[Security] Scraped URLs Stored Unencrypted in Database - Sensitive Data Exposed

[anshul23102]

Description

Scraped URLs (and their content) stored in plaintext database. No encryption. Database breach exposes all scraped websites and their content. User scraping activities visible to attackers.

Steps to Reproduce

1. User scrapes competitor website
2. Data stored in database
3. Database compromised
4. Attacker sees all scraped URLs and content

Environment Information

• Database: PostgreSQL/MySQL
• Encryption: None
• Storage: Plaintext
• Application version: Current main branch

Expected Behavior

Sensitive data encrypted at rest using AES-256. Database passwords and API keys encrypted separately.

Actual Behavior

File: src/models/ScrapedData.js
Stores URLs directly: await db.insert({ url, content })

Code Reference

File: src/models/ScrapedData.js
Missing: Field-level encryption for URLs and content

Additional Context

Implement encryption:

const encrypted = crypto.encrypt(url);
await db.insert({ encrypted_url: encrypted });

GSSoC Points Estimate: Level 2 (Security/Encryption)

Suggested Labels

• gssoc:approved
• type:bug
• severity:high
• area:security

[Xenon010101]

Hi, I am a GSSoC 2026 contributor and would like to work on this issue. This project matches my expertise. Please assign it to me.

/assign