SAST Rules

Author your own Rego-based SAST rules, publish them to a Git repository, and load them with the --rule flag — alongside or instead of the built-in rules.

Exhaustive, high-fidelity hardcoded-secret detection rules grouped by category.

Reports session, authentication and identity cookies set without HttpOnly in Go, Node.js, PHP, Python and Java, and framework settings that turn the session cookie's HttpOnly flag off.

Reports words in Python, JavaScript/TypeScript and Java source that mix Latin letters with Cyrillic or Greek lookalikes, the shape used to spoof usernames, domains and identifiers.

Reports code and configuration that disables, weakens or removes the browser's frame protection (X-Frame-Options, CSP frame-ancestors, Spring Security, helmet, Django, Rails, Rack, Talisman, ASP.NET), so any site can frame the application.

Reports target="_blank" links to dynamic URLs without rel="noopener noreferrer", links with rel="opener", and window.open() to a variable URL without noopener (reverse tabnabbing).

Reports passwords, tokens, keys, signatures, digests, OTPs and PINs checked with startswith/endswith/regionMatches or compared after truncation in Python and Java, so an empty or short guess matches.

Reports Java equals() between a declared type and a literal of another type (String vs number, Long vs int literal, UUID vs string) and Python string input compared with an int literal, checks that can never pass.

A comparison that examines the wrong property of its operands, so it can succeed or fail regardless of the values the author meant to compare. Reported: in Java, == or != between object references where a value comparison was meant (a String literal operand, a String-returning call such as getParameter/getHeader/trim/toString, a variable declared String a few dozen lines above, or two variables declared Integer/Long/BigDecimal and other boxed types), and classes compared by name (getClass().getName()/getSimpleName() with equals or ==); in Python, `is`/`is not` against a str, bytes, number, list, dict or empty-tuple literal in an if/elif/while/assert/return statement (also the first line of a condition that wraps) or an assignment, and type(x).__name__ or x.__class__.__name__ compared with ==/!=; in JavaScript/TypeScript, ==/=== against a fresh [] or {} literal (always a different object), x.constructor.name compared with ==/===, and typeof compared with a string typeof never returns ('array', 'null', 'date', ...); in Go, err.Error() text compared with ==/!= with a non-empty literal or another error's text instead of errors.Is (directly or through a variable assigned err.Error() a few lines above), and switch err.Error() {, and reflect.TypeOf(x).Name()/String() or fmt.Sprintf("%T") compared with ==; in PHP, loose ==/!= with an md5/sha1/hash/hash_hmac/crypt result, directly or through a variable assigned one a few lines above ("0e..." hashes compare as numbers), strcmp/strcasecmp(...) == 0 and !strcmp(...) (NULL == 0 when an argument is an array), and get_class() compared with a string literal. Not reported: err.Error() != "" (an emptiness test), comparisons with null/None/True/False, enums, primitives and char literals, equals()/Objects.equals/MessageDigest.isEqual/hash_equals/password_verify/errors.Is/instanceof/isinstance, strict === in PHP, a.intern() == b.intern(), get_class() against ::class or __CLASS__, timing-unsafe comparison of secrets (a different weakness), test code, comments and the pattern inside string literals. Two comparisons are reported by a more precise rule, so the line is reported once: a Java String compared with a string literal by == or != by VNX-597 (String compared with == instead of equals()), and a PHP loose comparison VNX-PHP-010 reports (a hash compared with ==, strcmp() == 0 on request data: PHP type juggling).

Reports Node.js require(), require.resolve() and dynamic import() calls whose module specifier contains Express or Koa request data, letting a caller choose which file the server loads and runs.

Reports C and C++ secrets wiped with memset, bzero or ZeroMemory just before the memory is freed or goes out of scope, a dead store the optimizer may delete.

Reports Python and JavaScript/TypeScript handlers in reCAPTCHA v3 projects that accept the siteverify response on success alone, and score checks against 0, so the bot detector never rejects a bot.

Reports a check the code has just made being made again: an else-if that repeats a condition of its own if chain, a && / || whose two operands are the same expression, and a security check statement repeated on the next line.

Reports a Java class, Go struct, Python class or TypeScript class/interface that declares more than 10 instance fields of non-primitive type, on its declaration line.

Reports the concrete case of too few layers: an HTTP controller, view, route handler or servlet that executes SQL against the database itself, once per file, in Java, Python and JavaScript/TypeScript.

Reports a C++ child class whose own destructor is declared without virtual, override or final although a parent in its base list declares a virtual destructor.

Reports a Java or C# String accumulated with +=, s = s + ... or s = s.concat(...) inside a for, foreach, while or do loop, where the variable is a String local declared before the loop.

Detects Python and JavaScript/TypeScript modules of the same project that import each other, directly or through a third module, including cycles hidden by an import deferred into a function.

Detects a single function or method in Go, Java, JavaScript/TypeScript, PHP, Python or Ruby whose body calls 40 or more distinct functions or methods (excessive fan-out).

Reports a single SQL SELECT written in Python, Java or JavaScript/TypeScript that combines five or more JOIN clauses and parenthesised sub-queries. Small queries, several queries in a row, str.join calls, comments and ORM chains are not reported.

Reports Python code that opens a database connection, pool, engine, HTTP session, cloud SDK client, broker or SMTP/FTP connection on every loop iteration with arguments that do not depend on the iteration. Per-target connections, retry loops, hoisted resources, open() and tests are not reported.

Reports a literal IPv4 address written into Python, JavaScript/TypeScript, Java or Go source as a URL host, a host/address setting, or the target of a socket or dial call. Loopback, 0.0.0.0, documentation ranges, the cloud metadata address, CIDR blocks, hostnames, comments and tests are not reported.

Detects database, cache and message-broker clients in Go, Java, JavaScript/TypeScript, PHP and Python initialised with a hard-coded non-loopback IP address or host name.

Reports Java and Python comments in which the author records that a design or architecture is not documented: a TODO/FIXME/XXX/TBD to document, explain or describe the design, or a note that the design doc is missing or pending. Ordinary TODOs, string literals and missing docstrings are not reported.

Detects blocks of comment lines that read as code (statements, control flow, calls) rather than prose, in Go, Java, JavaScript/TypeScript, PHP, Python and Ruby.

Reports a Python class that inherits from two or more concrete classes defined in the same file, each with its own methods or attributes. Mixins, ABCs, interfaces, empty marker classes, imported bases and test files are not reported.

Reports a C or C++ printf-style variadic function definition (a format string followed by ..., forwarded to the v*printf or v*scanf family) that has no format attribute on its definition or any prototype, so the compiler cannot check its arguments. Prototypes, macros, function pointers, variadic templates, count- or sentinel-driven variadics and attributed wrappers are not reported.

Reports raw database access (driver connect, cursor(), cursor.execute, Model.objects.raw, execute() or fetch() with SQL text) in a Python view, route, handler or controller module of a project that has a models/repositories/dao/db component. ORM queries, calls into the data layer, SQL inside the data layer, projects without one and tests are not reported.

Reports a non-final, non-volatile static field of a non-thread-safe type in a multi-threaded Java class (servlet, filter, Spring bean, JAX-RS resource, ContentProvider, Runnable/Thread or executor user) that a method writes without holding a lock, or a static formatter or calendar it uses unguarded. Constants, atomic and concurrent types, static-initialiser-only writes and tests are not reported.

Python database queries (cursor.execute, session.query, Model.objects.get/filter, asyncpg fetch) issued inside a loop or comprehension with the loop variable, or a name derived from it, as an argument: an N+1 query pattern. Chunked IN batches are not reported.

Java base classes whose own source file tests instanceof, pattern-matches, compares getClass() with, casts to, or constructs one of their subclasses declared elsewhere in the project.

Java static initializer blocks that construct application or library objects (new Type(...)) at class-load time, excluding JDK collections, value types and thrown exceptions.

Java method and constructor declarations with more than seven parameters, counted across line breaks with annotations and generic arguments removed; @Override and @ParameterizedTest methods are skipped.

Java servlets, EJBs, JAX-RS resources and Spring controllers that call System.exit(), Runtime.getRuntime().exit()/halt() or create their own threads with new Thread(...) or an Executors pool; launcher main methods and tests are not reported.

Java classes that implement Serializable but declare no serialVersionUID among their own members, including nested classes and headers split across lines.

Java SQL, JPQL, Criteria and Spring Data searches that force a sequential table scan: a leading LIKE/ILIKE wildcard in the query or the bound value, a function applied to a compared column, or a Containing/EndingWith/IgnoreCase derived query.

Java methods and constructors whose Javadoc names a @param the signature does not declare, or documents @return on a void method or a constructor.

A Java catch block whose body is empty, on one line or across lines, so the exception is swallowed with no log, rethrow, return or recorded decision.

An instance field of a JDK type that is never serializable (Thread, Socket, streams, JDBC Connection, ExecutorService, Optional, Logger and similar), neither static nor transient, in a Java class whose own header implements Serializable.

A Java if, else, for, while, synchronized, try, finally or do block with nothing between its braces, or an if or for whose body is a stray semicolon.

Java production code that opens database connections without a pool: DriverManager.getConnection(...), new DriverManagerDataSource or new SimpleDriverDataSource, or a vendor non-pooling DataSource with no pool in the file.

A Java method that performs five or more data-resource accesses itself (JDBC execute calls, JdbcTemplate, JPA queries and EntityManager operations, Spring Data repository calls, Hibernate/MyBatis session calls).

A Java class seven or more levels deep in a chain of extends clauses resolved across the project's Java files.

A C goto that jumps backwards to a label earlier in the same function, building a loop from an unconditional jump. Backward gotos in C++ files are reported by VNX-1119.

A C++ class or struct with virtual member functions and no base clause whose destructor is public and not virtual, where VNX-1087 does not already report it.

A hand-written Python module with more than 2000 lines of code (blank lines and # comments not counted).

A C++ member function that destroys the object it runs on: `delete this;` or an explicit call of its own destructor.

A Python views, routes, controllers or handlers module that opens a raw database connection or cursor, or runs raw SQL, instead of going through the data layer.

A Python function whose body performs more than 7 file or data access operations (open, execute, os/shutil/pathlib file operations).

A Python function whose body holds 5 or more lines of commented-out code.

A Python class defined in the project that more than 20 classes in the project derive from directly.

A C++ class declares virtual methods but no virtual destructor, so deleting it through a base-class pointer never runs the derived destructor.

A table defined in the project's SQL files that carries more than 8 secondary indices.

Python code that reads, writes or reflects on another class's private member through its name-mangled form (obj._Owner__attr, getattr(obj, "_Owner__attr")), bypassing that class's own methods.

A Python data-layer module (models.py, repositories/, dao/) that imports or reads the web layer's request and response objects (Flask request/session/redirect, django.http, django.shortcuts, FastAPI Request).

Python DB-API code that runs a SELECT over a caller-chosen range (BETWEEN or </>= against placeholders) with no LIMIT or aggregate and then loads every row with fetchall().

A Python for loop or Java enhanced for loop that removes, inserts or puts into the very collection it is iterating over, which skips elements, raises RuntimeError or throws ConcurrentModificationException.

A class that defines an ordering without the matching equality: Java compareTo() without equals(Object), Kotlin compareTo() without equals(), Python __lt__/__le__/__gt__/__ge__ without __eq__.

A C++ class whose destructor releases a raw pointer (delete, delete[], free) but which declares no copy constructor, so the implicit shallow copy leads to a double free (rule of three).

Two functions or methods in the same scope of one file whose names differ only in convention (validate_token and validateToken), in Python and JavaScript/TypeScript.

Java or Python code that launches a process through a hard-coded OS-specific shell (cmd /c, powershell, /bin/sh -c, bash -c, os.system("cls")) in a file that never checks which platform it runs on.

A generated Java or Kotlin source file (one carrying, before its first type declaration, a generator header such as 'This file was generated by', 'Auto-generated', 'Code generated ... DO NOT EDIT', or a @Generated annotation) imports or names a package from the Java EE modules that were removed from the JDK in Java 11 (JEP 320): javax.xml.bind (JAXB), javax.xml.ws, javax.jws and javax.xml.soap (JAX-WS/SAAJ), javax.activation, javax.annotation.Generated/PostConstruct/PreDestroy/Resource, and CORBA (org.omg.*, javax.rmi.CORBA). The generated code then cannot run without a runtime component the platform no longer ships. Reported: each import or fully qualified use. Not reported: when the project's pom.xml or Gradle build declares the replacement runtime (jaxb-api, jaxb-runtime, jaxws-api, jaxws-rt, javax.annotation-api, javax.activation, saaj, the jakarta.* API artifacts), hand-written code (no generator marker in the header; a comment further down that mentions generated classes does not count), the jakarta.* and javax.annotation.processing.Generated replacements, other generator runtimes a build declares explicitly (protobuf, Thrift, ANTLR), and the package names inside strings or comments.

C and C++ code writes or reads the in-memory representation of a multi-byte value or a struct straight to or from a socket, file or stream: send/sendto/recv/recvfrom/write/read/pwrite/pread, fwrite/fread (including the fwrite(&x, 1, sizeof x, f) form and std:: or :: qualified calls), or an iostream .write/.read through reinterpret_cast, where the buffer is the address of a variable (&n) or a pointer and the size is sizeof of that variable, of a multi-byte scalar type (int, long, short, uint16_t/uint32_t/uint64_t, float, double, size_t) or of a struct. The bytes on the wire or on disk then depend on the host's byte order, type widths, alignment and struct padding, so another machine reads a different value. Reported: the call line. Not reported: a byte-order conversion of the same variable within a few lines (htonl/ntohl, htobe64/le64toh, bswap, cpu_to_le32, memrev), single-byte values (char, uint8_t, bool, sizeof(char)), byte buffers sized by sizeof(buf), constant counts such as write(fd, &c, 1), host-local kernel interfaces read and written in native order by design (eventfd, signalfd, timerfd, inotify, self-pipe wakeups, judged by the descriptor's name, and descriptors the same file creates with pipe()/pipe2() or socketpair()), and calls inside comments or strings.

