Sensitive information is any data that should not be exposed to unauthorized users, such as credentials, tokens, personal records, internal documents, keys, or configuration files. In security work, the term is broader than “secret” data: it includes anything that could help an attacker move deeper into a system, impersonate a user, or steal access.
It matters because many attacks are not aimed at full system takeover at first. Instead, an attacker may exploit a flaw to read a process memory space, open a file path, query an account, or access a shared folder and then harvest useful data. Defenders limit this risk with least privilege, access controls, encryption, file permissions, segmentation, and careful logging. When a vulnerability is said to expose sensitive information, the real question is what that component can actually reach in a given deployment.