Related to information disclosure in the STRIDE model for performing threat-modeling analyses:
 STRIDE refers to the six threat categories that are examined when performing a security threat model against an application. STRIDE stands for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. More information on STRIDE and performing threat modeling can be found in the book Writing Secure Code, Second Edition (Microsoft Press 2003).
Is access to sensitive data secured?
Is sensitive information encrypted?
Are users of the data restricted to what they can access?
Do you offer security features in your application?