## Sensitive Data Exposure (Medium)

### Trigger Signals

- `console.log`/`logger.info`/`logger.debug` output containing sensitive fields
- Error responses exposing stack traces/internal information (`err.stack`, `ex.toString()` returned directly to client)
- API responses containing fields that should not be exposed (password hashes, internal IDs, full ID numbers)
- Log configuration at debug/verbose level and outputting request bodies

### Key Sinks

| Exposure Type | Sink Locations |
|---------|----------|
| Log Exposure | `console.log()`, `logger.info()`, `logger.debug()` outputting sensitive data |
| Error Information Exposure | `res.status(500).json({ error: err.stack })`, `response.send(ex.message)` |
| Response Field Exposure | API returning fields like `password`, `creditCard`, `ssn`, `internalId` |
| Debug Information Exposure | `debug=True` (Flask), `NODE_ENV=development`, `DEBUG=1` |

### Judgment Process

1. **Check log output**: `Grep` searches for `console.log`, `logger` calls, `Read` checks whether output content contains:
   - Passwords, Tokens, API Keys, Session IDs
   - ID numbers, phone numbers, bank card numbers
   - Full request bodies (potentially containing sensitive fields)
2. **Check error responses**: `Read` confirms whether error handling exposes internal information to the client:
   - Complete stack traces (`err.stack`)
   - Internal paths (`/app/services/user.js:42`)
   - Database error details (SQL statements, table names)
   - Should return generic error messages to client, detailed errors only logged
3. **Check API response fields**: `Read` confirms whether serialization/return logic filters sensitive fields:
   - Whether user objects exclude `password`/`salt`/`creditCard`
   - Whether `toJSON()`/`@JsonIgnore`/`exclude` filtering is used
4. **Check debug configuration**: `Read` confirms whether debug mode is disabled in production:
   - Whether there is environment checking (`if (process.env.NODE_ENV === 'production')`)

### Evidence Construction

After confirming a defect, the output must include:
- Exposure location (log/response/configuration, with file:line number)
- Type of sensitive data exposed (password/Token/ID number/stack trace)
- Attack vector (log access, error message collection, response field analysis)
- Business impact (information gathering provides material for subsequent attacks, compliance violations)

### Exclusions

- Log output already redacted (passwords displayed as `***`, Token shows only first 4 characters)
- Sensitive fields already filtered through `@JsonIgnore`/`toJSON()`/`exclude`
- Error responses already differentiated between internal logging and client responses
- Production configuration already disables debug mode (determined via environment variables)
