A developer pushes an application to production. The application receives a webhook over HTTPS without a secret. The webhook information contains credentials to service in cleartext. When the information is received, it is stored in the database with an SHA-256 hash. Credentials to the database are accessed at runtime through the use of a vault service. While troubleshooting, the developer sets the logging to debug to view the message from the webhook. What is the security issue in this scenario?
- Database credentials should be accessed by using environment variables defined at runtime.
- During the transport of webhook messages, the credentials could be unencrypted and leaked.
- During logging, debugging should be disabled for the webhook message.
- Hashing the credentials in the database is not secure enough; the credentials should be encrypted.
Reveal Solution Next Question