# Hidden data anyone can read

Prompt · Agent harness and modern stack · G03

Finds data sent to the browser that the screen hides but anyone can read.

## Prompt

```text
Inspect API responses, Server Component and SSR serialization payloads, and RPC returns crossing from server to browser. Find places where full database rows or internal objects (internal flags, other tenants' keys, audit metadata, large unused JSON columns) are serialized over the network and merely hidden in the UI.
```

**What it returns:** Each payload with the fields sent, the fields used, and any field that should never leave the server.

**Skip it when:** Static pages with no user data.

**Tools:** Browser network panel or curl against a local server.

**Changes:** Changes nothing

**Sessions:** One session

## Related

- [Outside input reaching sensitive actions](https://atlasscope.dev/prompts/outside-input-reaching-sensitive-actions): Follows input from outsiders to the places it can do harm.
- [Meaning drift across the stack](https://atlasscope.dev/prompts/meaning-drift-across-the-stack): Shows where one word (a task, a fund, a run) means slightly different things in different parts of the app.

Source: https://atlasscope.dev/prompts/hidden-data-anyone-can-read