title: Checkmarx reports Vulnerability - 'Unencrypted Web Config File' even when the code doesn't have any sensitive data
body: <p>My code contains a web.config file without any sections for connectionStrings or any other sensitive information.</p>
  <p>But Checkmarx SAST code scan reports &quot;Unencrypted Web Config File&quot; vulnerability.<br />
  &quot;<em><strong>The web.config file src/web.config does not encrypt the sensitive element found at line 1. This information can be plainly read by anyone with local file-system access.</strong></em>&quot;</p>
  <p>Here is my web.config for reference -</p>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
      &lt;configuration&gt;
          &lt;system.webServer&gt;
              &lt;rewrite&gt;
                  &lt;rules&gt;
                      &lt;rule name=&quot;Routes&quot; stopProcessing=&quot;true&quot;&gt;
                          &lt;match url=&quot;.*&quot; /&gt;
                          &lt;conditions logicalGrouping=&quot;MatchAll&quot;&gt;
                              &lt;add input=&quot;{URL}&quot; matchType=&quot;IsFile&quot; negate=&quot;true&quot; /&gt;
                              &lt;add input=&quot;{URL}&quot; matchType=&quot;IsDirectory&quot; negate=&quot;true&quot; /&gt;
                          &lt;/conditions&gt;
                          &lt;action type=&quot;Rewrite&quot; url=&quot;/&quot; /&gt;
                      &lt;/rule&gt;
                  &lt;/rules&gt;
              &lt;/rewrite&gt;
              &lt;httpProtocol&gt;
                  &lt;customHeaders&gt;
                      &lt;add name=&quot;X-Frame-Options&quot; value=&quot;SAMEORIGIN&quot; /&gt;
                      &lt;add name=&quot;Strict-Transport-Security&quot; value=&quot;max-age=31536000; includeSubDomains; preload&quot; /&gt;
                  &lt;/customHeaders&gt;
              &lt;/httpProtocol&gt;
              &lt;security&gt;
                  &lt;requestFiltering&gt;
                      &lt;verbs&gt;
                          &lt;add verb=&quot;OPTIONS&quot; allowed=&quot;false&quot; /&gt;
                      &lt;/verbs&gt;
                  &lt;/requestFiltering&gt;
              &lt;/security&gt;
          &lt;/system.webServer&gt;
          &lt;system.web&gt;
              &lt;httpCookies httpOnlyCookies=&quot;true&quot; /&gt;
          &lt;/system.web&gt;
      &lt;/configuration&gt;
  </code></pre>
  <p>Vulnerability is pointed out on line 1:<br />
  <code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;</code></p>
  <p>There is no sensitive sections that can be encrypted.</p>
  <p>What is the best way to mitigate such Checkmarx vulnerability report?</p>