Upload a project and it is checked against these rules, or download the offline package and run it on your own machine so the code never leaves it. Every report begins with its scope, then lists each control as passed or failed, and only then the findings, so you know how much was checked, not only what was found.
Categories: Secrets and credentials · Injection and unsafe execution · Unsafe deserialization and parsing · Request handling: paths, URLs, redirects, output · Cryptography · Transport security · Authentication, sessions and access control · Configuration and exposure · Sensitive data handling and logging · Containers · Infrastructure as code and pipelines · Dependencies and supply chain · Code hygiene.
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-001 | Private key committed to source | critical | all text files | A PEM private key block, header and key material, is present. Whoever holds the key can impersonate the server, sign artifacts, or log in as the account it belongs to. Removing the file in a later commit does not remove it from history. |
| CODE-002 | AWS access key committed to source | critical | all text files | A string in this code has the exact shape of an AWS access key ID (AKIA or ASIA followed by 16 characters), or an AWS secret access key next to its name. Anyone who can read this repository can try the key, and automated scrapers do within minutes of a public push. |
| CODE-003 | Google API key committed to source | high | all text files | A string has the shape of a Google API key (AIza followed by 35 characters). Depending on how the key is restricted, it can be used to run up billing or read data from the Google services it is enabled for. |
| CODE-004 | Source-control access token committed to source | critical | all text files | A GitHub or GitLab token (ghp_, gho_, github_pat_, glpat- and similar documented prefixes) is present. These tokens grant the access of the account that issued them, usually including private repositories and often write access. |
| CODE-005 | Slack token or webhook committed to source | high | all text files | A Slack API token (xoxb-, xoxp-, xapp-) or incoming-webhook URL is present. A bot or user token can read and post messages within its scopes; a webhook lets anyone post into the channel as your integration. |
| CODE-006 | Stripe live secret key committed to source | critical | all text files | A Stripe live-mode secret or restricted key (sk_live_, rk_live_), or a webhook signing secret, is present. A live secret key can create charges and refunds and read customer payment metadata. |
| CODE-007 | Third-party service token committed to source | high | all text files | A credential with a documented vendor prefix is present: Twilio, SendGrid, npm, PyPI, DigitalOcean, Shopify, Hugging Face, OpenAI, Anthropic, or an Oracle Cloud pre-authenticated request URL (a URL that grants access to an Object Storage bucket or object to whoever holds it). Each lets the holder act as your account on that service. |
| CODE-008 | JSON Web Token embedded in source | medium | all text files | A string decodes as a real JSON Web Token: a header with an algorithm and a payload object. A signed token in source is a bearer credential until it expires; many are long-lived service tokens. Some are sample tokens from documentation, which this scanner cannot tell apart from live ones. |
| CODE-009 | Hard-coded password, secret or token | high | all text files | A variable or setting whose name says it holds a password, secret or token is assigned a literal value that looks real: it is long enough, not a placeholder and not a reference to an environment variable. Credentials in source are visible to everyone with read access and persist in history. |
| CODE-010 | Credentials embedded in a URL or connection string | high | all text files | A URL of the form scheme://user:password@host contains a password. Connection strings are logged, shown in error messages and copied into tickets, so a password inside one spreads far beyond the file it was committed in. |
| CODE-011 | Sensitive file committed to the repository | high | all text files | A file that normally holds credentials is part of the source: an .env file with values, a key store, Terraform state, a package manager auth file or a password database. These files exist to hold secrets, so their presence in version control is a finding even before looking inside. |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-012 | SQL statement built by string concatenation or formatting | medium | csharp, go, java, javascript, kotlin, php, python, ruby, scala, typescript | A SQL statement is assembled from strings (concatenation, formatting or an f-string) and passed to a database call. If any interpolated value can be influenced by a user, the query can be rewritten by an attacker (SQL injection), which typically allows reading or changing any data the database account can reach. A statement built only from constants or internal names is not exploitable, and is reported at Low so it can be confirmed. |
| CODE-013 | Operating-system command built from variable input | high | c, cpp, csharp, go, java, javascript, kotlin, php, python, ruby, typescript | A shell command is run with text that is not a fixed literal: a variable, a concatenation or a formatted string. If any part is attacker-influenced, shell metacharacters (; | && $( ) in it run arbitrary commands with the privileges of this process (command injection). Commands built only from internal values are reported at Medium so they can be confirmed. |
