Information disclosure
Exposure of sensitive information to someone not authorized to see it (CWE-200), such as stack traces, configuration, source code, version details or personal data. MITRE prefers mapping a finding to its specific cause, such as error messages (CWE-209) or directory listings (CWE-548).
- Also called
- information leakage
- Defined in
- MITRE CWE-200
Covered in
Ship without debug modes, verbose errors or exposed files
Turn off debug output, publish an allowlisted build and probe each deployment for exposed files and endpoints.
Handle failures without leaking internals or weakening controls
Give callers a useful, bounded response while preserving protected diagnostic evidence and safe application state.
Prevent shared-cache poisoning and private-response deception
Define lookup and storage policy, trace cache/origin interpretation differences and verify both public reuse and private isolation.
Review tenant boundaries before implementation
Trace tenant identity through requests, data stores, caches, jobs, and administration, then turn plausible isolation failures into tests.
Practice: Local project: Repair a real proxy and shared cache