This exposes the authentication credentials in plaintext on the network and can lead to attackers finding and using the credentials to make unauthorized API calls.
This rule applies at the API Specification level (OAS/Swagger).
Risk of Token Theft: If Bearer Tokens are stored or transmitted in plaintext in client-side storage (such as local storage, cookies, or mobile device storage), they are vulnerable to theft by cross-site scripting (XSS) attacks or other client-side vulnerabilities. Attackers can steal these tokens and use them to access protected API resources without authorization.