| CODE-014 | Dynamic code evaluation | high | html, javascript, php, python, ruby, shell, typescript, vue | Text is turned into code at run time (eval, exec, the Function constructor, a string passed to setTimeout). If any part of that text can be influenced by a user, the attacker runs their own code inside your application. Evaluating a fixed literal is not reported; evaluating anything else is, at High when it is visibly request-derived and Medium otherwise. |
| CODE-019 | Template injection | high | javascript, python, ruby, typescript | A template, or HTML marked as safe, is built from a formatted string. If a user-controlled value reaches the template text (rather than being passed as a template variable), the attacker can write template expressions and, in Jinja2, ERB or EJS, typically run code on the server; if it reaches Markup or mark_safe it becomes a stored or reflected script injection. |
| CODE-056 | NoSQL query built from request data | medium | java, javascript, php, python, typescript | A document-database query receives the request body or query string as a whole, or uses $where. A caller who sends an object such as {"$ne": null} instead of a string changes what the query means, which is how logins are bypassed and records are read that were never meant to be. $where evaluates a string as JavaScript on the database server. |
| CODE-057 | LDAP or XPath query built from variable input | medium | csharp, go, java, javascript, kotlin, php, python, ruby, typescript | A directory (LDAP) search filter or an XPath expression is assembled by joining strings. Characters such as * ( ) | & ' in the input then change the query: a login filter can be made always-true, or other users' entries and nodes can be read. |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-015 | Unsafe deserialisation | high | csharp, groovy, java, javascript, kotlin, php, python, ruby, scala, typescript | Data is rebuilt into live objects with a mechanism that can run code while doing so (pickle, marshal, unsafe YAML loading, Java ObjectInputStream, PHP unserialize, .NET BinaryFormatter and similar). If an attacker can supply or alter the bytes, they can usually execute code on the server. This scanner cannot see where the data comes from, so confirm each location. |
| CODE-016 | XML parser that may resolve external entities | medium | csharp, java, javascript, kotlin, php, python, scala, typescript | An XML parser is created or configured in a way that allows a document to define entities that read local files or make network requests (XXE). If the document comes from outside, an attacker can read files from the server or reach internal addresses through it. For Java factories this means the file contains no call that disables DTDs or external entities. |
| CODE-058 | Archive extracted without checking member paths | medium | python | tarfile or zipfile extracts every member to disk. A member named ../../etc/cron.d/x or an absolute path, or a symbolic link pointing outside the folder, writes files outside the intended directory ("zip slip"), which can overwrite code or configuration. |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-017 | File path built from request data | medium | csharp, go, groovy, java, javascript, kotlin, php, python, ruby, scala, typescript | A file is opened, read, served or deleted using a path that includes a value taken from the request on the same line. If the value is not validated, '../' sequences let a caller escape the intended directory and read or overwrite other files (path traversal). This is a line-level heuristic: it does not see validation done on an earlier line. |
| CODE-018 | Outbound request to a user-supplied URL | low | csharp, go, groovy, java, javascript, kotlin, php, python, ruby, scala, typescript | The server fetches a URL that includes a value taken from the request. Unless the destination is checked, an attacker can make the server request internal addresses (cloud metadata services, admin panels, databases) and return or act on the response (server-side request forgery). Reported at Low because the scanner cannot see whether the host is validated. |
| CODE-020 | Redirect to a request-supplied address | low | csharp, go, groovy, java, javascript, kotlin, php, python, ruby, scala, typescript | The response redirects to an address that includes a value taken directly from the request. Attackers use this to send victims from your trusted domain to a phishing page. Reported at Low because validation on an earlier line is not visible to a line-level scan. |
| CODE-021 | Cross-site scripting sink | medium | html, javascript, php, ruby, template, typescript, vue | Content is written into a page as HTML rather than as text (innerHTML, document.write, dangerouslySetInnerHTML, v-html, the safe filter, echo of request data). If the content includes a user-supplied value that was not escaped, an attacker's script runs in the visitor's browser with their session. Writes of constant strings are not reported. Where the value is built from variables with no visible escaping call, the severity is Medium; a plain variable assignment is Low. |
