PTKDMobile App Security
Knowledge base / PTKD-API-PII-IN-RESPONSE
low M6 MASVS-PRIVACY-1 dynamic analysis PTKD-API-PII-IN-RESPONSE

PII in a response over a cacheable/first-party channel

A response carrying personal data was returned without cache-control: no-store, so it can persist in shared caches or on disk.

How it's exploited

A response carrying personal data was returned without Cache-Control: no-store, so it can persist in an intermediary or on-device cache. Later access to that cache reveals the personal data.

Why it matters

Personal data lingers in caches beyond the request, widening its exposure and complicating deletion obligations.

How to fix it

  1. Set Cache-Control: no-store on every response that contains personal data.
  2. Minimize the personal data returned to what the screen actually needs.

References