SessionStore.prototype.set = function(sid, sess, fn) {
  messageLogger.debug('SET ' + sid);

  // don't store passwords in DB
  if (sess.user && sess.user.password) {
    sess.user.password = "PASSWORD_HIDDEN";
  }

  db.set("sessionstorage:" + sid, sess);
  if (fn) {
    process.nextTick(fn);
  }
};
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.