CWE-540 (通过源代码导致的信息暴露) — Vulnerability Class 26

CWE-540 represents a critical information disclosure weakness where sensitive data, such as hardcoded credentials, API keys, or internal logic, is inadvertently embedded directly within source code files. This vulnerability is typically exploited by attackers who gain access to the application’s source repository or web-accessible directories, allowing them to extract confidential secrets without needing to reverse-engineer compiled binaries. Once obtained, this information facilitates further attacks, including unauthorized access, privilege escalation, or the identification of additional code vulnerabilities. To mitigate this risk, developers must strictly separate configuration data from application logic by utilizing secure environment variables or dedicated secret management services. Additionally, implementing robust access controls on version control systems and conducting regular code reviews to detect hardcoded secrets are essential practices for preventing accidental exposure of sensitive information.