Description
Sensitive data disclosure occurs when confidential information such as API tokens, access keys, secrets, or credentials are exposed in publicly accessible content. This can happen through HTML, JavaScript, error messages, comments, or configuration files, and may allow attackers to gain unauthorized access to systems or services.
Recommendation
First of all revoke the exposed secret. Scan and monitor code, configuration files, and web content to detect and remove sensitive data. Use environment variables or secrets management tools for handling credentials. Never hardcode secrets in source files or expose them in client-side code. Implement security reviews in your development pipeline to catch leaks before deployment.
References
Could your website be exposed too?
SmartScanner can check your website for Sensitive Data Disclosure and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Cloud Metadata Disclosure - Vulnerability
- Windows Path Disclosure - Vulnerability
- Kibana Sensitive Data Disclosure - CVE-2021-37939
- Unreferenced Source Code Disclosure - Vulnerability
