sensitive data Shipped
What this lens looks for
Minimize what you collect, encrypt what you keep, and never log what you shouldn't. Practice data minimization — APIs must return only the fields the client needs, using explicit response DTOs and never dumping database models directly. Classify data by sensitivity (public, internal, PII, sensitive PII) and apply controls proportional to the tier. Apply field-level encryption to highly sensitive fields such as SSN and payment info at the application level with a KMS (AWS KMS, Azure Key Vault, GCP KMS), separate from database-level encryption. Keep PII out of logs — tokens, passwords, credit card numbers, or PII must not be logged, and must be masked or redacted in all log outputs including debug level. Do not expose internals in API responses — internal IDs, stack traces, or database error messages must not appear in production; return generic errors with correlation IDs. Set Cache-Control: no-store on responses containing sensitive data.
What its verifier checks
API responses return only needed fields via explicit DTOs rather than raw database models; data is classified by sensitivity tier with controls applied proportionally; highly sensitive fields (SSN, payment info) are encrypted at the application layer using a KMS, separate from database-level encryption; tokens, passwords, card numbers, and PII are never logged and are masked/redacted in all log outputs including debug; production API responses do not expose internal IDs, stack traces, or database error messages, returning generic errors with correlation IDs instead; responses containing sensitive data set Cache-Control: no-store.