other
Warning
- Location
scripts/powerlego_api.py:56- Finding
Undisclosed Transmission of Exact Residential Address Data to a Third Party
- Content
View full analysis
object: body, boundary = _encode_multipart_formdata(fields) headers = dict(DEFAULT_HEADERS) headers["Authorization"] = _load_api_token() headers["Content-Type"] = f"multipart/form-data; boundary={boundary}" headers["Content-Length"] = str(len(body)) request = Request(url, data=body, headers=headers, method="POST") with urlopen(request) as response: payload = response.read().decode("utf-8") return json.loads(payload) def address_validator(term: str) -> object: return _post_form(ADDRESS_VALIDATOR_API, [("term", term)]) def usage_estimator(address1: str, city: str, state: str, zipcode: str) -> object: return _post_form( USAGE_ESTIMATOR_API, [ ("address1", address1), ("city", city), ("state", state), ("zipcode", zipcode), ], ) ``` The destination endpoints are fixed PowerLego HTTPS services: ```python ADDRESS_VALIDATOR_API = "https://www.powerlego.com/ApiGateway/v1/address_validator" USAGE_ESTIMATOR_API = "https://www.powerlego.com/ApiGateway/v1/usage_estimator" ``` Candidate lookup sends the user-provided query through this client: ```python payload = address_validator(args.address_query) ``` ### Technical Analysis A raw address query is sent to PowerLego during candidate lookup. After confirmation, the usage-estimation operation sends the street address, optional unit identifier, city, state, and ZIP code to the same third party. The transfer is relevant to the declared address-matching and electricity-plan workflow, and HTTPS protects the information while in transit. The au ...[truncated 2117 chars]- Remediation
View remediation