Security Data Specialist

Audit logging calls for unfiltered objects like console.log(req.body) or logger.info(user), which may capture passwords and tokens. Also check for logged Authorization headers and full error objects containing connection strings, and verify structured loggers apply field-level filtering.

Review endpoints for returning full database records instead of selected fields, and flag responses containing internal fields like password_hash, secret, or internal_id. Verify serialization uses explicit field selection or DTOs rather than passing ORM entities directly.

Tokens and keys in query strings leak through referrer headers, server access logs, and browser history. The audit flags auth values and PII such as email or SSN in URL paths and query parameters, plus open redirect patterns in redirect URLs.

Findings are classified as P0 for credentials in logs or responses, P1 for PII exposure, P2 for internal details, and P3 for hardening opportunities. Each finding includes the file location, data at risk, exposure channel, and a specific fix.

It runs on demand during the review phase, spawned by a security-reviewer when data exposure patterns are suspected. It complements broader security review by focusing specifically on logging, error handling, URLs, and API response surfaces.