Reply To: New web page

[SODIron]

I’ve done a quick look at the site with my IT security / governance head on and, straight away, there’s one obvious issue.

### Admin account details appear to be exposed in the UI

If you click your profile image as a member, the menu includes:

* Dashboard
* Match Content
* My Card
* Admin Panel
* Sign Out

If you click **Admin Panel**, it displays the default account of admin@scunthorpe-united.co.uk

That’s not ideal. In general, you don’t want to advertise the identity of a potential privileged/admin account to every authenticated user. On its own it’s not proof of compromise, but it does hand an attacker useful reconnaissance material for phishing, password-spraying, credential stuffing and social-engineering attempts.

From a security and governance point of view, privileged account identifiers and internal admin paths should only be exposed where there is a genuine operational need. Standard users should be shown the minimum data and functionality required for their role. In practice, this comes back to the principle of **least privilege**, **deny by default**, and not exposing privileged functionality or admin artefacts to users who have no business need to see them.

Relevant guidance includes:

* **NCSC – Secure design principles**
https://www.ncsc.gov.uk/collection/cyber-security-design-principles

* **NCSC – Secure system administration**
https://www.ncsc.gov.uk/collection/secure-system-administration

* **NCSC – Use privileged access management**
https://www.ncsc.gov.uk/collection/secure-system-administration/use-privileged-access-management

* **OWASP Top 10 – A01: Broken Access Control**
https://owasp.org/Top10/2025/A01_2025-Broken_Access_Control/

* **OWASP Authorization Cheat Sheet**
https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html

* **OWASP Access Control**
https://owasp.org/www-community/Access_Control

* **OWASP Authentication Cheat Sheet**
https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html

So in plain English: even if that email address is “only” an admin identifier and not a secret in itself, there’s no obvious reason for it to be visible to ordinary members. At best it’s untidy and leaks internal implementation detail; at worst it gives attackers a cleaner starting point for targeting privileged access.