xploitscan-shared-rules 1.2.2 → 1.4.0

package/dist/index.d.cts

@@ -51,6 +51,22 @@ interface CustomRule {
  */
 declare function getSnippet(content: string, line: number, contextLines?: number): string;
 
+/**
+ * Real-world consequence descriptions for VC### rules.
+ *
+ * Surfaced in the scan results UI ("Impact:" line) and in the AI summary
+ * email so users understand *why* a finding matters, not just what it is.
+ *
+ * Lives in shared-rules so the CLI, the web API, the standalone API, and any
+ * future surface read the same copy. Previously this map was duplicated
+ * inline inside both API entrypoints — the kind of place the
+ * `totalRules: 158` drift bug came from.
+ *
+ * Adding a rule? Add its impact string here so it shows up everywhere at
+ * once. If a rule has no entry, the UI falls back to the rule description.
+ */
+declare const RULE_IMPACTS: Record<string, string>;
+
 declare const hardcodedSecrets: CustomRule;
 declare const exposedEnvFile: CustomRule;
 declare const missingAuthMiddleware: CustomRule;
@@ -212,6 +228,54 @@ declare const hardcodedVercelToken: CustomRule;
 declare const hardcodedSupabaseServiceRole: CustomRule;
 declare const hardcodedVaultToken: CustomRule;
 declare const hardcodedPineconeKey: CustomRule;
+declare const hardcodedCohereKey: CustomRule;
+declare const hardcodedReplicateKey: CustomRule;
+declare const hardcodedMistralKey: CustomRule;
+declare const hardcodedTogetherKey: CustomRule;
+declare const hardcodedGroqKey: CustomRule;
+declare const hardcodedFireworksKey: CustomRule;
+declare const hardcodedPostmarkKey: CustomRule;
+declare const hardcodedResendKey: CustomRule;
+declare const hardcodedLoopsKey: CustomRule;
+declare const hardcodedCloudflareToken: CustomRule;
+declare const hardcodedFastlyToken: CustomRule;
+declare const hardcodedNetlifyToken: CustomRule;
+declare const hardcodedRailwayToken: CustomRule;
+declare const hardcodedFlyToken: CustomRule;
+declare const hardcodedAlgoliaAdminKey: CustomRule;
+declare const hardcodedQdrantKey: CustomRule;
+declare const hardcodedWeaviateKey: CustomRule;
+declare const hardcodedLinearKey: CustomRule;
+declare const hardcodedNotionKey: CustomRule;
+declare const hardcodedDiscordToken: CustomRule;
+declare const hardcodedIntercomToken: CustomRule;
+declare const hardcodedSentryAuthToken: CustomRule;
+declare const hardcodedLogtailToken: CustomRule;
+declare const hardcodedHighlightKey: CustomRule;
+declare const hardcodedPlivoToken: CustomRule;
+declare const ghaPullRequestTargetCheckout: CustomRule;
+declare const ghaPermissionsWriteAll: CustomRule;
+declare const ghaExpressionInjection: CustomRule;
+declare const ghaThirdPartyActionWithSecrets: CustomRule;
+declare const dockerfileADDInsteadOfCOPY: CustomRule;
+declare const dockerfileUnverifiedShellPipe: CustomRule;
+declare const dockerfileMissingHealthcheck: CustomRule;
+declare const pyRequestsVerifyFalse: CustomRule;
+declare const pyJinja2AutoescapeOff: CustomRule;
+declare const pyTempfileMktemp: CustomRule;
+declare const pyDjangoMarkSafe: CustomRule;
+declare const pyParamikoAutoAdd: CustomRule;
+declare const pyDjangoAllowedHostsWildcard: CustomRule;
+declare const pyJWTDecodeWeakConfig: CustomRule;
+declare const llmPromptInjection: CustomRule;
+declare const llmSystemPromptInjection: CustomRule;
+declare const llmOutputAsHTML: CustomRule;
+declare const vectorStoreQueryNoUserFilter: CustomRule;
+declare const vectorStoreUpsertNoMetadata: CustomRule;
+declare const llmCallNoMaxTokens: CustomRule;
