xploitscan-shared-rules 1.2.2 → 1.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/index.cjs +1583 -2
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +49 -1
- package/dist/index.d.ts +49 -1
- package/dist/index.js +1535 -2
- package/dist/index.js.map +1 -1
- package/package.json +2 -1
package/dist/index.d.cts
CHANGED
|
@@ -212,6 +212,54 @@ declare const hardcodedVercelToken: CustomRule;
|
|
|
212
212
|
declare const hardcodedSupabaseServiceRole: CustomRule;
|
|
213
213
|
declare const hardcodedVaultToken: CustomRule;
|
|
214
214
|
declare const hardcodedPineconeKey: CustomRule;
|
|
215
|
+
declare const hardcodedCohereKey: CustomRule;
|
|
216
|
+
declare const hardcodedReplicateKey: CustomRule;
|
|
217
|
+
declare const hardcodedMistralKey: CustomRule;
|
|
218
|
+
declare const hardcodedTogetherKey: CustomRule;
|
|
219
|
+
declare const hardcodedGroqKey: CustomRule;
|
|
220
|
+
declare const hardcodedFireworksKey: CustomRule;
|
|
221
|
+
declare const hardcodedPostmarkKey: CustomRule;
|
|
222
|
+
declare const hardcodedResendKey: CustomRule;
|
|
223
|
+
declare const hardcodedLoopsKey: CustomRule;
|
|
224
|
+
declare const hardcodedCloudflareToken: CustomRule;
|
|
225
|
+
declare const hardcodedFastlyToken: CustomRule;
|
|
226
|
+
declare const hardcodedNetlifyToken: CustomRule;
|
|
227
|
+
declare const hardcodedRailwayToken: CustomRule;
|
|
228
|
+
declare const hardcodedFlyToken: CustomRule;
|
|
229
|
+
declare const hardcodedAlgoliaAdminKey: CustomRule;
|
|
230
|
+
declare const hardcodedQdrantKey: CustomRule;
|
|
231
|
+
declare const hardcodedWeaviateKey: CustomRule;
|
|
232
|
+
declare const hardcodedLinearKey: CustomRule;
|
|
233
|
+
declare const hardcodedNotionKey: CustomRule;
|
|
234
|
+
declare const hardcodedDiscordToken: CustomRule;
|
|
235
|
+
declare const hardcodedIntercomToken: CustomRule;
|
|
236
|
+
declare const hardcodedSentryAuthToken: CustomRule;
|
|
237
|
+
declare const hardcodedLogtailToken: CustomRule;
|
|
238
|
+
declare const hardcodedHighlightKey: CustomRule;
|
|
239
|
+
declare const hardcodedPlivoToken: CustomRule;
|
|
240
|
+
declare const ghaPullRequestTargetCheckout: CustomRule;
|
|
241
|
+
declare const ghaPermissionsWriteAll: CustomRule;
|
|
242
|
+
declare const ghaExpressionInjection: CustomRule;
|
|
243
|
+
declare const ghaThirdPartyActionWithSecrets: CustomRule;
|
|
244
|
+
declare const dockerfileADDInsteadOfCOPY: CustomRule;
|
|
245
|
+
declare const dockerfileUnverifiedShellPipe: CustomRule;
|
|
246
|
+
declare const dockerfileMissingHealthcheck: CustomRule;
|
|
247
|
+
declare const pyRequestsVerifyFalse: CustomRule;
|
|
248
|
+
declare const pyJinja2AutoescapeOff: CustomRule;
|
|
249
|
+
declare const pyTempfileMktemp: CustomRule;
|
|
250
|
+
declare const pyDjangoMarkSafe: CustomRule;
|
|
251
|
+
declare const pyParamikoAutoAdd: CustomRule;
|
|
252
|
+
declare const pyDjangoAllowedHostsWildcard: CustomRule;
|
|
253
|
+
declare const pyJWTDecodeWeakConfig: CustomRule;
|
|
254
|
+
declare const llmPromptInjection: CustomRule;
|
|
255
