PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Identifying and Remediating CWE-312 Cleartext Storage of Sensitive Information in Laravel Applications

hackerone.com | incident | #code-review | #php | #secure-coding | #data-protection | #hackerone | #laravel | #cwe-312 | #cleartext-storage
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne walks through identifying and remediating CWE-312 cleartext storage of sensitive information in Laravel applications, using code review and debugging to locate unencrypted secrets.
Published
Collected

Related coverage

blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · borghq.io
Security Review for AI-Generated Code: What Changes Before Merge
More of every pull request is machine-drafted and the bug classes have not changed. What security review must catch in the diff before merge, and what it cannot.
blog · netspi.com
The Way Back Machine – Microsoft Word for Windows 1.1a
After Microsoft open-sourced Word for Windows 1.1a, a CheckMarx scan of the 1980s C++ codebase surfaced strcpy-style unsafe functions and 123 gotos—showing how far secure coding has come.
blog · netspi.com
Performing Code Reviews to PCI Requirements
A NetSPI post maps PCI requirements to the OWASP Top 10 for code reviews, noting gaps like track-data retention rules that OWASP does not cover, since no single PCI code-review checklist exists.
incident · hackerone.com
Data Privacy Regulations and Software Development: Navigating GDPR, CCPA, and Beyond
How GDPR and CCPA reshape software development: privacy by design, data minimization, encryption, DPIAs, and breach notification duties, with practical compliance guidance for developers.
incident · aikido.dev
Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer
233 versions across three Laravel-Lang repositories were compromised via malicious tags pointing to attacker fork commits, loading a PHP credential stealer through Composer's autoloader.
Back