# Application Data Exposure Testing

Distinguish real unauthorized data exposure from harmless metadata - response field...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill application-data-exposure-testing -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill application-data-exposure-testing -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill application-data-exposure-testing -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill application-data-exposure-testing -g -a gemini-cli -y`

## Description

Distinguish real unauthorized data exposure from harmless metadata - response field differentials by role and tenant, over-fetching, alternate serializers and exports, error responses, notifications, audit logs, cached content - requiring meaningful confidentiality or authorization impact to report.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Application Data Exposure Testing

## Purpose

Applications leak data through many channels beyond "the endpoint returned a field": nested objects, alternate serializers, exports, error responses, notifications, audit logs, caches. Most such leakage is harmless metadata. This skill finds the subset with meaningful confidentiality or authorization impact - by asking, for every response, what THIS identity should have received versus what it actually received.

## Entry Conditions

- You can observe the same application object or operation from at least two identity contexts (roles, tenants, or anonymous)
- OR: the application has export/report/serialization surfaces beyond the primary API

## Differential Reasoning (the core method)

For every response channel:

```text
what should THIS identity receive for this object?
vs
what did it actually receive?
```

Concretely: fetch the same object as the legitimate owner, then as a different identity (authz_matrix automates the replay), and DIFF the payloads field by field. Fields present in the attacker-context response that belong to another principal are exposure. Fields that are merely descriptive of your own data are not.

## Exposure Channels

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/application-security/application-data-exposure-testing/SKILL.md