Leakage often emphasizes an unintended disclosure path or transfer, while exposure emphasizes an accessible state, such as publicly readable storage, an overly broad permission, or sensitive content in a response. Security practice does not use these labels consistently.
An exposure can exist without evidence that anyone acquired the data. Leakage can be accidental or caused by a product weakness, configuration error, unsafe workflow, or deliberate misuse; it is not limited to attacks over a network.
Key points
Common pathsExamples include misaddressed messages, public links, exposed storage, excessive permissions, verbose errors, logs containing secrets, unsafe exports, lost media, and uploads to unapproved services.
InvestigationEstablish what was accessible or transmitted, for how long, to whom, through which path, and what logs, copies, caches, or downstream disclosures may exist.
Recurrence preventionCorrect the access or data-flow condition, rotate exposed credentials, remove unnecessary copies, improve handling rules, and validate that monitoring covers the relevant path.
Important limitationPublic accessibility does not prove that an unauthorized party viewed or copied data, while missing or incomplete logs cannot prove that no access occurred. Describe confirmed facts and uncertainty separately.