|
+
declare const llmSystemPromptInjection: CustomRule;
|
|
256
|
+
declare const llmOutputAsHTML: CustomRule;
|
|
257
|
+
declare const vectorStoreQueryNoUserFilter: CustomRule;
|
|
258
|
+
declare const vectorStoreUpsertNoMetadata: CustomRule;
|
|
259
|
+
declare const llmCallNoMaxTokens: CustomRule;
|
|
260
|
+
declare const graphqlNoDepthLimit: CustomRule;
|
|
261
|
+
declare const graphqlNoComplexityLimit: CustomRule;
|
|
262
|
+
declare const graphqlCSRFDisabled: CustomRule;
|
|
215
263
|
declare const secretInURLParam: CustomRule;
|
|
216
264
|
declare const secretLoggedToConsole: CustomRule;
|
|
217
265
|
declare const secretInErrorResponse: CustomRule;
|
|
@@ -403,4 +451,4 @@ declare function getObjectProperty(node: ObjectExpression, key: string): {
|
|
|
403
451
|
/** Does this CallExpression spread an expression `matcher` returns true for? */
|
|
404
452
|
declare function callSpreads(call: CallExpression, matcher: (node: Node) => boolean): boolean;
|
|
405
453
|
|
|
406
|
-
export { type AIFilterResult, type Confidence, type CustomRule, type DetectedFramework, type FilteredFinding, type Finding, type GradeResult, type ParsedFile, type RuleMatch, type SecurityGrade, type Severity, type TaintMap, allCustomRules, allRules, androidDebuggable, blockingMainThread, buildTaintMap, calculateGrade, callSpreads, callbackHell, clickjacking, clientComponentSecret, clientSideAuth, commandInjection, complianceMap, consoleLogProduction, corsLocalhost, corsServerless, corsWildcard, dangerousInnerHTML, deprecatedTLS, detectFramework, disabledTLSVerification, djangoDebug, dockerCopySensitive, dockerLatestTag, dockerRunAsRoot, dockerTooManyPorts, ecbModeEncryption, electronNavigationUnrestricted, emptyCatchBlock, envNotGitignored, evalUsage, eventListenerLeak, exposedAdminRoutes, exposedAuthSecret, exposedDBCredentials, exposedDatabaseStudio, exposedDebugMode, exposedDockerPorts, exposedEnvFile, exposedGitDir, exposedServerActions, exposedSourceMaps, exposedStackTraces, filterFalsePositives, firebaseClientConfig, flaskSecretKey, freeRules, getObjectProperty, getSnippet, githubActionsInjection, graphqlIntrospection, hardcodedAnthropicKey, hardcodedDatadogKey, hardcodedEncryptionKey, hardcodedGCPServiceAccount, hardcodedGitHubPAT, hardcodedGitLabToken, hardcodedIPAllowlist, hardcodedJWTSecret, hardcodedMailgunKey, hardcodedOAuthSecret, hardcodedPineconeKey, hardcodedSecrets, hardcodedSendGridKey, hardcodedShopifyToken, hardcodedSlackToken, hardcodedSupabaseServiceRole, hardcodedTwilioKey, hardcodedVaultToken, hardcodedVercelToken, hostHeaderRedirect, httpRequestSmuggling, insecureCookies, insecureDeepLink, insecureDeserialization, insecureDirectObjectReference, insecureElectronWindow, insecureFileUpload, insecureGRPC, insecureHTTPMethods, insecurePasswordReset, insecureRandomness, insecureWebSocket, ipcPathTraversal, isCalleeNamed, isMethodCall, javaDeserialization, jwtAlgConfusion, k8sNoResourceLimits, k8sPrivileged, k8sSecretNotEncrypted, lambdaWithoutVPC, largeBundleImport, logInjection, magicNumbers, massAssignment, missingAIRateLimit, missingAuthMiddleware, missingAuthRateLimit, missingBruteForce, missingCSP, missingCSRF, missingCertPinning, missingCloudTrail, missingContentDisposition, missingDBEncryption, missingErrorBoundary, missingFileSizeLimits, missingHSTS, missingHTTPS, missingLockFile, missingOAuthState, missingPagination, missingRequestSizeLimit, missingRequestValidation, missingSRI, missingSecurityMeta, nPlusOneQuery, nextPublicSecret, noRateLimiting, nosqlInjection, openRedirectParams, overlyPermissiveIAM, parseFile, pathTraversal, pickleDeserialization, piiInLogs, prototypePollution, raceCondition, rdsPubliclyAccessible, reflectedCORSOrigin, regexDos, runCustomRules, s3BucketNoEncryption, scanEntropy, secretInBundleConfig, secretInCLIArgument, secretInErrorResponse, secretInHTMLAttribute, secretInURLParam, secretLoggedToConsole, secretsInCI, securityGroupAllInbound, sensitiveAsyncStorage, sensitiveLocalStorage, sensitiveURLParams, sessionFixation, sqlInjection, ssrfVulnerability, ssti, stripeWebhookUnprotected, supabaseAnonAdmin, supabaseNoRLS, syncFileOps, terraformStateExposed, timingAttack, todoLeftInCode, unencryptedPII, unpinnedGitHubAction, unprotectedAPIRoutes, unprotectedDownload, unsafeObjectAssign, unsanitizedFilenames, unsanitizedHTMLExport, unvalidatedAPIParams, unvalidatedEventData, unvalidatedRedirect, visitBinary, visitCalls, vulnerableDependencies, weakHashing, weakPasswordRequirements, weakRSAKeySize, webhookSignatureVerification, xssVulnerability, xxeVulnerability };
|
|
454
|
+
export { type AIFilterResult, type Confidence, type CustomRule, type DetectedFramework, type FilteredFinding, type Finding, type GradeResult, type ParsedFile, type RuleMatch, type SecurityGrade, type Severity, type TaintMap, allCustomRules, allRules, androidDebuggable, blockingMainThread, buildTaintMap, calculateGrade, callSpreads, callbackHell, clickjacking, clientComponentSecret, clientSideAuth, commandInjection, complianceMap, consoleLogProduction, corsLocalhost, corsServerless, corsWildcard, dangerousInnerHTML, deprecatedTLS, detectFramework, disabledTLSVerification, djangoDebug, dockerCopySensitive, dockerLatestTag, dockerRunAsRoot, dockerTooManyPorts, dockerfileADDInsteadOfCOPY, dockerfileMissingHealthcheck, dockerfileUnverifiedShellPipe, ecbModeEncryption, electronNavigationUnrestricted, emptyCatchBlock, envNotGitignored, evalUsage, eventListenerLeak, exposedAdminRoutes, exposedAuthSecret, exposedDBCredentials, exposedDatabaseStudio, exposedDebugMode, exposedDockerPorts, exposedEnvFile, exposedGitDir, exposedServerActions, exposedSourceMaps, exposedStackTraces, filterFalsePositives, firebaseClientConfig, flaskSecretKey, freeRules, getObjectProperty, getSnippet, ghaExpressionInjection, ghaPermissionsWriteAll, ghaPullRequestTargetCheckout, ghaThirdPartyActionWithSecrets, githubActionsInjection, graphqlCSRFDisabled, graphqlIntrospection, graphqlNoComplexityLimit, graphqlNoDepthLimit, hardcodedAlgoliaAdminKey, hardcodedAnthropicKey, hardcodedCloudflareToken, hardcodedCohereKey, hardcodedDatadogKey, hardcodedDiscordToken, hardcodedEncryptionKey, hardcodedFastlyToken, hardcodedFireworksKey, hardcodedFlyToken, hardcodedGCPServiceAccount, hardcodedGitHubPAT, hardcodedGitLabToken, hardcodedGroqKey, hardcodedHighlightKey, hardcodedIPAllowlist, hardcodedIntercomToken, hardcodedJWTSecret, hardcodedLinearKey, hardcodedLogtailToken, hardcodedLoopsKey, hardcodedMailgunKey, hardcodedMistralKey, hardcodedNetlifyToken, hardcodedNotionKey, hardcodedOAuthSecret, hardcodedPineconeKey, hardcodedPlivoToken, hardcodedPostmarkKey, hardcodedQdrantKey, hardcodedRailwayToken, hardcodedReplicateKey, hardcodedResendKey, hardcodedSecrets, hardcodedSendGridKey, hardcodedSentryAuthToken, hardcodedShopifyToken, hardcodedSlackToken, hardcodedSupabaseServiceRole, hardcodedTogetherKey, hardcodedTwilioKey, hardcodedVaultToken, hardcodedVercelToken, hardcodedWeaviateKey, hostHeaderRedirect, httpRequestSmuggling, insecureCookies, insecureDeepLink, insecureDeserialization, insecureDirectObjectReference, insecureElectronWindow, insecureFileUpload, insecureGRPC, insecureHTTPMethods, insecurePasswordReset, insecureRandomness, insecureWebSocket, ipcPathTraversal, isCalleeNamed, isMethodCall, javaDeserialization, jwtAlgConfusion, k8sNoResourceLimits, k8sPrivileged, k8sSecretNotEncrypted, lambdaWithoutVPC, largeBundleImport, llmCallNoMaxTokens, llmOutputAsHTML, llmPromptInjection, llmSystemPromptInjection, logInjection, magicNumbers, massAssignment, missingAIRateLimit, missingAuthMiddleware, missingAuthRateLimit, missingBruteForce, missingCSP, missingCSRF, missingCertPinning, missingCloudTrail, missingContentDisposition, missingDBEncryption, missingErrorBoundary, missingFileSizeLimits, missingHSTS, missingHTTPS, missingLockFile, missingOAuthState, missingPagination, missingRequestSizeLimit, missingRequestValidation, missingSRI, missingSecurityMeta, nPlusOneQuery, nextPublicSecret, noRateLimiting, nosqlInjection, openRedirectParams, overlyPermissiveIAM, parseFile, pathTraversal, pickleDeserialization, piiInLogs, prototypePollution, pyDjangoAllowedHostsWildcard, pyDjangoMarkSafe, pyJWTDecodeWeakConfig, pyJinja2AutoescapeOff, pyParamikoAutoAdd, pyRequestsVerifyFalse, pyTempfileMktemp, raceCondition, rdsPubliclyAccessible, reflectedCORSOrigin, regexDos, runCustomRules, s3BucketNoEncryption, scanEntropy, secretInBundleConfig, secretInCLIArgument, secretInErrorResponse, secretInHTMLAttribute, secretInURLParam, secretLoggedToConsole, secretsInCI, securityGroupAllInbound, sensitiveAsyncStorage, sensitiveLocalStorage, sensitiveURLParams, sessionFixation, sqlInjection, ssrfVulnerability, ssti, stripeWebhookUnprotected, supabaseAnonAdmin, supabaseNoRLS, syncFileOps, terraformStateExposed, timingAttack, todoLeftInCode, unencryptedPII, unpinnedGitHubAction, unprotectedAPIRoutes, unprotectedDownload, unsafeObjectAssign, unsanitizedFilenames, unsanitizedHTMLExport, unvalidatedAPIParams, unvalidatedEventData, unvalidatedRedirect, vectorStoreQueryNoUserFilter, vectorStoreUpsertNoMetadata, visitBinary, visitCalls, vulnerableDependencies, weakHashing, weakPasswordRequirements, weakRSAKeySize, webhookSignatureVerification, xssVulnerability, xxeVulnerability };
