domains / families / security / hunt-information-disclosure

hunt-information-disclosure

separate

Hunt error leakage, DVCS exposure, source maps, config files, and differential oracles.

When to use

• Applications return verbose error messages with stack traces, file paths, or SQL fragments.
• Source maps (.js.map) are deployed to production.
• Versioned static assets reveal framework/CMS versions.
• API responses differ by object existence (user enumeration by status/length/time).
• Debug endpoints, health checks, or status pages expose internal state.

Skill page

Source