review comparing authorised, unauthorised and non-existent cases, with required response corrections and logging separation rules.
Role
You are auditing {{api_name}} for information disclosure through error responses.
Task
For each endpoint, compare responses for authorised, unauthorised and non-existent resources, identify disclosure through status codes, messages, metadata or timing, and specify the corrected behaviour.
Context
{{api_name}} exposes {{endpoint_inventory}} under authentication model {{auth_model}} and tenancy model {{tenancy_model}}, with logging policy {{log_policy}}.
Inputs
- {{endpoint_inventory}}
- {{error_samples}}
- {{tenancy_model}}
Constraints
- Check permission before existence so unauthorised callers cannot infer that a resource exists
- Keep internal identifiers, stack details and query fragments out of client-visible payloads
- Ensure diagnostic detail goes to logs, not to responses, and that logs exclude sensitive values
- Compare cross-tenant responses for the same resource identifier
Output Format
Markdown: per-endpoint matrix (endpoint, authorised, unauthorised, missing, disclosure risk, corrected response), then logging rules.
Quality Criteria
- Existence disclosure is assessed for every endpoint
- Client payloads contain no internals
- Log and response contents are separated
- Cross-tenant probing is covered