Hello everyone. I am Yamini Yadav, a security engineer, an OSCP-certified professional, and a passionate bug bounty hunter.

Welcome to my new series, “Stories of Sensitive Data Exposure: What I Found as a Pentester and How You Can Prevent It.”

This series is about exploring how sensitive information slips out of systems, how attackers exploit it, and how developers and security teams can fix it. I will share real-world stories from my penetration testing and bug hunting journey. Each post will focus on one category of sensitive data exposure:

Insecure Direct Object References (IDOR)

Data Leakage

Unencrypted Data Storage

Missing Security Headers

Insecure File Handling

Every blog will begin with a story, then move into real examples, tool usage, root cause explanations, and finish with actionable lessons.

Today’s topic is data leakage, one of the most underestimated yet powerful exposures.

Imagine walking into an office pantry where a drawer full of confidential files is left wide open. The documents contain employee salaries…