Credential disclosure is the exposure or sharing of login secrets, such as usernames, passwords, API keys, or authentication tokens. It may be deliberate, accidental, or induced through deception. Once exposed, credentials can let an attacker impersonate a legitimate user and access accounts or systems.
In real attacks, phishing messages, fake recruiters, and interview tasks may persuade targets to enter credentials on a fraudulent page or share them directly. Defenders should verify requests through a separate trusted channel, avoid reusing passwords, enable multifactor authentication, and promptly revoke or rotate any exposed secrets. Limiting account privileges and monitoring for unusual sign-ins can reduce the damage if credentials are compromised.