Java or Kotlin code imports or names a JDK-implementation-internal package that is not part of the Java SE platform and is not guaranteed to exist, or to behave the same, on another JVM, JDK vendor or release: sun.* (sun.misc.Unsafe, sun.misc.BASE64Encoder, sun.security.*, sun.nio.ch.*), jdk.internal.*, the com.sun.*.internal.* and com.sun.org.apache.* repackaged copies, and the unexported implementation packages com.sun.crypto.provider, com.sun.jndi, com.sun.imageio, com.sun.media.sound and com.sun.java.swing. Code built on them breaks on a JDK upgrade or a different runtime (BASE64Encoder was removed in Java 9; jdk.internal is closed by the module system). Reported: each import, static import and fully qualified use in code. Not reported: the supported, exported com.sun APIs (com.sun.net.httpserver, com.sun.management, com.sun.jna), the standard replacements (java.util.Base64, VarHandle), class names inside string literals (the reflective probe-and-fall-back pattern), third-party libraries that merely live under com.sun (com.sun.mail, com.sun.jersey, the com.sun.xml.bind and com.sun.xml.ws reference implementations), lookalike packages (sunrise, sunflower) and comments.

A dependency manifest declares a third-party component whose maintainers have deprecated, archived or end-of-lifed it, so security fixes no longer arrive: npm request/request-promise(-native), node-uuid, jade, node-sass, tslint, gulp-util, coffee-script, istanbul, babel-eslint, nomnom, bower, phantomjs(-prebuilt), protractor, swig and the npm 'crypto' stub in package.json dependency blocks; pycrypto, nose, PyPDF2, MySQL-python, pep8, sklearn and distribute in requirements*.txt (and requirements/*.txt), pyproject.toml (PEP 621 arrays and Poetry dependency tables) and Pipfile package sections; paperclip, therubyracer and Ruby Sass (gem 'sass') in a Gemfile; and log4j 1.x (log4j:log4j), commons-httpclient 3.x and Jackson 1.x (org.codehaus.jackson) in pom.xml and Gradle builds. Reported: the declaring line, with the maintained successor in the message. Not reported: the successors themselves (uuid, pug, sass, eslint, nyc, pycryptodome, pypdf, nose2, scikit-learn, mysqlclient, kt-paperclip, log4j 2, httpclient 4), lookalike names (request-ip, sass-rails, log4j-api, log4j-1.2-api), the names used as npm script keys or descriptions, Poetry and Pipfile [scripts] entries, and commented-out entries (including entries inside XML comments in pom.xml). A component that is merely old, or unmaintained without an upstream announcement, is not inferred.

C or C++ inline assembly (asm(...), asm volatile(...), __asm__ __volatile__(...), MSVC __asm/_asm { ... } blocks and single-line __asm/_asm instructions) appears in a file that is not a dedicated machine-dependent module, so CPU-specific code is mixed into general logic instead of being isolated behind a portable interface. Every port to a new architecture or compiler then has to find and rewrite it in place. A file counts as a dedicated module when it lives in a directory named for an architecture or platform layer (arch/, asm/, platform/, port/, hal/, cpu/, x86/, x86_64/, x86-64/, arm64/, aarch64/, riscv/, simd/, intrinsics/, atomic/ and similar) or its name says so (*atomic*, *intrin*, *simd*, barrier*, spinlock*, cpu*, *_x86, *_arm, *_avx2, *_neon, rdtsc*, platform*, osdep*, and the time-source modules monotonic*, clock*, timer*). Reported: the line opening each assembly statement. Not reported: inline assembly in such modules, calls to wrapper functions and compiler intrinsics, the asm keyword inside strings, identifiers that merely contain 'asm', and comments. Machine dependence other than inline assembly (system calls, intrinsics, preprocessor platform checks) is not judged.

A Java source file repeats the same non-trivial numeric literal (three or more digits, or a hexadecimal literal of three or more digits, such as 15000, 5242880, 413 or 0xCAFEBABE) in three or more separate statements instead of naming it once as a constant. Timeouts, size limits, status codes and magic values written out at each use drift apart when one copy is changed and the others are not, which is how a limit enforced in one place is forgotten in another. Reported: every statement that repeats the literal. Not reported: a literal used once or twice, a literal on a final/static final constant declaration (the symbolic constant itself), serialVersionUID, annotation arguments, lines that are tables of three or more numbers (array initialisers, lookup tables), round and bit-width values (powers of ten, 128 to 65536 and their masks 255/0xFF/0xFFFF/0xFFFFFFFF), decimals, numbers inside strings, Java text blocks and comments, generated sources (a generator header before the first type declaration, or @Generated), and test files. Literals that are each used only once are not judged: a single magic number is a style choice this line-oriented rule cannot weigh.

The same symbolic constant, with the same name and the same literal value, is defined separately in two or more Java source files (static final fields, or interface fields) instead of once in a shared constants class that the others reference. Each copy is changed on its own, so a timeout, retry limit, URL or key length that is meant to be one value drifts between classes. Reported: every duplicate definition, on the line that names the constant. Not reported: constants defined once and imported elsewhere, same names with different values (TAG, per-class limits), loggers and other non-literal initialisers, serialVersionUID, trivial values (true/false, 0, 1, -1, empty string, null), definitions repeated inside one file, generated sources (Android BuildConfig, protoc output and other files with a generator header before the first type declaration, or @Generated; an IDE's 'Auto-generated method stub' comment does not count), and test files. Only literal values are compared; constants computed from expressions are not.

A Python or PHP module relies on mutable global state from inside its functions to an excessive degree: the file contains three or more `global` statements (Python `global name`, PHP `global $name`), or a single `global` statement that rebinds four or more names. Functions coupled through shared globals cannot be reasoned about or tested in isolation, and in a long-lived web worker the values leak between requests and users. Reported: each `global` statement in such a file. Not reported: a file with one or two narrow `global` statements (the lazy singleton or module cache), the word global in strings, docstrings and comments, identifiers such as global_counter or GLOBAL_TIMEOUT, nonlocal, $GLOBALS array access, PHP statements that name only WordPress core globals ($wpdb, $post, $wp_query and the like, which WordPress exposes only that way), global statements shown as examples inside Python docstrings, and test files.

A nested loop that reuses the enclosing loop's own control variable (Python, C, C++, Java, JavaScript/TypeScript).

A design, architecture, ADR or RFC document with a section that is empty or holds only a placeholder such as TBD or TODO.

A Python function whose structured docstring documents some of its parameters but omits others.

A Python argparse, optparse or click command-line option declared without help text.

A /* block comment opened inside another block comment, in a language where block comments do not nest.

Python indentation that mixes tabs and spaces where indentation decides the block structure.

A source file missing the licence/copyright header that at least 80% of the project's files in the same language carry.

A Python docstring that documents a parameter the function does not take, usually left behind by a rename or removal.

Reports Python functions whose docstring is empty or a placeholder ("""""", """TODO""", """...""", a _summary_ stub or a bare TODO note), and public top-level functions or methods of 50 or more code lines with no docstring. Short or private helpers, nested functions and test files are not reported.

Reports a Python function whose docstring documents arguments and returns in sections (Google, NumPy or Sphinx style) but that raises a named exception its docstring never mentions. Bare re-raises and re-raised exception values, SystemExit, NotImplementedError, undocumented or summary-only functions and test files are not reported.

Reports a backward goto in C++: a goto whose label is defined earlier in the same function, so the jump builds a loop out of unconditional branches. Backward gotos in C files are reported by VNX-1075.

XML received in an HTTP request is parsed (DocumentBuilder, JAXB, StAX, lxml/ElementTree, minidom, xmltodict, xml2js, libxmljs, DOMParser, fast-xml-parser) in a file with no schema or structural validation.

Reports a Python top-level function or method whose McCabe cyclomatic complexity is 26 or more (one plus every if, elif, for, while, except and case statement and every and/or in their conditions). Simpler functions, comprehension decisions, docstring prose and test files are not counted or reported.

Reports a single Python statement line whose expression packs 16 or more arithmetic, bitwise, comparison and boolean operators, a line-level proxy for Halstead difficulty. Type unions and flag sets built only from |, negative literals in tables, docstring rule lines, string literals, comments, signatures, decorators and test files are not counted or reported.

Reports code that rewrites itself at run time: a Python or Node.js program writing to its own source file (__file__, sys.argv[0], __filename, process.argv[1], import.meta.url), replacing a function's __code__, or building or patching code objects. Reading one's own source and exec(compile(...)) of another file are not reported.

Reports the first Python control-flow statement in a function that sits inside five or more enclosing control blocks, measured from the enclosing def with the function's own indent step. Shallower nesting, nested defs, continuation lines, comments, docstrings and test files are not reported.

Reports Python RPC servers configured to expose far more than their own handlers: XML-RPC register_instance with allow_dotted_names=True, RPyC classic services or allow_all_attrs/allow_setattr/allow_delattr, Pyro4 REQUIRE_EXPOSE = False, and eval, exec, open, os.system or subprocess functions registered as remote procedures, directly or wrapped in a lambda.

Reports a Python global statement inside a function or method body (global counter, global a, b), which makes the function rebind a module-level variable: every caller, thread and request then shares and mutates that one binding, so state set for one caller leaks into the next. The finding is the global line itself. Not reported: a global statement at module level (it has no effect), nonlocal (closure scope), globals that are only module dunders such as __doc__ or __all__, the word 'global' in a comment, a string or prose, and test files (including conftest.py). A global line inside a triple-quoted string is not a statement and is not reported. Whether a particular module-level variable should be wider than its function is a design judgement; the rule reports the statement that widens it.

Reports C and C++ code and build files that switch off the compiler warnings which catch memory-safety and format-string defects. In C/C++ sources: #define _CRT_SECURE_NO_WARNINGS / _CRT_SECURE_NO_DEPRECATE / _SCL_SECURE_NO_WARNINGS, #pragma warning(disable: ...) naming C4996 (unsafe CRT functions such as strcpy) or the uninitialised-variable and buffer-overrun warnings (C4700, C4701, C4703, C4789), and #pragma GCC/clang diagnostic ignored (or the _Pragma("GCC diagnostic ignored ...") operator in a macro) for -Wall, -Wextra, -Weverything, -Wformat, -Wformat-security, -Wformat-nonliteral, -Wimplicit-function-declaration, -Wint-conversion, -Wincompatible-pointer-types or -Wreturn-type. In CMakeLists.txt, *.cmake, meson.build, Makefiles and MSBuild .vcxproj/.props files: a compiler flag that disables all warnings (-w, /W0, -Wno-everything, meson warning_level=0), -Wno-format / -Wno-format-security, MSVC /wd4996 (and /wd for C4700, C4701, C4703, C4789) and -D_CRT_SECURE_NO_WARNINGS, on a flags line (CFLAGS, CXXFLAGS, CMAKE_*_FLAGS, the COMPILE_FLAGS/COMPILE_OPTIONS properties, add_compile_options, target_compile_options, add_definitions, add_project_arguments, or a cc/gcc/clang/$(CC) command); _CRT_SECURE_NO_WARNINGS / _CRT_SECURE_NO_DEPRECATE / _SCL_SECURE_NO_WARNINGS named as a definition on any line (target_compile_definitions, add_compile_definitions, PreprocessorDefinitions) other than a message/echo; and MSBuild <WarningLevel>TurnOffAllWarnings or <DisableSpecificWarnings> listing 4996, 4700, 4701, 4703 or 4789. Not reported: a pragma or flag scoped to a GCC memory diagnostic such as -Warray-bounds, -Wstringop-overread or -Wuse-after-free (well-maintained projects silence these locally for known compiler false positives), suppression of a specific stylistic warning (fallthrough, unused parameter, constant conditional), strict flags such as -Wall -Werror, -w in a non-compiler command (sysctl -w), comments and strings in C sources.

HTTP request data names the native library, plugin or module loaded by plugin.Open, System.load, URLClassLoader, require/import(), dl(), FFI, importlib, ctypes, Ruby require/load or Fiddle.

A request value is converted or compared in a way that reads it as something other than what the requester sent, so the program acts on a different value than the one it checked or meant (CWE-115). Reported: JavaScript/TypeScript parseInt/Number.parseInt of request data with no radix argument ("0x10" is read as 16); JavaScript Boolean(x) or !!x and Python bool(x) of a string request value (req.query/params/headers/cookies; request.args/form/values/GET/POST/cookies/headers .get() or [...]), which is true for "false" and "0"; PHP loose comparison (== or !=) of request data with a token, password, hash, secret, signature, key, code or PIN ("0e..." magic hashes and type juggling make unequal values equal), strcmp() of request data tested with == 0 or ! (an array argument returns NULL, which equals 0), and in_array() of request data without the strict third argument. Request data is used inline or through a variable assigned from it in the 25 lines above. Not reported: parseInt with a radix, Number(), explicit comparisons such as === 'true' or .lower() == 'true', bool() of a whole collection (bool(request.args)), JSON body values in the Boolean checks (already typed), ===, hash_equals and password_verify, in_array(..., true), loose comparison with an ordinary string, and code in comments. Two shapes are reported by a more precise rule, so the line is reported once: a radix-less parseInt of request data used inline or through a variable assigned within the 10 lines above by VNX-1389 (incorrect parsing of numbers with different radices), and a PHP loose comparison or strcmp() test that VNX-PHP-010 reports (PHP type juggling); this rule keeps the longer 25-line flows, the Boolean/bool checks and non-strict in_array().

