---
url: https://scruple.dev/rules/security/no-sensitive-data-exposure.md
description: Disallow sensitive data sent through output sinks.
---

# security/no-sensitive-data-exposure

Disallow sensitive data sent through output sinks.

## What it checks

Response, render, file-transfer, and redirect sinks should expose only visibly projected, masked, redacted, or sanitized sensitive values.

## Rule metadata

* Package: `@scruple/security`
* Category: Data protection
* Tags: responses, privacy, redaction
* Default threshold: `0.9`
* Minimum confidence: `0.75`

## Examples

### Reported

```ts
res.json({ user, passwordHash: user.passwordHash });
```

### Accepted

```ts
res.json({ user: { id: user.id, name: user.name } });
```