Sensitive Information Disclosure (also known as *Sensitive Data Exposure*) happens when an application does not adequately protect sensitive information that may wind up being disclosed to parties that are not supposed to have access to it.

Sensitive data can include application-related information, such as session tokens, file names, stack traces, or confidential information, such as passwords, credit card data, sensitive health data, private communications, intellectual property, metadata, the product’s source code, etc.

Whichever security flaw is causing the information to be disclosed, all aspects of all kinds of services are potentially at risk.
Sensitive Information Disclosure can arise in databases, operating systems, and network devices.
It is particularly occurrent in web applications, as highlighted in [OWASP’s Top 10](https://owasp.org/Top10/A04_2021-Insecure_Design/), which lists Sensitive Information Disclosure as part of the Insecure Design web application security risk of which to be aware.