|
package/dist/index.d.ts
CHANGED
|
@@ -212,6 +212,54 @@ declare const hardcodedVercelToken: CustomRule;
|
|
|
212
212
|
declare const hardcodedSupabaseServiceRole: CustomRule;
|
|
213
213
|
declare const hardcodedVaultToken: CustomRule;
|
|
214
214
|
declare const hardcodedPineconeKey: CustomRule;
|
|
215
|
+
declare const hardcodedCohereKey: CustomRule;
|
|
216
|
+
declare const hardcodedReplicateKey: CustomRule;
|
|
217
|
+
declare const hardcodedMistralKey: CustomRule;
|
|
218
|
+
declare const hardcodedTogetherKey: CustomRule;
|
|
219
|
+
declare const hardcodedGroqKey: CustomRule;
|
|
220
|
+
declare const hardcodedFireworksKey: CustomRule;
|
|
221
|
+
declare const hardcodedPostmarkKey: CustomRule;
|
|
222
|
+
declare const hardcodedResendKey: CustomRule;
|
|
223
|
+
declare const hardcodedLoopsKey: CustomRule;
|
|
224
|
+
declare const hardcodedCloudflareToken: CustomRule;
|
|
225
|
+
declare const hardcodedFastlyToken: CustomRule;
|
|
226
|
+
declare const hardcodedNetlifyToken: CustomRule;
|
|
227
|
+
declare const hardcodedRailwayToken: CustomRule;
|
|
228
|
+
declare const hardcodedFlyToken: CustomRule;
|
|
229
|
+
declare const hardcodedAlgoliaAdminKey: CustomRule;
|
|
230
|
+
declare const hardcodedQdrantKey: CustomRule;
|
|
231
|
+
declare const hardcodedWeaviateKey: CustomRule;
|
|
232
|
+
declare const hardcodedLinearKey: CustomRule;
|
|
233
|
+
declare const hardcodedNotionKey: CustomRule;
|
|
234
|
+
declare const hardcodedDiscordToken: CustomRule;
|
|
235
|
+
declare const hardcodedIntercomToken: CustomRule;
|
|
236
|
+
declare const hardcodedSentryAuthToken: CustomRule;
|
|
237
|
+
declare const hardcodedLogtailToken: CustomRule;
|
|
238
|
+
declare const hardcodedHighlightKey: CustomRule;
|
|
239
|
+
declare const hardcodedPlivoToken: CustomRule;
|
|
240
|
+
declare const ghaPullRequestTargetCheckout: CustomRule;
|
|
241
|
+
declare const ghaPermissionsWriteAll: CustomRule;
|
|
242
|
+
declare const ghaExpressionInjection: CustomRule;
|
|
243
|
+
declare const ghaThirdPartyActionWithSecrets: CustomRule;
|
|
244
|
+
declare const dockerfileADDInsteadOfCOPY: CustomRule;
|
|
245
|
+
declare const dockerfileUnverifiedShellPipe: CustomRule;
|
|
246
|
+
declare const dockerfileMissingHealthcheck: CustomRule;
|
|
247
|
+
declare const pyRequestsVerifyFalse: CustomRule;
|
|
248
|
+
declare const pyJinja2AutoescapeOff: CustomRule;
|
|
249
|
+
declare const pyTempfileMktemp: CustomRule;
|
|
250
|
+
declare const pyDjangoMarkSafe: CustomRule;
|
|
251
|
+
declare const pyParamikoAutoAdd: CustomRule;
|
|
252
|
+
declare const pyDjangoAllowedHostsWildcard: CustomRule;
|
|
253
|
+
declare const pyJWTDecodeWeakConfig: CustomRule;
|
|
254
|
+
declare const llmPromptInjection: CustomRule;
|
|
255
|
+
declare const llmSystemPromptInjection: CustomRule;
|
|
256
|
+
declare const llmOutputAsHTML: CustomRule;
|
|
257
|
+