Decoded HTTP request data written into a Java, Python or Node log message without CR/LF neutralisation, inline or through a variable assigned from the request.

Reports Java code that has a validation framework available but leaves an input path out of it. Reported: in a Spring @Controller/@RestController that validates request bodies with @Valid elsewhere in the same file, a handler parameter bound with @RequestBody (including @RequestBody(required = false) and with other annotations such as @NotNull beside it) to an application type (a DTO, or a List/Set of one) without @Valid or @Validated (fully qualified @jakarta.validation.Valid counts), so that endpoint accepts the object unchecked; Bean Validation constraints (@Size, @Pattern, @Max, @NotBlank and the rest) on a @RequestParam, @PathVariable or @RequestHeader parameter in a controller with no @Validated anywhere in the file, which Spring before Framework 6.1 silently ignores (skipped when the project pins Spring Boot 3.2+ or Spring Framework 6.1+ in pom.xml (parent, spring-boot.version property or spring-boot-dependencies import), build.gradle(.kts), a Gradle version catalog or gradle.properties, where controller method validation is built in); and a Struts 1 <action> mapping with validate="false", which skips the ActionForm and Validator checks. Not reported: bodies bound to String, Map, JsonNode and other raw types, controllers that never use @Valid (the rule cannot tell which DTOs carry constraints), a @Validated controller, validate="true", XML comments, and test files. A BindingResult that is declared and never read is VNX-20's finding.

Reports a security setting that is initialised to its insecure value whenever nobody configures it. Python: a top-level DEBUG = True in a settings module that is not a development/local/test settings file, and an environment or config read (os.environ.get, os.getenv, os.environ.setdefault, decouple config(), django-environ env()/env.bool()) whose fallback value turns on a debug/insecure switch (DEBUG as the last word of the name, DEBUG_MODE, ALLOW_INSECURE, SKIP_TLS_VERIFY, DISABLE_AUTH, DISABLE_CSRF, NO_AUTH, CORS_ALLOW_ALL ...) or turns off a protection (VERIFY_SSL, TLS_VERIFY, CHECK_CERT, REQUIRE_AUTH, AUTH_ENABLED, CSRF_ENABLED, SECURE_COOKIES, SESSION_COOKIE_SECURE, SECURE_SSL_REDIRECT, HTTPS_ONLY, COOKIE_SECURE, REJECT_UNAUTHORIZED ...). Pydantic BaseSettings: a bool field declared directly in a class deriving from BaseSettings whose default is the insecure value (debug: bool = True, verify_ssl: bool = False). JavaScript/TypeScript: process.env.NAME || value or ?? value with the same insecure fallback, a destructuring default from process.env (const { DEBUG = 'true' } = process.env), process.env.INSECURE_SWITCH !== 'false' (on unless disabled) and process.env.PROTECTION === 'true' (off unless enabled). Not reported: a secure fallback (DEBUG defaulting to False, VERIFY_SSL defaulting to True), a read with no fallback, non-boolean settings, names that configure a debug tool rather than a debug mode (DEBUG_COLORS, DEBUG_PORT), a read quoted inside a string literal, a BaseSettings subclass of a project base class (the base is not followed), DEBUG = True in dev/local/test settings files or indented inside a class or docstring, comments, strings and test files. DEBUG turned on in a Django deployment settings module (DEBUG = True, or DEBUG read from the environment with a true default) is reported by VNX-PY-006, not here.

Reports Java code that builds a cipher IV or nonce (IvParameterSpec, GCMParameterSpec, ChaCha20ParameterSpec) from bytes that are not freshly random: a zero-filled new byte[N] passed straight to the spec; a byte[] allocated with new byte[N] and handed to the spec within the next 40 lines without anything filling it (no nextBytes, read, readFully, ByteBuffer.get, System.arraycopy, element assignment or other call that takes the array); a byte[] initialised from a literal ({...}, new byte[]{...}, "...".getBytes()) that the file uses as an IV; a string literal's bytes passed to the spec; and an IV filled by java.util.Random or ThreadLocalRandom.nextBytes. A zero, constant or predictable IV repeats across messages, which leaks plaintext equality under CBC and breaks confidentiality and authentication under CTR and GCM. Not reported: IVs filled by SecureRandom, IVs read from the message being decrypted, cipher.getIV(), byte arrays never used as an IV, strings and comments. Overlaps VNX-JAVA-020 (static IV) and VNX-329 (predictable IV); VNX-CRYPTO-010 (hard-coded IV, nonce or salt) leaves the Java IV lines this rule reports to it.

Reports C/C++ heap buffers sized by strlen() with no room for the terminator and then filled with strcpy/strcat/sprintf, and fixed-size heap buffers that receive an unbounded strcpy, strcat, gets or sprintf %s copy.

Reports a handler that stores a user-uploaded image byte for byte, so the EXIF block it carries (GPS coordinates, device make and serial, capture time, sometimes the owner's name) is published with it when the image is served. Reported, in a file that handles images (an image/ MIME check, an image extension, or avatar/photo/picture naming) and never re-encodes or strips them (no sharp, jimp, gm, Pillow Image.open/ImageOps, piexif, exif or strip-metadata call in the file; Python's str.strip() does not count, and comment lines are ignored when judging image context): Node fs.writeFile/writeFileSync of an uploaded buffer (req.file.buffer, or a variable taken from req.file/req.files or a .buffer), express-fileupload .mv() on a req.files entry, multer({ dest }) and multer.diskStorage(); Python Flask request.files[...] .save() (directly, through a variable, or in a for loop over request.files.getlist()), Django default_storage/FileSystemStorage .save() of a request.FILES entry, and a chunks() loop copying one to disk. Not reported: images decoded and re-encoded or stripped in the same file, uploads in files with no image context (documents, CSV), comments and test files. Stripping performed in another module is not visible to this line-oriented rule.

Reports Java arithmetic on a boxed numeric type inside a loop, where every iteration unboxes the value, computes, and allocates a new wrapper object: a for loop whose counter is declared as Integer, Long, Short, Byte, Double, Float or Character (for (Integer i = 0; i < n; i++)), and a local variable declared as one of those wrapper types with a numeric initial value (Long sum = 0L) that is then updated with ++, --, +=, -=, *=, /= or x = x + ... inside a for, while or do loop opened after it within the next 40 lines, including a single-statement loop body on the loop header line. Not reported: primitive counters and accumulators, enhanced-for loops over a List<Integer> (the element must be boxed anyway), wrapper variables that are only compared or reassigned, updates outside the loop, fields declared with an access modifier, comments and strings. This is a performance weakness: in a hot path the allocations raise GC pressure and latency, which is how it becomes a denial-of-service concern.

Reports a CSV export served to users (the file sets a text/csv content type, a .csv attachment or download name) that writes data rows through a CSV library without neutralising cells beginning with =, +, -, @, tab or carriage return, so a stored value such as =HYPERLINK(...) or =cmd|... runs as a formula when the download is opened in a spreadsheet. Reported: Python csv.writer/csv.DictWriter .writerow()/.writerows() and pandas .to_csv(); JavaScript json2csv (new Parser().parse, json2csv.parse), csv-stringify stringify(), fast-csv write/format, and papaparse Papa.unparse() without escapeFormulae; Java OpenCSV CSVWriter.writeNext()/writeAll() and Apache Commons CSV CSVPrinter.printRecord()/printRecords(). Not reported: header rows made only of string literals, files that neutralise formula cells (a sanitise/escape-formula helper, a check against the formula characters, defusedcsv, escapeFormulae: true), CSV written to local files with no HTTP download context, comments and test files. The download context and the neutralisation are judged on code with comment lines removed, so a Javadoc mentioning text/csv is not a download and a TODO saying sanitise is not a sanitiser. Building CSV lines by string concatenation from request data is VNX-140's finding.

Reports C/C++ writes that land before a buffer when a length is zero or negative: buf[strlen(buf) - 1] = ... without a non-empty check, buf[len - 1] after len = strlen(...), buf[n] after an unchecked read()/recv()/readlink() result, and literal negative indexes into arrays.

A Java javax.crypto.Cipher is created for a block cipher in ECB mode, which encrypts equal plaintext blocks to equal ciphertext blocks and so leaks the structure of the data and allows blocks to be cut, replayed and reordered. Reported: Cipher.getInstance() whose transformation names ECB for a block cipher ("AES/ECB/PKCS5Padding", "DESede/ECB/NoPadding", any case, with or without a provider argument), a bare block-cipher name ("AES", "DES", "DESede", "Blowfish", "RC2" and the like) for which the JCE provider default is ECB, the transformation written on the line after the opening parenthesis, and a Cipher.getInstance(NAME) whose NAME is a constant assigned such a transformation in the same file. Not reported: GCM, CCM, CBC, CTR and other modes, ChaCha20, AESWrap, RSA/ECB/... (RSA has no chaining; padding is judged by VNX-780), KeyGenerator.getInstance("AES") and SecretKeySpec(..., "AES"), a transformation passed in a variable whose value is not visible in the file, the text in comments or inside other string literals, and every call VNX-CRYPTO-003 (AES in ECB mode, CWE-327) reports: an explicit /ECB/ transformation, a bare block-cipher name, a constant or a getProperty default holding one, and a call split after getInstance( (reported there on the call line). Those are reported by VNX-CRYPTO-003, so a Java ECB cipher is one finding rather than two. What that rule does not report stays here: a mode concatenated onto the algorithm (alg + "/ECB/PKCS5Padding"), a getOrDefault default, and ECB in test sources, which VNX-CRYPTO-003 leaves out.

A java.util.Random, whose linear congruential algorithm is fully determined by its 48-bit seed, is given an explicit seed in production Java code, so every value it produces can be reproduced by anyone who knows or guesses the seed (a constant, the clock, a counter or a value derived from user data). Reported: new Random(<seed>) and new java.util.Random(<seed>) with any argument (a literal, a constant, System.currentTimeMillis()/nanoTime(), an expression), and <name>.setSeed(...) on a variable or field the same file declares as Random or assigns new Random(...). Not reported: new Random() with no seed (whether its use is security-sensitive is judged by VNX-JAVA-016), SecureRandom and its setSeed (which adds entropy rather than replacing it; seeding SecureRandom is VNX-335), other classes whose name merely contains Random, a method that is itself named setSeed, test code, comments and string literals.

Reports C/C++ off-by-one loops (i <= the length of the array they read) and char buffers filled to their full size by read()/recv()/fread() and then used as C strings without a terminating NUL.

A secret (a MAC, HMAC, signature, digest, hash, token, key, password, OTP, nonce or session value) is compared one element at a time in a Java loop that returns false at the first mismatch, so the comparison is performed in steps and its running time reveals how many leading bytes or characters of a forged value are correct (the software form of CWE-1254). Reported: inside a for/while loop, if (a[i] != b[i]) or if (a.charAt(i) != b.charAt(i)) followed by return false on the same line or the next code line, when the compared names or the enclosing method's signature name a secret. Not reported: an accumulate-and-test loop (diff |= a[i] ^ b[i]), MessageDigest.isEqual, a loop that returns the index of the first difference, the same loop over values whose names and method do not say they are secret, and comments. Whole-value comparisons with equals/Arrays.equals/== are reported by VNX-CRYPTO-008 and VNX-385.

strtok() keeps its position in hidden static state, so it is not reentrant: starting a second tokenization while one is in progress silently replaces the first, and the outer loop's next strtok(NULL, ...) continues through the wrong string or stops early. Reported, in C: inside the body of a for/while loop that iterates a strtok() tokenization (the loop begins on, or within three lines after, a strtok() call with a non-NULL string, and its header or body calls strtok(NULL, ...)), a line that starts another strtok() on a non-NULL string, or that calls a function defined in the same file whose body starts a strtok() tokenization (the nested call re-enters strtok). Not reported: strtok_r()/strtok_s(), a second tokenization that begins after the first loop has ended, a helper that does not call strtok(), a function calling itself, calls into other files (not visible to a line-oriented rule), text in comments and string literals. Signal handlers that call non-reentrant functions are reported by VNX-479 and VNX-828.

A Python debugger hook is left in production code, so the shipped program stops at an interactive debugger prompt (hanging the worker, or handing a shell to whoever owns the terminal) or opens a remote-debug port that executes arbitrary code for anyone who connects. Reported, unconditionally reached (not inside an if that tests a debug, pdb, environment, settings, config, args or flag value): pdb/ipdb/pudb/rpdb/remote_pdb/web_pdb.set_trace(), pdb.post_mortem()/pm(), the built-in breakpoint(), a bare set_trace() or embed() imported from one of those debuggers or from IPython, __import__("pdb").set_trace(), IPython.embed(), debugpy.listen()/wait_for_client()/breakpoint(), ptvsd.enable_attach()/wait_for_attach(), pydevd/pydevd_pycharm.settrace() and code.interact(). Not reported: a debugger behind a debug flag or environment check, a method or function of the program's own named set_trace or breakpoint (obj.set_trace(), self.breakpoint()), test files, an interactive console that is the program's own feature (code.interact() or embed() inside a function named for a shell, repl or console, as flask shell is), and the names in comments and strings. DEBUG = True framework settings are reported by VNX-215.

