Information Disclosure

Information Disclosure (also called Information Leakage or Sensitive Data Exposure) occurs when an application unintentionally exposes data that should remain private — to users, attackers, or the public. This ranges from trivial details like server version numbers all the way to plaintext credentials, internal source code, and private API keys. TWO MINDSETS — AND WHY IT MATTERS: Bug Bounty Mindset: Programs demand demonstrated impact. Finding a .env file with a live database password is P1 critical. Finding a server version header alone might be out of scope. You need to chain findings: leak → access → impact. A disclosed AWS key that lets you read S3 buckets is reportable; an X-Powered-By header is usually not. Pentesting Mindset: Every leak matters, even without immediate impact. An internal IP address in an error message helps map the network. A username in a stack trace assists brute force. A commented-out API endpoint reveals attack surface. Your client pays for completeness, not just severity. The skill is the same — the reporting threshold is what differs. Master the techniques for pentesting; learn impact chaining for bug bounty. COMMON INFORMATION CATEGORIES THAT GET LEAKED: - Credentials (DB passwords, API keys, JWT secrets, cloud credentials) - Internal infrastructure (hostnames, IPs, file paths, service names) - Application internals (stack traces, framework versions, query structure) - Business data (user PII, financial records, health information) - Source code and configuration files (.env, web.config, .git repositories)