HTTP Authorization Header Leakage via FTP Response

Ankit Mehta@Secvyn

•updated Jun 24, 2026•1•0•2

This rule detects potential leakage of HTTP Authorization headers (including 'Authorization', 'Basic', 'Bearer', 'Digest', and 'X-API-Key') over FTP (port 21) within network traffic. This could indicate a misconfiguration or an attempt to exfiltrate credentials or sensitive API keys in an unencrypted manner.