A cookie is configured with SameSite=None, or with the SameSite attribute switched off, so the browser attaches it to cross-site requests and a session cookie becomes usable for cross-site request forgery. Reported in JavaScript/TypeScript: a sameSite: 'none' (any case, any quote, quoted or bare key) or sameSite: false property in cookie options (res.cookie, express-session, cookie-session, cookie.serialize and similar option objects, on the call line or on its own line), an assignment such as req.session.cookie.sameSite = 'none', and a Set-Cookie header or document.cookie string containing SameSite=None. Python: SESSION_COOKIE_SAMESITE, CSRF_COOKIE_SAMESITE, LANGUAGE_COOKIE_SAMESITE or REMEMBER_COOKIE_SAMESITE set to None, False or "None" in any case (Django settings, Flask app.config[...] or config.update(...)), and set_cookie()/set_signed_cookie() calls with samesite=None or samesite="none" (on the call line or a continuation line of it), and Starlette/FastAPI SessionMiddleware with same_site="none". Not reported: Lax, Strict or true, a value computed at run time, a TypeScript type that lists 'none' among the allowed values, a set_cookie method signature whose parameter defaults to None, comparisons, the text inside comments and string literals, and test files. SameSite=None is sometimes required for a cookie used in a cross-site embed; such a cookie must not carry a session or credential.

Reports C/C++ allocations (malloc, alloca, realloc, new T[]) whose size multiplies a count read from input (atoi/strtoul, ntohl, getenv, scanf/fread into &n) with no overflow check, so a large count wraps the size around.

A quantity the client chose (a request field named quantity, qty, amount, units, credits, points, coins, num_items, deposit or withdraw/withdrawal) is used in a balance, stock or price calculation, or stored on an order, cart or wallet record, with no check that it is positive and within limits, so a negative or huge value moves money the wrong way, creates stock or overflows a total. Reported in Python (Flask/Django/DRF request.args/form/values/json/GET/POST/data/query_params) and JavaScript/TypeScript (req.body/query/params, including const { quantity } = req.body): the value, inline or through a variable assigned from it in the 20 lines above (including a TypeScript-annotated const), used in x += / -= / *= arithmetic, a $inc update, a multiplication, an x = y + / - arithmetic assignment, or as a quantity-named field (or shorthand property) of an ORM create/update/insert/save/build/upsert, $inc or $set. Not reported: a comparison of the value (<, <=, >, >=, in range(...)) or a max()/abs()/clamp/positive check between the read and the use, a file that validates with a schema (Joi/yup/zod .positive() or .min(0|1), pydantic conint/confloat/PositiveInt/gt=0/ge=1, express-validator isInt/isFloat({ min | gt })), the local assignment that reads the value, a value that is only displayed, counts and page sizes (judged by VNX-400 and VNX-606), a client amount credited to a balance or booked as an order total that VNX-840 reports (Client-Controlled Monetary Value, such as dst.balance += int(request.form["amount"]) or { $inc: { balance: -amount } } in a payment or wallet handler): that line is reported by VNX-840, so the negative-amount transfer is one finding rather than two, and text in comments and strings.

A position the client chose is used to index a list or array with no bounds check, so a negative value silently selects from the end (Python), an out-of-range value raises or yields undefined, and the client can read or remove an element it was never offered. Reported in Python: int(...) of a Flask/Django/DRF request value (request.args/form/values/json/GET/POST/data/query_params/view_args) used as a subscript x[v], or as the position of .pop(v)/.insert(v, ...), inline or through a variable assigned from it in the 15 lines above. JavaScript/TypeScript: parseInt/Number/parseFloat/unary + of req.body/query/params, or a req field named index, idx, pos, position, offset, slot, choice, row or column, used as a subscript x[v] or as the position of .splice(v, ...)/.at(v)/.charAt(v), inline, through a variable assigned in the 15 lines above, or through a position-named field destructured from the request (const { index } = req.body). Not reported: a comparison of the value (<, <=, >, >=, or a check against len()/.length) between the read and the use, slices (rows[offset:offset+20], .slice()), lookups keyed by a string (users[req.params.id], THEMES[name]), and text in comments and strings. Upper-bound-only checks are reported by VNX-839.

Detects request data parsed with no handling of malformed input: Python json.loads()/uuid.UUID()/Decimal()/fromisoformat() (and int()/float() of sources VNX-229 does not read) outside a try block, JavaScript JSON.parse() outside try, and parseInt()/Number() of route parameters and other sources VNX-229 does not read with no NaN check. A conversion VNX-229 reports is reported by VNX-229.

Detects JavaScript/TypeScript request values whose type the client chooses (query-string arrays and objects, JSON body fields) used as strings with no type check: string methods or .length on req.query/req.body/ctx.query fields. The Python form is reported by VNX-241.

Detects a server-side handler that reads a password-confirmation field (passwordRepeat, confirm_password, password2 and similar) from the request but never compares it with the password anywhere in the same file. JavaScript/TypeScript and Python.

Detects an uploaded file name checked against a denylist of dangerous extensions (php, exe, jsp, html, svg...) with a case-sensitive comparison, so shell.PHP passes. Python and JavaScript/TypeScript.

Detects Python code that derives an identity by merely base64- or hex-decoding a cookie or an identity-bearing header, with no signature check, so a client can encode any identity. The software analogue of CWE-1290.

Reports C/C++ code that uses a length field decoded from a message (ntohs, ntohl, be*toh, n2s, byte shifts) as a memcpy/memmove/strncpy length or a read/recv size without comparing it with the destination or the received size: the Heartbleed shape.

Detects Android Java/Kotlin code that restores a security decision (logged in, admin, role, PIN verified, unlocked, premium) from plain SharedPreferences or a saved-instance Bundle instead of re-establishing it. The software analogue of CWE-1304.

Detects C and C++ code that switches off a fault alert: SIGSEGV/SIGBUS/SIGFPE/SIGILL/SIGSYS/SIGXCPU/SIGABRT set to SIG_IGN through signal()/std::signal() or sigaction(), and a hardware watchdog disabled with WDIOS_DISABLECARD or the magic close. The software analogue of CWE-1320.

Detects JavaScript/TypeScript writes through a key an attacker can set to __proto__ or constructor: hand-written recursive merges, set-by-path walks, and nested assignments keyed by request data, with no key guard.

Reports synchronous Node.js APIs (fs.*Sync, execSync/spawnSync, pbkdf2Sync/scryptSync, zlib *Sync, bcrypt hashSync/compareSync) called inside an HTTP request handler, where they stall the event loop for every client. Startup code, helpers outside handlers, async APIs, scripts and tests are not reported.

Reports firmware C/C++ code that enables or keeps alive a hardware debug port (STM32 DBGMCU, Cortex-M DHCSR C_DEBUGEN, SWJ remap, AVR JTD cleared, nRF APPROTECT disabled, JTAG/SWD enable flags) outside a #ifdef DEBUG / #ifndef NDEBUG block.

Detects allocations (Go make, Java new byte[]/ByteBuffer.allocate, C/C++ malloc/calloc/realloc/new T[]) sized by a value that arrives from outside the program, such as a parsed number, a length prefix or a request header, with no upper bound checked first, and loops bounded by such a value that allocate on every pass. Sizes from len()/sizeof, constants, values compared against a maximum or clamped with min() are not reported.

Reports servers bound to a hard-coded wildcard address (0.0.0.0, ::, [::], Python's empty host) in Python, Node.js and Go: socket bind, app.run/uvicorn host=, .listen(port, '0.0.0.0'), net.Listen("tcp", "0.0.0.0:port"), http.Server{Addr:}, directly or through a constant. Loopback, configured addresses and Go's ":port" form are not reported.

Reports C/C++ shifts by a constant at or past the operand's width, or by a negative constant, which are undefined behaviour: 1 << 40, 1u << 32, 1ULL << 64, (uint32_t)v >> 32, a uint32_t/int variable shifted by 32, x << -1. Suffixed or widened operands within their width are not reported.

Reports Python and Node.js code that compiles a template whose source comes from request data (render_template_string, Jinja2 from_string/Template, Django and Mako Template, Handlebars.compile, ejs/pug render and compile, nunjucks renderString, lodash _.template), directly or through one or two assignments. Literal or file templates with request data passed as context are not reported.

Reports exact equality or inequality comparisons (==, !=, ===, !==) with a decimal literal that binary floating point cannot represent exactly (0.1, 0.3, 19.99f) in Python, JavaScript/TypeScript, Java and Go. Exact literals (0.5, 1.0), tolerance comparisons, ordering comparisons, strings and test files are not reported.

Reports C/C++ code that releases the same pointer, descriptor or handle twice on one path (free, fclose, close, CloseHandle, delete, *_free/*_destroy/*_close/*_cleanup), including an error path that frees and then jumps with goto to a cleanup label that frees again. Releases followed by x = NULL, exclusive branches and early returns are not reported.

Reports C/C++ code that confuses wide-character counts with byte counts: allocations and memcpy lengths taken from wcslen() without sizeof(wchar_t), wide-character APIs given sizeof(buf), and strlen() on a wchar_t string.

Reports parsers that guess the radix from the text (parseInt without a radix on request data, int(x, 0), strconv.ParseInt(s, 0, n), Integer.decode, strtol(s, end, 0), std::stoi(s, nullptr, 0), scanf %i, inet_aton/inet_addr), so '010' or '0x10' parse to a different value than a check expects.

Reports code that selects a weak HTTP authentication scheme, HTTP Digest (MD5) or NTLM (MD4), in Python, JavaScript/TypeScript, Java/Kotlin, C# and Go clients and servers.

Reports a password set to a trivially guessable value (123456, qwerty, letmein, password123, admin123, p@ssw0rd, ...) in code, configuration files, docker-compose, Dockerfiles, or as the fallback of an environment lookup.

Reports a default account (admin, root, sa, guest, postgres, elastic, tomcat, pi, ...) configured with a default, guessable or empty password: in a URL or DSN, a connection string, as adjacent call arguments, or as neighbouring user and password keys in code and configuration.

Reports a password set to a well-known default (password, admin, root, changeme, changeit, guest, secret, postgres, ...) in code, configuration files, docker-compose, Dockerfiles, or as the fallback of an environment lookup.

Offline floor for CWE-1395: reports manifests, lockfiles and pages that pin a well-known vulnerable or compromised release of lodash, minimist, jsonwebtoken, handlebars, jQuery, AngularJS, Bootstrap, PyYAML, Jinja2, event-stream, ua-parser-js, node-ipc, vm2 or node-serialize.

Reports Python and JavaScript/TypeScript code that writes a CSV, TSV, pipe- or colon-delimited record to a file or stream by joining request data with the delimiter, without quoting or escaping it.

Reports Go, Java, PHP and Ruby code that places HTTP request data in the system (instruction) prompt of an LLM call, where it can override the application's instructions (prompt injection).

A value read from an HTTP request is written into a process-wide setting: an environment variable, the module search path, runtime configuration (viper, ini_set, System.setProperty) or a JDBC connection's catalog.

Reports Python and JavaScript/TypeScript code that splits request data on a delimiter and indexes or unpacks the result as if the delimiter were always present, such as req.headers.authorization.split(' ')[1].

Reports a key=value or user:secret string split on every '=' or ':' and unpacked into a fixed number of names, which fails (Python) or truncates the value (JavaScript) when the value holds an additional separator.

Reports CSV parsed by splitting each line on every comma, which ignores CSV quoting so a quoted comma shifts every later column, in files that use no CSV parser.

Reports C/C++ strncpy, memcpy(dst, src, strlen(src)) and read/readlink/recv/fread calls that can leave a buffer without a NUL terminator when nothing terminates it before it is used as a string.

Reports an uploaded file's name or extension compared case-sensitively against a dangerous extension (php, jsp, aspx, exe, sh, html, svg, htaccess...), a deny check that "shell.PHP" bypasses.

Reports a check for a dangerous sequence (.., /, <script, a quote) that runs before the same value is URL-, HTML- or Unicode-decoded, and a check on the raw query string before a decoded parameter is read.

Reports a single-pass removal of a traversal sequence (../, ..\, ..), a <script> tag or (in a filter chain) a http:// scheme by replacing it with the empty string, which lets the surrounding characters collapse back into the token.

Reports allow-list checks on a URL, host, origin or redirect target that accept more than they name (a domain suffix without a leading dot, a host prefix without a trailing slash, a substring match, url.includes(allowedUrl), an unanchored or unescaped domain regex) and allow-lists whose entry is the wildcard "*".

Reports input validation by deny-list: a collection of attack tokens (shell metacharacters, <script/javascript:, ../, SQL comment and keyword tokens, executable extensions) that is named as a deny-list or applied to input with contains/replace/in.

Reports denylist filters for script, markup or SQL injection tokens (<script, javascript:, onerror, UNION) that match case-sensitively, so <SCRIPT> or JavaScript: slips through: removals with an empty replacement, regexes without a case-insensitive flag, and membership tests of a bare token, in Python, JavaScript/TypeScript, Java, PHP and Ruby.

Reports C/C++ length subtractions (len - HDR, len -= consumed, strlen(s) - 1) that size or index a memory operation with no prior check that the length is large enough, where the length is a function parameter or decoded from a message.

Reports numbers parsed from text and converted to a narrower or unsigned type without a range check: Go int32/uint16(...) of strconv.Atoi/ParseInt results, Java (byte)/(short)/(int) casts of Integer.parseInt/Long.parseLong, and C/C++ narrow or unsigned variables initialised from atoi/strtol.

Reports C/C++ sizes and indices one off for the terminator or last element: malloc(strlen(s)) then strcpy, buf[sizeof(buf)] or name[N] writes, for loops to i <= N over arr[N], strncat bounded by sizeof(dst), and strncpy bounded by strlen(src).

Reports C/C++ <ctype.h> calls (isspace, isdigit, tolower, ...) given a plain char, *p or p[i] of a char pointer without an (unsigned char) cast, and Java code that combines byte[] elements by shifting or by * 256 without & 0xff.

