CWE-540 is the weakness category for inclusion of sensitive information in source code. It covers secrets or trust-enabling details that are embedded directly in an application, such as API keys, credentials, internal endpoints, tokens, or logic that should stay private. Because shipped code can often be decompiled, copied, or inspected, anything placed in the client should be treated as recoverable.
This matters in cyber security because exposed information can become a shortcut around normal defenses. Attackers may reverse engineer an app to discover hidden services, reuse leaked identifiers, or call backend functions that were meant to be protected. Defenders reduce the risk by removing secrets from client code, enforcing authentication and authorization on every request server-side, rotating exposed credentials, and monitoring for unusual access patterns. CWE-540 is especially important in mobile and embedded products, where client code may sit close to high-value services or physical controls.