sensitive information such as passwords in any form. Avoid inconsistent messaging that
might accidentally tip off an attacker about internal state, such as whether a username is
valid or not.
In the context of OS Command Injection, error information passed back to the user