Input validation is wired up but never decides anything: an unread Spring BindingResult, discarded Bean Validation violations, express-validator chains with no validationResult(), WTForms data read without validate(), pydantic construct() on request data, and discarded gin bind or validator errors.

Reports HTTP responses that send a stored record's password, hash, secret, API key or similar field, a whole user/account record fetched from the database and serialised as is, and Django REST ModelSerializers of User with fields = '__all__'.

Reports login code that answers an unknown user or email ("User not found", "no such user", "Invalid username") with a different message from a wrong password, which lets an attacker enumerate accounts.

Reports Python and JavaScript/TypeScript login code that returns before hashing the password when the account does not exist (if user is None: return, if (!user) return, except User.DoesNotExist: return, if not user or not check_password(...), if user and checkpw(...)), so response time reveals which accounts exist.

Detects stack traces and database error messages sent to the client: traces in Python, Java, JavaScript/TypeScript, Go and C# responses, PHP die/echo of mysqli_error and friends, caught database exception messages in Python, Java and C# output, and configuration that turns detailed error pages on (Spring include-stacktrace, PHP display_errors, ASP.NET customErrors Off).

Detects errors the program raises itself whose message carries a secret value (password, secret, API key, private key, token, credential, DSN, connection string): Go fmt.Errorf/errors.New/http.Error/panic, Python raise/abort/HTTPException, Java throw new/sendError, JavaScript new Error/createError/res.status(4xx|5xx).

Detects user and account records serialised whole, password hash included: Express/Prisma handlers that res.json() a user fetched a few lines above (or res.json(await User.findById(...)) directly) with no projection or removal, Flask/Django responses built from user.__dict__ or vars(user), Django REST serializers exposing a User's password, Django serialize() of User.objects and model_to_dict(user), Laravel user models without $hidden, and Go model structs whose JSON tag exposes a password or its hash.

Detects health, status and debug endpoints that return the whole process environment or application configuration (process.env, os.environ, app.config, os.Environ(), System.getenv()), publishing every secret an operator put there.

Detects passwords, tokens and secrets passed to child processes on the command line (--password=$x, mysql -p$x, sshpass -p $x, docker login -p $x, curl -u user:$x, redis-cli -a $x, openssl pass:$x, kubectl create secret --from-literal=password=$x, aws configure set aws_secret_access_key $x, htpasswd -b, a password inside a URL argument) from Python, JavaScript/TypeScript, Go, Java, PHP and C# exec calls, and from shell scripts, Makefiles and Dockerfiles.

Detects debugging facilities left switched on for every visitor: Python cgitb.enable(), a Django Debug Toolbar shown to everyone, Express errorhandler outside a development check, the Node.js inspector bound to 0.0.0.0, and ASP.NET Core UseDeveloperExceptionPage/UseDatabaseErrorPage outside IsDevelopment().

Detects C and C++ bounded copies and formats (snprintf, strncpy, strlcpy, strncat, ...) whose truncation is never checked, when the truncated buffer is then used to open, remove or execute a file, run a command, contact a host, compare a name or write the audit log.

Detects Python code that discards the record of a security event: a failed token, signature or permission check swallowed by an except clause that only passes or by contextlib.suppress(), logging.disable(), a disabled security/audit logger, and Django's django.security loggers routed to the null handler.

A log call writes a credential (password, secret, token, API key) base64-encoded, inline or through a variable, in JavaScript, TypeScript or Python. Base64 is a reversible alternate name for the value, not a protection.

A password check, MAC or constant-time comparison, signature verification or OpenSSL verify/RNG call is made as a bare statement, so its verdict is discarded; also PHP openssl_verify() used directly as an if condition.

A request value is converted to a number with no handling of a missing or malformed value: Python int()/float() of a request value outside try, or Node.js parseInt/parseFloat/Number of req.query or req.body whose NaN is never handled.

Python request parameters (request.GET/POST/args/form/json/get_json()/data/query_params) are unpacked with ** into a call or dict, inline or through a variable, so every extra parameter a client sends is accepted.

A form or query-string parser is configured or called without a limit on field count, nesting depth or array length: unbounded parameterLimit/arrayLimit/depth/maxKeys in Node.js, None for Django/Werkzeug field limits, or parse_qs of a raw request body without max_num_fields.

A Python JSON request body value (Flask request.json, DRF request.data, json.loads(request.body)), whose type the client controls, is used with a str method and no type check. The JavaScript form is reported by VNX-1287.

C/C++ calls to gets(), std::gets(), _getws(), getws(), _getts() or getwd(), and C++ operator>> from a stream into a char array with no std::setw(): functions that write input of any length into a buffer they have no size for.

A chroot() call (C/C++, Python os.chroot, Go syscall/unix.Chroot, Rust fs::chroot, Ruby Dir.chroot) is not followed in the same function by a chdir, so the working directory stays outside the jail.

Reports C/C++ free(), delete and realloc() of a buffer named as a password, passphrase, PIN, secret or key with no wipe in the lines before, and Java code that turns a char[] password into an immutable String.

Reports Java and Python handlers that parse a request parameter, header or body with a call that throws on malformed text (parseInt, UUID.fromString, int(), json.loads) when no surrounding try catches the error.

Reports Go I/O calls whose error is silently dropped (bare Write/Read/WriteString, io.Copy, os.WriteFile), C allocations and fopen results used without a NULL check, and unchecked setuid/setgid/chroot privilege changes.

Reports C/C++ return values tested against the wrong failure value: pointers compared with < 0 or -1, mmap() compared with NULL, file descriptors tested with !fd, pthread results compared with -1, and ssize_t results stored unsigned then compared with < 0.

Reports a password taken from the request and stored unhashed (a model's password field, setPassword, a create/insert call, an SQL INSERT/UPDATE), and any password written to web storage or a cookie.

Reports a password passed as the data of a reversible transform (base64, hex, rot13, Fernet/AES/cipher encryption, CryptoJS, openssl_encrypt, AEAD Seal) and any decrypt_password/decryptPassword function.

Reports a string literal passed positionally as the password of an authentication or connection call (smtplib login, HTTPBasicAuth, JNDI SECURITY_CREDENTIALS, DriverManager.getConnection, new Sequelize, LDAP bind, mysqli_connect, new PDO, Net::SMTP.start, smtp.PlainAuth, SetBasicAuth, NetworkCredential and similar).

Reports literal passwords in XML configuration (Maven settings.xml, Spring and Hibernate XML, Tomcat context.xml/tomcat-users.xml/server.xml password attributes, .NET Web.config appSettings and connection strings), PHP config files (define('DB_PASSWORD', ...), $config[...]['password']) and credential dotfiles (.netrc, .pgpass, .pypirc, .npmrc).

A password is passed straight to base64, hex or ROT13 encoding, which anyone who reads the stored or logged value can reverse.

Password aging is switched off where it is configured: an AWS IAM password policy with no maximum age, Entra ID DisablePasswordExpiration, the Active Directory DONT_EXPIRE_PASSWORD flag, PowerShell -PasswordNeverExpires, or Linux PASS_MAX_DAYS/chage set to 99999 or -1.

A maximum password age is configured at more than 180 days: an AWS IAM password policy, Linux PASS_MAX_DAYS/chage, an Active Directory or Windows policy, an Entra ID domain, or an application setting naming a password's maximum age.

Root is assigned as a process's whole identity (setuid(0), setresuid(0, 0, 0), os.setuid(0)) in a function that never drops it, or a file is given the set-user-ID or set-group-ID bit.

A root-equivalent Linux capability (CAP_SYS_ADMIN, CAP_SYS_MODULE, CAP_SYS_PTRACE, CAP_SYS_RAWIO, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH, CAP_SETFCAP, CAP_BPF or all) is granted through libcap, libcap-ng, ambient capabilities, setcap, capsh or a systemd AmbientCapabilities= line.

The program runs sudo, doas or pkexec with a command line that includes a runtime value, chaining whatever controls that value to the root rights of the program's account.

Privileges are dropped in the wrong order: the user ID is changed to a non-root user before the group ID or the supplementary groups, so the later call fails and the process keeps root's groups.

Another program is executed after only the effective user ID was lowered (seteuid, setreuid(-1, uid), os.seteuid), so it starts with root as its real user ID and can switch straight back to root.

Detects root privilege kept after the privileged operation that needed it: a chroot in a project that never drops its identity afterwards, and a return to root (seteuid(0), setuid(0) in a setuid helper, os.seteuid(0)) that is never lowered again. C, C++, Python and Go.

Detects privilege drops whose result is thrown away: setuid/setgid/setresuid/setgroups/initgroups and the Windows impersonation calls as bare or (void)-cast statements in C and C++, syscall/unix Setuid-family calls in Go (also deferred), libc:: and nix calls in Rust, and posix_setuid-family calls in PHP. A failed drop leaves the program running with the identity it meant to give up.

Detects privilege changes whose failure is noticed and then ignored: an if on a failed setuid/setgid/setresuid/setgroups/chroot or impersonation call that only logs (C, C++), an except OSError/PermissionError that passes or logs around os.setuid/os.chroot (Python), an err != nil after syscall/unix Setuid that only logs (Go), and an if on a failed posix_setuid/posix_setgid that only logs (PHP).

Detects files and directories given a world-writable mode by a call the umask does not filter: chmod-family calls in C, C++, Python, Go, PHP, JavaScript/TypeScript, Ruby, Java and Rust, chmod/install -m/mkdir -m/COPY --chmod in shell scripts, Makefiles and Dockerfiles, mode: in Ansible tasks, and chmod commands run through system/exec/subprocess.

Detects permission sets that everything created afterwards inherits and that let anyone write: a process umask that leaves others-write open (umask(0), os.umask(0), process.umask(0), shell or Dockerfile umask 000, systemd UMask=0000), a Windows NULL DACL, an inheritable SDDL allow ACE for Everyone, and a .NET FileSystemAccessRule/RegistryAccessRule granting Everyone or Users write with inheritance.

Detects archive extraction that keeps the permissions (or owner) the archive carries: libarchive with ARCHIVE_EXTRACT_PERM/OWNER/ACL set unconditionally, Python tarfile extract()/extractall() without a filter and shutil.unpack_archive() without one, Go archive/tar and archive/zip extractors that reuse the entry's mode or Uid/Gid, and the Rust tar crate with set_preserve_permissions(true).

Detects a program or install step that sets the setuid bit on a file at run time: chmod-family calls with 04xxx, S_ISUID or perms::set_uid in C and C++, os.chmod with 0o4xxx or stat.S_ISUID in Python, os.ModeSetuid in Go, chmod-family calls with a setuid mode in PHP, JavaScript/TypeScript, Ruby and Rust, mode: '4755' in Ansible tasks, and chmod u+s/4755, install -m 4755 and COPY --chmod=4755 in shell scripts and Dockerfiles.

Detects code that is refused access to or control over a resource and carries on as if it had it: an owner-only chmod (0600, S_IRUSR|S_IWUSR) whose failure is ignored in C, C++, Python and Go, and a refused directory replaced by a broader one (chdir("/") after a failed chdir, a /tmp, gettempdir() or os.TempDir() fallback after a permission error).

Detects a C/C++ file replaced through a temporary (rename over the original) whose creation mode is the default or group/other-accessible and never copied from the original's st_mode, so a restricted file comes back readable by others.

Detects C/C++ code that trusts a file because its permission bits for group/others are tight (st_mode & S_IWOTH, & 077, std::filesystem perms::others_*) without ever comparing st_uid with the expected owner.

Detects an authentication routine stubbed to accept everyone: an authenticate/verify-password/verify-token function whose first statement is return true, an auth middleware that only calls next(), or a login_required decorator that returns the view unchanged.

Detects access checks that compare a name exactly when another spelling reaches the same thing: an if on the raw request path (getRequestURI, req.url/req.path, request.path) against a protected '/admin'-style literal or followed by a denial, and a reserved-username check without case folding.

Detects trust decisions on a client IP taken from a client-controlled header (X-Forwarded-For, X-Real-IP, True-Client-IP, HTTP_X_FORWARDED_FOR): comparison with an IP literal, allow-list membership, an is_trusted-style helper, an address-class test (is_private, isLoopbackAddress), or a rate limiter keyed on the header.

Detects signed tokens accepted without their age being enforced: JWT expiry verification disabled (ignoreExpiration, verify_exp False), a clock leeway of a day or more, and itsdangerous/Django timestamped signatures loaded without max_age.

Detects symmetric HMAC challenge-response code that answers a peer's challenge with exactly the computation it expects back, under the same key, so a challenge can be reflected to its sender and the answer replayed.

Detects password checks that cannot give the right answer: bcrypt.compare()/argon2.verify() used without await (a Promise is always truthy, so every password passes), and a password re-hashed with a fresh salt and compared with the stored hash (never equal).

An auth middleware, decorator, permission class or servlet filter that lets a request through because a token, API key or Authorization header is present, without verifying it.

A Python (Flask, FastAPI, Quart) route with an administrative path registered with no authentication decorator, dependency or check. The same defect in JavaScript, TypeScript and Go is VNX-425.

A setting that enforces MFA/2FA is switched off (require_mfa = False, mfaRequired: false, MFA_ENABLED = False, .requireMfa(false)), or a Cognito user pool has mfa_configuration = "OFF".

Login decided by comparing a submitted password directly with a stored or configured one (==, ===, !=, .equals()) instead of verifying a slow salted hash.

A password, card number, CVV, SSN, PIN, bank account number or key written into a cookie in cleartext, by name or by value, across Python, Node, Java, PHP, Ruby and Go cookie APIs.

