Plaintext credential / unhashed sensitive column

What it is

A column holds a credential or sensitive value in plaintext or in a reversible form — a password column that is not a hash, an unencrypted token, or a stored secret answer.

Why it matters

Anyone with read access to the table has the credentials, and so does anyone who obtains a backup. Because users reuse passwords, the impact of a plaintext password column reaches well beyond your application.

How to fix it

Hash passwords with bcrypt or argon2id and rehash on next login rather than forcing a reset. Encrypt tokens at rest with a key held outside the database, and drop the plaintext column once migration is complete.