CWE-313 Cleartext Storage in a File or on Disk
What this means
SiteShadow flagged sensitive information being written to files on disk in plaintext (logs, exports, caches, temp files, backups).
Why it matters
Cleartext files are easy to copy and exfiltrate.
- Backups and artifacts spread: files get copied to S3, build artifacts, laptops, and tickets.
- Permissions drift: a file that "should be private" often ends up readable by more than intended.
- Incident scope grows because file copies persist.
Safer examples
1) Don't write secrets to disk
Keep secrets in a secret manager and inject at runtime; avoid dumping configs with secrets.
2) Use strict permissions and protected locations
Write to application-owned directories and set restrictive permissions.
3) Encrypt sensitive exports
If you must export sensitive data, encrypt the output and control key distribution.
How SiteShadow detects it (high level)
- Recognizes file-write APIs and flags when sensitive fields are written.
- Flags "export/report" flows that include credentials or personal data without protection.
References
- CWE-313: https://cwe.mitre.org/data/definitions/313.html
---