A real http://, ws:// or ftp:// endpoint used by code: passed to an HTTP, FTP or socket client, assigned to an endpoint-named variable or key, or loaded by a script or iframe src.

A cryptographic key written into the source: a key-named variable assigned key material, a literal assigned to a variable that a key API consumes, or a literal passed straight to AES/DES/HMAC/Fernet/SecretKeySpec/createCipheriv/NewCipher or a JWT call. Node JWT, session and HMAC signing keys are reported by VNX-NODE-019.

An IV or nonce generated once (module, package or class level, or in a constructor) and reused by the encryption call for every message.

Reports code that accepts an expired certificate or signed token: swallowed CertificateExpiredException/ExpiredJwtException, jsonwebtoken ignoreExpiration: true, PyJWT verify_exp: False, ruby-jwt verify_expiration: false, OpenSSL verify callbacks that accept X509_V_ERR_CERT_HAS_EXPIRED, and X509_V_FLAG_NO_CHECK_TIME.

Reports AES in an unauthenticated mode (CBC, CTR, CFB, OFB) in Java, Kotlin, Node.js, PHP, Python and Ruby, in a file that never computes a MAC or signature, so the integrity step is missing. AEAD modes, ECB (VNX-CRYPTO-003) and files with an HMAC are not reported.

Reports keys generated too small: DSA and Diffie-Hellman below 2048 bits, AES keys below 128 bits, elliptic curves under 224 bits, and RSA/DSA/DH below 2048 bits in Ruby and PHP. RSA in Python, Go, Java and Node.js is VNX-CRYPTO-006's.

MD5 or SHA-1 is computed through a hash API on a security value: the call line, the three code lines above it or the next one (the next three for a Java/Kotlin MessageDigest, which is fed afterwards), never looking past a line that closes a block name a password, secret, token, session id, cookie, signature, salt, nonce, CSRF value, API key, credential or reset value. Both algorithms are broken for collision resistance and are fast to brute-force, so they must not hash passwords or derive tokens and signatures; use SHA-256 or stronger, HMAC-SHA256 for tokens and signatures, and argon2id/bcrypt/scrypt for passwords. Calls recognised: Python hashlib.md5()/sha1()/new('md5'|'sha1') and bare md5()/sha1() after from hashlib import, Node.js createHash('md5'|'sha1') and CryptoJS.MD5/SHA1, Java/Kotlin MessageDigest.getInstance("MD5"|"SHA-1"), commons-codec/Spring DigestUtils.md5Hex/sha1Hex/md5DigestAsHex and Guava Hashing.md5()/sha1(), PHP md5()/sha1()/md5_file()/sha1_file(), Ruby Digest::MD5/SHA1, OpenSSL::Digest::MD5/SHA1 and OpenSSL::Digest.new('MD5'|'SHA1'). Not reported: digests with no security name nearby (cache keys, ETags, checksums, content addresses), digests of a constant (static::class, __CLASS__, a string literal), Python calls marked usedforsecurity=False, HMAC-SHA1, names, fields, enums and comments that only mention the algorithms, and test files. A password passed straight into the digest (md5($pass), hashlib.md5(password.encode()), createHash('md5').update(password), DigestUtils.md5Hex(password), Digest::MD5.hexdigest(password)) is reported by VNX-CRYPTO-007, a password hashed with a fast hash, and not here; this rule keeps tokens, session ids, cookies, signatures, salts, nonces and keys, and a password named only around the call. Other MD5 and SHA-1 calls are reported by VNX-CRYPTO-001 and VNX-CRYPTO-002; Go is covered there.

Reports block-cipher IVs that are the key (or a slice of it) or come from a non-cryptographic generator or the clock, in Python, Java, Kotlin, Go and Node.js. Constant IVs are VNX-CRYPTO-010's and VNX-JAVA-020's.

Reports secrets generated from fewer than 16 random bytes (secrets.token_*, os.urandom, crypto.randomBytes, PHP random_bytes, Ruby SecureRandom.hex, short byte[]/ByteArray salts and keys) or from uuid1() and truncated uuid4(), when the value is named as a token, secret, key, salt or session id.

Reports secrets drawn as a random integer from fewer than 2^32 values (random.randint, secrets.randbelow, nextInt, crypto.randomInt, Math.random() * N, PHP random_int/mt_rand, Ruby rand/SecureRandom.random_number) when the value is named as a token, secret, key, session id or reset value. OTPs and PINs are not reported.

Reports generators that produce secrets seeded with a constant or the clock: seeded SecureRandom, setSeed(literal or currentTimeMillis), java.util.Random(time) for a token, and Python random.seed()/random.Random() with a fixed or time seed in a file that draws a secret from it.

Detects a PRNG seeded with a constant (a literal, an ALL_CAPS constant or a variable assigned one) when its output is security-relevant, and any seeded SecureRandom or ChaCha8. Python, Java, Kotlin, Go, C, C++, PHP, Ruby and JavaScript.

Detects a PRNG seeded from the clock or the process id when its output is security-relevant, and any time-seeded SecureRandom or ChaCha8. Python, Java, Kotlin, Go, C, C++, PHP, Ruby and JavaScript.

Detects a value drawn from a non-cryptographic PRNG (Math.random, rand/mt_rand/str_shuffle, Ruby rand/sample, Go math/rand) that is stored under, keyed by or returned as a secret. JavaScript/TypeScript, PHP, Ruby and Go.

Detects a PRNG seeded with a value narrowed to a small range (a modulus, a 16-bit mask or cast, a length or count, a small random range) when its output is security-relevant, and any narrowed seed on SecureRandom or ChaCha8. Python, Java, Kotlin, Go, C, C++, PHP, Ruby and JavaScript.

Detects secrets produced by predictable identifier generators: time-based UUIDs (v1/v6), name-based UUIDs (v3/v5) and PHP uniqid(), when stored under, keyed by or returned as a secret. Python, JavaScript/TypeScript, PHP, Go, Java, Kotlin and Ruby.

Detects secrets built from state an attacker can observe or estimate (the clock, the process id, the client address or the host name), raw or hashed, when stored under, returned as or set as the cookie value of a secret. C, C++, Python, JavaScript/TypeScript, PHP, Java, Kotlin, Go and Ruby.

Detects secrets that are the next value of a counter (sessionId++, ++lastToken, incrementAndGet(), atomic.AddInt64, next(counter), .succ) when the counter is named for a secret or its result is stored, returned or set as a cookie value of one. Java, Kotlin, Python, JavaScript/TypeScript, PHP, Ruby and Go.

Detects secrets that are the previous value plus a small random step (token += random.randint(...), session_id = last + rng.nextInt(500), isn = last_isn + (rand() % 64000)). Python, Java, Kotlin, JavaScript/TypeScript, PHP, Ruby, Go, C and C++.

A Content-Security-Policy nonce or an OAuth state parameter that must be fresh per response or per login is written into the source as a constant, in Go, Java, JavaScript/TypeScript, Python, PHP and HTML.

Python code loads request, socket or downloaded bytes with marshal, executes code fetched over the network, or runs a downloaded file, with no signature or digest check in between.

A request's Origin or Referer, or a postMessage event.origin, is validated with a substring, prefix, dot-less suffix or unanchored-regex test that a hostile site passes, or a WebSocket CheckOrigin accepts every origin.

A signature or MAC check whose result is discarded, or whose failure is caught and swallowed, so forged data is processed as genuine. Java, Go, JavaScript/TypeScript and Python.

A client address read from X-Forwarded-For, X-Real-IP, a similar client-written header or Flask request.access_route, falling back to the socket address, in Python, JavaScript/TypeScript, Go, Java, Kotlin, PHP, Ruby and C#.

Verified JWT claims, the session or the authenticated principal merged wholesale with the request body or query, and the request spread into Express render options, in JavaScript/TypeScript, Python and Java.

An access decision made on the host name a reverse DNS lookup returned for the peer's address, without forward confirmation, in Python, Java, Go, JavaScript/TypeScript, PHP and Ruby.

PHP in_array()/array_search() without strict mode on a request or JSON value, loose ==/!= on json_decode() output, strcmp() of a request value compared loosely with 0, and loosely compared hashes, where a value of another type passes the check.

Reports a web framework's built-in CSRF protection switched off: Django @csrf_exempt and a MIDDLEWARE list without CsrfViewMiddleware, Flask-WTF WTF_CSRF_ENABLED = False and csrf exemptions, Node.js csrf: false / checkOrigin: false / Apollo csrfPrevention: false / csurf ignoreMethods with POST, and Rails skip_before_action :verify_authenticity_token, protect_from_forgery except:, allow_forgery_protection = false or an ApplicationController with no protect_from_forgery.

Reports a <script src> or <link rel="stylesheet" href> that loads code from another origin (an absolute http(s):// or protocol-relative // URL) with no integrity= hash, in HTML and server-side templates.

Reports signature, MAC and checksum comparisons that can be passed without the right value: verification that runs only when the value is present (if sig and not compare_digest(...)), prefix/suffix/substring tests against a computed digest, and digests truncated before comparison, in Python, JavaScript/TypeScript and Java.

Reports Electron main-process code that answers a security prompt for the user: permission request/check handlers that always grant, certificate-error handlers that always accept, a certificate verifier that always returns 0, and the ignore-certificate-errors switch.

Reports Rails link_to/button_to calls that send DELETE with no confirm/turbo_confirm, and anchors with data-method="delete" or data-turbo-method="delete" and no data-confirm, so one click destroys data without warning.

Reports hand-written TLS identity checks (Java HostnameVerifier implementations and lambdas, certificate subject/issuer name tests, Python verify_hostname-style functions) that compare with endsWith/startsWith/contains/in instead of the standard matching rules.

Reports logging and print calls in Python, JavaScript/TypeScript and Java whose arguments name a social security number, passport number, date of birth, national ID, tax ID, driver's licence or medical record number.

Reports BroadcastReceiver.onReceive methods (Java, Kotlin) that act on a system broadcast such as BOOT_COMPLETED or SMS_RECEIVED without checking intent.getAction(), where the receiver is reachable by other apps.

A file path is checked and then used by name a few lines later, so another process can replace the file (typically with a symlink) between the check and the use

A path is tested for being a symbolic link and then opened, written or re-permissioned by name a few lines later. The test and the use are two lookups, so a local attacker can swap a regular file for a link to /etc/passwd or a key file between them, and the program follows it

A function registered as a signal handler in the same C or C++ file (signal(SIG..., h), std::signal, sigset, or a struct sigaction whose sa_handler/sa_sigaction is h, or a captureless C++ lambda registered in place) writes to a file-scope variable that is not declared volatile sig_atomic_t or atomic (_Atomic, atomic_*, std::atomic): an assignment, increment, compound assignment, a write to a member or element of it, or free() of it. The signal can arrive while the interrupted code is half way through using the same variable, so the handler corrupts it (a pointer freed under the main loop and freed again, a counter update lost, a struct reset mid-read)

Mutable state shared by every thread is written without synchronisation, in Java. Two shapes are reported. First, a request handler of a shared singleton writes an instance field: a servlet (a class extending HttpServlet or GenericServlet) assigning, incrementing or compound-assigning a non-static, non-final field (also through this.) inside doGet/doPost/doPut/doDelete/doPatch/doHead/service, or a Spring @Controller/@RestController doing the same inside a method annotated @GetMapping/@PostMapping/@PutMapping/@DeleteMapping/@PatchMapping/@RequestMapping. One instance serves all concurrent requests, so one user's value leaks into another's response. Second, in a file that runs on several threads (implements Runnable, extends Thread, new Thread, an ExecutorService, submit, CompletableFuture, parallelStream, ForkJoinPool, or a servlet or Spring controller), a static, non-final, non-volatile numeric field is incremented, decremented or compound-assigned (++, --, +=) outside any synchronized method or block and without a Lock, so concurrent updates are lost

A file is checked by name and then opened or changed by the same name within ten lines, in C or C++, so another process can swap the file (typically for a symlink) between the check and the use

A temporary switch into the root context (seteuid(0), setegid(0), setreuid(-1, 0), setregid(-1, 0), setresuid(-1, 0, -1) or setresgid(-1, 0, -1), also ::-qualified) that is not an atomic, contained step, in C or C++

A division or modulo whose divisor is a variable assigned from outside the program (a parsed number, a request value, a command-line argument) with no zero check above it, in C, C++, Go and Java.

A substring or element search whose result has three states (not found, found at position 0, found later) is tested as a boolean, so two of the states are treated as one

A public or protected Java method or constructor stores a mutable argument (an array, a mutable collection, Date, Calendar or StringBuilder) straight into a field instead of a copy.

A public or protected Java method returns one of the object's own mutable fields (an array, a mutable collection, Date, Calendar or StringBuilder) instead of a copy or an unmodifiable view.

C/C++ temporary files created so other local users can read, write or claim them: tmpnam/tempnam/mktemp, open()/creat() in /tmp with a mode other users can use, fopen() writing a fixed name in /tmp, and chmod() widening a mkstemp() file.

Python directories created or chmod-ed writable by every local user, and fixed, predictable file names written or logged to in /tmp, /var/tmp or /dev/shm.

Java login code that keeps the pre-login session: Spring Security sessionFixation().none() (or the XML equivalent), and servlets that store the authenticated user in the existing session without rotating its id.