+declare const graphqlNoDepthLimit: CustomRule;
+declare const graphqlNoComplexityLimit: CustomRule;
+declare const graphqlCSRFDisabled: CustomRule;
 declare const secretInURLParam: CustomRule;
 declare const secretLoggedToConsole: CustomRule;
 declare const secretInErrorResponse: CustomRule;
@@ -403,4 +467,4 @@ declare function getObjectProperty(node: ObjectExpression, key: string): {
 /** Does this CallExpression spread an expression `matcher` returns true for? */
 declare function callSpreads(call: CallExpression, matcher: (node: Node) => boolean): boolean;
 
-export { type AIFilterResult, type Confidence, type CustomRule, type DetectedFramework, type FilteredFinding, type Finding, type GradeResult, type ParsedFile, type RuleMatch, type SecurityGrade, type Severity, type TaintMap, allCustomRules, allRules, androidDebuggable, blockingMainThread, buildTaintMap, calculateGrade, callSpreads, callbackHell, clickjacking, clientComponentSecret, clientSideAuth, commandInjection, complianceMap, consoleLogProduction, corsLocalhost, corsServerless, corsWildcard, dangerousInnerHTML, deprecatedTLS, detectFramework, disabledTLSVerification, djangoDebug, dockerCopySensitive, dockerLatestTag, dockerRunAsRoot, dockerTooManyPorts, ecbModeEncryption, electronNavigationUnrestricted, emptyCatchBlock, envNotGitignored, evalUsage, eventListenerLeak, exposedAdminRoutes, exposedAuthSecret, exposedDBCredentials, exposedDatabaseStudio, exposedDebugMode, exposedDockerPorts, exposedEnvFile, exposedGitDir, exposedServerActions, exposedSourceMaps, exposedStackTraces, filterFalsePositives, firebaseClientConfig, flaskSecretKey, freeRules, getObjectProperty, getSnippet, githubActionsInjection, graphqlIntrospection, hardcodedAnthropicKey, hardcodedDatadogKey, hardcodedEncryptionKey, hardcodedGCPServiceAccount, hardcodedGitHubPAT, hardcodedGitLabToken, hardcodedIPAllowlist, hardcodedJWTSecret, hardcodedMailgunKey, hardcodedOAuthSecret, hardcodedPineconeKey, hardcodedSecrets, hardcodedSendGridKey, hardcodedShopifyToken, hardcodedSlackToken, hardcodedSupabaseServiceRole, hardcodedTwilioKey, hardcodedVaultToken, hardcodedVercelToken, hostHeaderRedirect, httpRequestSmuggling, insecureCookies, insecureDeepLink, insecureDeserialization, insecureDirectObjectReference, insecureElectronWindow, insecureFileUpload, insecureGRPC, insecureHTTPMethods, insecurePasswordReset, insecureRandomness, insecureWebSocket, ipcPathTraversal, isCalleeNamed, isMethodCall, javaDeserialization, jwtAlgConfusion, k8sNoResourceLimits, k8sPrivileged, k8sSecretNotEncrypted, lambdaWithoutVPC, largeBundleImport, logInjection, magicNumbers, massAssignment, missingAIRateLimit, missingAuthMiddleware, missingAuthRateLimit, missingBruteForce, missingCSP, missingCSRF, missingCertPinning, missingCloudTrail, missingContentDisposition, missingDBEncryption, missingErrorBoundary, missingFileSizeLimits, missingHSTS, missingHTTPS, missingLockFile, missingOAuthState, missingPagination, missingRequestSizeLimit, missingRequestValidation, missingSRI, missingSecurityMeta, nPlusOneQuery, nextPublicSecret, noRateLimiting, nosqlInjection, openRedirectParams, overlyPermissiveIAM, parseFile, pathTraversal, pickleDeserialization, piiInLogs, prototypePollution, raceCondition, rdsPubliclyAccessible, reflectedCORSOrigin, regexDos, runCustomRules, s3BucketNoEncryption, scanEntropy, secretInBundleConfig, secretInCLIArgument, secretInErrorResponse, secretInHTMLAttribute, secretInURLParam, secretLoggedToConsole, secretsInCI, securityGroupAllInbound, sensitiveAsyncStorage