In addition to secure code patterns, we also need to pay attention to the potential disclosure of sensitive information in our software releases. The identification of any PII helps us to investigate how the system is handling this sensitive data and see whether there is any violation of legislation, such as the General Data Protection Regulation (GDPR). Furthermore, the purpose of scanning for system-related sensitive information leakage is to review any system vulnerability exposure, such as that of a password or API key.
The following table shows details about scanning for sensitive information, PII, and the source code:
|
Area of white-box scanning |
Objective |
The primary scope of the scan |
|
Sensitive information scanning for system information |
To ensure no leaking of sensitive information, such as an API key, a password... |