CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
A developer stores an AWS secret key and database password in a GitHub public repository's configuration file. Which OWASP Top 10 (2021) category does this violation belong to?
- A.A01: Broken Access Control
- B.A02: Cryptographic Failures - sensitive data (secrets, passwords) exposed through insecure storage and transmission
- C.A05: Security Misconfiguration
- D.A06: Vulnerable and Outdated Components
Why B is correct
A02 Cryptographic Failures (formerly 'Sensitive Data Exposure') covers cases where sensitive data is not protected adequately. Committing secrets to version control is a common and critical form of this - secrets are permanently in git history even after deletion. Mitigations: use environment variables, secret managers (AWS Secrets Manager, HashiCorp Vault), pre-commit hooks (git-secrets, truffleHog), and secret scanning in CI/CD.
Know someone studying for Web App Fundamentals? Send them this one.