Data Protection intermediate 40 mins

Sensitive Data Exposure

Discover how applications inadvertently expose sensitive information through misconfigurations and poor security practices. Learn to identify leaked credentials, API keys, and personal data in error messages, backups, and client-side code.

Hands-on Labs

Real-world Scenarios

Immediate Feedback

1

Introduction to Sensitive Data Exposure

theory

Understand what sensitive data exposure is, why it matters, and common sources of leaks.

Introduction to Sensitive Data Exposure

What is Sensitive Data Exposure?

Sensitive Data Exposure occurs when applications, APIs, or servers fail to adequately protect confidential information such as credentials, API keys, personal data, or cryptographic keys.

Common sensitive data types

• Passwords and password hashes
• API keys, tokens, and secrets
• Personally Identifiable Information (PII)
• Encryption keys and certificates
• Internal configuration and debug data

Typical sources of exposure

• Misconfigured storage (public S3 buckets, exposed directories)
• Verbose error messages or stack traces
• Unencrypted transmissions (HTTP instead of HTTPS)
• Leftover files (.git, backups) on web root
• Logging secrets to accessible logs

Knowledge Check

Which of the following is a primary risk from sensitive data exposure?

2

Data-in-Transit: TLS and Transport Security

theory

Learn about protecting data during transport and common TLS misconfigurations.

Data-in-Transit: TLS and Transport Security

Protecting Data in Transit

Use TLS to encrypt data between clients and servers.

• Enforce TLS 1.2+ and disable insecure ciphers
• Use HSTS
• Redirect HTTP to HTTPS and validate certificates

Knowledge Check

Which practice helps protect data in transit?

3

Leakage via Debug/Error Messages (Simulation)

simulation

Simulate leaking secrets in verbose error pages.

Simulation Objective

Simulate leaking secrets in verbose error pages.

Target

/user/profile?show=error

Scenario

Stack trace disclosure

4

Exposed Backup/.git or Public Files (Simulation)

simulation

Simulate exposed config or repository files revealing secrets.

Simulation Objective

Simulate exposed config or repository files revealing secrets.

Target

/.git/HEAD

Scenario

Exposed git

5

API Key / Secret in JavaScript or HTML (Simulation)

simulation

Simulate discovering secrets embedded in static files.

Simulation Objective

Simulate discovering secrets embedded in static files.

Target

/static/js/app.js

Scenario

Frontend key disclosure

6

Insecure Storage: Plaintext Secrets (Simulation)

simulation

Simulate plaintext stored credentials.

Simulation Objective

Simulate plaintext stored credentials.

Target

/admin/export-users

Scenario

Plaintext passwords

7

Token Replay & Poorly Scoped Tokens

theory

Theory: long-lived tokens & overly broad scopes.

Token Replay & Poorly Scoped Tokens

Token Risks

Tokens should expire fast, be scoped, and revocable.

• Short expiry
• Minimal permissions
• Revocation & monitoring

Knowledge Check

Which reduces the blast radius if a key is leaked?

8

Prevention & Remediation Best Practices

theory

Learn controls to prevent leaks.

Prevention & Remediation Best Practices

Remediation & Prevention

• Encrypt at rest + in transit
• Use secrets managers
• Do not store secrets in repos
• Limit PII and retention

Knowledge Check

Which is a secure way to manage secrets?

9

Sensitive Data Exposure Challenge - Safe Remediation

simulation

Simulation: find exposed secret & provide remediation text.

Simulation Objective

Simulation: find exposed secret & provide remediation text.

Target

/.env

Scenario

Identify and remediate