🔐
AB-129
Credentials via headers not query params
What it means
API keys and tokens are passed in headers, not query parameters.
Why it matters
Query parameter credentials get logged in access logs, browser history, and referrer headers. Header-based credentials are never logged or cached.
✗
What's wrong
GET /api/data?api_key=secret123
✓
What's right
GET /api/data with header: Authorization: Bearer token123
Check this rule on your site
Enter your URL to check just this one rule (AB-001).