SCP06 Cryptographic Practices
What this means
SiteShadow flagged cryptographic practices that are weak, outdated, or misused (deprecated algorithms, weak key sizes, missing authentication, homebrew crypto, weak randomness).
Why it matters
Weak cryptography enables data exposure and tampering.
- Confidentiality loss when encryption is breakable or misused.
- Tampering risk when encryption is not authenticated (missing integrity).
- Credential compromise when passwords/tokens are generated or stored insecurely.
Safer examples
1) Use modern authenticated encryption (AEAD)
Prefer AES-GCM or ChaCha20-Poly1305 via vetted libraries (see CWE-326).
2) Use CSPRNG for tokens and keys
import secrets
token = secrets.token_urlsafe(32)3) Don't roll your own crypto
Avoid custom ciphers/encodings; use standard libraries and managed key storage (see CWE-1240 / S01).
How SiteShadow detects it (high level)
- Detects use of known-weak algorithms/modes and insecure crypto options.
- Flags crypto code used for auth/tokens/passwords where randomness or key management appears weak.
References
- OWASP Secure Coding Practices: https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/
---