What is Inclusion of Sensitive Information (CWE-540)?

TL;DR: Inclusion of Sensitive Information in Source Code (CWE-540) is a vulnerability where sensitive data is stored insecurely, leading to potential unauthorized access. It can be fixed by removing such information from source code and storing it securely.

What is Inclusion of Sensitive Information in Source Code?

Inclusion of Sensitive Information in Source Code (CWE-540) is a type of vulnerability that occurs when source code on a web server or repository contains sensitive information and should generally not be accessible to users. As defined by the MITRE Corporation under CWE-540, and classified by the OWASP Foundation under A01:2025 - Broken Access Control.

Quick Summary

Inclusion of Sensitive Information in Source Code is a serious security flaw that can lead to unauthorized access and data breaches. It occurs when sensitive information such as API keys or database credentials are stored within source code repositories, making them accessible to users who should not have this level of access. Jump to: Overview · How it Works · Business Impact · Attack Scenario · Detection Methods · Fixes

Jump to: Quick Summary · Inclusion of Sensitive Information in Source Code Overview · How Inclusion of Sensitive Information in Source Code Works · Business Impact of Inclusion of Sensitive Information in Source Code · Inclusion of Sensitive Information in Source Code Attack Scenario · How to Detect Inclusion of Sensitive Information in Source Code · How to Fix Inclusion of Sensitive Information in Source Code · Framework-Specific Fixes for Inclusion of Sensitive Information in Source Code · How to Ask AI to Check Your Code for Inclusion of Sensitive Information in Source Code · Inclusion of Sensitive Information in Source Code Best Practices Checklist · Inclusion of Sensitive Information in Source Code FAQ · Vulnerabilities Related to Inclusion of Sensitive Information in Source Code · References · Scan Your Own Site

Inclusion of Sensitive Information in Source Code Overview

What

Inclusion of Sensitive Information in Source Code is a vulnerability where sensitive data such as API keys, database credentials, and other secrets are stored within source code repositories or web servers.

Why it matters

This weakness can lead to unauthorized access and potential data breaches if an attacker gains access to the repository or server containing this sensitive information.

Where it occurs

It commonly occurs in web applications where sensitive configuration files or scripts are stored on publicly accessible servers or version control systems.

Who is affected

Developers, administrators, and organizations that manage source code repositories and web servers are at risk if they do not properly secure their sensitive data.

Who is NOT affected

Organizations that strictly enforce access controls and store sensitive information in secure locations such as environment variables or secret management solutions are less likely to be impacted by this vulnerability.

How Inclusion of Sensitive Information in Source Code Works

Root Cause

The root cause of Inclusion of Sensitive Information in Source Code is the presence of sensitive data within source code repositories or web servers, which should not be accessible to unauthorized users.

Attack Flow

1. An attacker gains access to a repository containing sensitive information.
2. The attacker extracts and uses this sensitive data for malicious purposes, such as API key theft or database credential misuse.

Prerequisites to Exploit

• Access to the source code repository or web server where sensitive data is stored.
• Lack of proper security measures to protect sensitive data within these repositories.

Vulnerable Code

# Example of storing an API key in a Python script
API_KEY = 'sensitive_api_key'
print(f'Using API Key: {API_KEY}')

This code demonstrates the vulnerability by directly including a sensitive API key in the source code, making it accessible to anyone with access to this repository.

Secure Code

# Example of securely storing an API key using environment variables
import os

API_KEY = os.getenv('API_KEY')
print(f'Using API Key: {API_KEY}')

This secure version avoids hardcoding sensitive information and instead retrieves it from a secure location such as an environment variable.

Business Impact of Inclusion of Sensitive Information in Source Code

Confidentiality

• Sensitive data exposure: Attackers can read and misuse application data, leading to unauthorized access.
• Financial loss: Data breaches resulting from exposed credentials can lead to significant financial losses due to legal penalties and reputational damage.

Integrity

• Unauthorized modifications: Sensitive information may be altered by attackers, compromising the integrity of critical systems.

