Insecure Storage of Sensitive Information

Sensitive data, such as credentials, tokens, PII, and financial details, is stored at rest without adequate protection: unencrypted database columns, secrets committed to plaintext configuration files, unencrypted backups, or logs that capture more than they should. This is distinct from a leaked secret sitting in a publicly reachable file, which is its own detectable category. This one is about the storage design itself being inadequate, which stays invisible from outside even when the storage layer is never directly exposed to the internet.

A black-box HTTP scan only sees what the application chooses to return in a response - it has no visibility into the database schema, disk encryption configuration, backup handling, or log retention policy sitting behind the application layer, regardless of whether any of it is ever exposed externally.

Infrastructure and database configuration review, source-level review of what gets written to logs and backups, and checking encryption-at-rest settings against the sensitivity of what's stored.

Tip: These are usually found by someone deliberately reasoning about what data a given cache, log, include file, or response should and shouldn't contain, rather than through a technical exploitation technique — a manual data-flow review specifically for sensitive content is the most reliable discovery method.

Real-World Impact

Privacy and sensitive-data-handling flaws cover exposure that happens even when every conventional technical control (authentication, authorization, encryption) is working as designed — data ends up somewhere it shouldn't through a policy gap, an over-broad cache, an included file left in a public build, or a mismatch between what one part of the system assumes about data sensitivity and what another part actually does with it.

The severity depends entirely on what data is exposed and to whom, but the regulatory dimension is often the larger practical concern: unauthorized exposure of personal data can trigger GDPR, CCPA, or sector-specific (HIPAA, and similar) reporting and penalty obligations regardless of whether the exposure was ever actually exploited by a third party, since the obligation is typically triggered by the exposure itself.

These flaws are also disproportionately likely to be found by researchers rather than automated tooling, since they usually require understanding what data a given context should and shouldn't have access to — a judgment call a generic scanner has no basis for making.

Prevention and Secure Design

Preventing Insecure Storage of Sensitive Information takes a defense-in-depth approach — no single control below is sufficient alone, but together they close off both the primary path and the most common bypasses.

Classify data sensitivity explicitly, and enforce handling rules by classification. Treat "what's sensitive" as an explicit, documented decision propagated through caching, logging, and inclusion policies — not an assumption each component makes independently.

Apply data minimization. Don't retain, cache, log, or transmit sensitive data that isn't actually needed for the current operation — the cheapest way to reduce exposure risk is reducing what could be exposed at all.

Audit caches, includes, and build artifacts for sensitive content specifically. Files included at build time, cached responses, and log output are common places sensitive data ends up without anyone deciding it should be there.

Align policy across every component that touches the data. A privacy commitment made at the product or legal level has to be reflected consistently in every technical component that handles that data — a gap between the two is exactly where this class lives.

Have privacy/data-handling reviewed as its own discipline. This overlaps with but isn't identical to general security review — someone specifically thinking about data lifecycle and exposure paths catches issues a pure access-control review misses.