Security finding
Public pages or documents contain content that should not be public
Security Error Severity: High
Part of the audit Sensitive content. Finding id: security.sensitiveContent.
What it costs you
Anyone who opens the page or downloads the document has this. Search engines can keep copies after you remove it.
What to do
Take the page or file offline, remove the content properly, and treat what was exposed as known to others.
What it checks
- Passwords or access keys exposed
- Internal server names and paths exposed
- Your confidential terms found on the site
- Documents with hidden text still readable
How to fix it
Change the credential, then remove it
- Change the password or key at the system it opens. Removing it from the page alone is not enough.
- Then remove it from the page or document and publish again.
- Check the log of that system for use you do not recognise.
How to check: Recrawl: the detector no longer reports the value. The old credential no longer works.
Edit and publish again
- Edit the page or document, remove the content and publish it again.
- Ask search engines to remove the old copy of the address.
How to check: Recrawl: the detector no longer reports the value.
Redact the document again
- Redact again with a tool that deletes the text under the mark, not one that draws a box over it, and export a new file.
- Replace the old file and do not keep it at another address.
- Ask search engines to remove the old copy of the address, and check whether the file is linked elsewhere on the site.
How to check: Open the new document, select all text, paste it into a text editor: the removed content is not there. Recrawl.
A real case
A spreadsheet the Police Service of Northern Ireland published in answer to a freedom of information request had a hidden tab listing all 9,483 officers and staff. The UK data protection regulator fined it 750,000 pounds in October 2024.