Broadcast, Not Stolen: How Passwords and Customer Records Reach Third Parties by Default
Passwords and personal data don’t have to be stolen to end up somewhere they shouldn’t. When an application writes them into a URL or a page title, ordinary analytics, monitoring, and fraud tools collect them by default. A Klaviyo sign-up form with no method attribute sent our test password to 31 third-party hostnames – the same omission we measured on 7,874 websites with credential- or PII-bearing forms across the top 100,000 websites