{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=lgoyal6/overfetch-response@0.3.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/overfetch-response@0.3.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/lgoyal6/overfetch-response@0.3.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/overfetch-response@0.3.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Answers one question about a web application: which HTTP responses hand a client more of a record than the endpoint needs. The shape of the bug is an endpoint that returns the whole database row because that was one line of code, and three fields nobody meant to expose going out with it. Five things are looked for: a handler that returns a whole ORM object, model instance or SELECT * row directly as the body with no field projection, serialiser allowlist or DTO; a response that names a sensitive-looking field (password_hash, salt, api_key, token, otp, reset_token, session_id, stripe_customer_id, internal_notes, is_admin, deleted_at, raw_response) while the rest of the body is public-shaped; a SELECT * feeding a response; a spread or merge that widens a response ({...user}, dict(**row), Object.assign({}, record)), which silently inherits any column a later migration adds; and a serialiser with an explicit denylist (exclude = [...]) rather than an allowlist (fields = [...]), which fails open the moment a column","distribution":{"digest":"sha256:59351fcb3ed0466654d48ad50ab43ef1e2f7f30b076aa42905c4d37fe0287a49","mediaType":"application/vnd.modiqo.rote-flow","size":46900,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/lgoyal6/overfetch-response@0.3.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/lgoyal6/overfetch-response@0.3.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/lgoyal6/overfetch-response@0.3.0.json"},"name":"overfetch-response","owner":{"kind":"user","slug":"lgoyal6"},"parameters":[{"description":"Directory tree whose HTTP responses should be audited for handing out more of a record than the endpoint needs","example":".","input":{"allowCustom":true,"choices":[],"label":"Root"},"name":"root","required":true,"type":"string"},{"default":"8","description":"How many directory levels below root to search for route definitions and serializers","example":"4","input":{"allowCustom":true,"choices":[],"label":"Depth"},"name":"depth","required":false,"type":"string"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/overfetch-response@0.3.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/lgoyal6/overfetch-response@0.3.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/overfetch-response@0.3.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.79.0"},"publishedAt":"2026-09-04T04:32:28.028212+00:00","reference":"lgoyal6/overfetch-response@0.3.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["bash","python3","find","xargs","grep","sed","sort","wc","tr","cat","mktemp","rm"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":3,"installs":0},"steps":{"count":2,"names":["analyze","discover"]},"title":"overfetch-response","type":"play","version":"0.3.0","visibility":"public"}