Sensitive Data Exposure

Leakage of protected data through weak protection, verbose errors or careless caching.

Specifications & Metrics

cwe

CWE-200

impact

High

Core Principles & Analysis

• Full card numbers in logs, tokens in URLs, personal data in error traces.
• Often not an exploit at all — just data nobody meant to publish.
• Classify data, encrypt at rest and in transit, and redact by default.