Config files : Unsafe password management

The application uses a password stored in plaintext or a bad hashed password in the configuration file. This can lead to the application data being compromised.

Developers often believe that the data stored in the configuration file is securely protected. This assumption simplifies the attacker’s job. Good password management guidelines require that a password never be stored in plaintext.