A field hidden by the interface is still readable by an export, an API call, or a technical account. Visibility rules and encryption solve different problems.
For sensitive financial values, the threat model should cover storage, transport, exports, logs, and operational access. A UI that masks a number while the database stores it in clear text has improved presentation, not confidentiality.
A migration also needs a compatibility plan: introduce the protected field, read from the new field first, fall back to the legacy value during transition, and remove the clear field only after verification.
Security decisions are architectural when the data is financial or personal. They should not depend on whether the current screen happens to display the value.
Top comments (0)