CWE-201 is a weakness class for information exposure through sent data: sensitive information is placed into an outbound message, request, log, or other transmitted content where it can be observed by the wrong party. The flaw is not usually about breaking encryption or gaining code execution; it is about data crossing a trust boundary when it should have been kept private.
In real attacks, CWE-201 can leak chat content, tokens, device details, identifiers, or internal metadata from clients and services. Even when access is “authorized,” a leak can still matter if the recipient should not see the data or if the data reaches a less-trusted network path. Defenders look for this weakness by reviewing serialization, API responses, telemetry, error handling, and log output, then redacting or suppressing sensitive fields before they are sent. In mobile and collaboration apps, strict data minimization and careful patching are especially important because a small disclosure can expose business-critical information.