Scan rule · RSC-PRV-022
Contact data in the shipped JavaScript
Finds e-mail addresses and phone numbers in clear text inside the shipped JavaScript bundles — not in the HTML, where the legal notice requires them.
Why this matters
A JavaScript bundle is public — every crawler loads it, and addresses inside end up on spam lists without anyone ever visiting the page. In the legal notice an address is required and intended; in the bundle it is usually an accident: the developer's e-mail as a default value, a hard-wired recipient for the contact form, a test record with a real number that survived the release.
In generated apps this happens easily: the prototype works with sample data meant to look real, and nobody swaps it out before launch. Under data protection law this is a data-minimisation question — data nobody needs does not belong in the shipped code. The finding stays `low` because the harmless explanation is common.
The evidence deliberately shows the hits masked only (`j***@example.com`). A report spelling out the address would itself be a leak. Check it yourself: download the bundle and search for `@`.
Scan tier
How to fix it
Take addresses and numbers out of the source: delete test data, configure form recipients server-side, render contact details only where they belong.