T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/segment.py:298
- Finding
- Excessive Export of Sensitive Financial Customer Data## Vulnerability Details **File Location**: `scripts/segment.py`, lines 298-300 **Vulnerability Type**: Excessive sensitive-data replication and insecure output handling **Risk Level**: Medium ### Vulnerable Code ```python # Save results out_csv = os.path.join(output_dir, 'segmentation_results.csv') df.to_csv(out_csv, index=False, encoding='utf-8-sig') ``` ### Technical Analysis The script writes the entire working DataFrame to `segmentation_results.csv`. This DataFrame retains the original input columns and adds derived segmentation fields. Consequently, the exported file may contain customer identifiers, balances, transaction information, dates, demographic attributes, branch details, and any other columns present in the source CSV. This behavior exceeds the documented result-table scope, which only requires the customer identifier, cluster, and segmentation label. No column allowlist, data minimization, masking, explicit approval, retention policy, or output permission control is applied before the export. Because the output directory is controlled through a command-line argument, sensitive information can be copied into a shared, broadly readable, synchronized, or otherwise insufficiently protected location. ### Attack Path 1. A customer CSV containing personal and financial information is supplied to the segmentation script. 2. The script loads the complete CSV and retains its original columns in `df`. 3. Clustering and derived columns are added to the same DataFrame. 4. The operator selects, or is induced to select, a shared or weakly protected output directory. 5. The complete DataFrame is written to `segmentation_results.csv`. 6. A user or process with access to that directory obtains a duplicated copy of all customer records, rather than only the intended segmentation fields. ### Impact Assessment This issue does not grant additional operating-system privileges or code execution. Its impact is on c ...[truncated 347 chars]
- Remediation
- ## Remediation Suggestions Apply data minimization by exporting an explicit allowlist of required fields: ```python export_columns = [ 'customer_id', 'cluster', 'cluster_rank', 'segment_label', ] available_columns = [c for c in export_columns if c in df.columns] df[available_columns].to_csv( out_csv, index=False, encoding='utf-8-sig', ) ``` Additional hardening should include: - Require explicit user approval before exporting any original financial or demographic fields. - Mask or pseudonymize customer identifiers when direct identification is unnecessary. - Create output files with restrictive permissions appropriate to the operating system. - Reject or warn about output directories that are shared, world-readable, or outside an approved location. - Document retention and secure-deletion requirements for generated reports. - Log which fields were exported without logging their sensitive values. - Keep raw source data and reduced analytical outputs in separately controlled locations.