<div><h3 style="box-sizing:border-box;margin:0px 15px 8px 0px;font-weight:500;font-size:24px;text-overflow:ellipsis;overflow:hidden;font-family:Roboto, &quot;Helvetica Neue&quot;, Helvetica, Arial, sans-serif;text-align:left;">Summary </h3><p style="box-sizing:border-box;margin-top:0px;margin-bottom:1rem;font-family:Roboto, &quot;Helvetica Neue&quot;, Helvetica, Arial, sans-serif;text-align:left;">Some APIs that gather sensitive information can mishandle it by echoing it back to the user as they type it at the input prompt. </p><h3 style="box-sizing:border-box;margin:0px 15px 8px 0px;font-weight:500;font-size:24px;text-overflow:ellipsis;overflow:hidden;font-family:Roboto, &quot;Helvetica Neue&quot;, Helvetica, Arial, sans-serif;text-align:left;">Explanation </h3><p style="box-sizing:border-box;margin-top:0px;margin-bottom:1rem;font-family:Roboto, &quot;Helvetica Neue&quot;, Helvetica, Arial, sans-serif;text-align:left;">Some APIs that gather sensitive information can mishandle it by echoing it back to the user.<br style="box-sizing:border-box;"><br style="box-sizing:border-box;"><br style="box-sizing:border-box;"><br style="box-sizing:border-box;"><b style="box-sizing:border-box;font-weight:bolder;">Example 1:</b><span>&nbsp;</span>The following code demonstrates a model in ASP.NET that has a password property, but does not specify the<span>&nbsp;</span><code style="box-sizing:border-box;font-family:SFMono-Regular, Menlo, Monaco, Consolas, &quot;Liberation Mono&quot;, &quot;Courier New&quot;, monospace;font-size:12.25px;color:rgb(225, 31, 38);background-color:rgb(241, 242, 243);border-radius:0px;">DataType</code><span>&nbsp;</span>as a password, meaning that by default it will be shown when displayed:<br style="box-sizing:border-box;"></p><br></div>