Check for Information Disclosure

Information disclosure vulnerabilities reveal internal details about your application that help attackers plan more targeted attacks. Stack traces in error messages expose technology versions and code paths. Debug endpoints left enabled in production leak application state. Exposed configuration files reveal database credentials. Verbose API responses include internal IDs, email addresses, or data from other users.

The recon skill maps your application's surface area and identifies exposed information, while scan_vulnerabilities checks for specific disclosure patterns. Together, they detect verbose error pages, directory listings, exposed source maps, debug panels, backup files, and API responses that return more data than the client needs.

Information disclosure is often dismissed as low severity, but it is the foundation for more serious attacks. Knowing the exact version of a framework tells an attacker which CVEs to try. Finding a debug endpoint reveals the application's internal logic. Discovering an exposed .env file gives immediate access to everything. Systematic information disclosure testing prevents these reconnaissance opportunities.