Preventing Sensitive Information Disclosure requires developers to adhere to numerous, necessary industry best-practices in line with current regulations to increase the difficulty for the attacker.

- Developers must first identify which data are sensitive according to the system architecture and regulatory requirements.
- Developers must ensure data in transit or storage are encrypted.
- Developers should remove debugging and test functionality from production applications and systems.
- Developers should review the listed items to determine if a justifiable business need exists for possessing each item present. Any items deemed unnecessary should be removed.
- Defined application/system build procedures should include steps to remove the files and features that are unnecessary for a production deployment, and internal security processes and controls should confirm this has occurred prior to production release.
