Insecure Design

Applications that handle sensitive data may also require a data classification strategy that will break your data into broad categories, so you can concentrate on protecting the most sensitive data.

Public Data	Data available to everyone, like company blogs
Private Data	Data available to authenticated users
Restricted Data	Sensitive data that may be owned by particular users, like profile information
High Risk Data	Access tokens, passwords and credentials for third-party APIs that must never be shared

Denoting your data with different risk categories can help you think through how to secure the most sensitive data.