A Password Traveled in a Tracking Request — Checking a Form Takes More Than One Search

If the form works, but you have never looked at the requests created after submission

You add ad pixels to measure signup conversions and turn on session replay to improve the inquiry process. The form submits properly and events are coming in, so everything may seem fine. But unless you check which external requests are created the moment an email address and password are entered, you cannot determine the scope of data transmission from whether the form works alone.

According to testing by security firm Melurna, Klaviyo signup forms were misconfigured from at least February 2024 through November 2025. Email addresses, passwords, company names, website addresses, and phone numbers could have been shared with external tracking companies embedded on the page, including Facebook, Google, HubSpot, Microsoft, LinkedIn, and X. However, public materials did not identify exactly which code or settings caused this, or which fields each company actually received and stored. techcrunch

Klaviyo said it fixed the issue and notified affected users. The known number of people affected was fewer than 200 based on “immediately available active logs,” but because the log-retention period was not disclosed, that number cannot be generalized to the impact across the full period. techcrunch

Start with a network audit

You do not need to sign up for another service or authenticate with an API. You can begin with Chrome, its built-in DevTools, and a form your organization owns or has explicitly authorized for testing. The values below are examples to show the format. Do not enter real customer information or a password used on another account; replace them with an organization-managed test address and values that meet the form’s validation rules.

1. Confirm the official procedure and readiness.
   Official Chrome Network documentation covers request recording, Preserve log, and request search. No tools to install or services to log in to are required beyond Chrome. Also confirm that you are authorized to reproduce the target form, consent state, login state, and regional conditions. developer.chrome
2. Clear the record and enable Preserve log.
   Open the form in Chrome, then go to the Network panel in DevTools. Confirm that recording is enabled, clear existing requests, and select Preserve log. This setting retains requests from the prior page even after you navigate following submission. It does not retroactively record requests that finished before DevTools was opened. developer.chrome
3. Complete a submission with unique test values.
   Enter an organization-managed test email and a fake password that is not reused on a real service. After pressing submit, confirm the success page or successful response, and record the time plus consent, login, and regional conditions. If a validation error occurs, do not count that scenario as a completed test.
4. Open the Search tab, not the standard Filter.
   With focus on the Network panel, press Command+F on macOS or Control+F on Windows and Linux. In the Search tab that opens on the right, enter the test email, phone number, and fake password one at a time, then press Enter. The Filter field at the top of the screen filters request properties such as domains and methods; it is not a search box for full Payload strings. developer.chrome
5. Record the destination and origin path of matching requests.
   Click each search result to check its destination URL and Headers·Payload·Response, then use Initiator in the request list to trace which script created the request. HAR files can contain authentication tokens or personal information, so do not upload them to ordinary messengers or public work repositories. developer.chrome
6. Compare third-party requests and tag settings even if the original text is absent.
   Review external-domain requests newly created before and after submission, and check whether automatic collection, user-provided data, CSS selectors, and hashing features are enabled in GTM, ad tags, and the CMP. Google Ads enhanced conversions can collect first-party data such as email, name, address, and phone number and send it to Google in hashed form, so an original-text search alone may not find it. developer.chrome +1
7. Determine approval status and restrict the transmission path.
   If original text or a verifiable transformed value is found, compare the destination, campaign purpose, consent conditions, applicable product, and internal approval. A hash alone does not prove a leak, but PII such as email addresses and personal phone numbers headed to Google Analytics must be removed before transmission. PII mixed into URLs, page titles, and form inputs is also in scope for review. support.google
8. Submit again under the same conditions after remediation.
   Repeat the process beginning with the Preserve log setting. Record that the scenario passes its initial check when a successful submission is recorded, no original or verifiable transformed test value is found at an unapproved destination, and tag settings contain no unapproved path that collects that field. developer.chrome +1

The dataLayer is a transmission list, not a security boundary

Third-party JavaScript running on the same page can read data available in the DOM. Even if you put only permitted values into the dataLayer, that does not automatically block ordinary third-party code from accessing the DOM. The actual scope varies with iframe isolation, sandboxing, and tag-manager settings. cheatsheetseries.owasp

If you can remove the relevant script from the browser, consider an architecture in which the host validates values and sends only necessary data through a server-side delivery path. If client-side tags must remain, reduce unnecessary DOM variables and Custom HTML, and limit template permissions, selectors, and automatic-collection scope. cheatsheetseries.owasp

In GTM, container permissions are divided into Read, Edit, Approve, and Publish. Separate the people who modify tags from those who publish to production, while remembering that permission separation alone does not validate the collection scope of tags already deployed. support.google

For session replay, review the current settings and when they changed

Session replay tools have different masking scopes depending on the product and its settings. Microsoft Clarity currently masks input boxes and dropdowns in every masking mode, and its default Balanced mode also classifies numbers and email addresses as sensitive content. learn.microsoft

If you use Clarity, check the current mode under Settings → Masking, then specify additional containers to mask with CSS selectors or the data-clarity-mask attribute. Changes do not apply retroactively to past recordings and may take up to one hour to appear in new recordings. Clarity masking also does not prevent transmission by other advertising or analytics tags. learn.microsoft

Ask the same questions every time a new tag is added

Sharing sensitive information through tracking technology is not a one-off Klaviyo case. The U.S. FTC alleged that GoodRx shared information such as prescription medications and health conditions with advertising platforms including Facebook and Google for years. Princeton researchers also published a list of 8,000 sites where session replay was observed, along with examples involving Walgreens prescription information and Gradescope student information. ftc.gov +1

The technical setup, data types, duration, and legal status differ across these cases. They cannot be combined into the same defect or a single scale of harm. The recurring operational question is whether the actual transmitted fields and execution conditions were reexamined after a new tag was added.

If you want to dig deeper

The Network features reference covers preserving requests across page navigations, the Search tab opened with Command/Ctrl+F, and how to inspect Headers·Payload·Initiator. developer.chrome.com

Third Party Javascript Management is useful for reviewing how third-party code accesses DOM data and the difference between client-side and server-side delivery approaches. cheatsheetseries.owasp.org

About enhanced conversions for web explains the scope of the Google Ads feature through which user-provided data may be normalized, hashed, and transmitted. support.google.com