Medium severityC#Sensitive Data ExposureMEDIUM confidence

Hardcoded Credit Card Literal

A value that matches a real credit-card number (Visa/MC/Amex/Discover) is hard-coded in source (CWE-312).

Standards mapping

CWE: CWE-312: Cleartext Storage of Sensitive Information CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
OWASP Top 10: A02:2021 - Cryptographic Failures
OWASP ASVS: V8.3.4 (L2)

Vulnerable vs. safe

Flagged by this check

var cardNumber = "4111111111111111";

Passes - the safe pattern

var cardLast4 = "1111";

Why it matters & how to fix it

A value that matches a real credit-card number (Visa/MC/Amex/Discover) is hard-coded in source (CWE-312). Cardholder data in code violates PCI-DSS and leaks through source control. Remove it, use documented test-card numbers in tests only, and never persist PANs in cleartext.

References

Rule ID integsec.csharp.sensitive-data.hardcoded-credit-card-literal - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks