Sensitive Data Exposure - The Bug That Looks Like a Feature Working Correctly

The API response came back 200. The data was correct. The test passed. Nobody noticed the response body also contained the user's hashed password, their internal account ID, a debug flag set to true, and a field called admin_notes that was never meant to leave the server. Sensitive Data Exposure does not look like an attack. It looks like a feature working correctly. TL;DR Sensitive Data Exposure happens when an application transmits, stores, or returns protected data without adequate controls.