CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
A developer stores an AWS secret key and database password in a GitHub public repository's configuration file. Which OWASP Top 10 (2021) category does this violation belong to?
- A.A05: Security Misconfiguration - default credentials (cloud keys, passwords) committed with sample settings and left unchanged
- B.A02: Cryptographic Failures - sensitive data (secrets, passwords) exposed through insecure storage and transmission
- C.A07: Identification and Authentication Failures - weak login (reused passwords, no MFA) allowed by the portal
- D.A09: Logging and Monitoring Failures - missing alerts (commit events, pushes) on repository changes
Why B is correct
A02 Cryptographic Failures (formerly 'Sensitive Data Exposure') covers cases where sensitive data is not protected adequately. Committing secrets to version control is a common and critical form of this - secrets are permanently in git history even after deletion. Mitigations: use environment variables, secret managers (AWS Secrets Manager, HashiCorp Vault), pre-commit hooks (git-secrets, truffleHog), and secret scanning in CI/CD.
Know someone studying for Web App Fundamentals? Send them this one.