Skip to main content
Rule Inventory

Static Analysis Rule Catalog

Explore the complete inventory of 1302 static analysis rules with severity classifications, line-targeting precision, and empirical benchmark maturity levels.

Showing 1302 of 1302 rules
Rule CodeDescription / TitleSeverityBenchmark Maturity
RULE-1
Exposed Hardcoded OpenAI/Stripe Secret API Key
line-precisefixture-tested
 CRITICAL Standard
RULE-3
Permissive Row Level Security (RLS) Policy (USING true)
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-8
Wildcard Access-Control-Allow-Origin (*) CORS Vulnerability
line-precisefixture-tested
 HIGH Standard
RULE-14
Insecure Hardcoded Fallback for Cryptographic Session / JWT Secret
line-precisefixture-tested
UNKNOWN Verified Gate
RULE-15
Unauthenticated API Mutation Route Handler (Missing Session / Auth Guard)
line-precisefixture-tested
 HIGH Standard
RULE-16
Unsanitized Direct InnerHTML DOM Mutation (XSS Risk)
line-precisefixture-tested
 HIGH Verified Gate
RULE-17
Potential Broken Object Level Authorization (BOLA / IDOR)
line-precisefixture-tested
 CRITICAL Standard
RULE-19
Autonomous Destructive LLM Tool Calling (OWASP LLM08 Excessive Agency)
line-precisefixture-tested
 CRITICAL Standard
RULE-20
Vulnerable Dependency or Wildcard Version in package.json
line-precisefixture-tested
UNKNOWN Standard
RULE-21
Potential Secret or PII Log Leakage in Application Telemetry
line-precisefixture-tested
 HIGH Standard
RULE-22
Client-Side Direct LLM API SDK Exposure
line-precisefixture-tested
 CRITICAL Standard
RULE-23
Mass Assignment Vulnerability in Database Mutation (CWE-915)
line-precisefixture-tested
 HIGH Standard
RULE-24
Path Traversal in Filesystem Operations (CWE-22)
line-precisefixture-tested
 CRITICAL Standard
RULE-25
Open Redirect via Unvalidated Return URL (CWE-601)
line-precise
 HIGH Verified Gate
RULE-26
GraphQL Query Depth & Complexity Limits Missing (DoS Prevention)
line-precisefixture-tested
 HIGH Standard
RULE-27
Catastrophic Backtracking Regular Expression (ReDoS CWE-1333)
line-precisefixture-tested
 HIGH Standard
RULE-28
JWT Algorithm Confusion Vulnerability (Missing Algorithms Whitelist)
line-precisefixture-tested
 CRITICAL Standard
RULE-31
Insecure YAML Deserialization (CWE-502 Remote Code Execution)
line-precisefixture-tested
 CRITICAL Standard
RULE-32
Dynamic Code Execution (eval / Function Remote Code Execution)
line-precisefixture-tested
UNKNOWN Verified Gate
RULE-33
Command Injection via Unsanitized Child Process Execution
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-34
Server-Side Request Forgery (SSRF) via Unvalidated Target URL
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-35
Path Traversal Vulnerability via User-Controlled File Path
line-precisefixture-tested
 HIGH Standard
RULE-36
Public Exposure of Backend Secret via NEXT_PUBLIC_ Environment Variable
line-precisefixture-tested
 CRITICAL Standard
RULE-37
Use of Broken Cryptographic Hash Function (MD5 / SHA-1)
line-precisefixture-tested
 HIGH Verified Gate
RULE-38
Insecure Pseudo-Random Number Generator Used in Security Context (Math.random)
line-precisefixture-tested
 HIGH Standard
RULE-39
Unverified JWT Token Decoding without Cryptographic Signature Verification
line-precisefixture-tested
 HIGH Standard
RULE-40
Insecure Session Cookie Configuration (Missing HttpOnly or Secure Flag)
line-precisefixture-tested
 HIGH Standard
RULE-41
Unvalidated Open Redirection Vulnerability (Open Redirect)
line-precisefixture-tested
 MEDIUM Standard
RULE-42
NoSQL Injection via Arbitrary JavaScript $where Evaluation
line-precisefixture-tested
 CRITICAL Standard
RULE-43
Hardcoded Session or Crypto Secret Key in Application Configuration
line-precisefixture-tested
 HIGH Verified Gate
RULE-44
Insecure CORS Configuration (Wildcard Origin with Allowed Credentials)
line-precisefixture-tested
 HIGH Standard
RULE-45
Permissive Database Row Level Security (RLS) Bypass Policy
line-precisefixture-tested
 CRITICAL Verified Gate
UI-61
Naive Fixed-Character Text Splitter
line-precisefixture-tested
 LOW Standard
SEC-WEB-00
Target Link Unhealthy / Broken Endpoint (HTTP ${statusCode})
line-precisefixture-tested
 HIGH Standard
SEC-WEB-01
Absence of Content-Security-Policy (CSP) Header
line-precisefixture-tested
 MEDIUM Standard
SEC-WEB-02
Absence of HSTS Strict Transport Security Header
line-precisefixture-tested
 MEDIUM Standard
SEC-WEB-03
Clickjacking Exposure (Missing X-Frame-Options Header)
line-precisefixture-tested
 MEDIUM Standard
SEC-WEB-04
MIME Sniffing Vulnerability (Missing X-Content-Type-Options)
line-precisefixture-tested
 LOW Standard
UI-106
Empty Silent Catch Block
line-precisefixture-tested
 LOW Standard
UI-111
TypeScript
line-precisefixture-tested
 LOW Standard
UI-117
Uncleaned Event Listener Memory Leak
line-precisefixture-tested
 MEDIUM Standard
UI-141
Unbounded Token Consumption (Missing max_tokens Limit)
line-precisefixture-tested
 MEDIUM Standard
CLICHE-07
Fabricated Brand Logos (Fake Trust Proof)
line-precisefixture-tested
 MEDIUM Standard
CLICHE-48
Unlabeled Toggle Switch Interactive Ambiguity
line-precisefixture-tested
 LOW Standard
CLICHE-50
Orphaned Dead Social Media Footer Anchors
line-precisefixture-tested
 LOW Standard
CLICHE-74
Unannounced External Link Navigation
line-precisefixture-tested
 LOW Standard
UI-23
Robotic Apology / Refusal Boilerplate
line-precisefixture-tested
 LOW Standard
RULE-1026
WCAG 2.2 AA: Interactive Input Missing Accessible Label or Keyboard Focus Ring
line-precisefixture-tested
 MEDIUM Standard
RULE-1027
line-precisefixture-tested
UNKNOWN Standard
RULE-1029
WCAG 2.2 AA: Non-Semantic Clickable Container Missing Keyboard Accessibility
line-precisefixture-tested
 MEDIUM Standard
RULE-1030
Unkeyed React Array Mapping Reconciliation Hazard
line-precisefixture-tested
 MEDIUM Standard
RULE-1033
Custom Web Font Missing font-display: swap (FOIT / LCP Penalty)
line-precisefixture-tested
 LOW Standard
RULE-1034
Synchronous Render-Blocking Script Tag Detected in Document Head
line-precisefixture-tested
 LOW Standard
RULE-1044
Interactive Element Touch Target Below WCAG 2.2 AA Minimum (<24x24px)
line-precisefixture-tested
 LOW Standard
UI-INTERACT-01
Modal Overlay Missing Backdrop Click Dismissal
line-precisefixture-tested
 LOW Standard
UI-INTERACT-02
Modal Dialog Missing Keyboard Escape Listener
line-precisefixture-tested
 LOW Standard
UI-INTERACT-03
Missing Focus Trap in Open Modal Dialog
line-precisefixture-tested
 LOW Standard
UI-INTERACT-04
Disruptive autoFocus Input Hijacking
line-precisefixture-tested
 LOW Standard
UI-INTERACT-05
Arbitrary Z-Index Escalation War (z-[99999])
line-precisefixture-tested
 LOW Standard
UI-INTERACT-06
Button Dimensions Shift During Loading State
line-precisefixture-tested
 LOW Standard
UI-INTERACT-07
Viewport Horizontal Overflow from w-screen
line-precisefixture-tested
 LOW Standard
UI-INTERACT-08
Hydration Mismatch from Client-Only Window Checks
line-precisefixture-tested
 LOW Standard
UI-INTERACT-10
Scroll Lock without Scrollbar Width Compensation
line-precisefixture-tested
 LOW Standard
UI-INTERACT-11
Double-Click Duplicate Mutation Hazard
line-precisefixture-tested
 LOW Standard
UI-INTERACT-12
Missing aria-expanded on Collapsible Accordion Triggers
line-precisefixture-tested
 LOW Standard
UI-INTERACT-14
Keyboard Tab Trap in Code / Text Area
line-precisefixture-tested
 LOW Standard
UI-INTERACT-16
Dropdown Menu Leaking on Outside Document Click
line-precisefixture-tested
 LOW Standard
UI-INTERACT-20
Unannounced Dynamic Toast / Alert Notifications
line-precisefixture-tested
 LOW Standard
UI-INTERACT-21
Clipboard Copy Button Lacking Confirmation State
line-precisefixture-tested
 LOW Standard
UI-INTERACT-22
Auto-Closing Notification Dismissal Too Fast
line-precisefixture-tested
 LOW Standard
UI-INTERACT-23
Nested Button Invalid HTML Hierarchy
line-precisefixture-tested
 LOW Standard
UI-INTERACT-25
Unchecked File Upload Size and Type Traps
line-precisefixture-tested
 LOW Standard
UI-INTERACT-29
Tab Component Lacking Arrow Key Keyboard Navigation
line-precisefixture-tested
 LOW Standard
UI-INTERACT-31
Slider / Range Input Missing Numeric Value Label
line-precisefixture-tested
 LOW Standard
UI-INTERACT-32
Audio / Video Auto-Play with Sound
line-precisefixture-tested
 LOW Standard
UI-INTERACT-35
Checkbox Label Click Area Disconnected
line-precisefixture-tested
 LOW Standard
UI-INTERACT-40
Interactive Chart Missing Keyboard Accessible Data Table
line-precisefixture-tested
 LOW Standard
UI-INTERACT-41
Draggable Kanban / List Lacking Keyboard Reordering
line-precisefixture-tested
 LOW Standard
UI-INTERACT-43
Form Submission Resetting Cursor Position in Controlled Input
line-precisefixture-tested
 LOW Standard
UI-INTERACT-44
Viewport Blocks Zoom (WCAG 1.4.4 Resize Text)
line-precisefixture-tested
 HIGH Standard
UI-INTERACT-47
Animated Counter Freezing on Rapid Page Scroll
line-precisefixture-tested
 LOW Standard
RULE-2001
Accessible Privacy Policy & Terms of Service Routes & Links Missing or Inactive
line-precisefixture-tested
 MEDIUM Standard
RULE-2003
Cookie Consent Banner Dark Pattern: Missing Symmetric Reject / Decline Action
line-precisefixture-tested
 MEDIUM Standard
RULE-2005
PII or Sensitive Authentication Secret Leaked in URL Query Parameters
line-precisefixture-tested
 MEDIUM Standard
RULE-2006
Raw Cardholder Data Input Element Detected (PCI-DSS SAQ-D Exposure Risk)
line-precisefixture-tested
 HIGH Standard
RULE-2010
Excessive Cookie Consent Duration Detected (>12 Months GDPR/CNIL Cap)
line-precisefixture-tested
 MEDIUM Standard
RULE-2014
Plaintext Password or Permanent Secret Transmitted in Email Payload
line-precisefixture-tested
 HIGH Standard
RULE-3001
PostgreSQL Table
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-3002
Dockerfile Executes as Root User (Container Privilege Escalation Risk)
line-precise
 HIGH Verified Gate
RULE-3003
Plaintext Database Credentials Embedded in Connection URI
line-precisefixture-tested
 CRITICAL Standard
RULE-3004
Permissive CORS (
line-precisefixture-tested
 HIGH Standard
RULE-3005
Unprotected Debug / Profiler Endpoint Exposed in Production Build
line-precisefixture-tested
 MEDIUM Standard
RULE-3006
Next.js Server Action Executes Database Mutation Without Schema Validation Guard
line-precisefixture-tested
 HIGH Standard
RULE-3007
Kubernetes Workload Manifest Missing CPU/Memory Resource Limits (DoS Risk)
line-precisefixture-tested
 LOW Standard
RULE-3009
Serverless Connection Pool Exhaustion Hazard (PrismaClient Constructed Per Request)
line-precisefixture-tested
 MEDIUM Standard
RULE-3011
Unencrypted Cache Connection URI (Missing rediss:// TLS Protocol)
line-precisefixture-tested
 HIGH Standard
RULE-3012
Public Read ACL Detected on Cloud Storage Bucket Configuration
line-precisefixture-tested
 HIGH Standard
RULE-3016
Production Server Missing Graceful Shutdown SIGTERM/SIGINT Signal Handlers
line-precisefixture-tested
 MEDIUM Standard
RULE-3017
Dangerous Host Docker Socket Mount (/var/run/docker.sock Exposed)
line-precisefixture-tested
 HIGH Standard
RULE-3018
Firebase Security Rules: Permissive Unauthenticated Read/Write Access (allow read, write: if true)
line-precisefixture-tested
 CRITICAL Standard
RULE-3019
line-precise
 MEDIUM Verified Gate
RULE-3020
MongoDB NoSQL Injection via $where JavaScript Evaluation or Raw Request Query Object
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-3021
SQL Injection: String Concatenation in Node.js Database Client Query
line-precisefixture-tested
 CRITICAL Standard
RULE-4001
Unbounded LLM Token Consumption (OWASP LLM04 Model Denial of Service)
line-precisefixture-tested
 HIGH Standard
RULE-4003
Untrusted LLM Output Execution (OWASP LLM05 Code Execution)
line-precisefixture-tested
 CRITICAL Standard
RULE-4004
Insecure Multi-Tenant Vector Search (Cross-Tenant Retrieval Hazard)
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-01
AWS Access Key ID Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-02
AWS Secret Access Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-03
GitHub Classic Personal Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-04
GitHub Fine-Grained Personal Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-05
GitHub OAuth Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-06
GitHub App Installation Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-07
Slack Incoming Webhook URL
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-08
Slack Bot User OAuth Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-09
Slack User Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-10
Stripe Live Secret Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-11
Stripe Live Restricted Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-12
Stripe Webhook Signing Secret
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-13
OpenAI API Secret Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-14
Anthropic API Secret Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-15
Google Gemini / AI Studio API Key
line-precisefixture-tested
 CRITICAL Verified Gate
SEC-SECRET-16
Google Cloud Service Account JSON Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-17
Google Cloud OAuth Client Secret
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-18
Supabase Service Role Secret Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-19
Polar.sh Webhook Secret Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-20
Polar.sh Access Token Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-21
Twilio Account SID & Auth Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-22
SendGrid Mail API Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-23
Mailgun API Private Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-24
Resend Email API Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-25
Postmark Server API Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-26
NPM Automation & Publishing Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-27
PyPI Package Upload API Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-28
HuggingFace User Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-29
Datadog API Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-30
Sentry Authentication Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-31
Cloudflare Global API Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-32
Cloudflare Scoped API Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-33
Algolia Admin API Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-34
DigitalOcean Personal Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-35
Heroku API Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-36
Vercel Personal Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-37
Netlify Personal Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-38
Shopify Admin API Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-39
Square Production Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-40
GitLab Personal Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-41
Bitbucket App Password Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-42
Atlassian / Jira API Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-43
Discord Bot Token Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-44
Telegram Bot API Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-45
RSA Private Key Block Exposure
line-precisefixture-tested
 CRITICAL Verified Gate
SEC-SECRET-46
OpenSSH Private Key Block Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-47
EC Private Key Block Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-48
PGP Private Key Block Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-49
Generic Private Key Block Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-50
Postman API Access Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-51
PlanetScale Database Password
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-52
Neon Database Connection Secret
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-53
Upstash Redis REST Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-54
Pinecone Vector DB API Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-55
Weaviate Cloud API Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-56
Qdrant Vector Database API Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-57
LaunchDarkly SDK Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-58
Segment Write Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-59
Intercom Access Token Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-60
Contentful Management Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-61
Auth0 Management API Client Secret
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-62
Okta API Token Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-63
Grafana Service Account Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-64
HashiCorp Vault Token Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-65
Docker Hub Personal Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-66
Kubernetes Service Account Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-67
HubSpot Private App Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-68
Linear API Access Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-69
Notion Integration Secret Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-70
Asana Personal Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-71
ClickUp Personal API Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-72
Airtable Personal Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-73
Snyk API Token Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-74
SonarCloud User Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-75
PayPal Live Client Secret
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-76
Coinbase Commerce API Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-77
Fastly API Token Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-78
Fly.io API Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-79
Render API Access Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-80
Railway API Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-81
Koyeb API Token Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-82
Supabase Database Direct Password
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-83
Firebase Cloud Messaging Server Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-84
OneSignal REST API Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-85
Mixpanel Project Secret Key
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-86
Amplitude Secret Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-87
Customer.io API Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-88
Braze Rest API Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-89
Zendesk API Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-90
Freshdesk API Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-91
Intercom Webhook Secret
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-92
GitGuardian API Key Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-93
Checkov Bridgecrew API Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-94
CircleCI Personal Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-95
Travis CI API Access Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-96
Semaphore CI Auth Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-97
Codecov Upload Token Exposure
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-98
SonarQube Authentication Token
line-precisefixture-tested
 CRITICAL Standard
SEC-SECRET-99
JWT Hardcoded Secret Key Constant
line-precisefixture-tested
 CRITICAL Verified Gate
SEC-SECRET-100
Generic High-Entropy Hex/Base64 API Key
line-precisefixture-tested
 HIGH Standard
DB-PERF-01
Prisma / ORM N+1 Query in Loop
line-precisefixture-tested
 MEDIUM Standard
DB-PERF-03
Deep Offset Pagination Performance Trap
line-precisefixture-tested
 LOW Standard
DB-PERF-05
Direct Unpooled Database Connection in Edge / Serverless
line-precisefixture-tested
 HIGH Standard
DB-PERF-09
Long-Running External API Call Inside DB Transaction
line-precisefixture-tested
 HIGH Standard
DB-PERF-10
PostgreSQL Public Table Missing Row Level Security (RLS)
line-precisefixture-tested
 CRITICAL Standard
DB-PERF-15
Uncommitted Database Transaction Connection Leak
line-precisefixture-tested
 HIGH Standard
DB-PERF-17
Redundant Duplicate Indexes on Same Column Prefix
line-precisefixture-tested
 LOW Standard
DB-PERF-29
Realtime WebSocket Channel Flooding Without Filter
line-precisefixture-tested
 LOW Standard
DB-PERF-34
Unbounded In-Memory Array Sorting in ORM
line-precisefixture-tested
 MEDIUM Standard
DB-PERF-38
Database Connection String with Plaintext Password in Repo
line-precisefixture-tested
 CRITICAL Standard
DB-PERF-43
Unprepared Dynamic SQL Query Injections
line-precisefixture-tested
 CRITICAL Standard
DB-PERF-51
Migration Takes a Blocking Table Lock on an Existing Table
line-precisefixture-tested
 MEDIUM Verified Gate
CLOUD-04
Docker Container Running as Default Root User
line-precisefixture-tested
 HIGH Verified Gate
CLOUD-05
Docker Base Image Using Mutable
line-precisefixture-tested
 MEDIUM Standard
CLOUD-06
Docker Secret Leak via Build ARG or ENV
line-precisefixture-tested
 HIGH Standard
CLOUD-07
Missing Multi-Stage Build in Production Dockerfile
line-precisefixture-tested
 LOW Standard
CLOUD-13
Kubernetes Pod Running with Privileged SecurityContext
line-precisefixture-tested
 CRITICAL Standard
CLOUD-15
Lambda Cold Start Heavy Module Initialization
line-precisefixture-tested
 LOW Standard
CLOUD-20
CloudFormation / CDK Wildcard IAM Action (Action:
line-precisefixture-tested
 CRITICAL Standard
CLOUD-26
CloudFront Missing Enforced HTTPS Redirection
line-precisefixture-tested
 HIGH Standard
CLOUD-27
CloudFront Insecure Legacy TLS Protocol Version (<TLSv1.2)
line-precisefixture-tested
 HIGH Standard
CLOUD-29
Indefinite CloudWatch Log Retention Period
line-precisefixture-tested
 LOW Standard
CLOUD-30
Terraform / OpenTofu Plaintext Secret in Output
line-precisefixture-tested
 MEDIUM Standard
CLOUD-31
Terraform State Backend Missing Encryption at Rest
line-precisefixture-tested
 MEDIUM Standard
CLOUD-36
Missing CloudTrail Multi-Region Audit Logging
line-precisefixture-tested
 MEDIUM Standard
CLOUD-37
ECR Container Image Repository Vulnerability Scan Disabled
line-precisefixture-tested
 MEDIUM Standard
CLOUD-38
ECR Container Repository Tag Mutability Enabled
line-precisefixture-tested
 LOW Standard
CLOUD-40
Security Group Permissive Inbound Ingress (0.0.0.0/0)
line-precisefixture-tested
 CRITICAL Standard
CLOUD-41
Missing AWS KMS Key Automatic Rotation
line-precisefixture-tested
 MEDIUM Standard
CLOUD-42
Lambda Function Invocation URL Missing AuthType
line-precisefixture-tested
 MEDIUM Standard
CLOUD-43
Redis / ElastiCache Cluster Missing In-Transit Encryption
line-precisefixture-tested
 MEDIUM Standard
CLOUD-44
Redis / ElastiCache Missing Auth Token Requirement
line-precisefixture-tested
 MEDIUM Standard
CLOUD-49
Kubernetes Service Account Automatic Token Mounting
line-precisefixture-tested
 LOW Standard
WEB-PERF-01
Above-The-Fold Hero Image Missing Priority Attribute
line-precisefixture-tested
 MEDIUM Standard
WEB-PERF-02
Unsized Image or Video Element Causing Layout Shift
line-precisefixture-tested
 LOW Standard
WEB-PERF-03
Synchronous Third-Party Script Tag Blocking Render
line-precisefixture-tested
 MEDIUM Standard
WEB-PERF-04
Non-Passive Touch or Wheel Event Listener
line-precisefixture-tested
 MEDIUM Standard
WEB-PERF-05
Uncompressed Legacy Font Format (.ttf / .otf) in Bundle
line-precisefixture-tested
 MEDIUM Standard
WEB-PERF-06
CSS @import Directive in Render-Critical Stylesheet
line-precisefixture-tested
 MEDIUM Standard
WEB-PERF-10
Unoptimized SVG with Embedded Raster Base64 Data
line-precisefixture-tested
 LOW Standard
WEB-PERF-11
Missing Preconnect for Critical External CDNs
line-precisefixture-tested
 LOW Standard
WEB-PERF-15
Forced Synchronous Layout Shift (Layout Thrashing)
line-precisefixture-tested
 MEDIUM Standard
WEB-PERF-18
Animated CSS Properties Triggering Layout Reflow
line-precisefixture-tested
 LOW Standard
WEB-PERF-20
Unoptimized Animated GIF Asset in Production
line-precisefixture-tested
 LOW Standard
WEB-PERF-23
CSS Filter Blur on Continuous Scrolling Container
line-precisefixture-tested
 LOW Standard
WEB-PERF-28
Render-Blocking Custom Web Font Declaration
line-precisefixture-tested
 LOW Standard
WEB-PERF-29
Synchronous LocalStorage Read in Event Loop Hot Path
line-precisefixture-tested
 LOW Standard
WEB-PERF-34
DOM Node Polling via setInterval Instead of Observers
line-precisefixture-tested
 LOW Standard
WEB-PERF-35
List Keyed by Array Index
line-precisefixture-tested
 LOW Standard
WEB-PERF-38
Missing HTML Lang Attribute Delaying Accessibility Tree
line-precisefixture-tested
 LOW Standard
WEB-PERF-39
Unused CSS Class Bloat in Production Bundle
line-precisefixture-tested
 LOW Standard
WEB-PERF-45
Missing Favicon and Icon Dimensions in Manifest
line-precisefixture-tested
 LOW Standard
API-03
Collection Endpoint Missing Pagination Boundary
line-precisefixture-tested
 MEDIUM Standard
API-07
Health Check Endpoint Exposing Internal System Credentials
line-precisefixture-tested
 HIGH Standard
API-13
API Endpoint Missing Strict JSON Schema / Zod Validation
line-precisefixture-tested
 MEDIUM Standard
API-15
GET Endpoint Performing State-Mutating Actions
line-precisefixture-tested
 HIGH Standard
API-18
Unauthenticated Debug or Metric Endpoint in Production
fixture-tested
 HIGH Standard
API-19
Wildcard Allowed Methods in CORS (Access-Control-Allow-Methods:
line-precisefixture-tested
 LOW Standard
API-20
Missing Rate Limiting on Authentication / Login Endpoints
line-precisefixture-tested
 CRITICAL Standard
API-21
Leaking Stack Traces in 500 Server Error Responses
line-precisefixture-tested
 HIGH Standard
API-23
Webhook Delivery Missing Cryptographic HMAC Signature
line-precisefixture-tested
 MEDIUM Standard
API-26
Unbounded Query Filter Parameters Exposing Full Table Scans
line-precisefixture-tested
 MEDIUM Standard
API-30
tRPC Procedure Missing Caller Context Authentication
line-precisefixture-tested
 HIGH Standard
API-35
Unsanitized User-Controlled Filename in Content-Disposition
line-precisefixture-tested
 MEDIUM Standard
API-37
Exposing Internal Database Errors in 400 Bad Request
line-precisefixture-tested
 MEDIUM Standard
API-42
Missing Strict Origin Validation in WebSocket Handshake
line-precisefixture-tested
 HIGH Standard
API-43
Unbounded WebSocket Message Payload Size
line-precisefixture-tested
 MEDIUM Standard
API-45
API Token Generation Using Math.random Instead of Crypto
line-precisefixture-tested
 HIGH Standard
API-46
Missing Timing-Safe Comparison on API Key Authentication
line-precisefixture-tested
 MEDIUM Standard
API-47
API Endpoint Returning Unfiltered Sensitive PII in User Objects
line-precisefixture-tested
 HIGH Standard
API-49
Unsafe URL Redirection in OAuth Callback Handler
line-precisefixture-tested
 HIGH Standard
API-50
Exposing Internal Microservice Hostname in Public API Response
line-precisefixture-tested
 LOW Standard
SUPPLY-01
Wildcard Package Dependency Version (
line-precisefixture-tested
 MEDIUM Standard
SUPPLY-02
Dangerous npm Lifecycle Script (preinstall / postinstall curl)
line-precisefixture-tested
 CRITICAL Standard
SUPPLY-04
Known Malicious / Deprecated Package (event-stream)
line-precisefixture-tested
 CRITICAL Standard
SUPPLY-05
Unpinned Git Dependency (git+https:// without Commit SHA)
line-precisefixture-tested
 HIGH Standard
SUPPLY-06
External CDN Script Missing Subresource Integrity (SRI)
line-precisefixture-tested
 MEDIUM Standard
SUPPLY-07
Public Leaked Internal npm Registry Token in .npmrc
line-precisefixture-tested
 CRITICAL Standard
SUPPLY-08
Typo-Squatting Package Hazard (e.g. cross-env-shell, lodash.js)
line-precisefixture-tested
 HIGH Standard
SUPPLY-13
Deprecated Cryptography Package Import:
line-precisefixture-tested
 LOW Standard
SUPPLY-14
Python Dependency Unpinned in requirements.txt
line-precisefixture-tested
 MEDIUM Standard
SUPPLY-17
Insecure Package Registry URL (HTTP instead of HTTPS)
line-precisefixture-tested
 HIGH Standard
SUPPLY-19
Unverified Direct Tarball / URL Package Dependency
line-precisefixture-tested
 HIGH Standard
SUPPLY-20
Unmaintained / Abandoned Package Import (left-pad)
line-precisefixture-tested
 LOW Standard
SUPPLY-22
GitHub Actions Workflow Using Mutable Branch Ref (@main)
line-precisefixture-tested
 MEDIUM Standard
SUPPLY-23
GitHub Actions Step Running Untrusted Pull Request Code
line-precisefixture-tested
 CRITICAL Standard
SUPPLY-25
Vulnerable Prototype Pollution in Deprecated
line-precisefixture-tested
 HIGH Standard
SUPPLY-26
Vulnerable XML Parser Susceptible to XXE Injection
line-precisefixture-tested
 HIGH Standard
SUPPLY-29
Over-Permissive GitHub Actions GITHUB_TOKEN Default
line-precisefixture-tested
 HIGH Standard
SUPPLY-32
Insecure Gradle / Maven Dependency Without Checksum
line-precisefixture-tested
 MEDIUM Standard
SUPPLY-34
Direct Dependency on Native Binary Compilers in Runtime
line-precisefixture-tested
 LOW Standard
SUPPLY-39
Unverified Download of Standalone Binary CLI Tools in CI
line-precisefixture-tested
 MEDIUM Standard
SUPPLY-49
Over-Permissive File Permissions in Published NPM Tarball
line-precisefixture-tested
 LOW Standard
LLM-SEC-04
Unsanitized LLM Output Rendered as Raw HTML / Stored XSS
line-precisefixture-tested
 CRITICAL Standard
LLM-SEC-08
Insecure Deserialization of ML Weights (Pickle / PyTorch)
line-precisefixture-tested
 MEDIUM Verified Gate
LLM-SEC-17
Hardcoded Model Provider API Keys in Client-Side Bundles
line-precisefixture-tested
 CRITICAL Standard
LLM-SEC-56
Insecure Dynamic Model Selection via User Input
line-precisefixture-tested
 MEDIUM Standard
LLM-COST-03
Uncached Vector Embedding Loop (Compounding API Cost)
line-precisefixture-tested
 LOW Standard
LLM-COST-06
Naive LLM Retry Loop Without Exponential Backoff
line-precisefixture-tested
 MEDIUM Standard
ZERO-AUTH-02
Excessive JWT Token Expiration Lifespan (>1 Hour)
line-precisefixture-tested
 MEDIUM Standard
ZERO-AUTH-03
Cryptographic Timing Attack in Token & Signature Verification
line-precisefixture-tested
 MEDIUM Standard
ZERO-AUTH-04
Hardcoded Authentication Bypass Headers (x-bypass-auth)
line-precisefixture-tested
 CRITICAL Standard
ZERO-AUTH-05
Broken Object Property Level Authorization (BOPLA / Mass Assignment)
line-precisefixture-tested
 HIGH Standard
ZERO-AUTH-09
Session Fixation Vulnerability on Login State Transition
line-precisefixture-tested
 HIGH Standard
ZERO-AUTH-10
Missing Rate Limiting on Authentication & Token Exchange Routes
line-precisefixture-tested
 CRITICAL Standard
ZERO-AUTH-11
Insecure Transmission of Bearer Tokens in URL Query Parameters
line-precisefixture-tested
 HIGH Standard
ZERO-AUTH-13
Permissive CORS Credentials with Wildcard Origins
line-precisefixture-tested
 MEDIUM Standard
ZERO-AUTH-17
Weak Default Password Policy in User Registration
line-precisefixture-tested
 MEDIUM Standard
ZERO-AUTH-18
Missing Cross-Site Request Forgery (CSRF) Protection on Cookie-Based Auth
line-precisefixture-tested
 MEDIUM Standard
ZERO-AUTH-20
Missing OAuth State Parameter (CSRF in OAuth Flow)
line-precisefixture-tested
 HIGH Standard
ZERO-AUTH-22
Lack of Constant-Time Password Hash Verification
line-precisefixture-tested
 HIGH Standard
ZERO-AUTH-24
Insecure OAuth Redirect URI Matching (Wildcard / Subdomain Match)
line-precisefixture-tested
 CRITICAL Standard
ZERO-AUTH-31
Insecure JWT Storage in Browser LocalStorage
line-precisefixture-tested
 MEDIUM Standard
ZERO-AUTH-39
Weak Ephemeral Key Generation for Diffie-Hellman Key Exchange
line-precisefixture-tested
 HIGH Standard
ZERO-AUTH-42
Unprotected GraphQL Introspection in Production Environments
line-precisefixture-tested
 LOW Standard
ZERO-AUTH-43
Missing Identity Verification on Webhook Receiver Endpoints
line-precisefixture-tested
 HIGH Standard
ZERO-AUTH-50
Insecure Ephemeral Token Generation using Math.random()
line-precisefixture-tested
 CRITICAL Standard
PRIVACY-01
Plaintext PII Logged to Standard Output / Console
line-precisefixture-tested
 HIGH Standard
PRIVACY-07
Unmasked PII Forwarded to Third-Party Error Trackers (Sentry)
line-precisefixture-tested
 HIGH Standard
PRIVACY-15
Unprotected Exposure of Customer PII in URL Query Strings
line-precisefixture-tested
 MEDIUM Standard
PRIVACY-25
Insecure Session Recording Tools Capturing Form Input PII
line-precisefixture-tested
 MEDIUM Standard
IAC-01
Security Group Ingress Open to World on SSH Port 22
line-precisefixture-tested
 CRITICAL Standard
IAC-02
Security Group Ingress Open to World on RDP Port 3389
line-precisefixture-tested
 CRITICAL Standard
IAC-03
Security Group Ingress Open to World on Database Ports (5432 / 3306)
line-precisefixture-tested
 CRITICAL Standard
IAC-04
AWS EBS Storage Volume Missing Default Encryption
line-precisefixture-tested
 MEDIUM Standard
IAC-05
IAM Policy with Wildcard Administrative Actions (Action: *)
line-precisefixture-tested
 CRITICAL Standard
IAC-06
S3 Bucket Versioning Disabled on Critical Storage
line-precisefixture-tested
 MEDIUM Standard
IAC-07
AWS CloudTrail Multi-Region Audit Logging Disabled
line-precisefixture-tested
 MEDIUM Standard
IAC-09
RDS Database Instance Missing Automated Backup Retention
line-precisefixture-tested
 MEDIUM Standard
IAC-10
RDS Database Instance Publicly Accessible (publicly_accessible = true)
line-precisefixture-tested
 CRITICAL Standard
IAC-12
Kubernetes Container Running with Host PID or IPC Namespace
line-precisefixture-tested
 CRITICAL Standard
IAC-14
Dockerfile Missing HEALTHCHECK Instruction
fixture-tested
 MEDIUM Standard
IAC-20
AWS KMS Key Policy Permitting Wildcard Principal (*)
line-precisefixture-tested
 CRITICAL Standard
IAC-21
Container Running with hostNetwork Enabled
line-precisefixture-tested
 CRITICAL Standard
IAC-22
Terraform Resource Using Hardcoded Plaintext Passwords
line-precisefixture-tested
 CRITICAL Standard
IAC-23
AWS Elasticache Redis Cluster Missing In-Transit Encryption
line-precisefixture-tested
 MEDIUM Standard
IAC-24
AWS S3 Bucket Policy Permitting Wildcard Principal (*)
line-precisefixture-tested
 CRITICAL Standard
IAC-28
AWS Elastic Load Balancer (ALB) Dropping HTTP to HTTPS Redirection
line-precisefixture-tested
 HIGH Standard
IAC-29
Kubernetes Pod Permitting Linux Capabilities (ALL)
line-precisefixture-tested
 CRITICAL Standard
IAC-31
Docker Compose Version 2/3 File Declaring Privileged Flag
line-precisefixture-tested
 CRITICAL Standard
IAC-32
AWS RDS Instance Missing Deletion Protection
line-precisefixture-tested
 MEDIUM Standard
IAC-33
AWS OpenSearch / Elasticsearch Cluster Missing Node-to-Node Encryption
line-precisefixture-tested
 MEDIUM Standard
IAC-35
AWS CloudFront Distribution Using Insecure SSL/TLS Protocols (TLSv1)
line-precisefixture-tested
 HIGH Standard
IAC-38
AWS EKS Cluster Endpoint Publicly Accessible Without CIDR Whitelist
line-precisefixture-tested
 MEDIUM Standard
IAC-42
AWS Lambda Function Runtime Using Deprecated Node.js or Python
line-precisefixture-tested
 MEDIUM Standard
IAC-44
AWS RDS Parameter Group Enforcing SSL/TLS Disabled
line-precisefixture-tested
 MEDIUM Standard
IAC-45
Kubernetes Ingress Allowing Insecure Snippet Annotations
line-precisefixture-tested
 MEDIUM Standard
IAC-48
Terraform AWS EC2 Instance Missing IMDSv2 Enforcement
line-precisefixture-tested
 HIGH Standard
IAC-49
Kubernetes Pod Tolerating All Taints (*)
line-precisefixture-tested
 LOW Standard
CHAOS-09
DNS TTL Caching Misconfiguration Preventing Fast Failover
line-precisefixture-tested
 LOW Standard
CHAOS-11
Unconstrained Thread Pool / Worker Concurrency in CPU-Bound Work
line-precisefixture-tested
 MEDIUM Standard
CHAOS-13
Lack of Backpressure Handling in Streaming Data Pipelines
line-precisefixture-tested
 MEDIUM Standard
CHAOS-18
Single Point of Failure (SPOF) Without Multi-AZ Redundancy
line-precisefixture-tested
 MEDIUM Standard
CHAOS-21
Missing Fallback for Third-Party Font or Script Outages
line-precisefixture-tested
 LOW Standard
CHAOS-28
Unconstrained Log Ingestion Flooding Disk / Logging Storage
line-precisefixture-tested
 LOW Standard
CHAOS-33
Insecure Fast-Fail Bypass Causing Silent Data Corruption
line-precisefixture-tested
 MEDIUM Standard
CHAOS-35
Unbounded Event Listener Growth on Global Window Object
line-precisefixture-tested
 LOW Standard
CHAOS-38
Missing Backoff on Database Connection Reconnection
line-precisefixture-tested
 MEDIUM Standard
CHAOS-39
Lack of Client-Side Cache Busting on Critical Static Assets
line-precisefixture-tested
 LOW Standard
GQL-01
Unrestricted GraphQL Query Depth (DoS Vulnerability)
line-precisefixture-tested
 HIGH Standard
GQL-02
Production GraphQL Introspection Enabled
line-precisefixture-tested
 MEDIUM Standard
GQL-03
Query Complexity & Cost Limit Disabled
line-precisefixture-tested
 HIGH Standard
GQL-04
Batch Request & Query Multiplexing Amplification Attack
line-precisefixture-tested
 HIGH Standard
GQL-06
Missing Field-Level Authorization Directive
line-precisefixture-tested
 CRITICAL Standard
GQL-07
GraphQL Playground / GraphiQL Exposed in Production
line-precisefixture-tested
 LOW Standard
GQL-09
Unbounded List Pagination in Resolvers
line-precisefixture-tested
 HIGH Standard
GQL-10
Missing CSRF Protection on GraphQL Mutations
line-precisefixture-tested
 HIGH Standard
GQL-15
Unrestricted Multipart GraphQL File Upload
line-precisefixture-tested
 CRITICAL Standard
GQL-16
Schema Directive Injection via User Input
line-precisefixture-tested
 CRITICAL Standard
GQL-17
GraphQL Resolver Raw SQL Injection
line-precisefixture-tested
 CRITICAL Standard
NEXT15-02
Client Component Props Exposing Server Secrets
line-precisefixture-tested
 CRITICAL Standard
NEXT15-05
Edge Middleware Header Injection via URL Parameters
line-precisefixture-tested
 HIGH Standard
NEXT15-06
Unbounded revalidateTag Invocations Allowing Cache Flush DoS
line-precisefixture-tested
 MEDIUM Standard
NEXT15-07
Mutating Server Action Triggered via Link Navigation (GET)
line-precisefixture-tested
 HIGH Standard
WEB3-01
Reentrancy Vulnerability (Checks-Effects-Interactions Violation)
line-precisefixture-tested
 CRITICAL Standard
WEB3-02
Integer Overflow / Underflow in Unchecked Math Block
line-precisefixture-tested
 HIGH Standard
WEB3-03
Frontrunning / MEV Sandwich Vulnerability (Zero Slippage Tolerance)
line-precisefixture-tested
 CRITICAL Standard
WEB3-05
Missing Access Control on Critical Admin Functions
line-precisefixture-tested
 CRITICAL Standard
WEB3-06
Signature Replay Attack (Missing EIP-712 Nonce & ChainID)
line-precisefixture-tested
 HIGH Standard
WEB3-07
Dangerous Delegatecall to Untrusted Target Address
line-precisefixture-tested
 CRITICAL Standard
WEB3-08
Unprotected Selfdestruct / Suicide Call
line-precisefixture-tested
 CRITICAL Standard
WEB3-09
Block Timestamp as Randomness Source
line-precisefixture-tested
 MEDIUM Standard
WEB3-10
Unchecked ERC-20 Transfer Return Value
line-precisefixture-tested
 HIGH Standard
PY-SEC-01
Unsafe Pickle Deserialization (Remote Code Execution)
line-precisefixture-tested
 CRITICAL Verified Gate
PY-SEC-02
Insecure PyYAML load() Without SafeLoader
line-precisefixture-tested
 CRITICAL Verified Gate
PY-SEC-03
Subprocess Execution with shell=True
line-precisefixture-tested
UNKNOWN Standard
PY-SEC-04
Python SQL Injection via String Interpolation (f-string / format / %)
line-precisefixture-tested
 HIGH Standard
PY-SEC-05
Django / Flask DEBUG Mode Enabled in Production Settings
line-precisefixture-tested
 MEDIUM Standard
PY-SEC-06
FastAPI Permissive CORS with Allow-Credentials
line-precisefixture-tested
 HIGH Standard
PY-SEC-07
Blocking Synchronous I/O Inside FastAPI async def Handler
line-precisefixture-tested
 MEDIUM Standard
PY-SEC-08
Insecure Celery Task Serializer (Pickle Serialization)
line-precisefixture-tested
 CRITICAL Standard
PY-SEC-09
Hardcoded Secret Key in Flask / Django Settings
line-precisefixture-tested
 HIGH Standard
PY-SEC-10
Unrestricted Jinja2 Server-Side Template Injection (SSTI)
line-precisefixture-tested
 CRITICAL Standard
PY-SEC-11
Dynamic Code Execution via eval() or exec()
line-precisefixture-tested
UNKNOWN Verified Gate
PY-SEC-12
Weak Cryptographic Hash Algorithm (MD5 / SHA-1)
line-precisefixture-tested
 HIGH Standard
PY-SEC-13
Insecure Temporary File Creation via tempfile.mktemp()
line-precisefixture-tested
 MEDIUM Standard
PY-SEC-14
Server-Side Request Forgery (SSRF) via Dynamic URL Fetch
line-precisefixture-tested
 HIGH Verified Gate
PY-SEC-15
Insecure XML Parser Vulnerable to XML External Entity (XXE)
line-precisefixture-tested
 HIGH Standard
PY-SEC-16
Path Traversal via Unsanitized File Access
line-precisefixture-tested
 HIGH Standard
PY-SEC-17
CSRF Protection Disabled (@csrf_exempt / WTF_CSRF_ENABLED = False)
line-precisefixture-tested
 MEDIUM Standard
PY-SEC-18
SSL / TLS Certificate Verification Disabled (verify=False)
line-precisefixture-tested
 CRITICAL Standard
PY-SEC-19
Insecure Deserialization via shelve or marshal Modules
line-precisefixture-tested
 HIGH Standard
PY-SEC-20
Hardcoded Database Connection String with Credentials
line-precisefixture-tested
 CRITICAL Standard
PY-SEC-21
Paramiko SSH Host Key Auto-Add Policy (AutoAddPolicy)
line-precisefixture-tested
 HIGH Standard
PY-SEC-22
Flask / Django Session Cookie Missing Secure or HttpOnly Flags
line-precisefixture-tested
 MEDIUM Standard
PY-SEC-24
Use of Assert Statement for Security or Authorization Checks
line-precisefixture-tested
 MEDIUM Standard
PY-SEC-25
Flask Weak Default Secret Key
line-precisefixture-tested
 HIGH Standard
PY-SEC-26
Cryptographically Weak PRNG Used for Security Tokens
line-precisefixture-tested
 HIGH Standard
PY-SEC-27
Django ALLOWED_HOSTS Configured with Wildcard (*)
line-precisefixture-tested
 HIGH Standard
PY-SEC-28
Hardcoded AWS Access Key ID in Python Source
line-precisefixture-tested
 CRITICAL Standard
PY-SEC-29
Unvalidated Open Redirect via Dynamic Request URL
line-precisefixture-tested
 MEDIUM Standard
PY-SEC-30
Raw SQL Query with % or .format() String Formatting
line-precisefixture-tested
 CRITICAL Standard
PY-SEC-31
Django Mass Assignment via Unfiltered Request Data Unpacking
line-precisefixture-tested
 HIGH Standard
PY-SEC-32
Insecure LDAP Search Filter String Interpolation
line-precisefixture-tested
 HIGH Standard
PY-SEC-33
Catastrophic Backtracking Regular Expression (ReDoS)
line-precisefixture-tested
 MEDIUM Standard
PY-SEC-34
Hardcoded Private Key in Python Source Code
line-precisefixture-tested
 CRITICAL Standard
PY-SEC-35
Broad Exception Handling Swallowing Critical Errors (except: pass)
line-precisefixture-tested
 LOW Standard
PY-SEC-36
Django SECURE_HSTS_SECONDS Not Configured or Disabled
line-precisefixture-tested
 MEDIUM Standard
PY-SEC-38
Insecure FTPLib Usage Without TLS (Plaintext FTP)
line-precisefixture-tested
 MEDIUM Standard
PY-SEC-39
Insecure Telnetlib Usage (Cleartext Management Protocol)
line-precisefixture-tested
 MEDIUM Standard
PY-SEC-40
Unsafe PyTorch Model Loading via torch.load Without weights_only
line-precisefixture-tested
 HIGH Standard
PY-SEC-41
Insecure TarFile Extraction Vulnerable to Arbitrary File Overwrite
line-precisefixture-tested
 HIGH Standard
PY-SEC-42
Insecure ZipFile Extraction Vulnerable to Zip Slip
line-precisefixture-tested
 HIGH Standard
PY-SEC-43
Insecure Cipher Mode (ECB Mode in PyCryptodome / Cryptography)
line-precisefixture-tested
 HIGH Standard
PY-SEC-44
JWT Signature Verification Disabled in PyJWT
line-precisefixture-tested
 CRITICAL Standard
PY-SEC-45
Missing Request Timeout on Python Requests / HTTPX Calls
line-precisefixture-tested
 LOW Standard
PY-SEC-46
Unrestricted File Upload Without Extension or Content Validation
line-precisefixture-tested
 HIGH Standard
PY-SEC-49
Django SESSION_COOKIE_AGE Overly Permissive (> 30 Days)
line-precisefixture-tested
 LOW Standard
PY-SEC-50
Insecure Multiprocessing Manager Without Authentication Key
line-precisefixture-tested
 HIGH Standard
K8S-01
Privileged Container Execution (privileged: true)
line-precisefixture-tested
 HIGH Standard
K8S-02
Container Allowed to Run as Root User
line-precisefixture-tested
 MEDIUM Standard
K8S-04
Dangerous Host Path Volume Mount (/ or /etc or /var/run)
line-precisefixture-tested
 CRITICAL Standard
K8S-05
AutomountServiceAccountToken Enabled by Default
line-precisefixture-tested
 MEDIUM Standard
K8S-08
Writable Root Filesystem (readOnlyRootFilesystem: false)
line-precisefixture-tested
 MEDIUM Standard
K8S-09
Container Insecure Capability Allocation (ALL or CAP_SYS_ADMIN)
line-precisefixture-tested
 CRITICAL Standard
GO-01
Command Injection via Unsanitized exec.Command Input
line-precisefixture-tested
 CRITICAL Standard
GO-02
SQL Injection via String Concatenation or fmt.Sprintf
line-precisefixture-tested
 CRITICAL Standard
GO-03
Missing Response Body Close (Leaking TCP Sockets)
line-precisefixture-tested
 MEDIUM Standard
GO-05
Data Race on Shared Map Without Mutex or sync.Map
line-precisefixture-tested
 HIGH Standard
GO-06
Path Traversal via Unvalidated File Access in Go Source
line-precisefixture-tested
 HIGH Standard
GO-07
Cross-Site Scripting (XSS) via Unescaped template.HTML
line-precisefixture-tested
 HIGH Standard
GO-08
Hardcoded Secret or API Key in Go Source Code
line-precisefixture-tested
 CRITICAL Standard
GO-09
Weak Cryptographic Algorithm in Go Source (MD5 / SHA1 / DES)
line-precisefixture-tested
 HIGH Standard
GO-10
Insecure TLS Configuration with InsecureSkipVerify: true
line-precisefixture-tested
 CRITICAL Standard
GO-13
Server-Side Request Forgery (SSRF) via Dynamic HTTP Call
line-precisefixture-tested
 HIGH Standard
GO-14
Unbounded Request Body Read (DoS Memory Exhaustion)
line-precisefixture-tested
 MEDIUM Standard
GO-15
Weak Random Number Generator Used in Security Context (math/rand)
line-precisefixture-tested
 HIGH Standard
GO-16
Unsafe Pointer Usage (unsafe.Pointer)
line-precisefixture-tested
 LOW Standard
GO-17
CORS Permissive Wildcard with AllowCredentials in Gin / Echo / Chi
line-precisefixture-tested
 MEDIUM Standard
GO-18
Gin Framework Running in Debug Mode in Production
line-precisefixture-tested
 LOW Standard
GO-19
Open Redirect via http.Redirect with Unsanitized User Input
line-precisefixture-tested
 MEDIUM Standard
GO-20
Missing Read/Write Timeout on http.Server (Slowloris DoS)
line-precisefixture-tested
 MEDIUM Standard
GO-21
Hardcoded Database Connection String with Credentials in Go
line-precisefixture-tested
 CRITICAL Standard
GO-22
Insecure JWT Parsing Without Signature Verification
line-precisefixture-tested
 CRITICAL Standard
GO-23
Insecure SSH Host Key Validation (ssh.InsecureIgnoreHostKey)
line-precisefixture-tested
 CRITICAL Standard
GO-24
Archive Path Traversal (Zip Slip / Tar Slip in Go)
line-precisefixture-tested
 HIGH Standard
GO-27
Nil Pointer Dereference on Unchecked Error Return
line-precisefixture-tested
 MEDIUM Standard
GO-29
Sensitive Information Leak via Insecure Log Output in Go
line-precisefixture-tested
 MEDIUM Standard
GO-32
Insecure Cookie Configuration Missing HttpOnly or Secure Flag
line-precisefixture-tested
 MEDIUM Standard
GO-33
Weak RSA Key Generation (< 2048 Bits) in Go
line-precisefixture-tested
 HIGH Standard
GO-34
Hardcoded AWS Access Key ID in Go Source
line-precisefixture-tested
 CRITICAL Standard
GO-35
Cgo Memory Leak or Missing C.free Call
line-precisefixture-tested
 MEDIUM Standard
GO-37
Context Leak via Missing defer cancel() Call
line-precisefixture-tested
 LOW Standard
GO-38
Unsafe Dynamic Plugin Loading via plugin.Open()
line-precisefixture-tested
 CRITICAL Standard
GO-39
Insecure gRPC Connection via grpc.WithInsecure()
line-precisefixture-tested
 MEDIUM Standard
GO-40
Insecure Temporary File Creation via Path Concatenation
line-precisefixture-tested
 LOW Standard
GO-41
LDAP Injection via Formatted Search Query in Go
line-precisefixture-tested
 HIGH Standard
GO-42
XPath Injection via Unsanitized Query Strings in Go
line-precisefixture-tested
 HIGH Standard
GO-45
Unsafe Deserialization via Gob Decoder on Untrusted Data
line-precisefixture-tested
 MEDIUM Standard
GO-46
Deprecated TLS Minimum Version (TLS 1.0 / TLS 1.1)
line-precisefixture-tested
 HIGH Standard
GO-49
Unbuffered Channel Deadlock Risk in Single Goroutine Flow
line-precisefixture-tested
 MEDIUM Standard
GO-50
Verbose Stack Trace Exposure in HTTP Response (Echo / Fiber)
line-precisefixture-tested
 HIGH Standard
TENANT-02
Tenant Context Leaked Across Async Execution Store
line-precisefixture-tested
 HIGH Standard
TENANT-04
Tenant S3 Storage Prefix Path Traversal Leakage
line-precisefixture-tested
 HIGH Standard
TENANT-06
IDOR - Record Loaded by Request ID Without Owner Scoping
line-precisefixture-tested
 CRITICAL Standard
CLOUD-SEC-01
Publicly Accessible S3 Bucket / Blob Container
line-precisefixture-tested
 CRITICAL Standard
CLOUD-SEC-02
Overprivileged IAM Wildcard Action (*)
line-precisefixture-tested
 CRITICAL Standard
CLOUD-SEC-03
Unencrypted Cloud Storage Volumes at Rest (EBS / Managed Disk)
line-precisefixture-tested
 HIGH Standard
CLOUD-SEC-04
Security Group Ingress Open to 0.0.0.0/0 on Management Ports
line-precisefixture-tested
 CRITICAL Standard
CLOUD-SEC-05
Multi-Cloud Audit Logging / CloudTrail Disabled
line-precisefixture-tested
 HIGH Standard
MOB-SEC-01
Insecure Local Data Storage in Cleartext SharedPreferences
line-precisefixture-tested
 HIGH Verified Gate
MOB-SEC-02
Hardcoded API Keys or OAuth Secrets in Mobile App Bundle
line-precisefixture-tested
 CRITICAL Standard
MOB-SEC-03
Cleartext HTTP Traffic Permitted in Mobile Manifest
line-precisefixture-tested
 HIGH Verified Gate
RULE-9304
TLS Certificate Validation Disabled
line-precisefixture-tested
 HIGH Standard
MOB-SEC-05
Exported Android Component Lacking Permission Guard
line-precisefixture-tested
 HIGH Verified Gate
RULE-9306
WebView Lets file:// Pages Read Local Files
line-precisefixture-tested
 HIGH Standard
RULE-9309
Weak Encryption Mode or Cipher (ECB / DES)
line-precisefixture-tested
 HIGH Standard
RULE-9310
Deep-Link URL Loaded Into a WebView Without a Host Check
line-precisefixture-tested
 HIGH Standard
RULE-9311
App Manifest Marked Debuggable
line-precisefixture-tested
 HIGH Standard
RULE-9312
Secret Written to the Device Log
line-precisefixture-tested
 MEDIUM Verified Gate
RULE-9313
Keychain Item Readable While the Device Is Locked
line-precisefixture-tested
 MEDIUM Standard
RULE-9314
SQLite Query Built by String Concatenation
line-precisefixture-tested
 HIGH Verified Gate
RULE-9315
Auth Token Stored in Unencrypted AsyncStorage
line-precisefixture-tested
 HIGH Standard
RULE-9316
File or Preferences Created World-Readable
line-precisefixture-tested
 HIGH Verified Gate
RULE-9317
FileProvider Exposes the Device Root
line-precisefixture-tested
 MEDIUM Standard
RULE-9318
Credentials Saved to a Plain File
line-precisefixture-tested
 HIGH Verified Gate
EVENT-03
Plaintext Event Broker Transport (Missing SASL / TLS)
line-precisefixture-tested
 CRITICAL Standard
CICD-SEC-01
Dangerous pull_request_target Workflow with Untrusted Checkout
line-precisefixture-tested
 CRITICAL Standard
CICD-SEC-02
Unpinned Third-Party Action Mutable Reference (@v1)
line-precisefixture-tested
 MEDIUM Verified Gate
CICD-SEC-03
Script Injection via Unescaped GitHub Context Expression
line-precisefixture-tested
 CRITICAL Standard
CICD-SEC-04
Overprivileged GITHUB_TOKEN Permissions (permissions: write-all)
line-precisefixture-tested
 HIGH Standard
CICD-SEC-05
Exposed Secret Tokens in Build Log Outputs
line-precisefixture-tested
 LOW Standard
RUST-01
Unsound Unsafe Block Missing Safety Invariant Comment
line-precisefixture-tested
 LOW Standard
RUST-02
Blocking Synchronous I/O Inside Tokio Async Function
line-precisefixture-tested
 MEDIUM Standard
RUST-04
Panic in Drop Trait Implementation (Process Abort)
line-precisefixture-tested
 MEDIUM Standard
RUST-05
SQL Injection via format! String Interpolation in Query
line-precisefixture-tested
 CRITICAL Verified Gate
FINTECH-01
Storage of Sensitive Authentication Data (Card CVV / CVC)
line-precisefixture-tested
 CRITICAL Standard
FINTECH-02
Unmasked Primary Account Number (PAN) Displayed in UI
line-precisefixture-tested
 HIGH Standard
FINTECH-03
Missing Idempotency-Key on Financial Payment Mutation
line-precisefixture-tested
 MEDIUM Standard
FINTECH-04
Insecure Webhook Signature Verification on Payment Callback
line-precisefixture-tested
 CRITICAL Verified Gate
FINTECH-05
Plaintext Cardholder Data Logged to Application Telemetry
line-precisefixture-tested
 HIGH Standard
HIPAA-02
PHI Exposed in URL Query Parameters / Referral Headers
line-precisefixture-tested
 HIGH Standard
HIPAA-04
Third-Party Analytics Tracking Pixels on Health Portal
line-precisefixture-tested
 CRITICAL Standard
HIPAA-05
Automated Session Timeout Missing on Clinical Terminal
line-precisefixture-tested
 MEDIUM Standard
OTEL-02
High-Cardinality Metric Label Explosion (UUID / Timestamp as Tag)
line-precisefixture-tested
 MEDIUM Standard
OTEL-05
Unbounded Telemetry Exporter Buffer (Missing Drop / Batching Policy)
line-precisefixture-tested
 MEDIUM Standard
CPP-SEC-01
Use of Unbounded String Copy Function (strcpy / gets / sprintf)
line-precisefixture-tested
 HIGH Standard
CPP-SEC-02
Use-After-Free Vulnerability (Dangling Pointer Dereference)
line-precisefixture-tested
 CRITICAL Standard
CPP-SEC-03
Double Free Vulnerability (Repeated Deallocation)
line-precisefixture-tested
 CRITICAL Standard
CPP-SEC-04
Integer Overflow Leading to Heap Buffer Overflow in malloc
line-precisefixture-tested
 MEDIUM Standard
ECOMM-01
Inventory Overselling Race Condition (Missing Row-Level Lock)
line-precisefixture-tested
 CRITICAL Standard
ECOMM-02
Client-Supplied Price / Discount Tampering Vulnerability
line-precisefixture-tested
 CRITICAL Standard
ECOMM-04
Negative Quantity Shopping Cart Exploit (Price Inversion)
line-precisefixture-tested
 HIGH Standard
ECOMM-05
Shopping Cart Session Hijacking via Predictable Cart ID
line-precisefixture-tested
 HIGH Standard
GRPC-03
Plaintext Insecure Channel Credentials in Production
line-precisefixture-tested
 MEDIUM Standard
GRPC-05
Unprotected gRPC Server Reflection in Public Production
line-precisefixture-tested
 MEDIUM Standard
PG-05
Deadlock Risk from Non-Deterministic Lock Acquisition Order
line-precisefixture-tested
 LOW Standard
WAF-02
Missing Edge Rate Limiting on High-Cost AI Inference Endpoints
line-precisefixture-tested
 HIGH Standard
WAF-05
Unchecked HTTP Request Body Size Exceeding Edge WAF Inspection Buffer
line-precisefixture-tested
 LOW Standard
WS-01
Missing WebSocket Heartbeat Ping/Pong Health Interval
line-precisefixture-tested
 LOW Standard
WS-02
Missing Authentication Handshake Guard on WebSocket Upgrade
line-precisefixture-tested
 CRITICAL Standard
WS-03
Cross-Site WebSocket Hijacking (CSWSH) via Unvalidated Origin
line-precisefixture-tested
 CRITICAL Standard
WS-05
Socket Reconnection Storm Flooding Backend Gateways
line-precisefixture-tested
 MEDIUM Standard
CACHE-03
Unauthenticated Redis Port Bound to Public Network Interfaces (0.0.0.0)
line-precisefixture-tested
 CRITICAL Standard
CACHE-04
Unsafe Lua Script Execution Susceptible to Injection or Infinite Loops
line-precisefixture-tested
 HIGH Standard
CACHE-05
Unpartitioned Large Cache Key Degradation (>1MB Payload Blob)
line-precisefixture-tested
 MEDIUM Standard
ISO-02
Privileged Access Rights Granted Without Documented Approval (A.5.18)
line-precisefixture-tested
 MEDIUM Standard
OAUTH-02
Permissive Wildcard Redirect URI in OAuth Client Configuration
line-precisefixture-tested
 HIGH Standard
OAUTH-03
Missing Cryptographic State / Nonce Parameter on Social Auth Handshake
line-precisefixture-tested
 HIGH Standard
OAUTH-05
Use of Deprecated Resource Owner Password Credentials (ROPC) Grant
line-precisefixture-tested
 MEDIUM Standard
TF-01
Unencrypted Cloud State Backend (Missing SSE on S3 / GCS State Bucket)
line-precisefixture-tested
 MEDIUM Standard
TF-02
Missing State Locking on Distributed Terraform Backend (DynamoDB Table)
line-precisefixture-tested
 MEDIUM Standard
TF-03
Security Group Ingress Open to the World on Administrative Ports (0.0.0.0/0)
line-precisefixture-tested
 CRITICAL Standard
TF-04
Hardcoded Cloud Provider Access Keys in Terraform Files
line-precisefixture-tested
 CRITICAL Standard
TF-05
Unversioned Terraform Provider / Module References (Floating Dependencies)
line-precisefixture-tested
 MEDIUM Standard
MESH-01
Permissive mTLS Mode in Service Mesh Ingress (Missing STRICT Mode)
line-precisefixture-tested
 CRITICAL Standard
MESH-04
Active Fault Injection Delay / Abort Remaining in Production
line-precisefixture-tested
 MEDIUM Standard
SLS-01
HTTP Function Timeout Above the API Gateway Limit (Runaway Billing)
line-precisefixture-tested
 MEDIUM Standard
SLS-02
Database Client Created Per Invocation Inside Lambda Handler
line-precisefixture-tested
 MEDIUM Standard
GW-04
Oversized Header Buffer Parsing Attack (HTTP 431 Vulnerability)
line-precisefixture-tested
 HIGH Standard
DNS-04
Unrestricted Zone Transfer (AXFR) Allowed on Public Nameservers
line-precisefixture-tested
 CRITICAL Standard
GRPH-01
Unbounded Cypher Traversal Missing Maximum Hop Limit
line-precisefixture-tested
 MEDIUM Standard
GRPH-02
Cypher Query String Concatenation Permitting Injection
line-precisefixture-tested
 CRITICAL Standard
AUDIT-01
Plaintext Credentials or PII Leaked in Application Logs
line-precisefixture-tested
 CRITICAL Standard
CONTAINER-01
Privileged Container Execution with Full Host Access
line-precisefixture-tested
 CRITICAL Standard
CONTAINER-02
Root User Execution in Container Runtime Image
line-precisefixture-tested
 HIGH Standard
CONTAINER-03
Writable Root Filesystem Allowing Malicious Binary Droppers
line-precisefixture-tested
 MEDIUM Standard
CONTAINER-04
Host Network Namespace Sharing Permitting Network Sniffing
line-precisefixture-tested
 CRITICAL Standard
CONTAINER-05
Exposed Docker Daemon Unix Socket Inside Container
line-precisefixture-tested
 MEDIUM Standard
TLS-01
Deprecated TLS 1.0 / 1.1 Protocols Permitted on Public Endpoints
line-precisefixture-tested
 HIGH Standard
TLS-02
Weak Cipher Suite Enabled (RC4 / 3DES / NULL / EXPORT)
line-precisefixture-tested
 HIGH Standard
TLS-04
TLS Certificate Verification Disabled (rejectUnauthorized: false)
line-precisefixture-tested
 HIGH Standard
MQ-02
Unbounded Prefetch Count Causing Consumer Starvation and Crash
line-precisefixture-tested
 MEDIUM Standard
MQ-03
Unsafe Message Deserialization Permitting Arbitrary Object Injection
line-precisefixture-tested
 CRITICAL Standard
MQ-04
Missing Publisher Confirms / Acknowledgments Leading to Data Loss
line-precisefixture-tested
 MEDIUM Standard
MQ-06
Failed Message Is Requeued Forever From the Error Handler
line-precisefixture-tested
 HIGH Standard
SBOM-03
SLSA Level 3 Provenance Attestation Missing in CI/CD Build Pipeline
line-precisefixture-tested
 LOW Standard
SBOM-05
Unvetted Third-Party GitHub Actions in Production CI/CD Workflows
line-precisefixture-tested
 MEDIUM Verified Gate
WASM-01
Unbounded WebAssembly Linear Memory Allocation
line-precisefixture-tested
 MEDIUM Standard
WASM-03
Unrestricted WASI Filesystem Preopens Permitting Host Traversal
line-precisefixture-tested
 CRITICAL Standard
SSO-02
SAML Audience Validation Disabled (audience: false)
line-precisefixture-tested
 HIGH Standard
SSO-03
SAML InResponseTo Validation Disabled (Response Replay)
line-precisefixture-tested
 MEDIUM Standard
PCI4-02
PCI-DSS Req 6.4.3 Insecure Third-Party Scripts on Payment Pages
line-precisefixture-tested
 HIGH Standard
SEARCH-02
Unindexed Leading Wildcard Search Triggering Full Cluster Scans
line-precisefixture-tested
 MEDIUM Standard
SEARCH-04
Fielddata Memory Leakage on High-Cardinality Analyzed Text
line-precisefixture-tested
 MEDIUM Standard
SDP-02
Split-Tunneling Configuration Permitting DNS Request Leakage
line-precisefixture-tested
 MEDIUM Standard
SDP-03
Inbound Perimeter Firewall Ports Open to Public Internet
line-precisefixture-tested
 CRITICAL Standard
SDP-05
Hardcoded WireGuard Private Key in Infrastructure Repositories
line-precisefixture-tested
 CRITICAL Standard
OPA-02
Admission Webhook Fail-Open Misconfiguration in Production
line-precisefixture-tested
 LOW Standard
CRYPTO-01
Hardcoded Cryptographic Keys and Static Salts in Source Code
line-precisefixture-tested
 CRITICAL Verified Gate
CRYPTO-02
Missing Automated Master Key Rotation Schedule Exceeding 90 Days
line-precisefixture-tested
 LOW Standard
CRYPTO-03
Insecure Legacy Cipher Modes Permitted (AES-ECB / Unauthenticated CBC)
line-precisefixture-tested
 CRITICAL Standard
CRYPTO-04
Cryptographic Nonce Reuse in Galois/Counter Mode (GCM) Encryption
line-precisefixture-tested
 CRITICAL Standard
CRYPTO-05
Weak Asymmetric Key Strengths (RSA < 3072 bits or ECC < 256 bits)
line-precisefixture-tested
 HIGH Standard
VECTOR-03
Unbounded Similarity Query Limit (top_k > 1000) Causing Memory Exhaustion
line-precisefixture-tested
 MEDIUM Standard
THREAT-04
MITRE T1003 OS Credential Dumping: Unauthorized Reading of Host Credential Files
line-precisefixture-tested
 HIGH Standard
FED-03
Unprotected Subgraph Introspection in Production
line-precisefixture-tested
 MEDIUM Standard
ASVS-05
ASVS V6.2 Cryptographic Storage: Using Insecure Random Salt or Low Iteration Counts
line-precisefixture-tested
 MEDIUM Standard
TSDB-03
High-Cardinality Tag Explosion Exhausting TSDB Inverted Index Memory
line-precisefixture-tested
 MEDIUM Standard
EBPF-02
Insecure BPF Syscall Permissions Permitting Unprivileged Loading
line-precisefixture-tested
 CRITICAL Standard
MQOPT-03
Default Guest Credentials Enabled on Message Broker Management UI
line-precisefixture-tested
 CRITICAL Standard
GRPCSEC-01
Insecure Plaintext gRPC Channel Instantiation in Production
line-precisefixture-tested
 MEDIUM Standard
GRPCSEC-03
Unbounded gRPC Inbound Message Size Permitting Memory Exhaustion
line-precisefixture-tested
 HIGH Standard
CSPM-01
Unrestricted Cloud Storage Bucket Public Read/Write Access
line-precisefixture-tested
 CRITICAL Standard
CSPM-02
Overprivileged Cloud IAM Roles with Wildcard Actions (*:*)
line-precisefixture-tested
 CRITICAL Standard
CSPM-04
Cloud Security Group Permitting Inbound SSH/RDP from 0.0.0.0/0
line-precisefixture-tested
 CRITICAL Standard
CSPM-05
Cloud Audit Trails (CloudTrail / Audit Logs) Disabled in Region
line-precisefixture-tested
 MEDIUM Standard
KERN-SEC-01
Unrestricted Linux Root Capabilities (CAP_SYS_ADMIN) Retained in Container Workloads
line-precisefixture-tested
 HIGH Standard
KERN-SEC-02
Missing Seccomp BPF Syscall Filtering on High-Privilege Worker Daemons
line-precisefixture-tested
 MEDIUM Standard
KERN-SEC-04
Kernel eBPF JIT Hardening Disabled Allowing Speculative Execution Leakage
line-precisefixture-tested
 MEDIUM Standard
KERN-SEC-05
Kernel Page Table Isolation (KPTI) Disabled in Boot Parameters
line-precisefixture-tested
 HIGH Standard
PHP-SEC-01
SQL Injection via Unparameterized Query Concatenation
line-precisefixture-tested
 CRITICAL Verified Gate
PHP-SEC-02
Local File Inclusion (LFI) via Dynamic include/require
line-precisefixture-tested
 CRITICAL Standard
PHP-SEC-03
OS Command Injection via shell_exec / system
line-precisefixture-tested
 CRITICAL Verified Gate
PHP-SEC-04
Insecure PHP Object Deserialization via unserialize()
line-precisefixture-tested
 CRITICAL Standard
PHP-SEC-05
Reflected Cross-Site Scripting (XSS) via Direct Echo
line-precisefixture-tested
 HIGH Standard
JAVA-SEC-01
SQL Injection via String Concatenation in Statement Execution
line-precisefixture-tested
 CRITICAL Standard
JAVA-SEC-02
Hardcoded Password or Secret Key in Java Source Code
line-precisefixture-tested
 HIGH Standard
JAVA-SEC-03
Unrestricted Java Deserialization via ObjectInputStream.readObject
line-precisefixture-tested
 CRITICAL Verified Gate
JAVA-SEC-04
Log4Shell / JNDI Remote Code Execution Pattern (CVE-2021-44228)
line-precisefixture-tested
 CRITICAL Standard
JAVA-SEC-05
Cryptographically Weak Cipher or Hash in Java (DES / RC4 / MD5 / ECB)
line-precisefixture-tested
 HIGH Standard
CS-SEC-01
C# SQL Injection via SqlCommand Interpolation / Concatenation
line-precisefixture-tested
 CRITICAL Standard
CS-SEC-02
Cryptographically Broken Hash / Cipher Algorithm (MD5 / SHA1 / DES)
line-precisefixture-tested
 HIGH Standard
CS-SEC-03
Insecure .NET Deserialization via BinaryFormatter (RCE Hazard)
line-precisefixture-tested
 CRITICAL Standard
RUBY-SEC-01
Ruby on Rails SQL Injection in ActiveRecord Query Interpolation
line-precisefixture-tested
 CRITICAL Verified Gate
RUBY-SEC-02
Insecure Mass Assignment via params.permit!
line-precisefixture-tested
 HIGH Verified Gate
RUBY-SEC-03
Remote Code Execution via eval with Unsanitized Parameters
line-precisefixture-tested
 CRITICAL Standard
NOSQL-SEC-01
MongoDB $where Arbitrary JavaScript Evaluation Injection
line-precisefixture-tested
 CRITICAL Standard
NODE-SQL-01
Node.js Database Query Formatted via String Concatenation
line-precisefixture-tested
 CRITICAL Standard
FIREBASE-SEC-01
Insecure Firebase Security Rules (Unauthenticated Public Read/Write)
line-precisefixture-tested
 CRITICAL Standard
MYSQL-SEC-01
MySQL Raw Query Injection via Python String Interpolation
line-precisefixture-tested
 CRITICAL Standard
MONGO-SEC-01
MongoDB NoSQL Injection via $where or Unvalidated Object Filter
line-precisefixture-tested
 CRITICAL Standard
REDIS-SEC-01
Insecure Redis Command Invocation or Lua Script Concatenation
line-precisefixture-tested
 HIGH Standard
ORM-RAW-01
ORM Raw Query Injection via Unsafe String Interpolation
line-precisefixture-tested
 CRITICAL Standard
SQLITE-SEC-01
Sensitive SQLite Database File Stored in Public Web Root
line-precisefixture-tested
 CRITICAL Standard
RULE-23001
RLS Policy Grants Every Signed-In User Access to All Rows
line-precisefixture-tested
 HIGH Standard
RULE-23002
Server Authorization Based on Supabase getSession()
line-precisefixture-tested
 HIGH Standard
RULE-23003
SECURITY DEFINER Function Without a Fixed search_path
line-precisefixture-tested
 HIGH Verified Gate
RULE-23004
Payment Amount or Price Controlled by the Client
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-23005
Secret Compared With === Instead of a Constant-Time Check
line-precisefixture-tested
 MEDIUM Standard
RULE-23006
Cron Endpoint Without a Secret Check
line-precisefixture-tested
 HIGH Standard
RULE-23007
User Input Interpolated Into the System Prompt (Prompt Injection)
line-precisefixture-tested
 HIGH Standard
RULE-23008
Next.js Version Vulnerable to Middleware Authorization Bypass (CVE-2025-29927)
line-precisefixture-tested
UNKNOWN Verified Gate
RULE-24001
Insecure Deserialization With a Function-Reviving Library (RCE)
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-24002
XML External Entity (XXE) Expansion Enabled
line-precisefixture-tested
 HIGH Verified Gate
RULE-24101
SQL Injection: Query Built From Dynamic Values
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-24102
OS Command Injection: Shell Command Built From Dynamic Values
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-24103
Insecure Deserialization of Untrusted Data
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-24104
XML External Entity (XXE) Processing Enabled
line-precisefixture-tested
 HIGH Verified Gate
RULE-24105
Cross-Site Scripting (XSS): Output Escaping Bypassed
line-precisefixture-tested
 HIGH Verified Gate
RULE-24106
File Inclusion: include/require With a Request-Controlled Path
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-24107
Unrestricted File Upload
line-precisefixture-tested
 HIGH Verified Gate
RULE-24108
Weak Password Hashing (MD5 / SHA-1)
line-precisefixture-tested
 HIGH Verified Gate
RULE-24109
TLS Certificate Validation Disabled
line-precisefixture-tested
 HIGH Standard
RULE-24110
Path Traversal: File Path Built From Request Input
line-precisefixture-tested
 HIGH Standard
SEC-API-01
Mass Assignment via Unvalidated Request Body (OWASP API3:2023)
line-precisefixture-tested
 CRITICAL Standard
SEC-SSRF-01
Server-Side Request Forgery (SSRF) via Dynamic Fetch
line-precisefixture-tested
 HIGH Standard
SEC-A10-01
OWASP 2025 A10 Fail-Open Exception in Authorization Guard
line-precisefixture-tested
 CRITICAL Standard
SEC-ERR-02
Verbose Stack Trace & System Error Leakage in API Response
line-precisefixture-tested
 MEDIUM Standard
DEP-01
${dep.name}@${dep.version} has ${list.length} known vulnerabilit${list.length === 1 ?
line-precisefixture-tested
UNKNOWN Verified Gate
LIVE-01
Environment file publicly downloadable (${envFiles.map((f) => f.path).join(
line-precisefixture-tested
 CRITICAL Standard
LIVE-02
Git repository metadata publicly downloadable (${gitFiles.map((f) => f.path).join(
line-precisefixture-tested
 HIGH Standard
LIVE-03
Site is served over plain HTTP only (no HTTPS on port 443)
line-precisefixture-tested
 HIGH Standard
LIVE-04
TLS certificate is not trusted (${probe.tls.authorizationError ||
line-precisefixture-tested
 CRITICAL Standard
LIVE-05
TLS certificate expires in ${daysLeft} day${daysLeft === 1 ?
line-precisefixture-tested
UNKNOWN Standard
LIVE-06
HTTP requests are not redirected to HTTPS
line-precisefixture-tested
 MEDIUM Standard
LIVE-07
Session cookie set without ${[...new Set(probe.insecureCookies.flatMap((c) => c.missing))].join(
line-precisefixture-tested
 MEDIUM Standard
RULE-27008
Database dump publicly downloadable
line-precisefixture-tested
 CRITICAL Standard
RULE-27009
Cloud / deploy credentials publicly downloadable
line-precisefixture-tested
 CRITICAL Standard
RULE-27010
Debug or log endpoint publicly reachable
line-precisefixture-tested
 HIGH Standard
RULE-27011
Database / search admin console publicly reachable
line-precisefixture-tested
 HIGH Standard
RULE-27012
Build / deployment configuration publicly downloadable
line-precisefixture-tested
 MEDIUM Standard
LIVE-13
Live exposure checks incomplete (${cov.answered}/${cov.total} paths checked)
line-precisefixture-tested
 LOW Standard
SEC-SSRF-01
Server-Side Request Forgery (SSRF) in Outbound Fetch / Webhook Dispatch
line-precisefixture-tested
 CRITICAL Verified Gate
RUBY-SEC-01
Unsafe YAML Deserialization
line-precisefixture-tested
 CRITICAL Standard
PHP-SEC-01
PHP Object Injection via unserialize()
line-precisefixture-tested
 CRITICAL Standard
DOTNET-SEC-01
Insecure XML Deserialization
line-precisefixture-tested
 CRITICAL Standard
RULE-27211
SCA: ${cveDef.cveId} - ${cveDef.title} (${pkgName}@${versionSpec})
line-precisefixture-tested
UNKNOWN Standard
RULE-27212
SCA: Deprecated Supply Chain Dependency
line-precisefixture-tested
 MEDIUM Standard
RULE-27214
SCA: ${info.cve} - ${info.title} (${pkg})
line-precisefixture-tested
 HIGH Standard
CLICHE-AI-COMMENT-01
Synthetic LLM Prompt Artifact & Header Injection
line-precisefixture-tested
 LOW Standard
CLICHE-AI-COMMENT-03
Unresolved AI Placeholder / Incomplete Code Comment
line-precisefixture-tested
 MEDIUM Standard
REDIS-SEC-02
Publicly Exposed Redis Port Without Password Authentication
line-precisefixture-tested
 CRITICAL Standard
RULE-28001
Server Action Uses the Service-Role Client Without Verifying the Caller
line-precisefixture-tested
 CRITICAL Standard
RULE-28002
Route Handler Uses the Service-Role Client Without Verifying the Caller
line-precisefixture-tested
 CRITICAL Standard
RULE-28003
Authorization Decision Based on Supabase user_metadata
line-precisefixture-tested
 HIGH Standard
RULE-28004
Database Authorization Trusts User-Editable user_metadata
line-precisefixture-tested
 HIGH Standard
RULE-28005
Storage Policy Lets Any User Overwrite or Delete Every File in the Bucket
line-precisefixture-tested
 HIGH Verified Gate
RULE-28006
Public View Bypasses Row Level Security (Missing security_invoker)
line-precisefixture-tested
 MEDIUM Standard
RULE-28007
SECURITY DEFINER Function Writes Data Without Checking the Caller
line-precisefixture-tested
UNKNOWN Standard
RULE-28008
Middleware Passes Request Headers as Response Headers (CVE-2025-57822)
line-precisefixture-tested
 HIGH Standard
RULE-28009
Image Optimizer Allows Any Remote Host (remotePatterns hostname
line-precisefixture-tested
 MEDIUM Standard
RULE-28010
dangerouslyAllowSVG Enabled Without an Image Content-Security-Policy
line-precisefixture-tested
 MEDIUM Standard
RULE-28011
Server Actions allowedOrigins Accepts Any Origin
line-precisefixture-tested
 MEDIUM Standard
RULE-28012
Auth Token Cookie Set Without httpOnly
line-precisefixture-tested
 MEDIUM Standard
RULE-28013
Open Redirect Through a Request-Controlled Redirect Target
line-precisefixture-tested
 MEDIUM Standard
RULE-28014
Record Owner Taken From the Request Instead of the Session
line-precisefixture-tested
 HIGH Standard
RULE-28015
Next.js Version Vulnerable to React2Shell RCE (CVE-2025-66478 / CVE-2025-55182)
line-precisefixture-tested
UNKNOWN Standard
RULE-28016
Users Can Update Their Own Privilege or Billing Column Through RLS
line-precisefixture-tested
 HIGH Standard
RULE-28017
Supabase Signed URL Valid for a Year or More
line-precisefixture-tested
 LOW Standard
RULE-28101
Path Traversal in res.sendFile / res.download (CWE-22)
line-precisefixture-tested
 HIGH Standard
RULE-28102
Prototype Pollution via Request-Controlled Object Keys (CWE-1321)
line-precisefixture-tested
 HIGH Standard
RULE-28103
NoSQL / ORM Operator Injection via Request Object Used as Query Filter (CWE-943)
line-precisefixture-tested
 HIGH Standard
RULE-28104
Login Query Matches the Request Password in the Database Filter
line-precisefixture-tested
 HIGH Standard
RULE-28105
Regular Expression Built From Request Input (ReDoS / Regex Injection, CWE-1333)
line-precisefixture-tested
 MEDIUM Standard
RULE-28106
Hardcoded JWT Signing Secret in Source Code (CWE-798)
line-precisefixture-tested
 HIGH Standard
RULE-28107
HMAC Signature Compared With === (Timing Attack, CWE-208)
line-precisefixture-tested
 MEDIUM Standard
RULE-28108
Deprecated crypto.createCipher Without IV (Weak Key Derivation, CWE-327)
line-precisefixture-tested
 HIGH Standard
RULE-28109
Static / Zero IV Passed to createCipheriv (CWE-329)
line-precisefixture-tested
 MEDIUM Standard
RULE-28110
Reflected XSS: Request Input Interpolated Into an HTML Response (CWE-79)
line-precisefixture-tested
 HIGH Standard
RULE-28111
Template Path Injection: res.render View Name From Request (CWE-73)
line-precisefixture-tested
 HIGH Standard
RULE-28112
Request Object Passed as Template Locals (EJS / hbs Option Injection RCE)
line-precisefixture-tested
 HIGH Standard
RULE-28113
Zip Slip: Archive Entry Name Used as an Output Path (CWE-22)
line-precisefixture-tested
 HIGH Standard
RULE-28114
Remote Code Execution: node:vm Evaluates Request Input (CWE-94)
line-precisefixture-tested
 CRITICAL Standard
RULE-28115
vm2 Sandbox Used to Run Code (Abandoned, Known Escapes)
line-precisefixture-tested
 HIGH Standard
RULE-28116
Command Injection: spawn / execFile With Request-Controlled Command or shell: true (CWE-78)
line-precisefixture-tested
 CRITICAL Standard
RULE-28117
Dynamic require() / import() of Request Input (CWE-94)
line-precisefixture-tested
 CRITICAL Standard
RULE-28118
Server-Side Request Forgery: Outbound Request to a Request-Supplied URL (CWE-918)
line-precisefixture-tested
 HIGH Standard
RULE-28119
Open Redirect to a Request-Supplied URL (CWE-601)
line-precisefixture-tested
 MEDIUM Standard
RULE-28120
Password Reset / Verification Link Built From the Host Header (CWE-640)
line-precisefixture-tested
 HIGH Standard
RULE-28121
Password Hashed With a Fast SHA-2 Digest (CWE-916)
line-precisefixture-tested
 HIGH Standard
RULE-28122
CORS Reflects Any Origin With Credentials Allowed (CWE-942)
line-precisefixture-tested
 HIGH Standard
RULE-28123
Static File Server Exposes the Project Directory (.env, Source Code)
line-precisefixture-tested
 HIGH Standard
RULE-28124
JWT Algorithm Confusion: HMAC and Public-Key Algorithms Accepted Together
line-precisefixture-tested
 HIGH Standard
RULE-28125
SQL Injection: Request Input Interpolated Into a Raw Query Fragment (CWE-89)
line-precisefixture-tested
 CRITICAL Standard
RULE-28201
LLM Provider API Key Exposed Through a Public Env Prefix
line-precisefixture-tested
UNKNOWN Standard
RULE-28202
LLM Output Executed as Code or Shell Command
line-precisefixture-tested
 CRITICAL Standard
RULE-28203
LLM-Generated SQL Executed Without Restriction
line-precisefixture-tested
 HIGH Standard
RULE-28204
Agent / MCP Tool Executes Model-Supplied Shell Command or Code
line-precisefixture-tested
 HIGH Standard
RULE-28205
Agent / MCP Tool Reads or Writes a Model-Supplied File Path Unchecked
line-precisefixture-tested
 HIGH Standard
RULE-28206
LLM SDK Used in the Browser With a Bundled API Key (dangerouslyAllowBrowser)
line-precisefixture-tested
 HIGH Standard
RULE-28207
LangChain Agent Given an Unsandboxed Python / Shell Interpreter
line-precisefixture-tested
 HIGH Standard
RULE-28251
pull_request_target Checks Out and Runs Untrusted PR Code (Pwn Request)
line-precisefixture-tested
 CRITICAL Standard
RULE-28252
workflow_run Checks Out and Runs the Triggering PR Head (Pwn Request)
line-precisefixture-tested
 CRITICAL Standard
RULE-28253
Script Injection via workflow_run / toJSON(github.event) Expression in run:
line-precisefixture-tested
 CRITICAL Standard
RULE-28254
Comment-Triggered Workflow Runs PR Code Without a Permission Check
line-precisefixture-tested
 HIGH Standard
RULE-28255
Artifact Contents Written to GITHUB_ENV / GITHUB_PATH in a Privileged Workflow
line-precisefixture-tested
 HIGH Standard
RULE-28256
Insecure Workflow Commands Re-Enabled (ACTIONS_ALLOW_UNSECURE_COMMANDS)
line-precisefixture-tested
 HIGH Standard
RULE-28257
Workspace Uploaded as Artifact With Persisted Git Credentials (ArtiPACKED)
line-precisefixture-tested
 HIGH Standard
RULE-28258
Spoofable Bot Check (github.actor) Guards a Privileged Workflow
line-precisefixture-tested
 MEDIUM Standard
RULE-28301
Hugging Face Model Loaded With trust_remote_code=True and No Pinned Revision
line-precisefixture-tested
 MEDIUM Standard
RULE-28302
LangChain Agent Allowed to Send Arbitrary HTTP Requests (allow_dangerous_requests)
line-precisefixture-tested
 HIGH Standard
RULE-28303
LangChain Chain That Executes Model-Written Code (PAL / Bash / SymbolicMath)
line-precisefixture-tested
 HIGH Standard
RULE-28304
MCP stdio Server Command Taken From the Request (Remote Code Execution)
line-precisefixture-tested
 CRITICAL Standard
RULE-28305
MCP Server Forwards the Client\
line-precisefixture-tested
 MEDIUM Standard
RULE-28306
HTTP MCP Server Listens on All Interfaces Without Authentication
line-precisefixture-tested
 MEDIUM Standard
RULE-28307
LLM Output Inserted as Raw HTML (v-html / {@html} / innerHTML +=)
line-precisefixture-tested
 HIGH Standard
RULE-28308
Chat Markdown Rendered With rehype-raw and No Sanitizer
line-precisefixture-tested
 MEDIUM Standard
RULE-28309
Agent / MCP Tool Fetches a Model-Supplied URL Without SSRF Checks
line-precisefixture-tested
 HIGH Standard
RULE-28310
Client-Chosen Model ID Passed to the LLM Provider Unchecked
line-precisefixture-tested
 MEDIUM Standard
RULE-28311
Vector Search Namespace / Tenant Filter Taken From the Request
line-precisefixture-tested
 HIGH Standard
RULE-28312
Secret Environment Variable Interpolated Into an LLM Prompt
line-precisefixture-tested
 HIGH Standard
RULE-28313
LLM Client Base URL Taken From the Request (Server API Key Exfiltration / SSRF)
line-precisefixture-tested
 HIGH Standard
RULE-28314
Keras Model Loaded With Safe Mode Disabled
line-precisefixture-tested
 MEDIUM Standard
RULE-28315
Downloaded Model Deserialized With a Pickle-Based Loader (joblib / dill / read_pickle)
line-precisefixture-tested
 MEDIUM Standard
RULE-28316
Ollama API Port Published on All Interfaces
line-precisefixture-tested
 MEDIUM Standard
RULE-28401
Authentication Handler Logs the Raw Request Body (Plaintext Password)
line-precisefixture-tested
 HIGH Standard
RULE-28402
Password, Government ID or Card Data Sent to an Analytics / Monitoring Vendor
line-precisefixture-tested
 HIGH Standard
RULE-28403
E-mail Address Used as the Google Analytics User ID
line-precisefixture-tested
 MEDIUM Standard
RULE-28404
Auth Handler Returns the User Record Including the Password Hash
line-precisefixture-tested
 HIGH Standard
RULE-28405
Full Request Headers or Cookies Written to Logs
line-precisefixture-tested
 MEDIUM Standard
RULE-28406
DRF Serializer Exposes Every User Field (fields =
line-precisefixture-tested
 HIGH Standard
RULE-28407
Django User Rows Serialized Without a Field List (Password Hash Exposed)
line-precisefixture-tested
 HIGH Standard
RULE-28408
Laravel User Model Does Not Hide the Password Hash
line-precisefixture-tested
 HIGH Standard
RULE-28409
Password or Card Data Stored in Browser Storage
line-precisefixture-tested
 HIGH Standard
RULE-28410
Database Dump Uploaded With a Public ACL
line-precisefixture-tested
 HIGH Standard
RULE-28411
Storage Bucket for Identity, Medical or Financial Documents Is Public
line-precisefixture-tested
 HIGH Standard
RULE-28412
FastAPI Route Returns the User ORM Object Without a response_model
line-precisefixture-tested
 HIGH Standard
RULE-28413
Request Logger Writes Every Request Body to the Logs
line-precisefixture-tested
 MEDIUM Standard
RULE-28414
Session Replay Records Unmasked Page Text
line-precisefixture-tested
 MEDIUM Standard
RULE-28501
Database or File Storage Encryption Explicitly Disabled
line-precisefixture-tested
 MEDIUM Standard
RULE-28502
Managed Data Service Publicly Accessible (publicly_accessible = true)
line-precisefixture-tested
 HIGH Standard
RULE-28503
IAM Role Trust Policy Allows Any AWS Principal to Assume the Role
line-precisefixture-tested
 CRITICAL Standard
RULE-28504
Lambda Permission Lets Any AWS Account Invoke the Function
line-precisefixture-tested
 HIGH Standard
RULE-28505
Resource Policy Grants Access to Everyone (Principal
line-precisefixture-tested
 HIGH Standard
RULE-28506
GCP Firewall Allows SSH or RDP From the Internet (0.0.0.0/0)
line-precisefixture-tested
 HIGH Standard
RULE-28507
Azure NSG Rule Allows SSH or RDP From the Internet
line-precisefixture-tested
 HIGH Standard
RULE-28508
Cloud SQL Instance Authorizes Connections From Any IP (0.0.0.0/0)
line-precisefixture-tested
 HIGH Standard
RULE-28509
Azure Database Firewall Rule Allows All IPv4 Addresses (0.0.0.0 - 255.255.255.255)
line-precisefixture-tested
 HIGH Standard
RULE-28510
Azure Storage Container Allows Anonymous Listing (container_access_type =
line-precisefixture-tested
 MEDIUM Standard
RULE-28511
GCP IAM Grants Privileged Access to allUsers / allAuthenticatedUsers
line-precisefixture-tested
 CRITICAL Standard
RULE-28512
Cloud Resource Accepts Deprecated TLS 1.0 / 1.1 Connections
line-precisefixture-tested
 MEDIUM Standard
RULE-28513
Managed Kubernetes Cluster With RBAC Disabled or Legacy ABAC Enabled
line-precisefixture-tested
 HIGH Standard
RULE-28514
Kubernetes RBAC Role Grants All Verbs on All Resources (*)
line-precisefixture-tested
 HIGH Standard
RULE-28515
Kubernetes RoleBinding Grants Access to Anonymous or All Authenticated Users
line-precisefixture-tested
 CRITICAL Standard
RULE-28516
cluster-admin Bound to a Workload ServiceAccount
line-precisefixture-tested
 HIGH Standard
RULE-28517
Container Explicitly Allows Privilege Escalation (allowPrivilegeEscalation: true)
line-precisefixture-tested
 MEDIUM Standard
RULE-28518
Container Seccomp / AppArmor / SELinux Confinement Disabled
line-precisefixture-tested
 MEDIUM Standard
RULE-28519
Plaintext Credential in Kubernetes Container env Value
line-precisefixture-tested
 MEDIUM Standard
RULE-28520
Dockerfile Pipes a Script Fetched Without TLS Verification Into a Shell
line-precisefixture-tested
 HIGH Standard
RULE-28521
Dockerfile ADD Downloads a Build Input Over Plain HTTP
line-precisefixture-tested
 MEDIUM Standard
RULE-28522
Compose Service Shares the Host PID Namespace
line-precisefixture-tested
 HIGH Standard
RULE-28523
Compose Service Uses the Host Network Stack (network_mode: host)
line-precisefixture-tested
 MEDIUM Standard
RULE-28524
Docker Engine API Exposed on Unauthenticated TCP Port 2375
line-precisefixture-tested
 CRITICAL Standard
RULE-28525
Kubernetes Control Plane or Kubelet Authorization Disabled
line-precisefixture-tested
 CRITICAL Standard
RULE-28601
Image Missing alt Text
line-precisefixture-tested
 MEDIUM Standard
RULE-28602
Button or Link Without an Accessible Name (Icon-Only or Empty)
line-precisefixture-tested
 MEDIUM Standard
RULE-28603
Positive tabIndex Overrides Natural Focus Order
line-precisefixture-tested
 LOW Standard
RULE-28604
aria-hidden on a Focusable Element
line-precisefixture-tested
 MEDIUM Standard
RULE-28605
Invalid ARIA Attribute Name
line-precisefixture-tested
 MEDIUM Standard
RULE-28606
Invalid or Abstract ARIA Role
line-precisefixture-tested
 MEDIUM Standard
RULE-28607
Anchor Used as a Button (onClick With No Real href)
line-precisefixture-tested
 MEDIUM Standard
RULE-28608
iframe Missing title
line-precisefixture-tested
 MEDIUM Standard
RULE-28609
Password Field Disables Password Managers (autocomplete=
line-precisefixture-tested
 LOW Standard
RULE-28610
Paste Blocked on Input Field
line-precisefixture-tested
 MEDIUM Standard
RULE-28611
Deprecated Moving Content Element (<marquee> / <blink>)
line-precisefixture-tested
 LOW Standard
RULE-28612
<label> Not Associated With a Form Control
line-precisefixture-tested
 LOW Standard
RULE-28614
Widget Role on an Element That Cannot Receive Focus
line-precisefixture-tested
 MEDIUM Standard
RULE-28615
Custom Button or Link Handles Click but Not Keyboard
line-precisefixture-tested
 MEDIUM Standard
RULE-28616
SVG Image Missing an Accessible Name
line-precisefixture-tested
 LOW Standard
RULE-28617
Invalid autocomplete Token
line-precisefixture-tested
 LOW Standard
RULE-28618
Timed Page Refresh / Redirect via meta refresh
line-precisefixture-tested
 MEDIUM Standard
RULE-28619
Ambiguous Link Text (
line-precisefixture-tested
 LOW Standard
RULE-28620
aria-label on a Generic Element Is Ignored
line-precisefixture-tested
 LOW Standard
RULE-28621
Auto-Playing Audio Without Controls
line-precisefixture-tested
 MEDIUM Standard
RULE-28622
Invalid lang Value on <html>
line-precisefixture-tested
 LOW Standard
RULE-28623
Keyboard Trap: onBlur Forces Focus Back Into the Field
line-precisefixture-tested
 HIGH Standard
RULE-28701
Webhook Signature Verified Over Re-Serialized JSON Instead of the Raw Body
line-precisefixture-tested
 MEDIUM Standard
RULE-28702
Payment Webhook Grants Credits Without Event-ID Deduplication
line-precisefixture-tested
 HIGH Standard
RULE-28703
Webhook HMAC Signs a Timestamp That Is Never Checked for Freshness
line-precisefixture-tested
 MEDIUM Standard
RULE-28704
postMessage Listener Trusts event.data Without Checking event.origin
line-precisefixture-tested
 HIGH Standard
RULE-28705
RLS Policy Authorizes Rows by the JWT Email Claim
line-precisefixture-tested
 MEDIUM Standard
RULE-28706
Next.js 16 Request Props Are Promises: params / searchParams Read Without await
line-precisefixture-tested
 MEDIUM Standard
RULE-28751
unstable_cache Callback Reads a Per-User Value Missing From the Cache Key
line-precisefixture-tested
 HIGH Standard
RULE-28752
Whole Database Row With Secret Columns Passed to a Client Component
line-precisefixture-tested
 HIGH Standard
RULE-28753
Destructive Agent Tool Runs Without Human Approval
line-precisefixture-tested
 MEDIUM Standard
RULE-28801
RLS Policy Lets Any Client Modify Every Row (USING (true))
line-precisefixture-tested
 HIGH Standard
RULE-28802
Firebase Rules Open Data to Everyone: allow Without Any Condition
line-precisefixture-tested
 CRITICAL Standard
RULE-28803
Firebase Realtime Database Rules Open to the Public
line-precisefixture-tested
 CRITICAL Standard
RULE-28804
Request Body Written to the Database As-Is (Mass Assignment)
line-precisefixture-tested
 HIGH Standard
RULE-28805
Authorization Decided by a Client-Controlled Cookie or Query Parameter
line-precisefixture-tested
 HIGH Standard
RULE-28806
Admin Check Trusts a Custom Request Header
line-precisefixture-tested
UNKNOWN Standard
RULE-28807
Server Secret Returned in an HTTP Response
line-precisefixture-tested
 CRITICAL Standard
RULE-28808
Hardcoded Session / Auth Signing Secret
line-precisefixture-tested
 HIGH Standard
RULE-28809
Upload Saved Under the Client-Supplied File Name
line-precisefixture-tested
 HIGH Standard
RULE-28810
Server-Side Template Injection: Request Input Compiled as a Template
line-precisefixture-tested
 CRITICAL Standard
RULE-28811
Credentials Sent With postMessage to Any Origin (\
line-precisefixture-tested
 HIGH Standard
RULE-28812
Predictable Math.random() in an OTP / Token Generator
line-precisefixture-tested
 HIGH Standard
RULE-28813
Flask Debug Server Exposed on All Interfaces
line-precisefixture-tested
 HIGH Standard
RULE-28814
Supabase .or() Filter Built From User Input (PostgREST Filter Injection)
line-precisefixture-tested
 MEDIUM Standard
RULE-28815
Privilege Field Stored in User-Editable Supabase user_metadata
line-precisefixture-tested
UNKNOWN Standard
RULE-28816
Storage Upload Path Is Only the Client File Name
line-precisefixture-tested
 MEDIUM Standard
RULE-28817
RLS Policy Lets Anyone Read Every Row of ${table} (USING (true))
line-precisefixture-tested
 HIGH Standard
RULE-28818
Clerk Middleware Marks Every API Route Public (${wide[1]})
line-precisefixture-tested
 HIGH Standard
RULE-28819
OAuth Account Linked to an Existing User by E-mail Alone (allowDangerousEmailAccountLinking)
line-precisefixture-tested
 MEDIUM Standard
RULE-28820
Laravel Model Allows Mass Assignment of Every Column ($guarded = [])
line-precisefixture-tested
 MEDIUM Standard
RULE-28821
Storage Policy Lets Every Caller Read All Files in the
line-precisefixture-tested
 HIGH Standard
RULE-28822
Every Submitted Form Field Is Written to the Database (Object.fromEntries)
line-precisefixture-tested
 HIGH Standard
RULE-28823
Every Request Field Is Copied Onto the Model (setattr loop)
line-precisefixture-tested
 HIGH Standard
RULE-28824
CORS Reflects Any Origin With Credentials Allowed
line-precisefixture-tested
 HIGH Standard
RULE-28825
Edge Function Runs an Admin Auth Operation Without Checking the Caller
line-precisefixture-tested
 HIGH Standard
RULE-28826
Server Secret ${m[1]} Inlined Into the Browser Bundle (next.config env)
line-precisefixture-tested
 CRITICAL Standard
RULE-28827
Rewrite Destination Host Taken From the Request Path (Open Proxy)
line-precisefixture-tested
 HIGH Standard
RULE-28828
Workflow Prints an Encoded Secret, Bypassing Log Masking
line-precisefixture-tested
 HIGH Standard
RULE-28829
line-precisefixture-tested
 HIGH Standard
RULE-28830
Supabase Pooler Connection String With the Database Password Committed
line-precisefixture-tested
 CRITICAL Standard
RULE-28831
Convex Production Deploy Key Committed
line-precisefixture-tested
 CRITICAL Standard
RULE-28832
Next.js Server Actions Encryption Key Hard-Coded
line-precisefixture-tested
 HIGH Standard
RULE-28833
Sensitive File in a Public Web Folder (${name})
line-precisefixture-tested
UNKNOWN Standard
RULE-28834
Supabase Service Role Key Used in a
line-precisefixture-tested
 CRITICAL Standard
RULE-28835
CORS Allows Any Origin with Credentials
line-precisefixture-tested
 MEDIUM Standard
RULE-28836
User-Supplied URL Rendered as a Link Without a Scheme Check
line-precisefixture-tested
 MEDIUM Standard
RULE-28837
Request Body Deep-Merged into an Object
line-precisefixture-tested
 MEDIUM Standard
RULE-28838
FastAPI ${m[1].toUpperCase()} Route Without an Auth Dependency (${m[2]})
line-precisefixture-tested
 HIGH Standard
RULE-28901
Open Redirect: Framework Redirect Helper Sends Users to a Request-Supplied URL (CWE-601)
line-precisefixture-tested
 MEDIUM Standard
RULE-28902
SSRF: NextResponse.rewrite Proxies to a Request-Supplied URL (CWE-918)
line-precisefixture-tested
 HIGH Standard
RULE-28903
Password Reset / Verification Link Built From the Host Header (CWE-640)
line-precisefixture-tested
 HIGH Standard
RULE-28904
Reflected XSS: Request Input Interpolated Into a text/html Response (CWE-79)
line-precisefixture-tested
 HIGH Standard
RULE-28905
NoSQL / ORM Operator Injection: Parsed Request Body Used as the Query Filter (CWE-943)
line-precisefixture-tested
 HIGH Standard
RULE-28906
Token Lookup Accepts an Object From the Request (Operator Injection Auth Bypass, CWE-943)
line-precisefixture-tested
 HIGH Standard
RULE-28907
Regular Expression Built From Request Input (ReDoS / Regex Injection, CWE-1333)
line-precisefixture-tested
 MEDIUM Standard
RULE-28908
DOM XSS: URL Fragment / Query Written to an HTML Sink (CWE-79)
line-precisefixture-tested
 HIGH Standard
RULE-28909
DOM Open Redirect / javascript: URL: Navigation Target Taken From the Query String (CWE-601, CWE-79)
line-precisefixture-tested
 HIGH Standard
RULE-28910
XSS: URL Parameter Rendered Through a Raw-HTML Binding (v-html / {@html} / set:html / __html)
line-precisefixture-tested
 HIGH Standard
RULE-28911
Every Proxy Hop Trusted: Client Can Spoof req.ip via X-Forwarded-For (CWE-348)
line-precisefixture-tested
 MEDIUM Standard
RULE-28912
Entire process.env Exposed to the Browser (Bundle define / Props / Response)
line-precisefixture-tested
 HIGH Standard
RULE-28913
Server Secret Exposed Through a Client-Bundled Env Variable (${m[1]})
line-precisefixture-tested
 HIGH Standard
RULE-28914
Secret Placed in Nuxt runtimeConfig.public (${k[2]})
line-precisefixture-tested
 HIGH Standard
RULE-28915
SvelteKit CSRF Origin Check Disabled
line-precisefixture-tested
 MEDIUM Standard
RULE-28916
Auth.js redirect Callback Returns Any URL (Open Redirect After Sign-In)
line-precisefixture-tested
 MEDIUM Standard
RULE-28917
JWT Verified With ignoreExpiration: true (Tokens Never Expire)
line-precisefixture-tested
 MEDIUM Standard
RULE-28918
Template Engine HTML Auto-Escaping Disabled (Stored / Reflected XSS)
line-precisefixture-tested
 MEDIUM Standard
RULE-28919
Prototype Pollution in Hand-Rolled Deep Merge / Path Setter (${fn.name}, CWE-1321)
line-precisefixture-tested
 MEDIUM Standard
RULE-28920
Server Action Updates / Deletes Records Without Verifying the Caller (${b.name})
line-precisefixture-tested
 HIGH Standard
RULE-28921
Draft / Preview Mode Enabled Without Checking a Secret
line-precisefixture-tested
 MEDIUM Standard
RULE-28922
Server State Embedded in an Inline <script> With Plain JSON.stringify
line-precisefixture-tested
 MEDIUM Standard
RULE-28923
CORS Reflects Any Origin With Credentials (origin: true + credentials: true, CWE-942)
line-precisefixture-tested
 HIGH Standard
RULE-28924
Origin Allow-List Bypassable (Unanchored Regex / includes / endsWith / startsWith)
line-precisefixture-tested
UNKNOWN Standard
RULE-28925
Hardcoded Session / JWT Signing Secret in Framework Auth Configuration (CWE-798)
line-precisefixture-tested
 HIGH Standard
RULE-28926
Server Trusts JWT Claims Decoded Without Verifying the Signature (CWE-345)
line-precisefixture-tested
 HIGH Standard
RULE-28927
Apollo Server CSRF Prevention Disabled
line-precisefixture-tested
 MEDIUM Standard
RULE-28928
SQL Injection: Request Input in a TypeORM orderBy / groupBy / select Expression (CWE-89)
line-precisefixture-tested
 HIGH Standard
RULE-28929
Electron Window Disables Web Security (Same-Origin Policy / Mixed Content)
line-precisefixture-tested
 HIGH Standard
RULE-28930
Electron Renderer Runs With Node Integration / Without Context Isolation
line-precisefixture-tested
UNKNOWN Standard
RULE-28931
NODE_TLS_REJECT_UNAUTHORIZED = 0 Disables Certificate Checks for the Whole Process
line-precisefixture-tested
 HIGH Standard
RULE-28932
File or Directory Made World-Writable (CWE-732)
line-precisefixture-tested
 MEDIUM Standard
RULE-28933
Sandboxed srcdoc iframe Allows Scripts and Same-Origin (Sandbox Escape)
line-precisefixture-tested
 MEDIUM Standard
RULE-28934
Content-Security-Policy script-src Allows
line-precisefixture-tested
 LOW Standard
RULE-28935
Password Check Uses an Unawaited Promise (Any Password Accepted)
line-precisefixture-tested
 HIGH Standard
RULE-28936
Auth Token Stored in a JavaScript-Readable Cookie
line-precisefixture-tested
 MEDIUM Standard
RULE-28937
Socket.IO User Identity Taken From Client Handshake Data (Impersonation)
line-precisefixture-tested
 HIGH Standard
RULE-28938
User Identity Parsed From a Plain (Unsigned) Cookie
line-precisefixture-tested
 HIGH Standard
RULE-29002
Django extra() SQL Injection
line-precisefixture-tested
 CRITICAL Standard
RULE-29003
Django mark_safe XSS
line-precisefixture-tested
 HIGH Standard
RULE-29014
FastAPI HTMLResponse XSS
line-precisefixture-tested
 HIGH Standard
RULE-29015
Django HttpResponse XSS
line-precisefixture-tested
 HIGH Standard
RULE-29016
Flask make_response XSS
line-precisefixture-tested
 HIGH Standard
RULE-29017
Django CORS Allows Every Origin With Credentials
line-precisefixture-tested
 HIGH Standard
RULE-29018
Markup() Wraps an Already-Formatted String (XSS)
line-precisefixture-tested
 HIGH Standard
RULE-29101
Jackson Default Typing Lets JSON Pick the Class to Instantiate
line-precisefixture-tested
 HIGH Standard
RULE-29102
Go text/template Rendered Into an HTTP Response (No HTML Escaping)
line-precisefixture-tested
 HIGH Standard
RULE-29104
Blade {!! !!} Prints Request Input Without Escaping
line-precisefixture-tested
 HIGH Standard
RULE-29105
Rails Request Input Chooses the Class or Method to Call
line-precisefixture-tested
 CRITICAL Standard
RULE-29106
Spring Request Input Evaluated as a SpEL Expression
line-precisefixture-tested
 CRITICAL Standard
RULE-29107
PHP extract() on Request Input Lets the Client Set Any Variable
line-precisefixture-tested
 HIGH Standard
RULE-29108
Rails send_file With a Path From params
line-precisefixture-tested
 HIGH Standard
RULE-29109
Laravel Raw SQL Expression Built From Request Input
line-precisefixture-tested
 CRITICAL Standard
RULE-29201
Firebase Test-Mode Rule: Anyone Can Read and Write Until the Date Passes
line-precisefixture-tested
 HIGH Standard
RULE-29202
nginx Directory Listing Enabled (autoindex on)
line-precisefixture-tested
 MEDIUM Standard
RULE-29203
Supabase Auth Redirects Allowed to Any Subdomain of a Shared Hosting Domain
line-precisefixture-tested
 HIGH Standard
RULE-29204
nginx alias Path Traversal (location ${open} without a trailing slash)
line-precisefixture-tested
 MEDIUM Standard
RULE-29205
MongoDB Bound to All Interfaces Without Authorization
line-precisefixture-tested
 HIGH Standard
RULE-29206
Elasticsearch Security Disabled on a Network-Reachable Node
line-precisefixture-tested
 HIGH Standard
RULE-29301
IDOR: Record Accessed by Request ID Without an Ownership Check
line-precisefixture-tested
 HIGH Standard
RULE-29302
Unauthenticated Mutation: Endpoint Modifies a Caller-Chosen Record
line-precisefixture-tested
 HIGH Standard
RULE-29303
SQL Injection: Request Input Reaches a Raw Query Through Variables (CWE-89)
line-precisefixture-tested
 CRITICAL Verified Gate
RULE-29304
Command Injection: Request Input Reaches a Shell Command Through Variables (CWE-78)
line-precisefixture-tested
 CRITICAL Standard
RULE-29305
Path Traversal: Request Input Reaches a File System Path (CWE-22)
line-precisefixture-tested
 HIGH Standard
RULE-29306
SSRF: Request Input Chooses the Host of a Server-Side Request (CWE-918)
line-precisefixture-tested
 HIGH Verified Gate
RULE-29307
Open Redirect: Request Input Chooses the Redirect Target (CWE-601)
line-precisefixture-tested
 MEDIUM Verified Gate
RULE-29308
XSS: Request/URL Input Rendered as HTML (CWE-79)
line-precisefixture-tested
 HIGH Standard
RULE-29309
Unauthenticated Endpoint Writes to GitHub for a Caller-Chosen Repository
line-precisefixture-tested
 HIGH Standard
RULE-29401
Paid API Key Exposed to the Browser (${name})
line-precisefixture-tested
 HIGH Standard
RULE-29402
Clerk Webhook Accepted Without svix Signature Verification
line-precisefixture-tested
 HIGH Standard
RULE-29403
Production Browser Source Maps Enabled
line-precisefixture-tested
 MEDIUM Standard
RULE-29501
Request Input Reaches a Shell Command (Python)
line-precisefixture-tested
 CRITICAL Standard
RULE-29502
Request Input Chooses the URL the Server Fetches (Python)
line-precisefixture-tested
 HIGH Standard
RULE-29503
Request Input Builds a File Path (Python)
line-precisefixture-tested
 HIGH Standard
RULE-29504
Request Input Reaches a Shell Command (Go)
line-precisefixture-tested
 CRITICAL Standard
RULE-29505
Request Input Chooses the URL the Server Fetches (Go)
line-precisefixture-tested
 HIGH Standard
RULE-29506
Request Input Builds a File Path (Go)
line-precisefixture-tested
 HIGH Standard
FLOW-07
${sink.model} Loaded by the Id in the URL Without an Ownership Check (Python)
line-precisefixture-tested
 HIGH Standard
RULE-29601
Database Write Is Never Awaited, So It Never Runs (${sb ?
line-precisefixture-tested
 HIGH Standard
RULE-29602
redirect() Inside try/catch Is Swallowed by the catch Block
line-precisefixture-tested
 HIGH Standard
RULE-29603
Async Function Passed Directly to useEffect
line-precisefixture-tested
 MEDIUM Standard
RULE-29604
useEffect Without a Dependency Array Sets State (Infinite Render Loop)
line-precisefixture-tested
 HIGH Standard
RULE-29605
${kind} Started in useEffect Without Cleanup
line-precisefixture-tested
 MEDIUM Standard
RULE-29606
async Callback in forEach Is Never Awaited
line-precisefixture-tested
 HIGH Standard
RULE-29607
Supabase .range() End Is Inclusive (Off-by-One Pagination)
line-precisefixture-tested
 MEDIUM Standard
RULE-29608
Comparison With NaN Is Always False
line-precisefixture-tested
 MEDIUM Standard
RULE-29609
State Array ${m[1]} Mutated In Place With .${m[2]}()
line-precisefixture-tested
 MEDIUM Standard
RULE-29610
Stripe ${m[1]} Given in Dollars Instead of Cents
line-precisefixture-tested
 HIGH Standard
RULE-29611
localStorage Read at Module Load Crashes Server Rendering
line-precisefixture-tested
 HIGH Standard
RULE-29613
Error Swallowed, Then Success Shown to the User
line-precisefixture-tested
 MEDIUM Standard
RULE-29614
INSERT Policy Uses USING Instead of WITH CHECK (Migration Fails)
line-precisefixture-tested
 HIGH Standard
RULE-29615
Signup Trigger Function ${fn} Is Not SECURITY DEFINER (Every Signup Fails)
line-precisefixture-tested
 HIGH Standard
RULE-29616
Policy Compares auth.uid() With ${table}.id Instead of ${ownerCol[1]}
line-precisefixture-tested
 HIGH Standard
RULE-29617
Foreign Key to auth.users Has No ON DELETE Rule (User Deletion Fails)
line-precisefixture-tested
 MEDIUM Standard
RULE-29618
Response Sent Without return; Handler Continues and Responds Again
line-precisefixture-tested
 HIGH Standard
RULE-29619
Route Handler Creates a Response but Never Returns It
line-precisefixture-tested
 HIGH Standard
RULE-29620
Hydration Mismatch: ${x[1].replace(/\s*\(\s*\)/,
line-precisefixture-tested
 MEDIUM Standard
RULE-29621
Hydration Mismatch: Date Formatted With the Runtime Time Zone During Render
line-precisefixture-tested
 MEDIUM Standard
RULE-29622
${g} Read During Render Crashes Server Rendering
line-precisefixture-tested
 HIGH Standard
RULE-29623
Hydration Mismatch: Render Output Branches on typeof window
line-precisefixture-tested
 MEDIUM Standard
RULE-29624
${x[3]}() Called During Render (Infinite Re-render Loop)
line-precisefixture-tested
 HIGH Standard
RULE-29625
${x[1]}={${x[2]}(...)} Calls the Setter During Render
line-precisefixture-tested
 HIGH Standard
RULE-29626
Stale State: Callback Registered Once Reads ${st} From the First Render
line-precisefixture-tested
 HIGH Standard
RULE-29627
Prop ${src} Copied Into State ${x[1]} That Never Updates
line-precisefixture-tested
 MEDIUM Standard
RULE-29628
${x[1]} Dependency ${fresh.length > 30 ?
line-precisefixture-tested
UNKNOWN Standard
RULE-29629
${x[1]} With [] Reads ${st} (Frozen at the First Render)
line-precisefixture-tested
 MEDIUM Standard
RULE-29630
useEffect Updates Its Own Dependency ${st} (Infinite Loop)
line-precisefixture-tested
 HIGH Standard
RULE-29631
Random key (${r[1]}()) Remounts the Element on Every Render
line-precisefixture-tested
 MEDIUM Standard
RULE-29632
Index key on ${arr}, Which Is Deleted From: Inputs Show the Wrong Row
line-precisefixture-tested
 MEDIUM Standard
RULE-29633
<${t.name}> Has ${valueAttr ?
