Testing for Sensitive Data Exposure

When to Use

During authorized penetration tests when assessing data protection controls
When evaluating applications for GDPR, PCI DSS, HIPAA, or other data protection compliance
For identifying leaked API keys, credentials, tokens, and secrets in application responses
When testing whether sensitive data is properly encrypted in transit and at rest
During security assessments of APIs that handle PII, financial data, or health records

Authorization: Written penetration testing agreement with data handling scope
Burp Suite Professional: For intercepting and analyzing responses for sensitive data
trufflehog: Secret scanning tool (pip install trufflehog)
gitleaks: Git repository secret scanner (go install github.com/gitleaks/gitleaks/v8@latest)
curl/httpie: For manual endpoint testing
Browser DevTools: For examining local storage, session storage, and cached data
testssl.sh: TLS configuration testing tool