Email addresses disclosed
Summary: PortSwigger's guidance states that email addresses appearing in application responses are not necessarily a vulnerability, since contact information and web mail content legitimately contain them. It notes that developer and staff addresses, whether visible on-screen or hidden in page source, can serve as usernames for login attempts or targets for social engineering, and that excessive disclosure can increase spam volume.
Bottom line: A developer's email address in page source hands an attacker a probable login username and a named person to target, at no cost to them. The recommended fix is removal or replacement with an anonymous mailbox such as helpdesk@example.com, optionally behind a server-side form with CAPTCHA.
Read the original at PortSwigger Research ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026