Information Disclosure — the 12 highest-paying patterns

Quick answer

Information Disclosure is any leak of data that helps the attacker: tokens, internal paths, library versions, configuration, source code, user data. Bug bounty programs pay for it fast when you demonstrate impact (access to something paid, another user, internal infra). The 12 most profitable patterns are well defined — it's worth building a checklist.

The 12 most reported patterns

1. API keys in window.CONFIG or equivalent

SPA apps inject global state into HTML on load:

window.CONFIG = { contentful: { ACCESS_TOKEN: "..." }, algolia: { apiKey: "..." } }
window.__INITIAL_STATE__ = { ... }
window.__NEXT_DATA__ = { ... }  // Next.js

Ctrl+U → search for TOKEN, API_KEY, SECRET. If you find one, test it against the service's real API to see the scope.

2. JavaScript bundles with hardcoded secrets

# LinkFinder + SecretFinder on the .js
python3 SecretFinder.py -i https://app.target.tld/main.abc123.js

Patterns to grep: aws_access_key, aws_secret, slack_webhook, stripe_secret_key, heroku_api_key, api_token.

3. Exposed .git

curl -sI https://target.tld/.git/HEAD
# If it responds 200 with "ref: refs/heads/main" → .git folder accessible

# Full dump with git-dumper
git-dumper https://target.tld/.git/ ./loot/

Access to the full repo history → secrets in old commits, backend source code.

4. Accessible .env, .bak, .swp

target.tld/.env
target.tld/config.php.bak
target.tld/.htaccess.bak
target.tld/wp-config.php~

Try typical wordlists (raft-medium-files, etc.) on each subdomain.

5. Verbose stack traces in errors

Force errors to see the responses:

GET /api/users?id=abc'
GET /api/users?id=null
GET /api/users?id=99999999999999

If the server responds with a stack trace including filesystem paths (/var/www/app/src/...), library versions and the SQL query → direct report.

6. Debug endpoints without auth

target.tld/debug
target.tld/debug/vars        # Go debug pprof
target.tld/actuator/env       # Spring Boot
target.tld/actuator/heapdump  # critical — JVM heap dump
target.tld/.well-known/security.txt
target.tld/__debug__
target.tld/console            # Werkzeug Python debug shell — direct RCE if present

A misconfigured Spring Boot Actuator is the classic. Werkzeug with /console is immediate RCE.

7. Header leaks

Server: Apache/2.4.6 (CentOS) PHP/5.4.16
X-Powered-By: PHP/5.4.16
X-AspNet-Version: 4.0.30319
X-Debug-Mode: 1
X-Backend-Server: app-prod-01.internal.tld

Outdated versions → potential CVE chain. Internal hostnames → asset enumeration.

8. CORS misconfig leaking data

If Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true → any origin can read authenticated responses. Report with a PoC showing cross-site reads.

9. Verbose responses on public endpoints

GET /api/v1/products/123

The response includes unnecessary fields:

{
  "id": 123,
  "name": "Widget",
  "internal_cost": 12.50,
  "supplier_email": "joao@supplier.tld",
  "stock_db_id": "prod-x42-internal",
  "created_by_uid": 88
}

Internal cost, supplier emails, internal IDs — all info disclosure if not strictly necessary.

10. Open S3 / Azure / GCP buckets

# S3 enumeration
aws s3 ls s3://target-uploads --no-sign-request
aws s3 ls s3://target-prod --no-sign-request

# Common bucket names
target-backups, target-uploads, target-static, target-dev, target-prod

Public buckets with backups, DB dumps, user files → critical info disclosure.

11. Source maps in production

target.tld/main.abc123.js.map

If it responds 200, it contains the un-minified original source code. Reveals frontend logic, internal endpoints, variables obfuscated in the bundle but not in the map.

12. PII leak via short URLs / predictable tokens

Endpoints like URL shorteners, invoice links, password reset, account confirmation with short or predictable tokens → enumeration exposes PII of hundreds of users. A pattern with a history of high bounties.

How you find it: checklist

[ ] Ctrl+U on the home and authenticated pages → grep TOKEN/SECRET/KEY
[ ] Analyze each .js bundle with LinkFinder + SecretFinder
[ ] Try /.git, /.env, /.bak, /backup, /admin
[ ] Force errors: id=', id=null, malformed body, weird content-type
[ ] Try /debug, /actuator, /__debug__, /pprof, /metrics, /console
[ ] Curl with -I to see Server / X-Powered-By on each subdomain
[ ] CORS scan on authenticated endpoints
[ ] Diff between authenticated and unauthenticated responses: any extra fields?
[ ] Enumerate S3/Azure/GCP buckets with names derived from the target
[ ] curl <endpoint>.js.map on the main bundles
[ ] Short / numeric tokens in notification URLs, transactional links

How to report it

Triage requires demonstrated impact, not "this header is present, it's bad". For each finding:

• Token / API key: a working HTTP request against the real API that demonstrates the scope (download paid content, list private resources).
• Debug endpoint: screenshots or curl showing sensitive information.
• Open bucket: a list of sensitive files + 1 downloaded example.
• Source maps: a screenshot of the visible original source code.

Without reproducible impact, it goes to Informational. With clear impact, they usually pay between €100 (low) and €5,000 (critical, depending on what's leaked).

Related labs

Practice recon of tokens, debug endpoints and source maps on real apps: Information Disclosure labs.