A password, or a password hash, is checked with an ordinary equality comparison, which returns as soon as the first byte differs, so the time a login takes tells an attacker how much of a guess is right (an observable timing channel; storing or comparing the plaintext password is a further weakness). Reported in Python, JavaScript/TypeScript and Java: ==, !=, === or !== where one operand is named as a password (password, passwd, passphrase, pwd, including user.password, row['password'], getPassword(), passwordHash, hashed_password, adminPassword) and the other operand is a real value; Java a.equals(b)/equalsIgnoreCase, Objects.equals and Arrays.equals with such an operand. Comparisons that continue onto the next line are joined, including a line break before the operator or .equals(. Not reported: presence checks against an empty string, None, null, undefined, a boolean or a number; a string literal or ALL_CAPS constant operand (hard-coded credentials are reported by other rules); confirmation, policy, length, field, type and similar names (password_confirmation, passwordPolicy, password.length); a new-versus-old password reuse check; `pwd` naming the working directory (assigned from a cwd call, user.dir or PWD in the same file); lines that already use a constant-time or hashing comparison (hmac.compare_digest, secrets.compare_digest, crypto.timingSafeEqual, MessageDigest.isEqual, bcrypt/check_password/PasswordEncoder.matches); the text in strings and comments; and test code. MAC, signature and token comparisons are reported by VNX-CRYPTO-008. Two comparisons on the same timing channel are reported by a more precise rule, so the line is reported once: both operands naming the password (user.password == request.form["password"]) by VNX-309, a login decided by a plain password comparison, and a password compared with a value named as a secret, token, digest, signature or MAC next to the hash call or request read that produced it by VNX-CRYPTO-008.

A Java class is looked up with Class.forName() or ClassLoader.loadClass() by a name assembled at run time (concatenation, String.format, or request data) without an allow-list check.

A Java catch block that is empty, or whose only statement evaluates the exception and discards the result, so a detected failure is silently dropped.

An exception is caught and silently discarded: a Java catch block holding only a TODO or auto-generated comment (plainly empty ones are reported by VNX-390), or a broad Python except whose whole body is pass.

A Python web handler catches an exception and returns an error body (jsonify, JsonResponse, HttpResponse, Response, Sanic json or a dict) without an error status, so the client receives 200 OK for a failed request.

A Java catch block reports success for an operation that failed: an HTTP 200 response (ResponseEntity.ok, HttpStatus.OK, Response.ok, setStatus(200)) or return true from a verify/validate/authorize-style method.

Python code uses an HTTP response body (requests, httpx, a session) without checking its status, or slices a string at str.find()/rfind() without checking for -1.

A catch clause catches the null-dereference exception (Java NullPointerException, Kotlin NullPointerException/KotlinNullPointerException, C# NullReferenceException) in place of a null check.

A catch of Exception, RuntimeException or Throwable (Java) or Exception/bare catch (C#) whose body neither rethrows nor uses the caught exception, turning every failure into the same default.

A Java method declares throws Exception or throws Throwable, so callers cannot tell which failures to handle. Overrides, main, Callable.call, close and Spring Security builder methods are not reported.

A number read from the HTTP request (Flask, Django, DRF, or an unbounded FastAPI int/float route parameter) sets a Python loop count, sleep, allocation, repetition or exponent with no upper bound, so one request can exhaust CPU, memory or a worker.

A C/C++ heap block held in a local variable (malloc, calloc, strdup, kzalloc, new and friends) is abandoned by a later return or throw before it is freed, stored, handed off or returned; or `p = realloc(p, n)` overwrites the only pointer to the old block, which leaks when realloc fails.

A long-lived descriptor is opened without close-on-exec (open/openat/creat without O_CLOEXEC, socket without SOCK_CLOEXEC, fopen without "e") and not closed nearby, in a C/C++ file that starts other programs (exec*, posix_spawn, popen, system), so every child inherits it.

A Java file or database handle bound to a local variable is never released before the method ends: streams, readers, writers (including Files.newBufferedReader/newInputStream and friends), ZipFile/JarFile and JDBC connections opened outside try-with-resources and never closed, returned or wrapped. Python handles are reported by VNX-775.

A number taken from the request sets, with no upper bound, how much work the server does: a range()/for/while-loop bound, a string or array repeat/size, Buffer.alloc, or a bcrypt/PBKDF2 cost chosen by the client (Python Flask/Django, Node Express/Koa).

Decompression with no bound on the output size: Python zipfile extractall() or per-member extract(), or tarfile extractall(), without a member size check, shutil.unpack_archive, gzip/zlib/bz2/lzma.decompress of request or network data; Node zlib gunzip/inflate/unzip/brotliDecompress without maxOutputLength, request streams piped through createGunzip, adm-zip extractAllTo, and unzipper.Extract or unzipper.Open entries streamed without an uncompressedSize check.

A directory-containment check (startsWith, startswith, is_relative_to, strings.HasPrefix) is made on a path that was never canonicalised, so an equivalent spelling such as base/../etc/passwd passes it.

A shared server pool capped at one or two members by a literal: HikariCP setMaximumPoolSize, DBCP setMaxTotal/setMaxActive, Tomcat/Jetty setMaxThreads and QueuedThreadPool, Spring hikari maximum-pool-size, dbcp2 max-total and tomcat threads.max (any relaxed-binding spelling) in .properties or application.yml, and newFixedThreadPool/ThreadPoolExecutor of size 1-2 in request-serving code.

Java locks other code can take and hold: synchronized on an interned string, a String constant, Boolean.TRUE/FALSE or a boxed valueOf cache; public Lock/ReentrantLock/ReadWriteLock/StampedLock/Semaphore fields or a public Object the class synchronizes on; and public getters that return the lock, including Lombok @Getter on a lock field.

Java code that may run without the lock it needs or cannot release it: a bare tryLock() whose result is discarded, synchronized (new ...), and Lock.lock()/lockInterruptibly() whose unlock in the same method is not in a finally block or that is never unlocked.

Reports a non-blocking lock attempt whose result is discarded, so the shared resource is touched whether or not the lock is held: pthread_mutex_trylock, sem_trywait, flock with LOCK_NB, lockf F_TLOCK, fcntl F_SETLK, C++ try_lock and unchecked std::try_to_lock, Go TryLock, Java tryLock, Python acquire(False). Checked results, explicit discards, blocking locks and test code are not reported.

Reports a C or C++ pointer released twice on one path: free/g_free/kfree/OPENSSL_free/delete of the same expression again within 20 lines with no reassignment, exit or branch in between, and a release followed by goto to cleanup code that releases it again. Nulled pointers, if/else and switch branches, other functions, macros and comments are not reported.

Reports the old pointer used after a successful realloc into a different variable, and C++ pointers or string_views kept into a temporary string (c_str()/data() of std::to_string, std::string(...) or std::string{...}, .str(), .substr(), a concatenation, Qt toUtf8().constData()). The realloc failure branch, p = realloc(p, n), full-expression uses and named strings are not reported.

Reports an administrative or management interface served over a plaintext network listener: Go http.ListenAndServe, Server.ListenAndServe/Serve and net.Listen naming an admin/management/mgmt address, handler or server, and Java/Kotlin ServerSocket, ServerSocketChannel and HttpServer.create for one. TLS listeners, loopback (including a Go address variable assigned only loopback literals) and Unix-socket listeners, non-admin listeners and test code are not reported.

Reports a side channel left open while the main channel is protected: a Unix control socket made world-writable (chmod to a mode with the other-write bit, or umask(0) before bind with no chmod after) in C, C++, Go and Python, and a Go plaintext http.ListenAndServe on a network address running at the same time as a TLS listener (one of them in a goroutine) that does not only redirect to HTTPS.

Reports a Unix domain socket or FIFO created at a fixed path in a shared world-writable directory (/tmp, /var/tmp, /dev/shm) in C, C++, Go and Python, as a literal, a constant or a C buffer filled by snprintf, and a Windows CreateNamedPipe in a file that never passes FILE_FLAG_FIRST_PIPE_INSTANCE, where another local user can claim the channel's name first.

Reports an administrative route (a path segment admin, administration, backoffice, superuser, sysadmin, staff or manage/management) registered with no authentication in front of it: Express/Koa/Fastify routes with no middleware, and Go handlers or gin/echo admin route groups with no middleware or in-handler check. The same defect on a Python route is VNX-306.

Reports Python code that finds modules, libraries or commands through the current working directory: sys.path and site.addsitedir entries that are empty, '.', relative or os.getcwd(); PATH-like variables given an empty or relative element; commands run by a cwd-relative path without cwd=; bare command names run after os.setuid(0); and ctypes loads of relative paths or bare DLL names.

Reports C/C++ code that loads a library or program through a search path an attacker can influence: LoadLibrary/LoadLibraryEx of a bare DLL name without a restricted search, dlopen of a relative path, and PATH/LD_LIBRARY_PATH/LD_PRELOAD/DYLD_* set to an empty or relative element or from argv.

Reports C, C++ and C# code that hands an unquoted Windows executable path containing a space to CreateProcess (NULL application name), WinExec, CreateService, a service ImagePath value or sc.exe binPath=, so Windows first runs C:\Program.exe or another space-truncated prefix.

Reports a static-file handler deployed on the application's own directory (express.static/serve-static/serve-index/koa-static/@fastify/static on __dirname or '.', Flask static_folder, StaticFiles, send_from_directory, add_static or STATICFILES_DIRS on the project root), which makes server source, configuration and secrets downloadable.

Reports Java errors with no handler: a WEB-INF/web.xml with no error page for uncaught exceptions, and CompletableFuture.runAsync/supplyAsync or ExecutorService.submit whose future is discarded with no exception handler, so the task's exception is silently lost.

Reports SA_NODEFER on a C/C++ sigaction whose handler does non-reentrant work (free, malloc, printf, syslog, exit, ...), so a second delivery of the same signal re-enters the handler while it runs.

Reports JavaScript/TypeScript and Python code that vets a URL with a simpler model than the client uses to act on it (a raw-string startsWith/includes/endsWith/in check against a host, or Node's legacy url.parse()) and then requests or redirects to the unchanged string.

Reports Python security APIs whose behaviour depends on the interpreter version: hmac.new() or hmac.HMAC() without a digest, ssl.SSLContext() with no or the generic PROTOCOL_TLS/PROTOCOL_SSLv23 protocol, module-level ssl.wrap_socket(), ssl.match_hostname() and cgi.escape().

Reports Python assert statements in production code that the code relies on: an assert whose condition is an authentication, authorisation or integrity check, and assert False/0/None used to stop a branch. python -O strips them, so the check silently stops running.

Detects a server-side fetch of a URL taken from the request whose response is relayed back to the caller (Python requests/httpx/urlopen, Node axios/fetch/got/needle/superagent, http-proxy targets), turning the service into an open proxy into its own network.

Detects Node's lenient HTTP parser switched on (insecureHTTPParser: true, --insecure-http-parser) and a message given both Transfer-Encoding and Content-Length in the same branch, the framing ambiguity behind request smuggling.

Detects Java security operations that are offered but do nothing (an empty or return-true setter/enable/change/verify for passwords, MFA, encryption, TLS, audit, sessions, roles, tokens) and request handlers whose whole body throws UnsupportedOperationException or NotImplementedException.

Detects a Java web endpoint marked obsolete but still served: @Deprecated (or OpenAPI deprecated = true) in the same annotation block as a Spring @*Mapping, JAX-RS @GET/@POST/@Path, Micronaut @Get/@Post, or on a @Controller/@RestController class, unless it answers 410 Gone or redirects.

Detects a C/C++ confirmation dialog (Win32 MessageBox, Qt QMessageBox, GTK gtk_message_dialog_new) whose answer is compared with a button the dialog does not offer, so the confirmed branch never runs or always runs.

Detects a configuration or request flag that arrives as text and is made boolean by truthiness, so 'false', '0' and 'no' all mean on: Python bool() of os.environ/getenv, request parameters, sys.argv or input(), os.environ.get with a True/False default, argparse type=bool, and Node Boolean()/!! of process.env/req.query or process.env.X || true/false.

Detects Unicode bidirectional override/isolate controls written literally in source code (Trojan Source), and HTML/template links whose URL-looking text names a host unrelated to the href, or whose href hides the real host behind host-like userinfo before '@'.

Detects Python and JavaScript/TypeScript function signatures whose security parameter defaults to the weaker setting (verify/verify_ssl/check_hostname/rejectUnauthorized/strictSSL = false, secure/httponly = false, autoescape or CSRF off, insecure/skip_verify/shell/debug = true), so every caller that omits it gets the insecure behaviour.

Reports Python (Flask, Django, Starlette) code that sets authorisation state from a cookie, header or request parameter the client controls: an is_admin/role cookie or header, a privilege flag tested straight from the query string, or a session role or trust flag assigned from request data.

Reports C/C++ code that tests an initialisation call (sodium_init, curl_global_init, pthread_mutex_init, a project's own *_init) for failure and then only logs, so execution continues with an uninitialised library, context or lock.

Reports a C/C++ local scalar or char array declared without an initialiser whose first mention in the same block reads it (return v, v++, v += ..., a condition, a printf argument, strcat(buf, ...)) before anything is stored in it.

Reports Python code that creates a temporary directory or file with tempfile.mkdtemp(), mkstemp() or NamedTemporaryFile(delete=False) and never removes it anywhere in the same file.

Reports Java code that releases a lock (unlock()) or closes a file, socket or JDBC resource (close()) only on the normal path, with no finally between acquisition and release, so an exception in between leaves it held or open.

Reports a Python dict literal that names the same string or integer key twice at the same level, where the later entry silently replaces the earlier one.

Reports C/C++ code that overwrites a string's NUL terminator (buf[strlen(buf)] = c, or buf[n] = c after n = strlen(buf)) with another character and writes no new terminator on the following lines.

Reports C/C++ code that stores a number parsed from input (atoi, strtol, std::stoi...) into an element of a char buffer, where an input of 0 inserts a NUL terminator mid-string.