line-precisefixture-tested
 HIGH Standard
RULE-29634
Form onSubmit Sends a Request Without preventDefault (Page Reloads)
line-precisefixture-tested
 HIGH Standard
RULE-29635
<button> Without type Inside a Form Also Submits It
line-precisefixture-tested
 MEDIUM Standard
RULE-29636
Payment Button Can Be Clicked Again While the Charge Is Pending
line-precisefixture-tested
 HIGH Standard
RULE-29637
Request API Used Without await: ${x[1]}() (Next.js 16)
line-precisefixture-tested
 HIGH Standard
RULE-29638
${name} Exported From a
line-precisefixture-tested
 HIGH Standard
RULE-29639
Async Client Component ${k.name}
line-precisefixture-tested
 HIGH Standard
RULE-29640
Server-Only Import in a Client Component:
line-precisefixture-tested
 HIGH Standard
RULE-29641
${x[1]}() Called From a Client Event Handler
line-precisefixture-tested
 HIGH Standard
RULE-29642
next/router Imported in the App Router
line-precisefixture-tested
 HIGH Standard
RULE-29643
force-static Route Handler Reads the Request
line-precisefixture-tested
 HIGH Standard
RULE-29644
line-precisefixture-tested
 HIGH Standard
RULE-29645
line-precisefixture-tested
 HIGH Standard
RULE-29646
Client-Only Code in a Server Component: ${h[1]}()
line-precisefixture-tested
 HIGH Standard
RULE-29647
${/global-error/.test(path) ?
line-precisefixture-tested
 HIGH Standard
RULE-29648
<Image fill> Without sizes Downloads a Full-Viewport-Width Image
line-precisefixture-tested
 LOW Standard
RULE-29649
line-precisefixture-tested
 HIGH Standard
RULE-29650
text-${col} on bg-${col}: Invisible Text
line-precisefixture-tested
 MEDIUM Standard
RULE-29651
Fixed ${wide[0]} Width Overflows Phone Screens
line-precisefixture-tested
 MEDIUM Standard
RULE-29652
{${x[1]}.length && ...} Renders
line-precisefixture-tested
 MEDIUM Standard
RULE-29653
State ${st} Mutated In Place, Then Set With the Same Reference
line-precisefixture-tested
 HIGH Standard
RULE-29654
router.${what} Does Not Exist on the next/navigation Router
line-precisefixture-tested
 HIGH Standard
RULE-29655
${x[1]} in the App Router
line-precisefixture-tested
 HIGH Standard
RULE-29656
line-precisefixture-tested
 HIGH Standard
RULE-29657
${/proxy\./.test(path) ?
line-precisefixture-tested
 HIGH Standard
RULE-29658
Form action Handler Treats Its Argument as an Event
line-precisefixture-tested
 HIGH Standard
RULE-29659
${x[1]}() Called ${why ===
line-precisefixture-tested
 HIGH Standard
RULE-29660
${m[1]}() Is Not Awaited in a Serverless Handler
line-precisefixture-tested
 HIGH Standard
RULE-29661
Promise Returned Without await Inside try: catch Never Runs
line-precisefixture-tested
 MEDIUM Standard
RULE-29662
.map(async ...) Result Used as Data Without Promise.all
line-precisefixture-tested
 HIGH Standard
RULE-29663
async Callback in .${m[1]}() Is Always Truthy
line-precisefixture-tested
 HIGH Standard
RULE-29664
async reduce() Uses the Accumulator Without Awaiting It
line-precisefixture-tested
 HIGH Standard
RULE-29665
async ${m[1]}() Used in a Condition Without await
line-precisefixture-tested
 HIGH Standard
RULE-29666
${w[1]} Updated From a Stale Read (Lost Update Race)
line-precisefixture-tested
UNKNOWN Standard
RULE-29667
.single() Errors on 0 Rows, So the
line-precisefixture-tested
 MEDIUM Standard
RULE-29668
Supabase ${m[2]}() Error Is Discarded but Its data Is Used
line-precisefixture-tested
 HIGH Standard
RULE-29669
${m[1]}: ${op} * 100 Is Not Rounded to an Integer
line-precisefixture-tested
 HIGH Standard
RULE-29670
${m[1]} Rounds to Whole Dollars Before Converting to Cents
line-precisefixture-tested
 HIGH Standard
RULE-29671
toFixed() String Added to a Number (Concatenation, Not Addition)
line-precisefixture-tested
 MEDIUM Standard
RULE-29672
Input String Added to a Number (String Concatenation)
line-precisefixture-tested
 MEDIUM Standard
RULE-29673
checkout.session.completed Fulfilled Without Checking payment_status
line-precisefixture-tested
 HIGH Standard
RULE-29674
Subscription Access Granted Without Checking subscription.status
line-precisefixture-tested
 HIGH Standard
RULE-29675
Stripe Timestamp ${f.split(
line-precisefixture-tested
 HIGH Standard
RULE-29676
Date-Only String Parsed as UTC, Then Read in Local Time (Off by One Day)
line-precisefixture-tested
 MEDIUM Standard
RULE-29677
getMonth() Is 0-Based (Month Off by One)
line-precisefixture-tested
 MEDIUM Standard
RULE-29678
line-precisefixture-tested
 MEDIUM Standard
RULE-29679
Date Objects Compared With == / ===
line-precisefixture-tested
 MEDIUM Standard
RULE-29680
toISOString() Used as the User
line-precisefixture-tested
 MEDIUM Standard
RULE-29681
Date Mutated In Place, Then Used Again
line-precisefixture-tested
 MEDIUM Standard
RULE-29682
${v} Used Without a Null Check After Fetching It
line-precisefixture-tested
 MEDIUM Standard
RULE-29683
Email Stored Lowercased but Looked Up Case-Sensitively
line-precisefixture-tested
 MEDIUM Standard
RULE-29684
Numbers Sorted With the Default .sort() (Compared as Strings)
line-precisefixture-tested
 MEDIUM Standard
RULE-29685
line-precisefixture-tested
 MEDIUM Standard
RULE-29686
typeof Never Returns
line-precisefixture-tested
 MEDIUM Standard
RULE-29687
Assignment ${m[1]} = ${m[2]} Inside if (Should Be ===)
line-precisefixture-tested
 HIGH Standard
RULE-29688
Math.round(x * ${m[2]} / ${m[2]}) Does Not Round to Decimals
line-precisefixture-tested
 MEDIUM Standard
RULE-29689
Delete and Insert on ${t} Run in Parallel (Promise.all)
line-precisefixture-tested
 HIGH Standard
RULE-29690
response.json() Is Not Awaited
line-precisefixture-tested
 HIGH Standard
RULE-29691
Mutable Default Argument ${v}=${p[2]} Is Shared Between Calls
line-precisefixture-tested
 MEDIUM Standard
RULE-29692
\
line-precisefixture-tested
 MEDIUM Standard
RULE-29693
datetime.utcnow().timestamp() Is Off by the Server UTC Offset
line-precisefixture-tested
 MEDIUM Standard
RULE-29701
Hardcoded localhost ${ctx} (${m[2].slice(0, 40)}) Breaks in Production
line-precisefixture-tested
UNKNOWN Standard
RULE-29702
VERCEL_URL Used as a Full URL (No https://, Changes Every Deployment)
line-precisefixture-tested
 MEDIUM Standard
RULE-29703
Whole Site Marked noindex / Disallowed for Search Engines
line-precisefixture-tested
 HIGH Standard
RULE-29704
Field default=${m[1]} Is Evaluated Once, at Import
line-precisefixture-tested
 MEDIUM Standard
RULE-29705
${m[1]} Uses auto_now=True and Changes on Every Save
line-precisefixture-tested
 MEDIUM Standard
RULE-29706
${m[1]} Flag Read as a String:
line-precisefixture-tested
 MEDIUM Standard
RULE-29707
int(price * 100) Truncates Floats and Loses a Cent
line-precisefixture-tested
 MEDIUM Standard
RULE-29708
${m[1]} Is Always None: ${fn}() Works in Place
line-precisefixture-tested
 MEDIUM Standard
RULE-29709
Background Task Queued Before the Transaction Commits
line-precisefixture-tested
 MEDIUM Standard
RULE-29710
${d[1]}() Returns the Session, So It Is Never Closed
line-precisefixture-tested
 MEDIUM Standard
RULE-29711
Error Returned With HTTP 200 OK
line-precisefixture-tested
 MEDIUM Standard
RULE-29712
Missing f Prefix:
line-precisefixture-tested
 LOW Standard
RULE-29713
${m[2].toUpperCase()} ${m[4]} Is Registered Twice
line-precisefixture-tested
 MEDIUM Standard
RULE-29714
Naive datetime.now() Mixed With Django Timezone-Aware Dates
line-precisefixture-tested
 MEDIUM Standard
RULE-29715
${t.trim().split(/\s/)[0]} Inside finally Swallows Exceptions
line-precisefixture-tested
 MEDIUM Standard
RULE-29716
${m[1].replace(/\($/,
line-precisefixture-tested
 MEDIUM Standard
RULE-29740
Tailwind Class Built at Runtime (${x[1]}-\${...}) Is Never Generated
line-precisefixture-tested
 MEDIUM Standard
RULE-29741
${name} Typed and Read Synchronously (Next.js ${context?.nextMajorVersion}+)
line-precisefixture-tested
UNKNOWN Standard
RULE-29742
Form Field Uses ${small} on Mobile: iOS Zooms In on Focus
line-precisefixture-tested
 LOW Standard
RULE-29743
useFormStatus() Called in ${decl[1] || decl[2]}, Which Renders the <form> Itself
line-precisefixture-tested
 MEDIUM Standard
RULE-29744
${x[1]} Has No Title
line-precisefixture-tested
 LOW Standard
RULE-29745
JSON.parse(localStorage...) Without try/catch
line-precisefixture-tested
 MEDIUM Standard
RULE-29746
<Image fill> Inside a Parent Without position: relative
line-precisefixture-tested
 MEDIUM Standard
RULE-29747
Element Only Appears on Hover (${shown})
line-precisefixture-tested
 LOW Standard
RULE-29748
Edge Runtime Route Imports Node-Only
line-precisefixture-tested
 HIGH Standard
RULE-29749
Middleware Matcher Also Runs on _next/static Assets and Images
line-precisefixture-tested
 LOW Standard
RULE-29750
<${x[1]} asChild> Has ${n} Children
line-precisefixture-tested
 HIGH Standard
RULE-29751
<html> Lacks suppressHydrationWarning With next-themes
line-precisefixture-tested
 LOW Standard
RULE-29752
Search Request in useEffect Can Show Results for an Old Query
line-precisefixture-tested
 MEDIUM Standard
RULE-29753
useMutation Never Invalidates the Queries This File Shows
line-precisefixture-tested
 LOW Standard
RULE-29755
Stripe ${x[1]} Is a Relative Path (${x[3]})
line-precisefixture-tested
 HIGH Standard
RULE-29756
Destructuring a Reactive Object Loses Reactivity
line-precisefixture-tested
 MEDIUM Standard
RULE-29757
Platform.OS Compared With
line-precisefixture-tested
 MEDIUM Standard
RULE-29758
Import
line-precisefixture-tested
 HIGH Standard
RULE-29759
Link to ${href}, but No Page Exists at That Route
line-precisefixture-tested
 MEDIUM Standard
RULE-29760
next/image Loads ${host}, Which next.config Does Not Allow
line-precisefixture-tested
 HIGH Standard
RULE-29761
${what} in an App Built With output:
line-precisefixture-tested
 HIGH Standard
RULE-29762
useSearchParams() in a Client Page Without a Suspense Boundary
line-precisefixture-tested
 HIGH Standard
RULE-29763
${x[1]} Selector Returns a New ${x[3].startsWith(
line-precisefixture-tested
 HIGH Standard
RULE-29764
process.env.${x[1]} Is Undefined in the Expo App
line-precisefixture-tested
 MEDIUM Standard
RULE-29765
${name}.defaultProps Is Ignored in React 19
line-precisefixture-tested
 MEDIUM Standard
RULE-29780
${x[1]} Selector Calls .${x[3]}() on Store State
line-precisefixture-tested
 MEDIUM Standard
RULE-29781
${name}() Called While ${comp.name} Renders
line-precisefixture-tested
 HIGH Standard
RULE-29782
onValueChange Receives a Value, Not an Event (${x[1]}.target)
line-precisefixture-tested
 HIGH Standard
RULE-29783
register(${x[2]}) Spread Onto <${x[1]}>, Which Has No Native Input
line-precisefixture-tested
 MEDIUM Standard
RULE-29784
aria-hidden=
line-precisefixture-tested
 MEDIUM Standard
RULE-29785
Route Param ${v} May Be an Array: ${v}.${use[1]}() Can Crash
line-precisefixture-tested
 MEDIUM Standard
RULE-29786
Form Action Returns an Error Without fail()
line-precisefixture-tested
 MEDIUM Standard
RULE-29787
Background Task Receives the Request Session
line-precisefixture-tested
 HIGH Standard
RULE-29788
Path Parameter ${name} Has No Type, So It Is Always a String
line-precisefixture-tested
 MEDIUM Standard
RULE-29789
Naive datetime.now() Compared in a File That Uses Aware Datetimes
line-precisefixture-tested
 MEDIUM Standard
RULE-29790
${m[2]}.${m[3]}() Without return: the Handler Keeps Running
line-precisefixture-tested
 HIGH Standard
RULE-29791
${x[1]} Is Still a Placeholder (
line-precisefixture-tested
 HIGH Standard
RULE-29792
${fn.name}() Fakes the Request With a Timer
line-precisefixture-tested
 HIGH Standard
RULE-29793
The Real Request Is Commented Out, but Success Is Still Shown
line-precisefixture-tested
 HIGH Standard
RULE-29794
${fn.name}() Shows Success Without Sending Anything
line-precisefixture-tested
 HIGH Standard
RULE-29795
line-precisefixture-tested
 MEDIUM Standard
RULE-29796
Link Points to
line-precisefixture-tested
 LOW Standard
RULE-29797
Login Checks a Hard-Coded Password
line-precisefixture-tested
 CRITICAL Standard
RULE-29798
removeEventListener(${x[1]}) Gets a New Function, So Nothing Is Removed
line-precisefixture-tested
 MEDIUM Standard
RULE-29799
process.env.${x[1]} in a Vite App Is Undefined in the Browser
line-precisefixture-tested
 HIGH Standard
RULE-29800
setTimeout of ${Math.round(ms / 60000)} min in a Serverless Function Never Fires
line-precisefixture-tested
 HIGH Standard
RULE-29801
Both Branches of the Ternary Are ${x[1].slice(0, 40)}
line-precisefixture-tested
 MEDIUM Standard
RULE-29802
Row Saved With ${m[1]}: ${m[2]} (null When Signed Out)
line-precisefixture-tested
 MEDIUM Standard
RULE-29803
Test-Mode Payment Key Hard-Coded (${x[2].slice(0, 9)}...)
