So far we've listed different types of information, but not where we can expect to find anything. Here are a few places where a website or app can unintentionally expose sensitive information.
Data Leak Vectors
Config Files
Config management is an entire branch of operations that ensures configuration credentials are never exposed. Whether you're injecting them at runtime via a service such as consul (see Further reading for a link) or simply leaving them unversioned by including them in your project's .gitignore, there are varying degrees of sophistication in the available solutions.
But sometimes those measures fail and a config file is included in a server's root directory, logs on an exposed build server...