Cryptographic Failures
Sensitive data exposed through weak/missing crypto - cleartext transport, weak hashing, hardcoded keys, predictable tokens.
OWASP rank: 2
Practical checks
- Confirm TLS everywhere; no mixed content
- Look for sensitive data in responses/JS/localStorage
- Check for weak or missing password hashing
- Hunt hardcoded secrets in JS bundles