The flip side of all those wonderful APIs: they all leak data

It has probably not escaped anyone that APIs are important. You cannot run a system today that does not have sensible APIs to enable integrations, ready-built connectors or, quite simply, a really fast and good frontend, a great site in short. The flip side of having APIs that push data out to the frontend is that people sometimes do not really make sure they only push out what is needed at that moment. Sometimes a lot of other things come with it that you may not want to be published for the whole world. Above all when you have a general API, as with a SaaS product designed to cover as many needs as possible.

When we at Commerce Mind look around the industry, we realise that many have not grasped that with these possibilities also comes the responsibility to think about how you handle your data model. It is rather closer to industry standard to leak sensitive data such as exact stock levels or purchase prices.

By examining a larger number of e-commerce sites, we have found companies that unknowingly and publicly push out the exact stock level for every product in every channel (central warehouse or store), the purchase price they buy the products for, and when new products are delivered. Things most of them absolutely do not want to be freely available to everyone in the world.

What happens is that the code in the e-commerce site's backend assembles data that the frontend might need, meaning the part that renders what you see on the site. For example, the frontend needs to know whether the item is in stock or not to show a green flag, and whether the buy button should be clickable, and then push out code that says "In stock" but also "8118 units". Because it is a pain to maintain many different data models for different scenarios, you build one model and then reuse it everywhere. And suddenly you are pushing out more data than you intended.

What data are you leaking?

In practice, anyone with an ordinary browser can open your website and capture the data model being pushed out. And if, instead of "In stock = true", you push out "In stock = 8118", they can see it. When all you actually want is for the frontend to draw a green dot indicating the item is in stock, you have now also told them your exact count. With a little simple coding, they can then download your complete stock levels for all products to keep tabs on their competitors. Of course, if you want to publish exact stock levels this is not a problem, but this is a simple example.

Worse examples are those who happen to publish their purchase prices or margins per product. For this article we at Commerce Mind have examined a number of sites and contacted the e-commerce operators where we found purchase prices, so they could be corrected and removed. But there are with 100% certainty a large number of sites still out there that we have not looked at where these are still exposed. If you have exact stock levels and purchase prices for your competitors, you can adjust your pricing and campaign strategy accordingly, something we know is already being done.

But there are even more dangerous examples. We have found sites where, for instance, ID and password for their payment providers have been published. Which could be used to make purchases and returns without being noticed unless you are really paying attention. We have of course already contacted all the e-commerce operators where this has been found and made sure it has been removed. But again, there are very many sites out there, so there are surely some that still have this problem.

Our recommendation is that you as an e-commerce operator or technology partner to e-commerce operators immediately take a look at what data you are sending to the frontend and consider whether it really is needed, or whether it needs to be locked down somehow. It is fast and easy to get wrong unfortunately.

If you want support or want to know more about how to find data leaks, feel free to contact us at Commerce Mind and we will of course help you.