char to_hex(char code) {
    static char hex[] = "0123456789abcdef";
    return hex[code & 15];
}

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.