# Search Framework Security Audit > Audits PeopleSoft Search Framework security: deployed search definitions with no security, sensitive fields in the search index, search administrators, and the search callback user. --- Site [llms.txt](/llms.txt) ---

New to psLens? This page documents one specific report. To see how it runs in the product, what the output looks like, and how teams use it in practice, start with a live walkthrough.

Book a Demo Browse Reports

Tailored Operational Context

Target Database: —
Context Type: —
Alert Severity: —
Triggered Time: —
Firing Context: —
Contextual SQL:
```
—
```

## Search Framework Security Audit Report **Report ID:** `ptsf-security-audit` **Category:** Security ## Purpose This report audits the security of the PeopleSoft Search Framework from four tables: the search definitions (`PSPTSF_SD`), their deployments (`PTSF_DEPLOY_OBJ`), their indexed fields (`PSPTSF_SD_ATTR`), and the search instances (`PTSF_SRCH_ENGN`). A search index is a copy of application data that sits outside the PeopleSoft database. Row-level security does not follow the data there unless the search definition is set up to apply it, and the search engine holds a PeopleSoft sign-on of its own. ## Sections | Section | Finding | Severity | Reads | | --------- | -------------------------------------------------- | -------- | ------------------------------------------------- | | UNSECURED | Deployed search definition has no security | info | `PSPTSF_SD`, `PTSF_DEPLOY_OBJ`, `PSPTSF_SD_PNLGP` | | SENSITIVE | Sensitive field is indexed | warning | `PSPTSF_SD_ATTR`, `PSQRYFIELD`, `PSPTSF_SRCHATTR` | | ADMIN | User holds a search administration permission list | info | `PSROLECLASS`, `PSROLEUSER`, `PSOPRDEFN` | | CALLBACK | Search callback user holds an administrator role | warning | `PTSF_SRCH_ENGN`, `PSROLEUSER` | ### UNSECURED Lists every search definition that is deployed to a search instance and has neither document-level security (`PTSF_ISDOCACL`) nor source-level security (`PTSF_ISSRCACL`). The Search Framework does not filter the results of such a definition by user. Delivered definitions over public data are deployed this way on purpose: the PeopleTools 8.62 Campus Solutions demo database reports six, including the class search and course catalog definitions. The finding is raised to **warning** when the definition also indexes a sensitive field. When the definition is mapped to a component for keyword search, the component is shown. ### SENSITIVE Lists every indexed field whose field name is on the sensitive-field list. For a query-based definition the query field is resolved to its record field through `PSQRYFIELD`. For a record-based definition the field comes from `PSPTSF_SRCHATTR`. The finding says whether the field is faceted or displayed in results, and is **critical** when the definition is deployed with no security. The sensitive-field list is the `mcp.maskedFields` setting, the same list that masks values in MCP query results. The default is `NATIONAL_ID`, `BIRTHDATE`, `BANK_ACCOUNT_NUM`, `ACCOUNT_EC_ID`, `SSN`, `TAX_ID`, `CREDIT_CARD_NBR`, `CVV`, and `DRIVERS_LIC_NBR`. Fields are matched by exact name, and the report prints the list it used. ### ADMIN Lists the active users who hold `PTPT3100` (Search Administrator), `PTPT3300` (Search Server), or `PTPT5700` (Insights Administrator), with the role that grants it or a note that it is the user's primary permission list. Locked accounts are counted but not listed. ### CALLBACK The search engine signs in to PeopleSoft as the callback user of each search instance. The section lists every role each callback user holds, and reports a finding when one of them is `PeopleSoft Administrator` or `Security Administrator`. This section reads `PTSF_SRCH_ENGN`, which also stores the search engine, proxy, and callback passwords. psLens excludes those three columns from the request and never displays them. The table is optional: without it the section is skipped. ## Skipped Sections A section runs only when every table it reads was read in full. When a table is not whitelisted or its query fails, the section is marked **Skipped** in the summary with the table name and the reason. It is never reported as clean. ## Report Output - **Header** with the database, the generation timestamp, and the number of search definitions, deployed definitions, and search instances. - **Warning block** naming any table whose query failed. - **Summary table** with one row per section: `Clean`, the number found, or `Skipped` with the reason. - **One section per finding type**, with links to the search definition or user detail page. ## Parameters This report has no configurable parameters. The sensitive-field list comes from `mcp.maskedFields` in the configuration. ## Change Tracking The report is diffable. Findings are keyed by section and object, for example `UNSECURED|SSR_CLASS_SEARCH_LFF` or `ADMIN|VP1|PTPT3100`. A scheduled run with notify mode **On change** reports a newly deployed unsecured definition, a newly indexed sensitive field, or a user added to a search administration role. ## Related Reports - [Search Framework Integrity Audit](/docs/reports/objects/ptsf-integrity-audit/) finds search definitions that reference a missing query, Application Engine program, or application class. - [PeopleTools Access Audit](/docs/reports/security/peopletools-access/) lists users with Application Designer, Data Mover, and other PeopleTools access.