Inclusion of Sensitive Information in Source Code Attack Scenario

1. An attacker gains unauthorized access to a web server or repository containing sensitive configuration files.
2. The attacker extracts API keys and database credentials from these files.
3. Using the extracted credentials, the attacker performs unauthorized actions within the application environment.
4. The organization suffers financial losses due to data breaches and reputational damage.

How to Detect Inclusion of Sensitive Information in Source Code

Manual Testing

• Review source code repositories for any hardcoded sensitive information such as API keys or database credentials.
• Ensure that sensitive files are stored securely outside of public web servers and version control systems.
• Verify that access controls are properly enforced to prevent unauthorized users from accessing sensitive data.

Automated Scanners (SAST / DAST)

Static analysis tools can detect hardcoded secrets within source code, while dynamic testing requires runtime execution to identify vulnerabilities in deployed applications.

PenScan Detection

PenScan’s scanner engines such as ZAP and Nuclei can help identify instances of Inclusion of Sensitive Information in Source Code by scanning repositories and web servers for sensitive data exposure.

False Positive Guidance

A finding is likely a false positive if the detected pattern appears to be sensitive information but is actually part of a secure configuration or environment variable setup.

How to Fix Inclusion of Sensitive Information in Source Code

• Remove scripts containing sensitive information from web servers and move them to locations not accessible via the internet.
• Use environment variables or secret management solutions like HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault for storing secrets securely.
• Implement strict access controls on repositories containing sensitive data to prevent unauthorized access.

Framework-Specific Fixes for Inclusion of Sensitive Information in Source Code

Python/Django

# Securely store API keys using environment variables
import os

API_KEY = os.getenv('API_KEY')
print(f'Using API Key: {API_KEY}')

Java

// Use system properties to securely store sensitive information
String apiKey = System.getProperty("api.key");
System.out.println("Using API Key: " + apiKey);

How to Ask AI to Check Your Code for Inclusion of Sensitive Information in Source Code

Review the following Python code block for potential CWE-540 Inclusion of Sensitive Information in Source Code vulnerabilities and rewrite it using environment variables:

# Example vulnerable code
API_KEY = 'sensitive_api_key'
print(f'Using API Key: {API_KEY}')

Inclusion of Sensitive Information in Source Code Best Practices Checklist

✅ Regularly audit source code repositories to identify and remove any hardcoded sensitive information.

✅ Use version control systems that enforce security policies, such as GitLab or GitHub with secret scanning enabled.

✅ Implement strict access controls on repositories containing sensitive data to prevent unauthorized access.

✅ Store sensitive information securely using environment variables or secure secret management solutions.

Inclusion of Sensitive Information in Source Code FAQ

How does Inclusion of Sensitive Information in Source Code occur?

It occurs when source code on a web server or repository contains sensitive information that is accessible to users, such as API keys, database credentials, and other secrets.

What are the consequences of Inclusion of Sensitive Information in Source Code?

Attackers can read and misuse application data, leading to unauthorized access and potential data breaches.

How does Inclusion of Sensitive Information in Source Code impact confidentiality?

It exposes sensitive information such as API keys or database credentials that can be used by attackers for malicious purposes.

What are the common methods to detect Inclusion of Sensitive Information in Source Code?

Manual code reviews and automated static analysis tools can help identify instances where sensitive data is stored insecurely in source code repositories.

How do I prevent Inclusion of Sensitive Information in Source Code?

Remove scripts from web servers and move them to locations not accessible via the internet. Use environment variables or secure secret management solutions for storing secrets.

What are some best practices to avoid Inclusion of Sensitive Information in Source Code?

Regularly audit source code repositories, use version control systems that enforce security policies, and implement strict access controls on sensitive files.

How can I test if my application is vulnerable to Inclusion of Sensitive Information in Source Code?

Conduct a thorough review of your source code for any hardcoded secrets or credentials. Use automated tools like PenScan to scan for vulnerabilities.

Vulnerabilities Related to Inclusion of Sensitive Information in Source Code

References

• MITRE
• OWASP Top 10:2025 - Broken Access Control
• NVD NIST

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Inclusion of Sensitive Information in Source Code and other risks before an attacker does.