COMMON WEAKNESS ENUMERATIONIncomplete

CWE-531

Inclusion of Sensitive Information in Test Code

Accessible test applications can pose a variety of security risks. Since developers or administrators rarely consider that someone besides themselves would even know about the existence of these applications, it is common for them to contain sensitive information or functions.

Abstraction

Variant

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

Accessible test applications can pose a variety of security risks. Since developers or administrators rarely consider that someone besides themselves would even know about the existence of these applications, it is common for them to contain sensitive information or functions.

Root cause

How and when does the problem arise?

Lifecycle phase

Testing

Risk

What does successful exploitation lead to?

Read Application Data

Affected security scopes: Confidentiality

Defence

How is it prevented and fixed?

Distribution · Installation

Defence to apply across several lifecycle phases

Detail
Remove test code before deploying the application into production.