Storage of Sensitive Data in a Mechanism without Access Control

Property	Value
Language
Severity
CWE	CWE-921: Storage of Sensitive Data in a Mechanism without Access Control
Confidence Level	Medium
Impact Level	Low
Likelihood Level	Low

Description

Authorization headers are being added to HTTP requests without setting the 'sensitive' flag using 'set_sensitive(true)'. This means sensitive credentials like API keys or tokens may not be properly protected during logging or error handling.

Impact

If sensitive headers are not marked as such, their values could be accidentally exposed in logs, debugging output, or error messages. This can lead to credential leakage, allowing attackers to gain unauthorized access to protected resources or user accounts.