Database Connection Without SSL/TLS
About A02:2021 — Cryptographic Failures
Cryptographic failures cover everything from hardcoded secrets in source code to using broken algorithms (MD5, SHA-1) to transmitting passwords in plaintext.
Impact: When this class ships, it's usually a data breach. Hardcoded API keys end up on GitHub and get scraped within minutes. Weak password hashing means a single database leak unlocks every user's password. Plaintext-over-HTTP endpoints get sniffed on public WiFi.
How to fix it: Never store secrets in source code — use environment variables and a secret manager. Use bcrypt/argon2 for password hashing, not MD5/SHA-1. Always use HTTPS in production. Use the platform's modern crypto APIs instead of rolling your own.
Common patterns in this category:
- Hardcoded API keys, tokens, or passwords committed to git
- MD5 or SHA-1 used for password hashing instead of bcrypt/argon2
- Sensitive data sent over HTTP instead of HTTPS
- Encryption keys stored alongside the encrypted data
- Custom crypto implementations instead of vetted libraries
Framework mapping
Findings from this rule map to the following framework controls. This is an informational mapping, not an audit, certification, or attestation.
See the full compliance coverage page for how every rule maps to OWASP Top 10 and CWE, and which rules also carry informational SOC 2 and ISO 27001 cross-references.
VC050 is part of the full 223-rule set on paid plans (from $19/mo)
The free, no-signup scan (paste code, upload a file, or npx xploitscan@latest scan .) runs 30 core rules.