Four things I would check first with NestJS if a bank's API kept leaking sensitive data
A bank's API rarely leaks sensitive data on purpose. Nobody writes a line of code that says send the customer's full account number to anyone who asks. It happens in smaller, quieter ways, a response object that includes more fields than the frontend actually needed, an authorization check that confirms someone is logged in but never checks whether they should see this specific record, a log line that was only meant for debugging but ended up storing a full card number in plain text. If I were b