, sensitiveLocalStorage, sensitiveURLParams, sessionFixation, sqlInjection, ssrfVulnerability, ssti, stripeWebhookUnprotected, supabaseAnonAdmin, supabaseNoRLS, syncFileOps, terraformStateExposed, timingAttack, todoLeftInCode, unencryptedPII, unpinnedGitHubAction, unprotectedAPIRoutes, unprotectedDownload, unsafeObjectAssign, unsanitizedFilenames, unsanitizedHTMLExport, unvalidatedAPIParams, unvalidatedEventData, unvalidatedRedirect, visitBinary, visitCalls, vulnerableDependencies, weakHashing, weakPasswordRequirements, weakRSAKeySize, webhookSignatureVerification, xssVulnerability, xxeVulnerability };
+export { type AIFilterResult, type Confidence, type CustomRule, type DetectedFramework, type FilteredFinding, type Finding, type GradeResult, type ParsedFile, RULE_IMPACTS, type RuleMatch, type SecurityGrade, type Severity, type TaintMap, allCustomRules, allRules, androidDebuggable, blockingMainThread, buildTaintMap, calculateGrade, callSpreads, callbackHell, clickjacking, clientComponentSecret, clientSideAuth, commandInjection, complianceMap, consoleLogProduction, corsLocalhost, corsServerless, corsWildcard, dangerousInnerHTML, deprecatedTLS, detectFramework, disabledTLSVerification, djangoDebug, dockerCopySensitive, dockerLatestTag, dockerRunAsRoot, dockerTooManyPorts, dockerfileADDInsteadOfCOPY, dockerfileMissingHealthcheck, dockerfileUnverifiedShellPipe, ecbModeEncryption, electronNavigationUnrestricted, emptyCatchBlock, envNotGitignored, evalUsage, eventListenerLeak, exposedAdminRoutes, exposedAuthSecret, exposedDBCredentials, exposedDatabaseStudio, exposedDebugMode, exposedDockerPorts, exposedEnvFile, exposedGitDir, exposedServerActions, exposedSourceMaps, exposedStackTraces, filterFalsePositives, firebaseClientConfig, flaskSecretKey, freeRules, getObjectProperty, getSnippet, ghaExpressionInjection, ghaPermissionsWriteAll, ghaPullRequestTargetCheckout, ghaThirdPartyActionWithSecrets, githubActionsInjection, graphqlCSRFDisabled, graphqlIntrospection, graphqlNoComplexityLimit, graphqlNoDepthLimit, hardcodedAlgoliaAdminKey, hardcodedAnthropicKey, hardcodedCloudflareToken, hardcodedCohereKey, hardcodedDatadogKey, hardcodedDiscordToken, hardcodedEncryptionKey, hardcodedFastlyToken, hardcodedFireworksKey, hardcodedFlyToken, hardcodedGCPServiceAccount, hardcodedGitHubPAT, hardcodedGitLabToken, hardcodedGroqKey, hardcodedHighlightKey, hardcodedIPAllowlist, hardcodedIntercomToken, hardcodedJWTSecret, hardcodedLinearKey, hardcodedLogtailToken, hardcodedLoopsKey, hardcodedMailgunKey, hardcodedMistralKey, hardcodedNetlifyToken, hardcodedNotionKey, hardcodedOAuthSecret, hardcodedPineconeKey, hardcodedPlivoToken, hardcodedPostmarkKey, hardcodedQdrantKey, hardcodedRailwayToken, hardcodedReplicateKey, hardcodedResendKey, hardcodedSecrets, hardcodedSendGridKey, hardcodedSentryAuthToken, hardcodedShopifyToken, hardcodedSlackToken, hardcodedSupabaseServiceRole, hardcodedTogetherKey, hardcodedTwilioKey, hardcodedVaultToken, hardcodedVercelToken, hardcodedWeaviateKey, hostHeaderRedirect, httpRequestSmuggling, insecureCookies, insecureDeepLink, insecureDeserialization, insecureDirectObjectReference, insecureElectronWindow, insecureFileUpload, insecureGRPC, insecureHTTPMethods, insecurePasswordReset, insecureRandomness, insecureWebSocket, ipcPathTraversal, isCalleeNamed, isMethodCall, javaDeserialization, jwtAlgConfusion, k8sNoResourceLimits, k8sPrivileged, k8sSecretNotEncrypted, lambdaWithoutVPC, largeBundleImport, llmCallNoMaxTokens, llmOutputAsHTML, llmPromptInjection, llmSystemPromptInjection, logInjection, magicNumbers, massAssignment, missingAIRateLimit, missingAuthMiddleware, missingAuthRateLimit, missingBruteForce, missingCSP, missingCSRF, missingCertPinning, missingCloudTrail, missingContentDisposition, missingDBEncryption, missingErrorBoundary, missingFileSizeLimits, missingHSTS, missingHTTPS, missingLockFile, missingOAuthState, missingPagination, missingRequestSizeLimit, missingRequestValidation, missingSRI, missingSecurityMeta, nPlusOneQuery, nextPublicSecret, noRateLimiting, nosqlInjection, openRedirectParams, overlyPermissiveIAM, parseFile, pathTraversal, pickleDeserialization, piiInLogs, prototypePollution, pyDjangoAllowedHostsWildcard, pyDjangoMarkSafe, pyJWTDecodeWeakConfig, pyJinja2AutoescapeOff, pyParamikoAutoAdd, pyRequestsVerifyFalse, pyTempfileMktemp, raceCondition, rdsPubliclyAccessible, reflectedCORSOrigin, regexDos, runCustomRules, s3BucketNoEncryption, scanEntropy, secretInBundleConfig, secretInCLIArgument, secretInErrorResponse, secretInHTMLAttribute, secretInURLParam, secretLoggedToConsole, secretsInCI, securityGroupAllInbound, sensitiveAsyncStorage, sensitiveLocalStorage, sensitiveURLParams, sessionFixation, sqlInjection, ssrfVulnerability, ssti, stripeWebhookUnprotected, supabaseAnonAdmin, supabaseNoRLS, syncFileOps, terraformStateExposed, timingAttack, todoLeftInCode, unencryptedPII, unpinnedGitHubAction, unprotectedAPIRoutes, unprotectedDownload, unsafeObjectAssign, unsanitizedFilenames, unsanitizedHTMLExport, unvalidatedAPIParams, unvalidatedEventData, unvalidatedRedirect, vectorStoreQueryNoUserFilter, vectorStoreUpsertNoMetadata, visitBinary, visitCalls, vulnerableDependencies, weakHashing, weakPasswordRequirements, weakRSAKeySize, webhookSignatureVerification, xssVulnerability, xxeVulnerability };

package/dist/index.d.ts

@@ -51,6 +51,22 @@ interface CustomRule {
  */
 declare function getSnippet(content: string, line: number, contextLines?: number): string;
 
+/**
+ * Real-world consequence descriptions for VC### rules.
+ *
+ * Surfaced in the scan results UI ("Impact:" line) and in the AI summary
+ * email so users understand *why* a finding matters, not just what it is.
+ *
+ * Lives in shared-rules so the CLI, the web API, the standalone API, and any
+ * future surface read the same copy. Previously this map was duplicated
+ * inline inside both API entrypoints — the kind of place the
+ * `totalRules: 158` drift bug came from.
+ *
+ * Adding a rule? Add its impact string here so it shows up everywhere at
+ * once. If a rule has no entry, the UI falls back to the rule description.
+ */
+declare const RULE_IMPACTS: Record<string, string>;
+
 declare const hardcodedSecrets: CustomRule;
 declare const exposedEnvFile: CustomRule;
 declare const missingAuthMiddleware: CustomRule;
@@ -212,6 +228,54 @@ declare const hardcodedVercelToken: CustomRule;
 declare const hardcodedSupabaseServiceRole: CustomRule;
 declare const hardcodedVaultToken: CustomRule;
 declare const hardcodedPineconeKey: CustomRule;
+declare const hardcodedCohereKey: CustomRule;
+declare const hardcodedReplicateKey: CustomRule;
+declare const hardcodedMistralKey: CustomRule;
+declare const hardcodedTogetherKey: CustomRule;
+declare const hardcodedGroqKey: CustomRule;
+declare const hardcodedFireworksKey: CustomRule;
+declare const hardcodedPostmarkKey: CustomRule;
+declare const hardcodedResendKey: CustomRule;
+declare const hardcodedLoopsKey: CustomRule;
+declare const hardcodedCloudflareToken: CustomRule;
+declare const hardcodedFastlyToken: CustomRule;
