Low severityMulti-languagePII / PHI ExposureMEDIUM confidence

IBAN

A value matching an International Bank Account Number (IBAN) appears in source.

Standards mapping

CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
OWASP Top 10: A02:2021 - Cryptographic Failures
OWASP ASVS: V8.3.4 (L2)

Vulnerable vs. safe

Flagged by this check

iban = "GB00EXAMPLE0000000000"

Passes - the safe pattern

iban = "redacted-account"

Why it matters & how to fix it

A value matching an International Bank Account Number (IBAN) appears in source. Triage (higher false-positive rate): if real financial PII, remove it and keep such data in an encrypted store.

References

Rule ID integsec.generic.pii-phi.iban - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks