I think, especially in an age of heroku/lambda/etc, we can assume requests are logged by infrastructure. It is a trivially easy mistake to make - most devs forg

I think, especially in an age of heroku/lambda/etc, we can assume requests are logged by infrastructure. It is a trivially easy mistake to make - most devs forget that requests tend to be logged by infrastructure. This happens enough to get it's own CWE - https://cwe.mitre.org/data/definitions/532.html https://cwe.mitre.org/data/definitions/532.html Copy and paste won't help you here. This usually happens on focus changes and frequently is done not as part of form submission but to see if people bounce from the page and for stats - meaning it goes to a less secured database and usually has widely available access to it. The fix here, in my opinion, is a mixture of technical (browsers aggressively disabling this sort of thing) and legal (penalizing accidental disclosures heavily). As a user, you can't do much.