T09 · Insecure Skill Coding Practices
Warning
- Location
- references/api.md:21
- Finding
- Phone Number Exposed in a GET Request Query String<. Include the `x-api-key` header and request `GET /api/wa/check?phone=...`. Base URL is `https://wa-check-api.whatsabot.com`. ``` ### Technical Analysis The requested phone number is a personal identifier and is transmitted to an external service as part of the URL. Although HTTPS encrypts the request in transit, it does not prevent the complete URL from being recorded by the destination service or by trusted infrastructure that terminates TLS. Query strings are routinely captured in reverse-proxy access logs, API gateways, CDN records, application telemetry, browser or client diagnostics, shell history, and debugging systems. Consequently, using a GET query param ...[truncated 1931 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the GET endpoint with an authenticated `POST /api/wa/check` endpoint and place the phone number in a JSON request body: ```http POST /api/wa/check Content-Type: application/json x-api-key: YOUR_API_KEY {"phone":"34605797764"} ``` 2. Configure the API service, reverse proxies, gateways, and observability tools to redact phone numbers and authorization credentials. Disable request-body logging for this endpoint where possible. 3. Remove real-looking phone numbers from documentation and tests. Use clearly reserved or synthetic examples. 4. Inform users before transmitting a phone number to `wa-check-api.whatsabot.com`, especially when the number may belong to a third party. Obtain explicit confirmation where appropriate. 5. Document the provider’s data retention, deletion, access-control, subprocessors, and privacy policies. Retain submitted identifiers only for the minimum period required to complete the lookup. 6. Apply server-side authorization, rate limiting, abuse monitoring, and anti-enumeration controls. The documented limit of 1,000 requests per hour may still permit substantial profiling. 7. Prefer the MCP integration only if it provides equivalent or stronger privacy guarantees; verify that it does not internally place the phone number in a logged URL. 8. Continue loading the API key from a protected secret store or environment variable. Never include it in URLs, examples, source control, exception messages, or application logs. ]]>