What Is Sensitive Data Exposure?
Sensitive data exposure — reframed as cryptographic failures in the current OWASP Top 10 — is the failure to adequately protect data in transit and at rest. Passwords, payment details, health records, personal data: when these are transmitted in the clear, stored unencrypted, or leaked through side channels, the result is a breach of confidentiality that regulation and users take very seriously.
What causes it?#
| Cause | Example |
|---|---|
| No encryption in transit | Data sent over plain HTTP |
| Weak/no encryption at rest | Plaintext database fields |
| Weak password hashing | Fast or unsalted hashes |
| Leaky side channels | Logs, error messages, caches, backups |
| Over-broad responses | APIs returning more than needed |
Note how many causes are not about the primary datastore: logs, backups, and verbose API responses leak data that the main encryption never touched.
Why isn’t encryption enough?#
Because data leaks around encryption. You can encrypt the database and still write card numbers to a log file, return them in an API response, or ship them in an unencrypted backup. And encryption depends on key management — a leaked key undoes it — and on using current algorithms, not broken legacy ones.
How do you protect sensitive data?#
- Encrypt in transit everywhere — TLS with HSTS, no plaintext fallback.
- Encrypt at rest with well-managed keys; hash passwords with Argon2/bcrypt.
- Minimize collection and retention — data you do not hold cannot leak.
- Close side channels — keep secrets out of logs, errors, and caches; secure backups.
Sensitive data exposure ties together TLS, key management, and password storage. More at the Web Security hub.
Frequently asked questions#
What is sensitive data exposure?
Sensitive data exposure — reframed as cryptographic failures in the current OWASP Top 10 — is the failure to adequately protect sensitive information such as passwords, payment details, health records, or personal data. Causes include transmitting data without TLS, storing it unencrypted or weakly hashed, and leaking it through logs, errors, or backups.
Is encrypting data enough to protect it?
No. Encryption is necessary but not sufficient. Data can still leak through logs, error messages, caches, backups, and over-broad API responses; keys can be poorly managed; and weak or outdated algorithms can be broken. Protecting data means minimizing what you collect, controlling access, and securing the whole data lifecycle.