A04:2025 - Cryptographic Failures
Occurs when applications fail to adequately protect sensitive data such as financial records, credentials, or personal information. This includes weak encryption, missing encryption in transit, inadequate key management, and improper data storage.
Overview
Sensitive data exposure is a broad category covering failures to protect data throughout its lifecycle. This includes: transmitting data in cleartext, using weak encryption algorithms, improper key management, insufficient access controls on stored data, and failing to classify and identify sensitive data that requires protection.
Impact
Data breach, identity theft, financial fraud, regulatory penalties, and reputational damage.
Remediation
Encrypt all sensitive data at rest and in transit, use TLS 1.3, implement proper key management, classify data by sensitivity, minimize data retention, and disable caching for sensitive responses.
Classify data by sensitivity level and apply appropriate protections
Encrypt all sensitive data at rest (AES-256) and in transit (TLS 1.3)
Implement proper key management with rotation
Minimize data collection and retention
Disable caching for responses containing sensitive data
Use secure comparison functions to prevent timing attacks
Related SuperClue scanner checks
These scanner checks look for signs of A04:2025 - Cryptographic Failures. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works