Privacy ruleset

Security and data-protection checks of the data an API exposes: credentials and personal data (GDPR Art. 4(1), Art. 9) should never travel in URLs, which end up in server and proxy logs, browser history and Referer headers (OWASP API Security Top 10 API2:2023, CWE-598, GDPR Art. 5(1)(f), 25 and 32). The ruleset is not part of all; add it next to another ruleset:

commands:
  lint:
    extends: [recommended, privacy]

Rules

Name	Severity
privacy/no-credentials-in-url	error
privacy/no-personal-data-in-url	warning