Recently, at the organization I work for, we've been using a static code inspection tool.
One of the more interesting findings is that private information, such as passwords, may be stored in the heap where it could potentially be intercepted by an application scanning the heap or perhaps a disk swap.
The app being scanned is a web app that runs on a private web server behind a firewall, so I'm wondering if this finding is relevant.
The app is written in C# and the "remediation" suggestion is to store sensitive information in character arrays rather than string objects so that they aren't stored in the heap. I realize it would take up some time to properly remediate this issue, so I wanted to ask if this finding is relevant when the code runs on a private server because presumably, a hypothetical attacker would have to bypass the firewall and run malicious code on the web server to steal data.