Rules›northwind-pii-in-metadata

northwind-pii-in-metadata

warning

northwind/security/pii-in-metadata

Docs page ↗

Personal details — email, phone, date of birth, full card number, government ID — are stuffed into the metadata object as a convenient place to keep them.

6

codebases affected, of 58

10%

of everything we scanned

—

no docs fix scored yet

0

docs commits aimed at this

Where it’s failing

metadata contains personal data ("{{field}}") — metadata is not a store for PII.

what we find

what we change it to

await northwind.charges.create({
amount: 4999, currency: 'usd', customer,
metadata: {
email: user.email,
phone: user.phone,
dob: user.dateOfBirth, // ends up in exports and support views
},
})
await northwind.charges.create({
amount: 4999, currency: 'usd', customer,
metadata: {
user_id: user.id, // opaque — resolve against your own DB
order_id: order.id,
},
})

Put only your own opaque identifiers in metadata (order_id, user_id, invoice_id) and look the personal data up in your own database when you need it.

Metadata

Category
security
Type
suggestion
Severity
warning
Recommended
yes
Languages
javascriptpython

Live telemetry

6 / 58 scans

Fired in 10% of scanned codebases.

After every docs commit

No docs commits target this rule yet. When one merges, the next weeks of scans re-score it here.

A fix for your docs page

Wherever this rule fires, a page on your docs site taught it. api-doctor writes the edit and opens it as a pull request on your docs repo — you review and merge.

No fix yet

Draft a docs fix for this rule

api-doctor writes the docs change from the fire pattern — you review it