Sensitive Data Exposure
debt(d8/e6/b6/t6)
Closest to 'silent in production until users hit it' (d9), slightly better at d8 because semgrep and trufflehog can catch some patterns (hardcoded secrets, obvious password logging), but most exposure paths (verbose API responses, URL params, cache contents) remain invisible until a breach or audit.
Closest to 'cross-cutting refactor across the codebase' (e7), slightly better at e6 because the quick_fix explicitly says to audit logs, error messages, API responses, and DB columns — touching many files across multiple concerns (logging config, API serializers, schema, session handling).
Closest to 'persistent productivity tax' (b5), bumped to b6 because applies_to spans web/cli/queue-worker contexts and every new feature handling user data must re-evaluate exposure paths (logs, responses, storage, transit), shaping ongoing design decisions.
Closest to 'serious trap' (t7), slightly better at t6 because the misconception (encryption-at-rest is sufficient) is a widespread and dangerous wrong intuition — developers genuinely believe checking the encryption box solves exposure, missing logs/transit/backup/cache paths.
Also Known As
TL;DR
Explanation
Sensitive data exposure covers any case where confidential information is accessible beyond its intended audience — logged passwords, stack traces with database credentials in error pages, session tokens in URLs, unencrypted fields in a database, or API keys committed to source control. Mitigation requires classifying sensitive fields, scrubbing them from logs, using HTTPS everywhere, encrypting at rest, and auditing what appears in error output.
Common Misconception
Why It Matters
Common Mistakes
- Logging passwords, tokens, or full credit card numbers in application or access logs.
- Sending sensitive data in URL query strings which appear in server logs and browser history.
- Returning full user objects from APIs including hashed passwords, internal IDs, or admin flags.
- Storing unencrypted PII in session data or client-side cookies.
Code Examples
// Logging sensitive fields
$logger->info('Payment', ['card_number' => $card, 'cvv' => $cvv]);
// Returning full model in API response
return response()->json(User::find($id)); // includes password_hash, SSN...// PHP 8.2 — #[SensitiveParameter] redacts value in stack traces
function charge(#[\SensitiveParameter] string $cardNumber): void {}
// API resources — explicit allowlist
class UserResource extends JsonResource {
public function toArray($request): array {
return [
'id' => $this->id,
'name' => $this->name,
'email' => $this->email,
// password_hash, ssn never included
];
}
}
// Encrypt sensitive fields at rest
$ssn = Crypt::encryptString($rawSsn);
// php.ini production:
// display_errors = Off
// expose_php = Off