---
name: validate-mass-pii-exposure
description: Evidence bar and data-handling limits for broad personal-data exposure - the fields, the population, cross-user reach and scale, without bulk collection. Use when validating a finding that exposes many users' personal data, such as an IDOR over user records or an open export.
---

# Validate mass personal-data exposure

- Use researcher-controlled records where possible. Retrieve the minimum complete representative record needed to establish the exposed fields; do not download the full population merely to prove scale.
- Establish cross-user or cross-tenant reach, authentication requirements, enumeration method, and reliability. Use server-provided totals, pagination metadata, query counts, identifier ranges, or distinct aggregate results to quantify the reachable population.
- Identify the concrete personal-data categories, sensitivity, affected subject types, production environment, and whether records include credentials, recovery data, identity documents, financial data, health data, precise location, communications, or linked account identifiers.
- Stop immediately when programme policy requires it after inadvertent personal-data access. Preserve only the evidence needed for remediation and apply the programme's redaction and retention rules.
- Make the report distinguish observed samples and counts from estimates, avoid extrapolating beyond evidence, and state exactly how scale was measured without exposing unrelated individuals.