Medium severityRubySensitive Data ExposureMEDIUM confidence

Hardcoded PII Literal

A hard-coded value matching an SSN or credit-card number is present in source (CWE-312).

Standards mapping

CWE: CWE-312: Cleartext Storage of Sensitive Information CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
OWASP Top 10: A02:2021 - Cryptographic Failures
OWASP ASVS: V8.3.4 (L2)

Vulnerable vs. safe

Flagged by this check

test_ssn = "000-00-0000"

Passes - the safe pattern

zip_code = "94105"

Why it matters & how to fix it

A hard-coded value matching an SSN or credit-card number is present in source (CWE-312). Real personal data must never be embedded in code (likely test data leaking in); remove it and load fixtures from a secured, non-production data source.

References

https://cwe.mitre.org/data/definitions/312.html

Rule ID integsec-ruby-hardcoded-pii-literal - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks