What Zelsis checks · Security

Security checks on every pull request

Zelsis covers the security checks you would expect from a code scanner, and only proven critical findings block a merge.

Checked on every pull request

Secret keys in client code, logs or committed config
Routes and records loaded by id without checking who owns them
Database access rules that let any signed-in user read or change every row
SQL and shell commands built from request input
CORS that allows any origin together with credentials
Package versions with a published advisory, and the version that fixes it
Public buckets, firewalls open to the internet and containers running with too many rights
TLS certificate checks turned off

Caught in real code

Our test suite scans these examples on every release.

Cached data served to the wrong user

NEXTAI-01

unstable_cache reads the signed-in user from the surrounding scope but keys the cache without it, so one user's data is served to everyone.

app/dashboard/orders/page.tsx

Flagged

import { unstable_cache } from 'next/cache';
import { auth } from '@/auth';
import { db } from '@/lib/db';

export default async function OrdersPage() {
  const userId = (await auth())?.user?.id;
  const getOrders = unstable_cache(
    async () => db.order.findMany({ where: { userId } }),
    ['dashboard-orders']
  );
  return <OrderList orders={await getOrders()} />;
}

Passes

import { unstable_cache } from 'next/cache';
import { auth } from '@/auth';
import { db } from '@/lib/db';

const getOrders = unstable_cache(
  async (userId: string) => db.order.findMany({ where: { userId } }),
  ['dashboard-orders']
);

export default async function OrdersPage() {
  const userId = (await auth())?.user?.id;
  return <OrderList orders={await getOrders(userId!)} />;
}

Admin check on a token nobody verified

RULE-39

Express middleware reads the role from jwt.decode(), which only base64-decodes the token. Anyone can sign their own token with role "admin".

src/middleware/auth.js

Flagged

const jwt = require('jsonwebtoken');

module.exports = function requireAdmin(req, res, next) {
  const token = req.headers.authorization.split(' ')[1];
  const user = jwt.decode(token);
  if (user.role !== 'admin') return res.status(403).end();
  req.user = user;
  next();
};

Passes

const jwt = require('jsonwebtoken');

module.exports = function requireAdmin(req, res, next) {
  const token = req.headers.authorization.split(' ')[1];
  const user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });
  if (user.role !== 'admin') return res.status(403).end();
  req.user = user;
  next();
};

Scan a repository