sc-data-exposure

SC: Sensitive Data Exposure

Purpose

Detects sensitive data exposure including PII in logs, stack traces in production responses, debug mode enabled in production, sensitive data in URLs, source maps deployed to production, exposed .git directories, backup files, and excessive data in API responses. Focuses on data leaving the application boundary unintentionally.

Activation

Called by sc-orchestrator during Phase 2. Always runs.

Phase 1: Discovery

Keyword Patterns to Search

# Debug/verbose modes
"DEBUG = True", "debug: true", "NODE_ENV.*development",
"FLASK_DEBUG", "APP_DEBUG", "RAILS_ENV.*development",
"stackTrace", "stack_trace", "printStackTrace"

# PII in logs
"logger.*email", "log.*password", "console.log.*token",
"logging.*credit", "log.*ssn", "print.*secret"

# Sensitive data in URLs
"?token=", "?api_key=", "?password=", "?secret=",
"?access_token=", "?session="

# Information disclosure
".git/", "phpinfo()", "server_info", "X-Powered-By",
".env", "wp-config.php", "web.config", "application.properties"

# Source maps
".map", "sourceMappingURL", "//# sourceMappingURL"

# Verbose error responses
"res.status(500).send(err)", "return error.message",
"traceback.format_exc()", "e.getMessage()"

Vulnerability Patterns

1. Stack Trace in Production:

// VULNERABLE: Raw error sent to client
app.use((err, req, res, next) => {
  res.status(500).json({ error: err.stack });
});

// SAFE: Generic error in production
app.use((err, req, res, next) => {
  console.error(err.stack);  // Log internally
  res.status(500).json({ error: 'Internal server error' });
});

2. PII in Logs:

# VULNERABLE: Logging sensitive data
logger.info(f"User login: email={email}, password={password}")
logger.debug(f"Payment: card={card_number}, cvv={cvv}")

# SAFE: Redact sensitive fields
logger.info(f"User login: email={mask_email(email)}")
logger.debug(f"Payment: card=****{card_number[-4:]}")

3. Debug Mode in Production:

# VULNERABLE: Django debug mode
# settings.py
DEBUG = True  # Exposes full stack traces, SQL queries, template context

# SAFE
DEBUG = os.environ.get('DEBUG', 'False') == 'True'