A data breach does not wait, and neither should you. Code can expose more than you expect, especially when it handles non-human identities with sensitive columns attached. These identities—service accounts, API keys, automated agents—often hold high privileges. If their data is stored or logged without strict controls, the blast radius of a compromise can be enormous.
Non-human identities sensitive columns are fields linked to machine accounts that contain confidential information. These can include secrets, tokens, certificate data, connection strings, or configuration values tied to critical systems. They may live in user tables, audit logs, or custom schemas, often overlooked because they are not tied to a person. This makes them both easy to forget and a target for attackers.
The first step is identifying which columns are sensitive. Look at every table where a non-human identity is represented. Scan for anything that could give access beyond its scope. Common examples: api_secret, private_key, refresh_token, service_password. These should be encrypted at rest, masked in logs, and excluded from debug dumps.