Definition
The OWASP API Security Top 10 listed it as "Excessive Data Exposure" in its 2019 edition; the 2023 edition folded it into "Broken Object Property Level Authorization," which covers reading and writing fields a client isn't allowed to. It tends to happen when filtering is left to the client and the server returns database rows as they are.
Macnica's tally (published October 7, 2026, in Japanese) lists "APIs that return more information than necessary" among the weaknesses attackers targeted, and reports cases where API keys extracted from smartphone apps were used to call APIs in a way that looks like legitimate access. In 9 of the 81 cases disclosed since July 2026, data retrieval through APIs or databases was confirmed. The article recommends checking whether APIs return more data than needed and whether guest access returns unnecessary results.
Lemma implementation
Excessive data exposure comes from designs that hand over the raw data in order to establish a needed fact. Lemma answers a query with a proof that a condition holds, not with the raw data. To "is this member 20 or older?" it returns not a birth date but a zero-knowledge proof of that fact.
Which fields may be returned is fixed up front in the schema and the selective disclosure settings. For queries routed through Lemma, undisclosed attributes have no path into the response at all, so nothing depends on client-side filtering.
Which client received which attribute, and when, is kept in the audit trail. Whether reads wider than expected keep happening can be checked afterwards.