A reproducible method, not a table of 'this version sends field X'. Capture conclusions must come from your own measurement; copied ones are not trustworthy.
Approach: build fake data with known content and see whether it appears verbatim in the outbound request. Only known content works as a marker.
Build the sample
Customer: Test-A Phone: 000-0000-0000 ID: 000000000000000000 Order: TEST-0001 Note: this sentence verifies request body content
All obviously fake placeholders. Real data cannot be recalled once it enters a request, so the sample must contain nothing real.
Capture the request
- Have the session read the sample and answer something simple (the customer name, say).
- Capture the outbound request at the same time (local HTTP proxy, or raise the host's log level).
- Search the body for those placeholders.
Reading the result
| Result | Means | Next |
|---|---|---|
| All four appear | The whole file is read in and sent | Mask sensitive material first, or keep processing local |
| Some appear | Fields may be trimmed or chunked | Find out which; do not assume partial means safe |
| None appear | Maybe it never read the file, or you missed the body | Confirm it answered correctly first, or the experiment is void |
Writing a useful conclusion
- State the sample, host version, model, and which hop you captured (host to gateway, or gateway to model vendor).
- State which fields did not appear — more informative than 'everything is sent'.
- Never write 'masked therefore safe': masking rules leak too.