Sensitive Data Exposure

What it is

CWE-200 is a broad category covering any path that reveals sensitive information (credentials, tokens, internal identifiers, PII, business secrets, stack traces) to a party that should not have access. The disclosure can be active (an endpoint returns the data) or passive (a log file or cache stores it).

Why it matters

Most disclosed breaches involve a CWE-200 leak somewhere in the chain: stack traces that reveal database schema, debug endpoints returning environment variables, error messages that enumerate users, log files that capture authentication tokens, or response bodies that include fields the API was not supposed to return. Modern privacy regulations (GDPR Article 33, HIPAA 164.408, PCI-DSS 12.10) impose disclosure timelines that start the moment a CWE-200 exposure is detected.

Common patterns

• •Returning raw exception objects, stack traces, or DEBUG=True output to clients in production.
• •Logging request bodies that contain passwords, tokens, or credit card numbers.
• •Including internal IDs, database row counts, or schema hints in error responses.
• •User enumeration via different error messages for valid vs invalid usernames.
• •Response serialization that includes server-only fields (password hash, isInternal flag).
• •Debug or admin endpoints (/debug, /healthz with full env dump, /admin/users) accessible without authentication.

Languages affected

Example

from flask import Flask, jsonify, request

app = Flask(__name__)
app.config['DEBUG'] = True

@app.errorhandler(Exception)
def handle(e):
    return jsonify({
        'error': str(e),
        'type': type(e).__name__,
        'traceback': str(e.__traceback__),
        'request_body': request.get_data(as_text=True),
    }), 500

import logging
from flask import Flask, jsonify
from werkzeug.exceptions import HTTPException

app = Flask(__name__)
app.config['DEBUG'] = False  # Never True in production
logger = logging.getLogger(__name__)

@app.errorhandler(HTTPException)
def handle_http(e):
    # HTTP errors return their status code with a generic message.
    return jsonify({'error': e.name}), e.code

@app.errorhandler(Exception)
def handle_generic(e):
    # Log the full exception server-side with a correlation id.
    correlation_id = request.headers.get('X-Request-Id', 'unknown')
    logger.exception('Unhandled exception', extra={'correlation_id': correlation_id})
    # Return generic error to the client; no stack trace, no request echo.
    return jsonify({'error': 'Internal server error', 'correlation_id': correlation_id}), 500

Where this fits in OWASP Top 10

Compliance framework mapping

Related CWEs