Privacy finding
Email addresses, phone numbers and lists of people that anyone can collect
Privacy Info Severity: Low
Part of the audit Exposed contact details. Finding id: privacy.contactExposure.
What it costs you
Addresses and numbers in plain text are collected by automated tools and come back as spam, phishing and calls aimed at named employees.
What to do
Keep shared contact points public. For personal details, decide per page whether they need to be there, and use a contact form or a shared address where they do not.
What it checks
- Email address shown in plain text
- Personal phone number shown
- Staff list easy to copy in bulk
How to fix it
Show the directory's contact details on request
- Decide who needs the directory: visitors, or only colleagues.
- Show contact details only after a click or to signed-in users, or replace them with a contact form per person.
How to check: curl the page and search the output for an email address. Then run this rule again.
Publish shared contact points, not personal ones
- Go through the listed pages and mark which addresses and numbers belong to one person.
- Replace those with a shared address or a contact form where the page does not need the personal one.
How to check: Run this rule again after the next crawl.
A real case
In a six-month test by the Center for Democracy and Technology, about 97% of the spam went to six addresses that were published on three websites. One address left online for the whole test received 6,035 spam messages; one taken down after two weeks received 894.
Thresholds
| Name | Default | Meaning |
|---|---|---|
min_people_in_directory | 10 | A page is reported as a staff directory when it names at least this many people next to email addresses or phone numbers. |