declare const vectorStoreQueryNoUserFilter: CustomRule;
|
|
258
|
+
declare const vectorStoreUpsertNoMetadata: CustomRule;
|
|
259
|
+
declare const llmCallNoMaxTokens: CustomRule;
|
|
260
|
+
declare const graphqlNoDepthLimit: CustomRule;
|
|
261
|
+
declare const graphqlNoComplexityLimit: CustomRule;
|
|
262
|
+
declare const graphqlCSRFDisabled: CustomRule;
|
|
215
263
|
declare const secretInURLParam: CustomRule;
|
|
216
264
|
declare const secretLoggedToConsole: CustomRule;
|
|
217
265
|
declare const secretInErrorResponse: CustomRule;
|
|
@@ -403,4 +451,4 @@ declare function getObjectProperty(node: ObjectExpression, key: string): {
|
|
|
403
451
|
/** Does this CallExpression spread an expression `matcher` returns true for? */
|
|
404
452
|
declare function callSpreads(call: CallExpression, matcher: (node: Node) => boolean): boolean;
|
|
405
453
|
|
|
406
|
-
export { type AIFilterResult, type Confidence, type CustomRule, type DetectedFramework, type FilteredFinding, type Finding, type GradeResult, type ParsedFile, type RuleMatch, type SecurityGrade, type Severity, type TaintMap, allCustomRules, allRules, androidDebuggable, blockingMainThread, buildTaintMap, calculateGrade, callSpreads, callbackHell, clickjacking, clientComponentSecret, clientSideAuth, commandInjection, complianceMap, consoleLogProduction, corsLocalhost, corsServerless, corsWildcard, dangerousInnerHTML, deprecatedTLS, detectFramework, disabledTLSVerification, djangoDebug, dockerCopySensitive, dockerLatestTag, dockerRunAsRoot, dockerTooManyPorts, ecbModeEncryption, electronNavigationUnrestricted, emptyCatchBlock, envNotGitignored, evalUsage, eventListenerLeak, exposedAdminRoutes, exposedAuthSecret, exposedDBCredentials, exposedDatabaseStudio, exposedDebugMode, exposedDockerPorts, exposedEnvFile, exposedGitDir, exposedServerActions, exposedSourceMaps, exposedStackTraces, filterFalsePositives, firebaseClientConfig, flaskSecretKey, freeRules, getObjectProperty, getSnippet, githubActionsInjection, graphqlIntrospection, hardcodedAnthropicKey, hardcodedDatadogKey, hardcodedEncryptionKey, hardcodedGCPServiceAccount, hardcodedGitHubPAT, hardcodedGitLabToken, hardcodedIPAllowlist, hardcodedJWTSecret, hardcodedMailgunKey, hardcodedOAuthSecret, hardcodedPineconeKey, hardcodedSecrets, hardcodedSendGridKey, hardcodedShopifyToken, hardcodedSlackToken, hardcodedSupabaseServiceRole, hardcodedTwilioKey, hardcodedVaultToken, hardcodedVercelToken, hostHeaderRedirect, httpRequestSmuggling, insecureCookies, insecureDeepLink, insecureDeserialization, insecureDirectObjectReference, insecureElectronWindow, insecureFileUpload, insecureGRPC, insecureHTTPMethods, insecurePasswordReset, insecureRandomness, insecureWebSocket, ipcPathTraversal, isCalleeNamed, isMethodCall, javaDeserialization, jwtAlgConfusion, k8sNoResourceLimits, k8sPrivileged, k8sSecretNotEncrypted, lambdaWithoutVPC, largeBundleImport, logInjection, magicNumbers, massAssignment, missingAIRateLimit, missingAuthMiddleware, missingAuthRateLimit, missingBruteForce, missingCSP, missingCSRF, missingCertPinning