SEC015
Cleartext password storage
Object Pascal — Delphi & Free Pascal
Error
Security
Storing passwords without hashing is a critical vulnerability if the data store is compromised
storing passwords without hashing is a critical vulnerability if the data store is compromised.
Why this severity
storing passwords without hashing is a critical vulnerability if the data store is compromised.
Known false positives
test fixtures using obvious placeholder values.
Remediation example
HashedPwd := BCrypt.HashPassword(EditPassword.Text);
Query.ParamByName('pwd').AsString := HashedPwd;