OWASPASVS 5.0 requirement
ASVS-V14.2.6 The application only returns the minimum required sensitive data for the application's functionality.
- Standard
- OWASP ASVS 5.0
- Chapter
- V14 Data Protection
- Section
- V14.2 General Data Protection
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that the application only returns the minimum required sensitive data for the application's functionality. For example, only returning some of the digits of a credit card number and not the full number. If the complete data is required, it should be masked in the user interface unless the user specifically views it.