Common API bugs
“Open devtools — the response is carrying fields customers were never meant to see.”
A response is serialized from the internal record without a projection, so fields meant only for staff or internal systems ride along. Nothing in the interface displays them — they are visible only in the payload.
Internal field leaks into a public payloadgreen beltResponse-shape review and excessive data exposure
Choose your app
The same mistake, planted in different products. Pick the domain you want to hunt it in.
TapTrust Federal
TapTrust Federal Credit Union · Banking · Online + teller
online.taptrustfederal.test
1 planted defecthunt here →
QualityChart
St. Quality Health · Healthcare · EHR
Not seeded here yet — an open seat for a contributor to plant this defect in QualityChart.
QualityMart
QualityMart Inc. · Retail · Big-box e-commerce
Not seeded here yet — an open seat for a contributor to plant this defect in QualityMart.