Cryptographic Failures and Sensitive Data Exposure

Cryptographic failures cover every way an application mishandles the protection of sensitive data, whether in transit across the network or at rest in a database. The category was renamed from Sensitive Data Exposure to emphasise the root cause: the exposure is usually the symptom, and weak or missing cryptography is the disease. When it goes wrong, passwords, tokens, and personal data leak.

Analogy🏏Cricket

🍳 Think of it like cooking: A recipe can look flawless on paper, but a head chef only truly judges the dish by tasting the finished plate, because heat, timing, and the actual oven reveal problems the written method never shows. Just as tasting the cooked result catches what reading the recipe cannot, DAST probes the running application and catches the misconfigurations and runtime behaviour that reading the source cannot. This reveals DAST's stance: it judges the dish as it is actually served, not the recipe as it was merely written.

Getting this right is less about inventing algorithms and more about applying well-vetted ones correctly. The common failures are predictable: transmitting data in plaintext, storing passwords with fast or reversible hashing, hard-coding keys, and using outdated algorithms. This lesson maps those failures to the small set of correct defaults that eliminate most of them.

Analogy🏏Cricket

💰 Think of it like finance: A real audit that actually attempts a sample transaction proves beyond doubt whether a control can be bypassed, with little room for a false alarm, but it can only test the accounts and processes the auditors actually reach. Just as a hands-on audit yields high-confidence, low-false-positive results yet is bounded by what it examines, DAST yields high-confidence findings about real exploitability yet is bounded by the surface it can reach. This reveals its trade-off: what it confirms is solid, but it only confirms what it manages to touch.