T09 · Insecure Skill Coding Practices
Error
- Location
data/health-reports/default/history.json:2- Finding
Named Longitudinal Medical Records Included in the Distributed Package
- Content
View full analysis
Vulnerability Details
File Location:
data/health-reports/default/history.json:2-51;data/health-reports/default/2025-04-27.json:2-113
Vulnerability Type: Plaintext sensitive health information disclosure
Risk Level: HighVulnerable Code Snippets
From
data/health-reports/default/history.json:json { "user_id": "default", "user_name": "\u7e41\u54e5", "reports": [ { "date": "2022-10-30", "file": "2022-10-30.json", "source": "\u4f53\u68c0\u62a5\u544a", "summary": { "bmi": 22.8, "ldl": 2.41, "key_findings": [ "\u7aa6\u6027\u5fc3\u52a8\u8fc7\u7f13", "\u7ea2\u7ec6\u80de\u538b\u79ef\u504f\u9ad8" ] } }, { "date": "2025-04-27", "file": "2025-04-27.json", "source": "\u4f53\u68c0\u62a5\u544a", "summary": { "bmi": 24.2, "ldl": 2.95, "key_findings": [ "\u8102\u86cb\u767d589\u2191", "C\u80bd\u504f\u4f4e", "\u7532\u72b6\u817a\u7ed3\u8282TI-RADS 3\u7ea7", "\u80ba\u7ed3\u8282" ] } } ] }From
data/health-reports/default/2025-04-27.json:json { "date": "2025-04-27", "user_id": "default", "user_name": "\u7e41\u54e5", "source": "\u4f53\u68c0\u62a5\u544a", "indicators": { "cardiovascular": { "lipoprotein_a": { "value": 589.0, "unit": "mg/L", "ref": "0-300", "status": "high" }, "blood_pressure": { "value": "112/67", "unit": "mmHg", "ref": "<120/80", "status": "normal" } }, "metabolic": { "c_peptide": { "value": 0.94, "unit": "ng/mL", "ref": "1.00-4.80", "status": "low" } } }, "imaging": { "thyroid": { "finding": "\u7532\u ...[truncated 2480 chars]- Remediation
View remediation
Remediation Suggestions
- Remove all real or potentially real health reports and names from the distributed package.
- Replace the records with clearly labeled synthetic fixtures containing invented values and identities.
- Purge the exposed files from version-control history, release archives, package registries, caches, and published artifacts where feasible.
- Notify the affected data subject and follow the applicable privacy-incident process if the records represent an actual person.
- Add automated checks for personal identifiers and health information to the release pipeline.
- Keep test fixtures in a dedicated directory and document that production health records must never be committed.
- Apply data-minimization and retention rules so only information necessary for testing is included.