---
issue: 127
title: "Scanner: GET /intents/:id exposes salt and callbackUrl in response"
severity: low
domain: Scanner
labels: [security, scanner, information-disclosure]
status: open
created: 2026-05-30
source: Full Codebase Audit 2026-05-30
---

# Scanner: GET /intents/:id exposes salt and callbackUrl in response

**Severity:** low
**Domain:** Scanner
**Labels:** security, scanner, information-disclosure

## Description

`scanner/api.go:260` returns the full intent struct including `salt` (used in payment reference derivation) and `callbackUrl` (internal backend endpoint). Both are internal implementation details that should not be exposed to callers.

## Options

1. Tag `salt` and `callbackUrl` with `json:"-"` and return a sanitized DTO.
2. Return them only to admin/privileged callers.
3. Keep `callbackUrl` but always hide `salt`.

## Recommendation

Return a sanitized DTO that omits `salt` and `callbackUrl`; both are internal. Response-shape change may affect existing callers.

## Affected Files

- `scanner/api.go:260`

## References

- [Full Codebase Audit 2026-05-30](../09%20-%20Audits/Full%20Codebase%20Audit%20-%202026-05-30.md) — DEC-59