Sensitive Data Exposure happens when a website accidentally reveals confidential information to users through the front end of the application.

The front end is everything your browser can see and interact with:

• HTML
• CSS
• JavaScript
• Images
• Client-side scripts

Anything sent to the browser can potentially be viewed by anyone.

This is different from the back end, which runs on the server and is normally hidden from users.

Even if attackers cannot directly hack the server, exposed information in the front end can help them:

• Log into accounts
• Find hidden pages
• Discover APIs
• Reveal admin panels
• Access databases indirectly
• Launch further attacks

So developers must avoid exposing sensitive information in client-side code.

How Attackers Find Exposed Data