CWE-922: Insecure Storage of Sensitive Information
A weakness where sensitive data is stored without sufficient protection against unauthorized access.
Why It Matters
Unlike a network-based weakness, this one is exploitable entirely offline once file-system access is obtained — through a rooted device, a backup extraction, or physical access to the device.
Application to Application Security
The CWE-level identifier underlying OWASP Mobile M9 (Insecure Data Storage) — plaintext SharedPreferences, unencrypted SQLite files, and world-readable external storage writes are all instances of this weakness.
Relation to Software Development
Storage APIs are chosen for simplicity during implementation, and an encryption pass is often treated as separable hardening work that competes with feature deadlines.
How Strata Surfaces This
Static analysis of storage API calls and their surrounding context (variable and key names) to distinguish sensitive data storage from benign preference values.
Developer guidance
Use platform-provided encrypted storage (Android Keystore-backed EncryptedSharedPreferences, iOS Keychain) for any credential, token, or PII — sandbox isolation alone is not sufficient protection.
Management guidance
Storage findings often cluster around the same feature area — worth checking whether a storage-handling pattern was copied across multiple features rather than treating each finding as isolated.