A security scan was run on a couple of servers I manage. In the resulting reports, some mastercard "matches" were found in the following file:
I'd like to show that I am being proactive in terms of security but:
- I think it's pretty unlikely that any real mastercard details should be found in this file, considering my app does not save such information, nor even have it entered into a form
- I am very loathe to delete or even move/rename this file because of potential deleterious effects on the functioning of postgresql
So my question is, how should I satisfy the security staff that:
- the mastercard "matches" are false positives, or;
- I have taken appropriate action to mitigate any potential security breaches?