Data Leak security vulnerability on my app

[wordpresschef]

Hey everyone!
I’m using Flusk to secure my app and it recently flagged an vulnerability, but I need some help

It’s a Data Leak vulnerability described as followed:

@Data Leak

Data leaks are database entries that are publicly accessible, this is because your app’s database is accessible publicly unless you define proper Privacy Rules. As a general rule, there should never be unprotected data unless its fully public (like a blog for example)

Here’s the additional data provided by the Flusk tool:

@For version test

The following fields were marked as sensitive and have data leaking:

• Email ospite
• Evento
• ID scheduled email reminder
• Nome ospite
• Teleono ospite
• Transazione

More fields were found leaking but were reviewed or predicted as non-sensitive and therefore ignored (7)
1 fields were properly secured with no data leaks.

@For version live

The following fields were marked as sensitive and have data leaking:

• Email ospite
• Evento
• ID scheduled email reminder
• Nome ospite
• Note
• Transazione

More fields were found leaking but were reviewed or predicted as non-sensitive and therefore ignored (6)
2 fields were properly secured with no data leaks.

---

It affects the database Prenotazioni.
I have read the documentation of the vulnerability but I’m still unsure what to do next.

Here’s the link to the test preview of my app: Capetoste, chi viene a cena?

Here’s what I understand:
I’ve set privacy rules for those fields, only users with specific “Role” can access them, “everyone else” have access to none of those files.

Here is an additional screenshot that might also help:

Do you have any clue what the vulnerability is about? And what I should be doing from there?

Any help would be really appreciated

Dimitri

---

Posted with the @Flusk tool

[jonah.deleseleuc]

First of all, please read this article. Once you’re done reading read the rest of this comment.

Essentially, all your data objects (bubble things) are publicly visible unless you define privacy rules which make the only accessible to those who meet the rule you define (your privacy rule!)