, missingCloudTrail, missingContentDisposition, missingDBEncryption, missingErrorBoundary, missingFileSizeLimits, missingHSTS, missingHTTPS, missingLockFile, missingOAuthState, missingPagination, missingRequestSizeLimit, missingRequestValidation, missingSRI, missingSecurityMeta, nPlusOneQuery, nextPublicSecret, noRateLimiting, nosqlInjection, openRedirectParams, overlyPermissiveIAM, parseFile, pathTraversal, pickleDeserialization, piiInLogs, prototypePollution, raceCondition, rdsPubliclyAccessible, reflectedCORSOrigin, regexDos, runCustomRules, s3BucketNoEncryption, scanEntropy, secretInBundleConfig, secretInCLIArgument, secretInErrorResponse, secretInHTMLAttribute, secretInURLParam, secretLoggedToConsole, secretsInCI, securityGroupAllInbound, sensitiveAsyncStorage, sensitiveLocalStorage, sensitiveURLParams, sessionFixation, sqlInjection, ssrfVulnerability, ssti, stripeWebhookUnprotected, supabaseAnonAdmin, supabaseNoRLS, syncFileOps, terraformStateExposed, timingAttack, todoLeftInCode, unencryptedPII, unpinnedGitHubAction, unprotectedAPIRoutes, unprotectedDownload, unsafeObjectAssign, unsanitizedFilenames, unsanitizedHTMLExport, unvalidatedAPIParams, unvalidatedEventData, unvalidatedRedirect, visitBinary, visitCalls, vulnerableDependencies, weakHashing, weakPasswordRequirements, weakRSAKeySize, webhookSignatureVerification, xssVulnerability, xxeVulnerability };
|
|
454
|
+
export { type AIFilterResult, type Confidence, type CustomRule, type DetectedFramework, type FilteredFinding, type Finding, type GradeResult, type ParsedFile, type RuleMatch, type SecurityGrade, type Severity, type TaintMap, allCustomRules, allRules, androidDebuggable, blockingMainThread, buildTaintMap, calculateGrade, callSpreads, callbackHell, clickjacking, clientComponentSecret, clientSideAuth, commandInjection, complianceMap, consoleLogProduction, corsLocalhost, corsServerless, corsWildcard, dangerousInnerHTML, deprecatedTLS, detectFramework, disabledTLSVerification, djangoDebug, dockerCopySensitive, dockerLatestTag, dockerRunAsRoot, dockerTooManyPorts, dockerfileADDInsteadOfCOPY, dockerfileMissingHealthcheck, dockerfileUnverifiedShellPipe, ecbModeEncryption, electronNavigationUnrestricted, emptyCatchBlock, envNotGitignored, evalUsage, eventListenerLeak, exposedAdminRoutes, exposedAuthSecret, exposedDBCredentials, exposedDatabaseStudio, exposedDebugMode, exposedDockerPorts, exposedEnvFile, exposedGitDir, exposedServerActions, exposedSourceMaps, exposedStackTraces, filterFalsePositives, firebaseClientConfig, flaskSecretKey, freeRules, getObjectProperty, getSnippet, ghaExpressionInjection, ghaPermissionsWriteAll, ghaPullRequestTargetCheckout, ghaThirdPartyActionWithSecrets, githubActionsInjection, graphqlCSRFDisabled, graphqlIntrospection, graphqlNoComplexityLimit, graphqlNoDepthLimit, hardcodedAlgoliaAdminKey, hardcodedAnthropicKey, hardcodedCloudflareToken, hardcodedCohereKey, hardcodedDatadogKey, hardcodedDiscordToken, hardcodedEncryptionKey, hardcodedFastlyToken, hardcodedFireworksKey, hardcodedFlyToken, hardcodedGCPServiceAccount, hardcodedGitHubPAT, hardcodedGitLabToken, hardcodedGroqKey, hardcodedHighlightKey, hardcodedIPAllowlist, hardcodedIntercomToken, hardcodedJWTSecret, hardcodedLinearKey, hardcodedLogtailToken, hardcodedLoopsKey, hardcodedMailgunKey, hardcodedMistralKey, hardcodedNetlifyToken, hardcodedNotionKey, hardcodedOAuthSecret, hardcodedPineconeKey, hardcodedPlivoToken, hardcodedPostmarkKey, hardcodedQdrantKey, hardcodedRailwayToken, hardcodedReplicateKey, hardcodedResendKey, hardcodedSecrets, hardcodedSendGridKey, hardcodedSentryAuthToken, hardcodedShopifyToken, hardcodedSlackToken, hardcodedSupabaseServiceRole, hardcodedTogetherKey, hardcodedTwilioKey, hardcodedVaultToken, hardcodedVercelToken, hardcodedWeaviateKey, hostHeaderRedirect, httpRequestSmuggling, insecureCookies, insecureDeepLink, insecureDeserialization, insecureDirectObjectReference, insecureElectronWindow, insecureFileUpload, insecureGRPC, insecureHTTPMethods, insecurePasswordReset, insecureRandomness, insecureWebSocket, ipcPathTraversal, isCalleeNamed, isMethodCall, javaDeserialization, jwtAlgConfusion, k8sNoResourceLimits, k8sPrivileged, k8sSecretNotEncrypted, lambdaWithoutVPC, largeBundleImport, llmCallNoMaxTokens, llmOutputAsHTML, llmPromptInjection, llmSystemPromptInjection, logInjection, magicNumbers, massAssignment, missingAIRateLimit, missingAuthMiddleware, missingAuthRateLimit, missingBruteForce, missingCSP, missingCSRF, missingCertPinning, missingCloudTrail, missingContentDisposition, missingDBEncryption, missingErrorBoundary, missingFileSizeLimits, missingHSTS, missingHTTPS, missingLockFile, missingOAuthState, missingPagination, missingRequestSizeLimit, missingRequestValidation, missingSRI, missingSecurityMeta, nPlusOneQuery, nextPublicSecret, noRateLimiting, nosqlInjection, openRedirectParams, overlyPermissiveIAM, parseFile, pathTraversal, pickleDeserialization, piiInLogs, prototypePollution, pyDjangoAllowedHostsWildcard, pyDjangoMarkSafe, pyJWTDecodeWeakConfig, pyJinja2AutoescapeOff, pyParamikoAutoAdd, pyRequestsVerifyFalse, pyTempfileMktemp, raceCondition, rdsPubliclyAccessible, reflectedCORSOrigin, regexDos, runCustomRules, s3BucketNoEncryption, scanEntropy, secretInBundleConfig, secretInCLIArgument, secretInErrorResponse, secretInHTMLAttribute, secretInURLParam, secretLoggedToConsole, secretsInCI, securityGroupAllInbound, sensitiveAsyncStorage, sensitiveLocalStorage, sensitiveURLParams, sessionFixation, sqlInjection, ssrfVulnerability, ssti, stripeWebhookUnprotected, supabaseAnonAdmin, supabaseNoRLS, syncFileOps, terraformStateExposed, timingAttack, todoLeftInCode, unencryptedPII, unpinnedGitHubAction, unprotectedAPIRoutes, unprotectedDownload, unsafeObjectAssign, unsanitizedFilenames, unsanitizedHTMLExport, unvalidatedAPIParams, unvalidatedEventData, unvalidatedRedirect, vectorStoreQueryNoUserFilter, vectorStoreUpsertNoMetadata, visitBinary, visitCalls, vulnerableDependencies, weakHashing, weakPasswordRequirements, weakRSAKeySize, webhookSignatureVerification, xssVulnerability, xxeVulnerability };
|