| CODE-060 | Regular expression built from request data | low | csharp, go, java, javascript, kotlin, php, python, ruby, typescript | A regular expression is compiled from request input. A caller can send a pattern that takes exponential time on certain input (catastrophic backtracking) and tie up a worker, or one that matches far more than intended. |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-022 | Weak hash used for passwords or signatures | medium | csharp, go, java, javascript, kotlin, php, python, ruby, typescript | MD5 or SHA-1 appears next to password or signature handling, or a plain SHA-2 hash is applied to a password. MD5 and SHA-1 are broken for collision resistance, so signatures and certificates built on them can be forged. Fast hashes of any kind let an attacker who obtains the stored values test billions of password guesses per second. |
| CODE-023 | Weak cipher or cipher mode | medium | c, cpp, csharp, go, groovy, html, java, javascript, kotlin, php, powershell, python, ruby, rust, scala, shell, swift, template, typescript, vue | The code selects a cipher that is obsolete (DES, 3DES, RC4, RC2) or a mode that leaks structure (ECB: identical plaintext blocks give identical ciphertext blocks), or a legacy API that derives keys unsafely. Data protected this way may be recoverable or modifiable by an attacker who sees the ciphertext. |
| CODE-024 | Hard-coded cryptographic key or IV | high | c, cpp, csharp, go, groovy, html, java, javascript, kotlin, php, powershell, python, ruby, rust, scala, shell, swift, template, typescript, vue | A cryptographic key is written into the source as a literal, or an initialisation vector or nonce is a fixed value. Anyone with the source can decrypt or forge the protected data, and a fixed IV or nonce breaks the confidentiality guarantees of CBC, CTR and GCM (a repeated GCM nonce also leaks the authentication key). |
| CODE-025 | Non-cryptographic random number used for a secret | medium | csharp, go, java, javascript, kotlin, php, python, ruby, typescript, vue | A general-purpose random number generator (Python random, Math.random, PHP rand/mt_rand, java.util.Random) is used on the same line as a name that suggests a token, password, session id, nonce or salt. These generators are predictable: an attacker who observes a few outputs can often compute the next ones, and so guess other users' tokens. |
| CODE-059 | Asymmetric key shorter than 2048 bits | medium | config, csharp, dockerfile, go, groovy, java, javascript, kotlin, make, php, python, ruby, scala, shell, typescript, yaml | An RSA key of 1024 bits or fewer is generated. Keys of this size can be factored with resources within reach of a well-funded attacker and are rejected by current browsers, certificate authorities and standards (NIST SP 800-57 and 800-131A call for at least 2048 bits). |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-026 | TLS certificate verification disabled | medium | c, config, cpp, csharp, dockerfile, go, groovy, html, java, javascript, kotlin, make, php, powershell, python, ruby, rust, scala, shell, swift, template, typescript, vue, yaml | The code switches off TLS certificate or hostname checking (verify=False, rejectUnauthorized: false, InsecureSkipVerify, curl -k and equivalents). The connection is still encrypted, but the client no longer checks who it is talking to, so anyone on the network path can impersonate the server and read or alter the traffic, including any credentials sent over it. If this is a deliberate assessment or diagnostic code path that inspects servers with untrusted certificates, confirm it can never carry your own credentials or sensitive data and is not reachable with attacker-chosen destinations. |
| CODE-027 | Legacy SSL/TLS protocol version enabled | medium | c, config, cpp, csharp, dockerfile, go, groovy, html, java, javascript, kotlin, php, powershell, python, ruby, rust, scala, shell, swift, template, typescript, vue, yaml | The configuration selects SSLv2/SSLv3, TLS 1.0 or TLS 1.1. These versions have known attacks (POODLE, BEAST) and are deprecated by RFC 8996 and by PCI DSS. Code that lists these names in order to detect or test for them is also reported, since a text scan cannot tell enabling from probing. |
| CODE-069 | Data fetched or sent over plain HTTP, FTP or WS | low | csharp, go, groovy, java, javascript, kotlin, php, python, ruby, rust, scala, shell, swift, typescript | A request, download or connection is made to an address that begins with http://, ftp:// or ws://. The traffic, including any credentials, tokens and downloaded code, crosses the network unencrypted and can be read or altered by anyone on the path; a downloaded script or package can be swapped for a malicious one. Addresses for local development, XML namespaces and links in comments are ignored. |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-028 | JWT signature verification disabled | high | c, cpp, csharp, go, groovy, html, java, javascript, kotlin, php, powershell, python, ruby, rust, scala, shell, swift, template, typescript, vue | JSON Web Token handling is configured to accept unsigned tokens (algorithm 'none'), to skip signature verification, or to skip expiry checks. A token that is not verified can be written by anyone, so an attacker can claim any identity or role. |
| CODE-031 | Cookie set without Secure or HttpOnly | low | config, csharp, go, groovy, java, javascript, kotlin, php, python, ruby, scala, typescript | A cookie is set without the HttpOnly flag, without Secure, or with one of them explicitly turned off. Without HttpOnly any script injected into a page can read the cookie (session theft); without Secure the browser also sends it over plain HTTP where it can be captured on the network. This is a line-level heuristic and cannot see defaults set elsewhere in the framework. |