+declare const hardcodedNetlifyToken: CustomRule;
+declare const hardcodedRailwayToken: CustomRule;
+declare const hardcodedFlyToken: CustomRule;
+declare const hardcodedAlgoliaAdminKey: CustomRule;
+declare const hardcodedQdrantKey: CustomRule;
+declare const hardcodedWeaviateKey: CustomRule;
+declare const hardcodedLinearKey: CustomRule;
+declare const hardcodedNotionKey: CustomRule;
+declare const hardcodedDiscordToken: CustomRule;
+declare const hardcodedIntercomToken: CustomRule;
+declare const hardcodedSentryAuthToken: CustomRule;
+declare const hardcodedLogtailToken: CustomRule;
+declare const hardcodedHighlightKey: CustomRule;
+declare const hardcodedPlivoToken: CustomRule;
+declare const ghaPullRequestTargetCheckout: CustomRule;
+declare const ghaPermissionsWriteAll: CustomRule;
+declare const ghaExpressionInjection: CustomRule;
+declare const ghaThirdPartyActionWithSecrets: CustomRule;
+declare const dockerfileADDInsteadOfCOPY: CustomRule;
+declare const dockerfileUnverifiedShellPipe: CustomRule;
+declare const dockerfileMissingHealthcheck: CustomRule;
+declare const pyRequestsVerifyFalse: CustomRule;
+declare const pyJinja2AutoescapeOff: CustomRule;
+declare const pyTempfileMktemp: CustomRule;
+declare const pyDjangoMarkSafe: CustomRule;
+declare const pyParamikoAutoAdd: CustomRule;
+declare const pyDjangoAllowedHostsWildcard: CustomRule;
+declare const pyJWTDecodeWeakConfig: CustomRule;
+declare const llmPromptInjection: CustomRule;
+declare const llmSystemPromptInjection: CustomRule;
+declare const llmOutputAsHTML: CustomRule;
+declare const vectorStoreQueryNoUserFilter: CustomRule;
+declare const vectorStoreUpsertNoMetadata: CustomRule;
+declare const llmCallNoMaxTokens: CustomRule;
+declare const graphqlNoDepthLimit: CustomRule;
+declare const graphqlNoComplexityLimit: CustomRule;
+declare const graphqlCSRFDisabled: CustomRule;
 declare const secretInURLParam: CustomRule;
 declare const secretLoggedToConsole: CustomRule;
 declare const secretInErrorResponse: CustomRule;
@@ -403,4 +467,4 @@ declare function getObjectProperty(node: ObjectExpression, key: string): {
 /** Does this CallExpression spread an expression `matcher` returns true for? */
 declare function callSpreads(call: CallExpression, matcher: (node: Node) => boolean): boolean;
 
-export { type AIFilterResult, type Confidence, type CustomRule, type DetectedFramework, type FilteredFinding, type Finding, type GradeResult, type ParsedFile, type RuleMatch, type SecurityGrade, type Severity, type TaintMap, allCustomRules, allRules, androidDebuggable, blockingMainThread, buildTaintMap, calculateGrade, callSpreads, callbackHell, clickjacking, clientComponentSecret, clientSideAuth, commandInjection, complianceMap, consoleLogProduction, corsLocalhost, corsServerless, corsWildcard, dangerousInnerHTML, deprecatedTLS, detectFramework, disabledTLSVerification, djangoDebug, dockerCopySensitive, dockerLatestTag, dockerRunAsRoot, dockerTooManyPorts, ecbModeEncryption, electronNavigationUnrestricted, emptyCatchBlock, envNotGitignored, evalUsage, eventListenerLeak, exposedAdminRoutes, exposedAuthSecret, exposedDBCredentials, exposedDatabaseStudio, exposedDebugMode, exposedDockerPorts, exposedEnvFile, exposedGitDir, exposedServerActions, exposedSourceMaps, exposedStackTraces, filterFalsePositives, firebaseClientConfig, flaskSecretKey, freeRules, getObjectProperty, getSnippet, githubActionsInjection, graphqlIntrospection, hardcodedAnthropicKey, hardcodedDatadogKey, hardcodedEncryptionKey, hardcodedGCPServiceAccount, hardcodedGitHubPAT, hardcodedGitLabToken, hardcodedIPAllowlist, hardcodedJWTSecret, hardcodedMailgunKey, hardcodedOAuthSecret, hardcodedPineconeKey, hardcodedSecrets, hardcodedSendGridKey, hardcodedShopifyToken, hardcodedSlackToken, hardcodedSupabaseServiceRole, hardcodedTwilioKey, hardcodedVaultToken, hardcodedVercelToken, hostHeaderRedirect, httpRequestSmuggling, insecureCookies, insecureDeepLink, insecureDeserialization, insecureDirectObjectReference, insecureElectronWindow, insecureFileUpload, insecureGRPC, insecureHTTPMethods, insecurePasswordReset, insecureRandomness, insecureWebSocket, ipcPathTraversal, isCalleeNamed, isMethodCall, javaDeserialization, jwtAlgConfusion, k8sNoResourceLimits, k8sPrivileged, k8sSecretNotEncrypted, lambdaWithoutVPC, largeBundleImport, logInjection, magicNumbers, massAssignment, missingAIRateLimit, missingAuthMiddleware, missingAuthRateLimit, missingBruteForce, missingCSP, missingCSRF, missingCertPinning, missingCloudTrail, missingContentDisposition, missingDBEncryption, missingErrorBoundary, missingFileSizeLimits, missingHSTS, missingHTTPS, missingLockFile, missingOAuthState, missingPagination, missingRequestSizeLimit, missingRequestValidation, missingSRI, missingSecurityMeta, nPlusOneQuery, nextPublicSecret, noRateLimiting, nosqlInjection, openRedirectParams, overlyPermissiveIAM, parseFile, pathTraversal, pickleDeserialization, piiInLogs, prototypePollution, raceCondition, rdsPubliclyAccessible, reflectedCORSOrigin, regexDos, runCustomRules, s3BucketNoEncryption, scanEntropy, secretInBundleConfig, secretInCLIArgument, secretInErrorResponse, secretInHTMLAttribute, secretInURLParam, secretLoggedToConsole, secretsInCI, securityGroupAllInbound, sensitiveAsyncStorage, sensitiveLocalStorage, sensitiveURLParams, sessionFixation, sqlInjection, ssrfVulnerability, ssti, stripeWebhookUnprotected, supabaseAnonAdmin, supabaseNoRLS, syncFileOps, terraformStateExposed, timingAttack, todoLeftInCode, unencryptedPII, unpinnedGitHubAction, unprotectedAPIRoutes, unprotectedDownload, unsafeObjectAssign, unsanitizedFilenames, unsanitizedHTMLExport, unvalidatedAPIParams, unvalidatedEventData, unvalidatedRedirect, visitBinary, visitCalls, vulnerableDependencies, weakHashing, weakPasswordRequirements, weakRSAKeySize, webhookSignatureVerification, xssVulnerability, xxeVulnerability };
+export { type AIFilterResult, type Confidence, type CustomRule, type DetectedFramework, type FilteredFinding, type Finding, type GradeResult, type ParsedFile, RULE_IMPACTS, type RuleMatch, type SecurityGrade, type Severity, type TaintMap, allCustomRules, allRules, androidDebuggable, blockingMainThread, buildTaintMap, calculateGrade, callSpreads, callbackHell, clickjacking, clientComponentSecret, clientSideAuth, commandInjection, complianceMap, consoleLogProduction, corsLocalhost, corsServerless, corsWildcard, dangerousInnerHTML, deprecatedTLS, detectFramework, disabledTLSVerification, djangoDebug, dockerCopySensitive, dockerLatestTag, dockerRunAsRoot, dockerTooManyPorts, dockerfileADDInsteadOfCOPY, dockerfileMissingHealthcheck, dockerfileUnverifiedShellPipe, ecbModeEncryption, electronNavigationUnrestricted, emptyCatchBlock, envNotGitignored, evalUsage, eventListenerLeak, exposedAdminRoutes, exposedAuthSecret, exposedDBCredentials, exposedDatabaseStudio, exposedDebugMode, exposedDockerPorts, exposedEnvFile, exposedGitDir, exposedServerActions, exposedSourceMaps, exposedStackTraces, filterFalsePositives, firebaseClientConfig, flaskSecretKey, freeRules, getObjectProperty, getSnippet, ghaExpressionInjection, ghaPermissionsWriteAll, ghaPullRequestTargetCheckout, ghaThirdPartyActionWithSecrets, githubActionsInjection, graphqlCSRFDisabled, graphqlIntrospection, graphqlNoComplexityLimit, graphqlNoDepthLimit, hardcodedAlgoliaAdminKey, hardcodedAnthropicKey, hardcodedCloudflareToken, hardcodedCohereKey, hardcodedDatadogKey, hardcodedDiscordToken, hardcodedEncryptionKey, hardcodedFastlyToken, hardcodedFireworksKey, hardcodedFlyToken, hardcodedGCPServiceAccount, hardcodedGitHubPAT, hardcodedGitLabToken, hardcodedGroqKey, hardcodedHighlightKey, hardcodedIPAllowlist, hardcodedIntercomToken, hardcodedJWTSecret, hardcodedLinearKey, hardcodedLogtailToken, hardcodedLoopsKey, hardcodedMailgunKey, hardcodedMistralKey, hardcodedNetlifyToken, hardcodedNotionKey, hardcodedOAuthSecret, hardcodedPineconeKey, hardcodedPlivoToken, hardcodedPostmarkKey, hardcodedQdrantKey, hardcodedRailwayToken, hardcodedReplicateKey, hardcodedResendKey, hardcodedSecrets, hardcodedSendGridKey, hardcodedSentryAuthToken, hardcodedShopifyToken, hardcodedSlackToken, hardcodedSupabaseServiceRole, hardcodedTogetherKey, hardcodedTwilioKey, hardcodedVaultToken, hardcodedVercelToken, hardcodedWeaviateKey, hostHeaderRedirect, httpRequestSmuggling, insecureCookies, insecureDeepLink, insecureDeserialization, insecureDirectObjectReference, insecureElectronWindow, insecureFileUpload, insecureGRPC, insecureHTTPMethods, insecurePasswordReset, insecureRandomness, insecureWebSocket, ipcPathTraversal, isCalleeNamed, isMethodCall, javaDeserialization, jwtAlgConfusion, k8sNoResourceLimits, k8sPrivileged, k8sSecretNotEncrypted, lambdaWithoutVPC, largeBundleImport, llmCallNoMaxTokens, llmOutputAsHTML, llmPromptInjection, llmSystemPromptInjection, logInjection, magicNumbers, massAssignment, missingAIRateLimit, missingAuthMiddleware, missingAuthRateLimit, missingBruteForce, missingCSP, missingCSRF, missingCertPinning, missingCloudTrail, missingContentDisposition, missingDBEncryption, missingErrorBoundary, missingFileSizeLimits, missingHSTS, missingHTTPS, missingLockFile, missingOAuthState, missingPagination, missingRequestSizeLimit, missingRequestValidation, missingSRI, missingSecurityMeta, nPlusOneQuery, nextPublicSecret, noRateLimiting, nosqlInjection, openRedirectParams, overlyPermissiveIAM, parseFile, pathTraversal, pickleDeserialization, piiInLogs, prototypePollution, pyDjangoAllowedHostsWildcard, pyDjangoMarkSafe, pyJWTDecodeWeakConfig, pyJinja2AutoescapeOff, pyParamikoAutoAdd, pyRequestsVerifyFalse, pyTempfileMktemp, raceCondition, rdsPubliclyAccessible, reflectedCORSOrigin, regexDos, runCustomRules, s3BucketNoEncryption, scanEntropy, secretInBundleConfig, secretInCLIArgument, secretInErrorResponse, secretInHTMLAttribute, secretInURLParam, secretLoggedToConsole, secretsInCI, securityGroupAllInbound, sensitiveAsyncStorage, sensitiveLocalStorage, sensitiveURLParams, sessionFixation, sqlInjection, ssrfVulnerability, ssti, stripeWebhookUnprotected, supabaseAnonAdmin, supabaseNoRLS, syncFileOps, terraformStateExposed, timingAttack, todoLeftInCode, unencryptedPII, unpinnedGitHubAction, unprotectedAPIRoutes, unprotectedDownload, unsafeObjectAssign, unsanitizedFilenames, unsanitizedHTMLExport, unvalidatedAPIParams, unvalidatedEventData, unvalidatedRedirect, vectorStoreQueryNoUserFilter, vectorStoreUpsertNoMetadata, visitBinary, visitCalls, vulnerableDependencies, weakHashing, weakPasswordRequirements, weakRSAKeySize, webhookSignatureVerification, xssVulnerability, xxeVulnerability };