Documentation - V-274679

Title

The API's internal authorization tokens must not be provided back to the user.

Description

<VulnDiscussion>An API's internal authorization tokens must not be provided back to the user because exposing these tokens increases the risk of unauthorized access to sensitive backend systems or services. Internal tokens are meant to authenticate and authorize the API's internal operations and must remain private to maintain the security of the application architecture. If these tokens are leaked or made accessible to users, malicious actors could exploit them to gain elevated privileges, bypa...

Fix Text (Documentation Requirement)

Review the API and authentication codebase. Remove internal tokens being passed around or exposed at any point in the code.