CH-SEC-034Credentials and personal data never travel in the URL: every form that sends a password, a token or personal data uses an explicit POST (or a server action), and no code reads credentials from the query string or logs them
Currently v3.25.0. To cite a stable, pinned form of this page, use /standard/versions/3.25.0/CH-SEC-034.
- Area
- SEC
- Severity
- critical
- Detection
- static
- Corpus coverage
- not measured by the corpus
Corpus coverage measured as of 9/2/2026 (commit 2c57d95600).