---
name: validate-sensitive-disclosure
description: Evidence bar for disclosure of confidential data that is neither a secret nor broad personal data - records, source, configuration or internal operational data. Use when validating an information-disclosure finding of that kind.
---

# Validate sensitive disclosure

- Retrieve one complete representative value or record and establish the reachable population using counts or pagination metadata where available. A prefix, mask, empty rendering, attacker-supplied text, or mere endpoint reachability is insufficient.
- Establish why the data is confidential, whose data it is, which roles or tenants are affected, and whether access is read-only, mutable, enumerable, or bulk-accessible.
- For credentials, tokens, signing material, or API keys, follow the `validate-secret-exposure` skill. For broad personal-data exposure, follow the `validate-mass-pii-exposure` skill and do not bulk-download the population merely to prove scale.
- Redact the disclosed values in the report as the `write-finding-report` skill's Redaction section says. Keep the exact evidence linked to the finding, and collect no unrelated data.