Private product exposure

Unauthorized or unintended exposure of non-public assortment, pricing, fulfillment, or policy data to crawlers, agents, or public surfaces because access controls, segmentation, or publication boundaries were not correctly enforced.

StoreSteady treats private product exposure as a reference term because Robots-only access control: Private content "protected" by `robots.txt` or `noindex` only.

• Robots-only access control changes what a crawler, shopping channel, or AI assistant can safely infer about the merchant surface.
• Without a named category, operators tend to treat private product exposure as generic AI noise instead of a reproducible finding with evidence and a validation path.

• B2B prices reachable without login, unpublished SKUs in public feeds or sitemaps, internal IDs leaked in client JS, wholesale pricing in public JSON endpoints, segment-specific offers exposed to all visitors.

Run authenticated-vs-unauthenticated catalog crawls and diff the assortment. Inventory all public endpoints exposed in client JS and sitemap; probe each without credentials. Parse public scripts and feeds for sensitive-field patterns (wholesale-price keys, internal-ID prefixes, segment markers).

• Public PDPs with public prices - these are intentionally exposed.
• A 404 on a non-existent SKU URL - that's correct behavior.

1. Identify the merchant-controlled source that creates the private product exposure signal.
2. Reconcile visible copy, machine-readable data, policy text, feed state, and checkout behavior where the term applies.
3. Keep the fix high-level in public docs; detailed remediation belongs inside paid scan workflows.

Rerun the same evidence capture used for detection. The finding is validated only when the original private product exposure signal no longer reproduces and adjacent source surfaces still agree.

• RFC 9309 - Robots Exclusion Protocol (explicitly not an authorization mechanism) →
• Google guidance - `robots.txt` is not a mechanism for hiding content →
• OWASP - broken access control →

• Eligibility surface →
• Agent trust assertion →

• StoreSteady public methodology →
• RFC 9309 - Robots Exclusion Protocol (explicitly not an authorization mechanism) →
• Google guidance - `robots.txt` is not a mechanism for hiding content →
• OWASP - broken access control →