line-precisefixture-tested
 MEDIUM Standard
RULE-29804
Auth Returns a Fake Token (
line-precisefixture-tested
 HIGH Standard
LIVE-01
Supabase ${s.kind ===
line-precise
 CRITICAL Standard
LIVE-02
${s.kind} Is in Your Website
line-precise
UNKNOWN Standard
LIVE-03
Source Maps Are Public, So Your Original Source Code Can Be Downloaded
line-precise
 MEDIUM Standard
RULE-29820
Write Inside $transaction Uses ${outer} Instead of ${tx}
line-precisefixture-tested
 HIGH Standard
RULE-29821
Action ${name} for useActionState Takes Only (formData)
line-precisefixture-tested
 HIGH Standard
RULE-29822
catch Reads err.response.status but fetch Does Not Reject on HTTP Errors
line-precisefixture-tested
 MEDIUM Standard
RULE-29823
forEach Calls Async ${m[1]} Without Awaiting It
line-precisefixture-tested
 HIGH Standard
RULE-29824
Array.fill() With an Object Shares the Same Reference in Every Slot
line-precisefixture-tested
 MEDIUM Standard
RULE-29825
${m[1] ?? m[2]} Handler Reads params From the Request Argument
line-precisefixture-tested
 HIGH Standard
RULE-29826
useSearchParams() Result Mutated Directly
line-precisefixture-tested
 HIGH Standard
RULE-29827
line-precisefixture-tested
 HIGH Standard
RULE-29828
Pagination Skips the First Page (${page} * ${m[2]} With 1-Based ${page})
line-precisefixture-tested
 HIGH Standard
RULE-29829
Response.redirect() Called With a Relative Path
line-precisefixture-tested
 HIGH Standard
RULE-29831
${j[1]}.text() Read After ${j[1]}.json() Consumed the Body
line-precisefixture-tested
 MEDIUM Standard
RULE-29832
${m[1]}() Called With a Regex Without the g Flag
line-precisefixture-tested
 HIGH Standard
RULE-29833
Drizzle ${m[2]}(${m[3]}) Without .where() Affects Every Row
line-precisefixture-tested
 HIGH Standard
RULE-29834
${m[2]}() Compares a New Object/Array Literal by Reference
line-precisefixture-tested
 MEDIUM Standard
RULE-29835
new Promise() With an async Executor
line-precisefixture-tested
 MEDIUM Standard
RULE-29836
fetch() With a Relative URL in Server Code
line-precisefixture-tested
 HIGH Standard
RULE-29837
.${m[1]}(column, null) Never Matches NULL Rows
line-precisefixture-tested
 HIGH Standard
RULE-29838
${n} Modified While Looping Over It
line-precisefixture-tested
 HIGH Standard
RULE-29839
Date Format
line-precisefixture-tested
 HIGH Standard
RULE-29840
Number Parsed Back From toLocaleString() Output
line-precisefixture-tested
 MEDIUM Standard
RULE-29841
async Function Passed to use${m[1]}
line-precisefixture-tested
 HIGH Standard
RULE-29842
while (… .exec()) Loop Never Advances
line-precisefixture-tested
 HIGH Standard
RULE-29843
${r[1]} Inside finally Overrides the try/catch Result
line-precisefixture-tested
 MEDIUM Standard
RULE-29844
Promise.${m[1]}() Given Separate Arguments Instead of an Array
line-precisefixture-tested
 HIGH Standard
RULE-29845
Plain Object Passed as a Response Body
line-precisefixture-tested
 HIGH Standard
RULE-29846
Plain Object Passed to new ${m[1]}()
line-precisefixture-tested
 HIGH Standard
RULE-29847
Route Placeholder Left in URL ${m[2].slice(0, 40)}
line-precisefixture-tested
 HIGH Standard
RULE-29848
${m[1]}() Arguments Swapped
line-precisefixture-tested
 HIGH Standard
RULE-29849
timedelta.seconds Used as the Total Duration
line-precisefixture-tested
 MEDIUM Standard
RULE-29850
NaN Lookup That Can Never Match
line-precisefixture-tested
 HIGH Standard
RULE-29851
new URL() Called With Only a Relative Path
line-precisefixture-tested
 HIGH Standard
RULE-29852
${n}.abort() Cancels Nothing (signal Never Passed)
line-precisefixture-tested
 MEDIUM Standard
RULE-29853
map(parseInt) Uses the Index as the Radix
line-precisefixture-tested
 HIGH Standard
RULE-29854
sort() Comparator Returns a Boolean
line-precisefixture-tested
 HIGH Standard
RULE-29855
Coroutine ${m[1]}() Called Without await
line-precisefixture-tested
 HIGH Standard
RULE-29856
Money Converted to Cents by Truncating amount * 100
line-precisefixture-tested
 MEDIUM Standard
RULE-29857
Strings From toFixed() Concatenated Instead of Added
line-precisefixture-tested
 HIGH Standard
RULE-29858
Number.${m[1]}() Called on an Unparsed String
line-precisefixture-tested
 MEDIUM Standard
RULE-29859
Set-Cookie Header Overwritten by a Second set()
line-precisefixture-tested
 MEDIUM Standard
RULE-29860
FileList Appended to FormData as a Single Value
line-precisefixture-tested
 HIGH Standard
RULE-29861
${fn.name}() Only Changes Local State
line-precisefixture-tested
 HIGH Standard
RULE-29862
Discount Code
line-precisefixture-tested
 HIGH Standard
RULE-29863
${fn.name}() Accepts the Code Without Checking It on a Server
line-precisefixture-tested
 CRITICAL Standard
RULE-29864
line-precisefixture-tested
 MEDIUM Standard
RULE-29865
${fn.name}() Creates Recovery Codes Only in the Browser
line-precisefixture-tested
 HIGH Standard
RULE-29866
Text Saved With a PDF Content Type
line-precisefixture-tested
 HIGH Standard
RULE-29867
fetch() Sends a body Without a method
line-precisefixture-tested
 HIGH Standard
RULE-29868
multipart/form-data Content-Type Set by Hand on a FormData Upload
line-precisefixture-tested
 HIGH Standard
RULE-29869
${r[1]}.current Used as a Hook Dependency
line-precisefixture-tested
 MEDIUM Standard
RULE-29870
State ${m[1]} Mutated With .${s[1]}()
line-precisefixture-tested
 HIGH Standard
RULE-29871
${r[1]}() Called Inside unstable_cache
line-precisefixture-tested
 HIGH Standard
RULE-29872
reduce() Callback Never Returns the Accumulator
line-precisefixture-tested
 HIGH Standard
RULE-29873
${n} Read With Object.keys / Spread
line-precisefixture-tested
 HIGH Standard
RULE-29874
use(fetch(…)) Called During Render
line-precisefixture-tested
 HIGH Standard
RULE-29875
String ${m[1].slice(0, 30)} + Number Is Concatenated
line-precisefixture-tested
 HIGH Standard
RULE-29876
Value Encoded Twice for URLSearchParams
line-precisefixture-tested
 MEDIUM Standard
RULE-29877
btoa(JSON.stringify(…)) Breaks on Non-ASCII Text
line-precisefixture-tested
 MEDIUM Standard
RULE-29878
Intl Currency Format Without a currency Code
line-precisefixture-tested
 HIGH Standard
RULE-29879
flatMap() With an async Callback
line-precisefixture-tested
 HIGH Standard
RULE-29880
useContext(${m[1]}.Provider) Instead of useContext(${m[1]})
line-precisefixture-tested
 HIGH Standard
RULE-29881
Stream Parser Does Not Handle the [DONE] Message
line-precisefixture-tested
 HIGH Standard
RULE-29882
${m[1]}() Callback Returns an Object Literal
line-precisefixture-tested
 HIGH Standard
RULE-29883
generateMetadata Calls ${r[1]}()
line-precisefixture-tested
 HIGH Standard
RULE-29884
Math.${m[1]}(${m[2]}) Given an Array
line-precisefixture-tested
 HIGH Standard
RULE-29885
new URL(req.url) Without a Base in a Node Server
line-precisefixture-tested
 HIGH Standard
RULE-29886
Caught ${n} Copied With Spread / JSON.stringify
line-precisefixture-tested
 MEDIUM Standard
RULE-29887
setMonth(getMonth() ± n) Skips Short Months
line-precisefixture-tested
 MEDIUM Standard
RULE-29888
${m[1]}.test() on a Global Regex Alternates Between true and false
line-precisefixture-tested
 HIGH Standard
RULE-29889
BigInt Combined With a Number
line-precisefixture-tested
 HIGH Standard
RULE-29890
JSON.stringify(${m[1]}) on a ${kind} Sends {}
line-precisefixture-tested
 HIGH Standard
RULE-29891
.in() Filter Given a String Instead of an Array
line-precisefixture-tested
 HIGH Standard
RULE-29892
textSearch() on User Input Uses to_tsquery Syntax
line-precisefixture-tested
 MEDIUM Standard
RULE-29893
JWT expiresIn Given in Milliseconds
line-precisefixture-tested
 HIGH Standard
RULE-29894
timingSafeEqual Without a Length Check
line-precisefixture-tested
 MEDIUM Standard
RULE-29895
${m[1]}().${m[2]} Without await (Next.js ${nextMajor})
line-precisefixture-tested
UNKNOWN Standard
RULE-29897
os.path.join() With an Absolute Second Path
line-precisefixture-tested
 HIGH Standard
RULE-29898
Module Variable ${a[1]} Updated Without
line-precisefixture-tested
 HIGH Standard
RULE-29899
${r[1]}.read() Called a Second Time Without seek(0)
line-precisefixture-tested
 MEDIUM Standard
RULE-29900
Upload Saved Using the Client File Name
line-precisefixture-tested
 HIGH Standard
RULE-29901
http.FileServer Serves the Working Directory
line-precisefixture-tested
 HIGH Standard
RULE-29902
Static Server Allows Dotfiles (dotfiles:
line-precisefixture-tested
 HIGH Standard
RULE-29903
Query Parser Configured With allowPrototypes: true
line-precisefixture-tested
 HIGH Standard
RULE-29905
jwt.decode Accepts Both RSA/EC and HMAC Algorithms
line-precisefixture-tested
 CRITICAL Standard
RULE-29906
Global ValidationPipe Without whitelist: true
line-precisefixture-tested
 MEDIUM Standard
RULE-29907
SAML ${m[1]}: false
line-precisefixture-tested
 CRITICAL Standard
RULE-29908
Spring Boot Actuator Exposes ${prop ? prop[1] :
line-precisefixture-tested
 HIGH Standard
RULE-29909
CORS Allows Any Origin With Credentials
line-precisefixture-tested
 HIGH Standard
RULE-29910
Authenticated Response Sent With Cache-Control
line-precisefixture-tested
 HIGH Standard
RULE-29911
SQLAlchemy text() Fragment Built From an f-string
line-precisefixture-tested
 HIGH Standard
RULE-29912
getPublicUrl() on the Private
line-precisefixture-tested
 HIGH Standard
RULE-29913
JWT kid Header Used to Load the Verification Key From Disk
line-precisefixture-tested
 CRITICAL Standard
RULE-29914
Secret Token Matched by Pattern: ${m[2]} via .${m[1]}()
line-precisefixture-tested
 HIGH Standard
RULE-29916
JWT Signed Without an Expiry
line-precisefixture-tested
 MEDIUM Standard
RULE-29917
Request Input Passed as an Argument to ${m[1]}
line-precisefixture-tested
 HIGH Standard
RULE-29918
reqwest danger_accept_invalid_${m[1]}(true)
line-precisefixture-tested
 HIGH Standard
RULE-29919
${s[1]} Falls Back to a Hard-Coded Value
line-precisefixture-tested
 HIGH Standard
RULE-29920
open() Called With a Request Parameter
line-precisefixture-tested
 CRITICAL Standard
RULE-29921
req.signedCookies Used but cookieParser() Has No Secret
line-precisefixture-tested
 HIGH Standard
RULE-29922
Directory Listing Enabled With serve-index
line-precisefixture-tested
 MEDIUM Standard
RULE-29923
Response Content-Type Chosen by the Request
line-precisefixture-tested
 HIGH Standard
RULE-29924
Access Decided by localStorage
line-precisefixture-tested
 MEDIUM Standard
RULE-29925
Checkout ${m[1]} Taken From the Request
line-precisefixture-tested
 MEDIUM Standard
RULE-29926
Access Token Sent in the URL Query String
line-precisefixture-tested
 MEDIUM Standard
RULE-29927
MCP ${m[1]} Without DNS-Rebinding Protection
line-precisefixture-tested
 MEDIUM Standard
RULE-29928
LLM Output Field ${m[1]} Used as an Access Decision
line-precisefixture-tested
 HIGH Standard
RULE-29929
Read-Only SQL Enforced by a
line-precisefixture-tested
 HIGH Standard
RULE-29930
process.env Returned or Serialized Whole
line-precisefixture-tested
 CRITICAL Standard
RULE-29931
${m[1]} Chosen by the Caller
line-precisefixture-tested
 HIGH Standard
RULE-29932
Prompt Template Built From User Input
line-precisefixture-tested
 HIGH Standard
RULE-29933
LLM Called in a Loop With No Attempt Limit
line-precisefixture-tested
 HIGH Standard
RULE-29934
Agent Tool Sends Server Credentials to a Model-Chosen URL
line-precisefixture-tested
 CRITICAL Standard
RULE-29936
Agent Tool Writes or Deletes a Model-Chosen Path
line-precisefixture-tested
 CRITICAL Standard
RULE-29938
Raw ${m[1]} From the AI SDK Sent to the Client
line-precisefixture-tested
 MEDIUM Standard
RULE-29939
Browser Tool Runs Model-Written Script (page.${m[1]})
line-precisefixture-tested
 CRITICAL Standard
RULE-29940
MCP Client Connects to a Server URL From the Request
line-precisefixture-tested
 CRITICAL Standard
RULE-29942
LangServe add_routes() Without Authentication
line-precisefixture-tested
 HIGH Standard
RULE-29943
ingress-nginx ${m[1]}-snippet Annotation
line-precisefixture-tested
 HIGH Standard
RULE-29944
pip --extra-index-url Allows Dependency Confusion
line-precisefixture-tested
 HIGH Standard
RULE-29945
Lockfile Integrity Checks Disabled
line-precisefixture-tested
 MEDIUM Standard
RULE-29946
Service Uses externalIPs
line-precisefixture-tested
 MEDIUM Standard
RULE-29947
Pull Request Jobs Run on a Self-Hosted Runner
line-precisefixture-tested
 HIGH Standard
RULE-29948
nginx Trusts Client IP Headers From ${m[1]}
line-precisefixture-tested
 HIGH Standard
RULE-29949
Redis protected-mode no Without a Password
line-precisefixture-tested
 HIGH Standard
RULE-29950
Dependency Installed From a Moving Git ${m[1] ?
line-precisefixture-tested
 MEDIUM Standard
RULE-29951
Admission Webhook Fails Open (failurePolicy: Ignore)
line-precisefixture-tested
 MEDIUM Standard
RULE-29952
uv index-strategy Set to an Unsafe Mode
line-precisefixture-tested
 HIGH Standard
RULE-29953
Dispatch Input Interpolated Into a run: Script
line-precisefixture-tested
 MEDIUM Standard
RULE-29954
Secret Value Hard-Coded in Terraform
line-precisefixture-tested
 HIGH Standard
RULE-29955
TLS Verification Disabled in the Image (${m[1].split(/[= ]/)[0]})
line-precisefixture-tested
 HIGH Standard
RULE-29956
ADD Downloads a Remote File Without --checksum
line-precisefixture-tested
 MEDIUM Standard
RULE-29958
Override Replaces ${m[1]} With ${m[2].slice(0, 40)}
line-precisefixture-tested
 HIGH Standard
RULE-29959
Workflow Expands toJSON(secrets)
line-precisefixture-tested
 CRITICAL Standard
RULE-29960
Snapshot / Image Shared With All AWS Accounts
line-precisefixture-tested
 CRITICAL Standard
RULE-29961
Rewrite Destination Host Taken From the Request (Open Proxy)
line-precisefixture-tested
 HIGH Standard
RULE-29962
Untrusted Artifact Extracted Into the Workspace Root
line-precisefixture-tested
 HIGH Standard
RULE-29963
CloudFront Connects to the Origin Over HTTP
line-precisefixture-tested
 MEDIUM Standard
RULE-29964
Build Credentials Copied Into the Final Image (${m[1]})
line-precisefixture-tested
 HIGH Standard
RULE-29965
${DB[m[1]]} Exposed by a LoadBalancer / NodePort Service
line-precisefixture-tested
 HIGH Standard
RULE-29966
Submodule Fetched Over ${m[1]}://
line-precisefixture-tested
 MEDIUM Standard
RULE-29967
GitHub OIDC Trust Accepts Any Repository
line-precisefixture-tested
 CRITICAL Standard
RULE-29968
Final Image Runs With NODE_ENV=development
line-precisefixture-tested
 MEDIUM Standard
RULE-29969
${m[1]} Enabled in the Workflow
line-precisefixture-tested
 MEDIUM Standard
RULE-29970
Container Shares the Host IPC Namespace
line-precisefixture-tested
 MEDIUM Standard
RULE-29972
Package Registry Uses Plain HTTP
line-precisefixture-tested
 HIGH Standard
RULE-29973
${name} Port ${m[2]} Published on All Interfaces
line-precisefixture-tested
 MEDIUM Standard
RULE-29974
Raw ${k[1]} Sent in an Analytics Event
line-precisefixture-tested
 MEDIUM Standard
RULE-29975
${m[1]} Sent in a URL Query String
line-precisefixture-tested
 HIGH Standard
RULE-29976
Every Recipient Put in the ${m[1] ===
line-precisefixture-tested
 HIGH Standard
RULE-29977
Refresh Token Stored in Web Storage (${m[1]})
line-precisefixture-tested
 HIGH Standard
RULE-29978
${m[1]} Saved in Plain Text
line-precisefixture-tested
 HIGH Standard
RULE-29979
Foreign Server Password Committed in a Migration
line-precisefixture-tested
 HIGH Standard
RULE-29980
ON DELETE SET NULL on NOT NULL Column ${m[1]}
line-precisefixture-tested
 HIGH Standard
RULE-29981
NOT IN (SELECT …) Returns No Rows When the Subquery Has a NULL
line-precisefixture-tested
 MEDIUM Standard
RULE-29982
Trigger on ${table} Updates ${table} Again (Infinite Recursion)
line-precisefixture-tested
 HIGH Standard
RULE-29983
REFRESH MATERIALIZED VIEW Without CONCURRENTLY
line-precisefixture-tested
 MEDIUM Standard
RULE-29984
pg_notify Sends the Whole Row as Payload
line-precisefixture-tested
 MEDIUM Standard
RULE-29985
${m[1]}.id Is a 32-bit ${m[2].toUpperCase()}
line-precisefixture-tested
 MEDIUM Standard
RULE-29986
Redis KEYS Pattern Scan in Application Code
line-precisefixture-tested
 HIGH Standard
RULE-29987
Row Count Computed by Loading Every Row (${m[1]}().length)
line-precisefixture-tested
 HIGH Standard
RULE-29988
Entire Table Loaded, Then Filtered in JavaScript
line-precisefixture-tested
 MEDIUM Standard
RULE-30000
aria-label
line-precisefixture-tested
 MEDIUM Standard
RULE-30001
<select> Navigates or Submits on Change
line-precisefixture-tested
 MEDIUM Standard
RULE-30002
Analytics / Chat Script Loaded With strategy=
line-precisefixture-tested
 MEDIUM Standard
RULE-30003
Every Icon in ${m[2]} Bundled (Dynamic ${m[1]}[name] Lookup)
line-precisefixture-tested
 HIGH Standard
RULE-30004
Whole lodash Imported in Client Code
line-precisefixture-tested
 MEDIUM Standard
RULE-30005
priority on Every Image Rendered by .map()
line-precisefixture-tested
 MEDIUM Standard
RULE-30006
Auto-Advancing Carousel Without a Pause Control
line-precisefixture-tested
 MEDIUM Standard
RULE-30007
<${n[1]}> Nested Inside <${tag}>
line-precisefixture-tested
 MEDIUM Standard
RULE-30009
Content Revealed Only on Mouse Hover
line-precisefixture-tested
 MEDIUM Standard
RULE-30010
new Intl.${f[1]}() Created for Every Item
line-precisefixture-tested
 MEDIUM Standard
RULE-30011
Error Stack Trace Rendered in the UI
line-precisefixture-tested
 MEDIUM Standard
RULE-30101
${v} = http.request() Is Never Ended, So the Request Is Never Sent
line-precisefixture-tested
 HIGH Standard
RULE-30102
uncaughtException Handler Keeps the Process Running
line-precisefixture-tested
 MEDIUM Standard
RULE-30104
Object.${it[1]}(${e[1]}) on a Numeric Enum Lists Every Member Twice
line-precisefixture-tested
 MEDIUM Standard
RULE-30105
zlib.${m[1]}${m[2] ??
line-precisefixture-tested
 HIGH Standard
RULE-30106
${v} Has the g Flag and Is Reused With .test()
line-precisefixture-tested
 MEDIUM Standard
RULE-30107
${m[1]}() in a Request Handler Blocks the Event Loop
line-precisefixture-tested
 MEDIUM Standard
RULE-30108
Middleware catch Swallows the Error and Never Calls next()
line-precisefixture-tested
 MEDIUM Standard
RULE-30109
cookies().${m[1]}() Called While Rendering a Server Component
line-precisefixture-tested
 HIGH Standard
RULE-30110
sync.${p[2]} ${p[1]} Passed by Value
line-precisefixture-tested
 HIGH Standard
RULE-30151
Export Downloads an Empty File
line-precisefixture-tested
 HIGH Standard
RULE-30152
${m[1]} Are Hard-Coded in the Source
line-precisefixture-tested
 HIGH Standard
RULE-30201
Agent Loop Calls the Model With No Step Limit
line-precisefixture-tested
 MEDIUM Standard
RULE-30202
Agent Tool Runs ${fsCall[1]}() on a Path the Model Chose
line-precisefixture-tested
 HIGH Standard
RULE-30251
Node Inspector Exposed on All Interfaces (${m[0]})
line-precisefixture-tested
 CRITICAL Standard
RULE-30252
${m[1]} Is Downloaded Over an Unencrypted URL
line-precisefixture-tested
 HIGH Standard
RULE-30301
${name} Is Read by the Code but Declared in No Env Template or Deploy Config
line-precisefixture-tested
 MEDIUM Standard
RULE-30302
Dockerfile Uses Node ${d.major}, but ${engines.path} Requires Node ${engines.major}+
line-precisefixture-tested
 MEDIUM Standard
RULE-30303
App Accepts ${mb(bytes)} Uploads, but ${proxy.path} Stops Requests at ${mb(proxy.bytes)}
line-precisefixture-tested
 MEDIUM Standard
RULE-30304
Query Filters
line-precisefixture-tested
 LOW Standard
RULE-30305
Browser Code Queries
line-precisefixture-tested
 HIGH Standard
RULE-30306
Outbound HTTP Call Without a Timeout (Go)
line-precisefixture-tested
 MEDIUM Standard
RULE-30307
Balance or Stock Is Read, Changed in Code, Then Saved Without a Lock
line-precisefixture-tested
 HIGH Standard
RULE-30308
Per-User Data
line-precisefixture-tested
 HIGH Standard
RULE-30309
line-precisefixture-tested
 MEDIUM Standard
RULE-30310
Request to ${m[1]} Leaves Out ${missing.join(
line-precisefixture-tested
 MEDIUM Standard
RULE-30311
Payment Webhook Adds Credit Without Recording Which Events It Already Handled
line-precisefixture-tested
 HIGH Standard
RULE-30312
Endpoint Sends SMS Without a Rate Limit
line-precisefixture-tested
 HIGH Standard
RULE-30313
This ${model} Query Skips the Tenant Filter the Other ${model} Queries in This File Use
line-precisefixture-tested
 HIGH Standard
RULE-30315
${fk.table}.${fk.col} Cascades on Delete but No Migration Indexes It
line-precisefixture-tested
 LOW Standard
RULE-30341
Outside Call Retried in a Tight Loop With No Backoff
line-precisefixture-tested
UNKNOWN Standard
RULE-30342
axios-retry Retries With No Delay
line-precisefixture-tested
UNKNOWN Standard
RULE-30401
Token Is Decoded by Hand and Trusted Without a Signature Check
line-precisefixture-tested
 CRITICAL Verified Gate