# Secrets leaked to telemetry and URLs

Tokens in query strings, URL paths, analytics events, or API objects that get logged or returned

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; 2 confirmed bounties: $200 and $200; latest 2026-10-08. Updated 2026-10-23._

## How it works
A secret meant to authorize one action is placed in a broadly readable channel: a URL query string, a URL path, an analytics event, or an API response object. The code assumes that channel is private or transient, but telemetry SDKs, page events, and serializers copy it verbatim. The invariant that breaks: a credential must never appear in any channel that is logged, forwarded, or returned to anyone other than its intended holder.

## Where it shows up
- Reset or magic-link tokens passed as bare query-string keys in the URL [E1](https://bugbountylibrary.com/r/h1%3A4071670.md)[E3](https://bugbountylibrary.com/r/h1%3A4000185.md)
- Tokens embedded in a URL path that the server consumes directly to perform a state change [E2](https://bugbountylibrary.com/r/h1%3A229619.md)
- Analytics/RUM SDKs initialized without a redaction hook (beforeSend, scrub callbacks) and high sampleRate [E1](https://bugbountylibrary.com/r/h1%3A4071670.md)
- `analytics.page()` or page-load events forwarding `location.search`/`url` on reset pages [E3](https://bugbountylibrary.com/r/h1%3A4000185.md)
- Multiple telemetry SDKs on one page (RUM, Segment, Sentry), each with its own redaction [E1](https://bugbountylibrary.com/r/h1%3A4071670.md)
- API user objects returning session identifiers or token fields

## How to review
Trace every place a token is generated and every sink it can reach. The property to enforce: tokens live only in request bodies or headers, never in URLs, and any telemetry or API serializer touching a URL or user object strips known secret parameters and fields. Enumerate every SDK loaded on the page and check each one's own redaction hook independently; scrubbing one pipeline does not cover others [E1](https://bugbountylibrary.com/r/h1%3A4071670.md). For tokens in a URL path, test whether visiting the bare token URL performs the state change without proving ownership of the target [E2](https://bugbountylibrary.com/r/h1%3A229619.md).

## Variants seen
- Reset token captured by RUM with no beforeSend, correlated to the account via session_id [E1](https://bugbountylibrary.com/r/h1%3A4071670.md)
- Email-change confirmation token in the URL path; visiting it confirms the change without owning the target email [E2](https://bugbountylibrary.com/r/h1%3A229619.md)
- Reset token sent to Segment via automatic page events [E3](https://bugbountylibrary.com/r/h1%3A4000185.md)

## Why fixes fail
Redaction is applied per sink. A path-scoped scrub of one SDK's pipeline leaves other telemetry SDKs on the same page still forwarding the URL [E1](https://bugbountylibrary.com/r/h1%3A4071670.md).

## Impact and severity
Account takeover: live reset tokens unlock accounts [E1](https://bugbountylibrary.com/r/h1%3A4071670.md)[E3](https://bugbountylibrary.com/r/h1%3A4000185.md), and a path token that confirms an action without ownership proof lets an attacker complete a change for an address they do not control [E2](https://bugbountylibrary.com/r/h1%3A229619.md). Severity rises with token lifetime, scope breadth, and correlation to identity.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A4071670.md
- E2: https://bugbountylibrary.com/r/h1%3A229619.md
- E3: https://bugbountylibrary.com/r/h1%3A4000185.md