Explicit GET form includes a recognised personal-data field
ShipReady found static form markup with an explicit GET method and an input field matching its recognised personal-data signals.
Why it matters
When a browser conventionally submits a form with GET, submitted values become part of the request URL. A form collecting personal data is worth reviewing to ensure that behavior is intentional.
How ShipReady detects it
What it inspects
ShipReady parses static HTML outside inert template elements. It inspects form markup and input elements for an explicit method=GET and either input type=email or an input name containing email, e-mail, phone, telephone, mobile, ssn, birthdate, or dob.
What triggers a finding
The rule triggers when one parsed form has an explicit GET method and contains a recognised personal-data field signal. It deduplicates the same endpoint path and field type.
What the evidence shows
The evidence proves that static markup declares an explicit GET form containing a recognised personal-data field signal, and reports the resolved form endpoint without recording a submitted value.
Limits of this check
ShipReady does not submit the form, inspect JavaScript interception, verify endpoint behavior, or inspect actual submitted values. It does not flag omitted methods, POST forms, unrecognised fields, card fields, select or textarea controls, or forms inside templates. If the browser submits the form conventionally, GET form values can become part of the request URL; ShipReady does not observe that submission or any resulting logs, history, referrer, or legal outcome.
How to fix it
Confirm the intended submission design
Locate the reported form and determine whether it uses normal browser submission or JavaScript handling in production.
Use POST for the intended design
If the form conventionally submits recognised personal data, configure the form and its endpoint to use POST and read the values from the request body.
Review the form fields and route
Confirm the form's fields, action, and client-side behavior match the intended data flow after changing its submission method.
How to verify the change
Test the deployed form behavior
In a controlled environment, inspect the form markup and exercise the intended submission path with non-sensitive test data.
Expected: The form uses the intended method and its endpoint receives the values through the intended request mechanism.