| CODE-032 | CSRF protection disabled | medium | csharp, groovy, java, javascript, kotlin, php, python, ruby, typescript | Cross-site request forgery protection is switched off for a view or for the whole application. A malicious page can then make a logged-in user's browser submit state-changing requests (change email, transfer, delete) without their knowledge. Disabling is sometimes correct for pure token-authenticated APIs; confirm that no cookie-based session reaches the exempted endpoints. |
| CODE-071 | Password compared as plain text | medium | csharp, go, groovy, java, javascript, kotlin, php, python, ruby, scala, typescript | A password from a user record is compared directly with the value that was typed in. That only works if passwords are stored unhashed, so a copy of the database discloses every account; ordinary comparison also leaks timing. The match is on variable names and can be wrong where the field holds a hash. |
| CODE-072 | Signed token issued without an expiry | low | java, javascript, kotlin, php, python, ruby, typescript | A JSON Web Token is created with no expiry claim (exp / expiresIn / setExpiration). A token that never expires stays valid for ever once it leaks, survives password changes and cannot be revoked short of changing the signing key. This is a heuristic: if the payload is built elsewhere and already contains exp, the finding is a false positive. |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-029 | Debug mode enabled | medium | config, dockerfile, php, python, ruby, shell, yaml | A framework debug switch is on. Debug pages show source code, settings and environment variables to anyone who triggers an error, and Flask's Werkzeug debugger and Django's debug page can be used to run code. When the server also listens on all interfaces (0.0.0.0), the debugger is reachable from the network, which is rated High. Development settings files are reported at Low. |
| CODE-030 | Permissive cross-origin (CORS) policy | low | config, csharp, go, groovy, java, javascript, kotlin, php, python, ruby, scala, typescript, yaml | Cross-origin requests are allowed from any origin. For a public, read-only API that is a legitimate choice. If the same service also allows credentials, or serves data that depends on the caller's session, any website a user visits can read that data with their login (rated Medium when credentials are also enabled nearby). |
| CODE-033 | Spring actuator endpoints exposed | medium | config, yaml | Spring Boot is configured to expose every actuator endpoint over the web, or to switch actuator security off. Endpoints such as env, heapdump, threaddump, beans and mappings reveal configuration (sometimes with secrets), memory contents and the application's internals, and some allow changing log levels or shutting the service down. |
| CODE-034 | World-writable permissions | medium | dockerfile, go, javascript, make, php, python, ruby, shell, typescript, yaml | Files or directories are made readable, writable and executable by every user on the system (mode 777). Any other account, container or compromised service on the host can then replace scripts and binaries that this application later runs, which turns a minor foothold into code execution. |
| CODE-062 | Predictable or race-prone temporary file | medium | c, cpp, python, shell | A temporary file is created with a name that is chosen first and opened later, or with a fixed name in a shared folder. Another user or process can create that name in between, or a link planted in advance, so the program reads or overwrites a file that is not its own (a symlink or race attack). |
| CODE-063 | Framework security setting weakened | medium | config, groovy, java, javascript, kotlin, python, ruby, scala, typescript | A built-in protection of the web framework is turned off or left at a published example value: any Host header is accepted, HTTPS is not forced, HSTS or clickjacking protection is disabled, or a signing key is a placeholder that anyone can guess. Placeholder signing keys let an attacker forge sessions and tokens. |
| CODE-064 | Risky PHP setting | medium | config, php | PHP is configured so that include() can load a remote URL, request variables become global variables, session identifiers travel in the URL, or the exact PHP version is announced. Remote includes turn any file-inclusion bug into remote code execution; session ids in URLs leak through logs and the Referer header. |
| CODE-065 | Web server lists directories or announces its version | medium | config | The web server configuration lets visitors browse folders, announces its exact version, or allows the TRACE method. Directory listings reveal backup files, source and configuration that were never meant to be linked; version banners tell an attacker which known vulnerabilities to try. |
| CODE-070 | Service listens on every network interface | info | config, csharp, go, groovy, java, javascript, kotlin, php, python, ruby, scala, typescript | The service is told to accept connections on every network interface. That is normal inside a container behind a proxy, but on a server with a public address it exposes the service, and any admin or debug endpoint with it, to the whole network. Databases and caches especially should not be reachable from outside. |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-061 | Sensitive value written to a log | medium | csharp, go, groovy, java, javascript, kotlin, php, python, ruby, scala, shell, typescript | A password, token, key or card number appears to be passed to a logging or print call. Logs are copied to monitoring systems, support tickets and backups with wider access than the database, so a secret written there is exposed to everyone who can read them and stays long after it is rotated. This is a line-level heuristic on the variable names. |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-035 | Container runs as root | medium | dockerfile | The final stage of this Dockerfile never switches to a non-root user, so the application runs as root inside the container. A vulnerability in the application then gives the attacker root in the container, which makes container escapes, writes to mounted volumes and attacks on the host much easier. The base image may already set a non-root user; this scan cannot see inside it. |
| CODE-036 | Container image not pinned or fetched from a URL | low | dockerfile | The base image has no tag or uses 'latest', or ADD downloads a file from a URL. A moving tag means two builds of the same Dockerfile can contain different software, including a compromised or broken one; ADD from a URL has no integrity check and runs at build time with whatever the server returns. |
| CODE-037 | Secret stored in a container image variable | high | dockerfile | An ENV instruction sets a password, token or key to a literal value, or an ARG with a secret-like name is declared. ENV values are baked into the image and readable by anyone who can pull it (docker inspect). ARG values are kept in the image history (docker history), so build arguments are not a safe way to pass secrets either. |
| CODE-038 | Remote script piped into a shell | medium | dockerfile, make, shell, yaml | A script downloads content and feeds it straight into a shell or interpreter. Whatever the server returns at that moment is executed with your privileges, with no chance to review it and no integrity check. A compromised or hijacked download host, or a truncated transfer, becomes arbitrary code execution in your build or deployment. |
| CODE-039 | Recursive delete of an unchecked variable | medium | dockerfile, make, shell | rm -rf is run on a path made from a variable followed by '/'. If the variable is empty or unset, the path becomes '/' or '/*' and the command deletes the system. This is a well-known cause of destroyed machines and wiped data volumes. Scripts that use 'set -u' or the ${VAR:?} form are not reported. |
| CODE-066 | Container given control of the host | high | dockerfile, make, shell, yaml | A container is started with the Docker socket, the host's network or process namespace, all capabilities, or --privileged. Anything running inside can then start further containers as root, read other containers' traffic and processes, or escape to the host: a flaw in the application becomes control of the machine. |
| CODE-068 | Image exposes a remote-login or admin port | medium | dockerfile | The image exposes SSH, Telnet, remote desktop, VNC or the Docker daemon port, or installs a server for them. A container should do one job and be managed from outside; a login service inside it adds another set of accounts and passwords to defend and is a favorite target. |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-040 | Infrastructure rule open to the internet on an admin port | high | terraform | A Terraform security group, security list, network security group rule or firewall allows traffic from anywhere (0.0.0.0/0 or ::/0) on a management or database port (SSH, RDP, SMB, MySQL, PostgreSQL, SQL Server, Oracle DB, MongoDB, Redis, Elasticsearch and similar), or on every port. Those services are scanned for continuously and attacked with leaked credentials and unpatched flaws within minutes of exposure. Covers AWS, GCP and Oracle Cloud (oci_core_security_list and oci_core_network_security_group_security_rule) resources. |
| CODE-041 | Storage or database exposed publicly | high | terraform | Terraform asks for a bucket, container or database that anyone on the internet can reach: a public-read ACL, a disabled public access block, a grant to allUsers, a database marked publicly_accessible, or an Oracle Cloud Object Storage bucket whose access_type is anything other than NoPublicAccess (ObjectRead and ObjectReadWithoutList expose its objects without authentication). Public storage is a leading cause of data breaches. |
| CODE-042 | Encryption or HTTPS enforcement disabled | medium | terraform | Terraform explicitly turns off encryption at rest, encryption in transit or HTTPS enforcement, or allows TLS 1.0/1.1. Data on an unencrypted volume or database is readable from snapshots, backups and discarded media, and plain-HTTP access exposes credentials and content to anyone on the network path. |
| CODE-043 | Hard-coded credential in Terraform | high | terraform | A Terraform provider or resource sets an access key, secret, token or password to a literal string. Terraform files live in version control and the values are also written to the state file in clear text, so the credential is exposed to everyone who can read the repository or the state backend. |
| CODE-044 | Kubernetes workload with elevated privileges | high | yaml | A Kubernetes manifest runs a container privileged, shares the host's network, PID or IPC namespace, adds a powerful Linux capability (SYS_ADMIN, NET_ADMIN, ALL), mounts a host path, or runs as root / allows privilege escalation. Privileged or host-namespace containers can break out to the node, and from the node to the rest of the cluster. Root and privilege escalation are reported at Medium. |
| CODE-045 | Secret in a Kubernetes environment variable | high | yaml | A container environment variable with a secret-like name (a password, token or key) is given a literal value in the manifest. The value is stored in version control, shown by kubectl describe and visible to everyone with read access to the workload. |
| CODE-046 | Kubernetes Secret manifest with inline data | high | yaml | A Kubernetes Secret object with its data included is committed to the repository. The values under 'data' are only base64 encoded, which is not encryption: anyone who can read the file can decode them in one command. |
| CODE-047 | Kubernetes workload without resource limits | info | yaml | A workload defines containers but no resource limits. Without a CPU and memory limit, one misbehaving or compromised container can starve the rest of the node. This is a reliability and containment note, not an exploitable vulnerability. |
| CODE-048 | GitHub Actions: untrusted input reaches a shell or privileged checkout | high | yaml | A workflow either interpolates attacker-controllable event data (issue or pull request title and body, branch names, commit messages, comments) directly into a shell script, so a crafted title can run commands on the runner; or it checks out the pull request's own code under pull_request_target, which runs with repository secrets and a write token. |
| CODE-049 | GitHub Actions: third-party action not pinned to a commit | medium | yaml | A workflow uses an action that is referenced by a branch, which changes whenever the author pushes, or (for third-party actions, at Low) by a version tag that the author can move. A compromised or malicious update to the action then runs in your pipeline with access to your secrets and token. Only a full commit SHA is immutable. |
| CODE-050 | GitHub Actions: workflow token has write-all permissions | medium | yaml | The workflow grants its GITHUB_TOKEN every permission (permissions: write-all). Any step, including a third-party action or a compromised dependency, can then push code, modify releases and alter repository settings. |
| CODE-067 | Access policy grants every action, resource or principal | high | json, terraform, yaml | A cloud access policy uses the wildcard "*" for the action, for the resource, or for who may use it. An identity with Action * on Resource * is an administrator; a policy open to Principal * lets anyone on the internet use the permission it grants. Both turn one stolen key, or one mistake, into a full account takeover. |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-051 | Dependencies are not locked | low | requirements | A dependency manifest has no lockfile beside it, or a Python requirements file lists packages without an exact version (==). Without a lock, every install resolves to whatever is newest that day, so builds are not reproducible and a malicious or broken release is picked up automatically. This is a hygiene finding about how dependencies are declared; it says nothing about known vulnerabilities. |
| CODE-052 | Risky dependency source or version | medium | all text files | A dependency is declared with a wildcard or 'latest' version, fetched from a git branch or URL instead of a registry release, pulled over plain HTTP or git://, or certificate checking is turned off for the package manager. Plain-HTTP sources can be tampered with in transit; unpinned git or URL sources change without any version bump. Extra index URLs are listed because they are how dependency-confusion attacks reach a build. This does not detect known-vulnerable versions. |
| CODE-053 | Install script downloads and runs remote code | high | all text files | An npm lifecycle script (preinstall, install, postinstall, prepare) fetches something from the network, and in the serious case pipes it into a shell or interpreter. These scripts run automatically on every machine that installs the package, including CI runners holding secrets, so whatever the remote server returns is executed there. |
| ID | Control | Severity | Applies to | Why it matters |
|---|---|---|---|---|
| CODE-054 | Security-related TODO or FIXME comment | info | c, config, cpp, csharp, dockerfile, go, groovy, html, java, javascript, kotlin, make, php, powershell, python, ruby, rust, scala, shell, sql, swift, template, terraform, typescript, vue, yaml | Comments mark security work as unfinished (a TODO or FIXME that mentions authentication, validation, encryption, secrets or similar) or call code a hack. They are not vulnerabilities, but they show where the authors themselves knew a control was missing or temporary. |
| CODE-055 | Security linter suppressed | info | c, config, cpp, csharp, dockerfile, go, groovy, html, java, javascript, kotlin, make, php, powershell, python, ruby, rust, scala, shell, sql, swift, template, terraform, typescript, vue, yaml | A security linter or static-analysis warning has been switched off for specific lines (nosec, noqa S-codes, eslint security rules, nolint:gosec, NOSONAR). Each suppression may be justified, but each is also a place where a finding was silenced instead of fixed, so they deserve a periodic review. |