Reports a C/C++ function that returns a pointer offset from an unchecked strchr/strrchr/memchr/strstr/strpbrk result (return strchr(s, '=') + 1, or p = strchr(...) then return p + 2 with no NULL test), which yields NULL + n when the search fails.

Reports pointer arithmetic in C/C++ that multiplies an offset by sizeof() on a pointer or array whose element is wider than one byte (int, long, double, *_t, struct), which the compiler already scales, so the offset lands sizeof(T) times too far. Byte pointers (char, uint8_t, void), allocation and length arguments, and member expressions are not reported.

Reports C/C++ pointer subtraction between pointers that provably point into different objects: two distinct sized arrays, two separate allocations (malloc, calloc, strdup, new[]), or iterators of two different containers. The result is undefined and cannot serve as a size. Pointers that may share an object, members, element values, linked-list nodes and comments are not reported.

Reports request data that chooses the class, module, method or constant reflection loads or calls: Java Class.forName, loadClass and getMethod/getField; Python import_module, __import__, getattr, pydoc.locate and globals()[...]; Ruby constantize, const_get and send/public_send. Constant names, configuration values, request.method, allow-listed values and fixed-table lookups are not reported.

Reports Java public static final fields that hold a mutable value (a new ArrayList/HashMap/HashSet/Date/StringBuilder and similar, or Arrays.asList), where final freezes only the reference. Immutable collections, non-public fields, test sources and comments are not reported. A public static final array is the same weakness in its array-specific form and is reported by VNX-582, not here.

Reports server-owned values taken from the client: a price, total, discount or privilege field (role, isAdmin) read from the request body, query, params or cookies in JavaScript/TypeScript, and hidden form inputs in templates that carry a price, privilege or user id. Admin back-office routes, price fields that are only compared, user-chosen fields such as amount or quantity, CSRF tokens, tests and comments are not reported.

Reports C/C++ calls whose behaviour differs between platforms in a way that changes correctness: signal() installing a handler (once per file), strerror_r() outside a variant-selecting #if, realloc(p, 0), the MSVC _snprintf/_vsnprintf family, and vfork(). SIG_IGN/SIG_DFL, sigaction, snprintf, fork, test sources and comments are not reported.

Reports C/C++ calls whose arguments make the library behaviour undefined: memcpy/strcpy/strcat with the same object as source and destination, sprintf/snprintf whose destination is also an argument, fflush(stdin), and a literal NULL passed to a %s conversion or a mem*/str* pointer argument. memmove, snprintf(NULL, 0, ...), distinct objects or array elements, element-sized copies within an array, output-stream flushes, tests and comments are not reported.

Detects a value that can be NULL being dereferenced before it is checked: an unchecked malloc/calloc/realloc/strdup/fopen/getenv result in C and C++, and an unchecked request parameter, header, environment variable, system property or listFiles() result in Java.

Detects calls to and imports of Java and Python standard-library APIs that are deprecated (most for removal) or already removed (Thread.stop, boxed-primitive constructors, one-argument URLEncoder.encode, Class.newInstance, finalize, the PEP 594 modules, ssl.wrap_socket, cgi.escape, collections ABC aliases and more), each with its replacement.

Detects a switch with no default whose cases are the only thing that sets a variable (uninitialised or NULL in C/C++, null in Java) that is read after the switch, so an unhandled value leaves it uninitialised or null.

Detects a call to a function that is not async-signal-safe (stdio, malloc/free, syslog, exit, strtok, localtime, longjmp, new/delete, std::cout, mutex locks) inside a C/C++ crash handler, a handler the same file installs only for fault signals such as SIGSEGV.

Reports operators that compile but do not do what the line means. Java: a String compared with == or != against a string literal (reference identity, not content) and a BigDecimal compared by reference with BigDecimal.ZERO/ONE/TEN. C: a char pointer compared with == or != against a string literal (address comparison; use strcmp). C/C++: a bit mask tested as flags & MASK == value, which parses as flags & (MASK == value). C/C++/Java: the transposed compound assignment x =+ n / x =- n (an assignment of +n, not an increment). Not reported: equals()/compareTo()/strcmp, comparisons with null, char literals, std::string compared with a literal in C++ (operator== compares content; a .h header that uses std::, class, namespace or template counts as C++), parenthesised masks ((flags & MASK) == value), x = -n written with a space, and operators inside strings and comments. Assignment used as a condition (if (x = y)) is VNX-481. A Java String compared with a string literal is reported by VNX-597 (String compared with == instead of equals()) and not here, unless the file never names the String type, which that rule needs.

Detects an if or while condition that is a bare assignment, if (x = y), in C, C++ and Java, where a comparison (==) was meant. The deliberate double-parenthesis form is not reported.

Detects a statement that only compares, x == y; (or a Python test line cart.total == 0 with no assert), and a for loop whose initialiser compares (for (i == 0; ...)), in C, C++, JavaScript, TypeScript and Python. The result is discarded, so the intended assignment or assert never happens.

Detects braceless if/else/for/while bodies followed by a second statement at the same indentation (the 'goto fail' shape), and if (...); with an empty body, in C, C++ and Java.

A case or default label of a C, C++ or Java switch whose statements run into the next label of the same switch: the label has a body of its own, and its last statement is not a break, return, throw, continue, goto, yield or a call that does not return (exit, abort, System.exit), so control falls through into the next case. Not reported: stacked labels with no statements between them (case 1: case 2:), a fall-through marked as deliberate (a /* fall through */ or FALLTHROUGH comment, [[fallthrough]], __attribute__((fallthrough))), Java arrow labels (case X ->), which never fall through, the last label of a switch, and labels in comments or string literals. A body whose last statement is a bare if guarding the exit (if (x) return -1;, with no else) is reported, because the other branch falls through. A body ending in an inner block (an if/else or loop closed by a brace) is not judged.

An object's type is decided by comparing its class name: in Java, getClass().getName(), getSimpleName() or getCanonicalName() (or Foo.class.getName()) compared with equals/equalsIgnoreCase/== in either order; in C#, GetType().Name or GetType().FullName compared with ==, != or Equals; in Python, type(x).__name__ or x.__class__.__name__ compared with ==, != or in. A switch (C# switch expression, Python match) on such a name is reported, as is a class name stored in a local and compared with a literal within the next eight lines. Different classes can share a name (another package, another class loader, an attacker-supplied subclass or plugin), so a trust or dispatch decision made this way can be satisfied by the wrong type. Not reported: instanceof, isinstance, is, isAssignableFrom and class-object identity (getClass() == Foo.class, GetType() == typeof(Foo), type(x) is Foo), a class name read for logging or display, and the pattern in comments or string literals.

A credential is held in a Java field with no access modifier, so the only thing protecting it is package scope: a field of a top-level class, declared at member level without private/protected/public, that is either a key type (SecretKey, PrivateKey, Key, KeyPair, Credentials, any name) or a String/char[]/byte[] whose name says it is a password, passphrase, secret, API key, token, credential or private key. Java packages are open (any class that declares the same package, or a jar on the class path that splits it, can read the field), so this is not access control. Not reported: private, protected and public fields (public exposure is VNX-493), fields of an interface (implicitly public), injected fields carrying an annotation, constants that name a parameter, header, field, attribute or length rather than holding a value (PASSWORD_PARAM, TOKEN_HEADER), local variables, nested classes, test code and comments.

Per-request or per-user data stored in a field of a Java component that one instance serves every request: a class that extends HttpServlet/GenericServlet, is annotated @WebServlet, @Controller or @RestController, or extends a Struts Action. A request handler assigns a non-final field (instance or static) from the request (getParameter, getHeader, getAttribute, getSession, getRemoteUser, getUserPrincipal, getCookies, getInputStream/getReader, getQueryString), directly or through a local variable assigned from the request a few lines above. Concurrent requests share the field, so one user's data is served to another. Not reported: locals, final fields, assignments in init() or a constructor, fields of classes that are not request singletons (including Spring beans annotated @RequestScope, @SessionScope or @Scope request/session/prototype), fields set from servlet configuration, and the pattern in comments or string literals.

A Java class that is not final declares a public clone() that is not final and builds its copy with super.clone() within the next few lines. super.clone() creates the object without running a constructor, and because neither the class nor the method is final, a subclass can override clone() and hand out copies that skip the constructor's checks or share mutable internals. Not reported: a final clone() (including one that only throws CloneNotSupportedException), a clone() in a final class or record, a clone() that copies through a constructor rather than super.clone(), a clone overload with parameters, non-public clone methods, and the pattern in comments or string literals.

A Java inner class (a non-static member class, or an anonymous class created with new X() { ... }) reads a private field of its outer class whose name says it holds a password, passphrase, secret, API key, token, credential, private, master, signing, encryption or HMAC key, or PIN. Inner classes compile to separate top-level classes, so the compiler (before Java 11 nestmates) widens access to the outer class's private field through package-visible accessors any class in the package can call, and the inner instance keeps the outer instance, and the secret, reachable. Reported at the inner class's declaration. Not reported: static nested classes, inner classes that do not use a sensitive field, lambdas, sensitive fields that are not private, test code and comments.

A public field that any code can overwrite holds security- or business-critical data: in Java a public field without final, in C# a public field without readonly or const, whose name says it is a password, passphrase, secret, API key, private key, token, credential, an admin flag, role, permission or privilege, or a price, balance, amount or salary. Any class can change it, so a check that reads it can be steered. Static and instance fields are both reported. Not reported: final, readonly and const fields, C# properties ({ get; ... } or =>), private, protected and package-private fields (package scope is VNX-487), constants that name a parameter or header rather than hold the value, methods, test code, and the pattern in comments or string literals.

A public Java method that returns an array type returns a private array field itself (return field; or return this.field;), so the caller receives a reference to the object's internal state and can change its elements. final on the field does not help: it fixes the reference, not the contents. Reported at the return statement. Not reported: a defensive copy (field.clone(), Arrays.copyOf, System.arraycopy into a new array, List.of/unmodifiableList), a private field initialised to an empty array (new T[0], {}), which cannot be changed, a local variable or method parameter that shadows the field, non-public methods, public fields (VNX-493 judges those), collections, and the pattern in comments or string literals.

Detects JVM, OS, path, environment and host information (System.getProperty of platform keys, System.getenv, System.getProperties, InetAddress.getLocalHost, MXBeans) written to an HTTP response, returned from a REST handler, added to a view model or printed in a JSP.

Detects Java classes that implement Cloneable and hold a secret field (password, token, API key, private key, card number) without refusing clone().

Detects non-transient secret fields (password, token, API key, private key, card number) in Java classes that implement Serializable and do not control their serial form.

Detects public static fields that are not final (Java) or not readonly/const (C#), which any code in the process can reassign.

Detects HTTP request data (parameters, headers, cookies, query string, Spring request arguments, Flask/Django request fields) stored in the server-side session without validation, inline, through a few assignments or a list or map; operands the enclosing method proves constant are not reported. Java and Python.

Detects code that decodes an encoded blob (base64, hex, rot13, zlib, marshal, atob, Buffer.from, String.fromCharCode) and executes it with exec/eval, new Function, vm or child_process. Python, JavaScript and TypeScript.

Detects a condition comparing the current time with a hard-coded date that guards file deletion, a shell command or code evaluation. Python, JavaScript and TypeScript.

Detects Python code that leaks data bit by bit through sleep durations, or encodes data (hex, base32, base64) into the host names of DNS lookups.

Detects Python code that stores a password, secret, token, API key or credential in its own process environment (os.environ[...] =, os.putenv, os.environ.setdefault/update), where every child process inherits it and other processes of the same user can read it.

Detects password policies in code that accept passwords shorter than 8 characters: length checks on password values, minimums declared on password fields (Joi/zod/yup, express-validator, jQuery Validate, Mongoose, @Size, C# StringLength/MinLength, ASP.NET Identity RequiredLength, Django MinimumLengthValidator) and an empty Django AUTH_PASSWORD_VALIDATORS.

Detects a password, API key, token, private key or credentials file written to a file that other local users can read: Go WriteFile/OpenFile with a group- or world-readable mode or os.Create of a credential path, Python os.open/os.chmod with such a mode, pathlib write_text/write_bytes or open() of a credential file with no owner-only mode, Node fs.writeFile without mode 0o600, and Java Files.write/FileWriter without owner-only POSIX permissions.

Detects credentials sent to a remote host over plain http://: URLs with a user:password pair, HTTP client calls to http:// URLs that carry auth=, an Authorization header or a password/token field, requests built on http:// that get SetBasicAuth or an Authorization header, and login forms that post to an http:// action.

Detects plaintext passwords put into a cache: lru_cache/cache/@cached/@memoize/@Cacheable/memoize() on a function that takes a password, and cache/redis/memcache writes (set, setex, put, hset...) whose key or value is a password variable or a request's password field.

Detects authenticated or user-data responses that are explicitly made cacheable: Django @cache_page, Flask-Caching @cache.cached and @cache_control(public=True | max_age=N) stacked with @login_required and similar decorators, and a public or max-age Cache-Control header set in a handler that is authenticated or serves user data.

Detects log and print calls that write a whole HTTP request part (all headers, the body, the form, the cookies) or its Authorization/Cookie header, in Python, JavaScript/TypeScript, Go (including logged httputil.DumpRequest output) and Java.

Detects Java servlets and JSPs that catch an exception and write its message or stack trace to the HTTP response: printStackTrace into the response writer, print/write of the exception or its getMessage()/toString() on response.getWriter() or a writer taken from it, response.sendError(code, e.getMessage()), and <%= exception.getMessage() %> in JSP.

Detects a password, secret, token, key, credential or the whole environment written into a web-served directory (public/, static/, www/, /var/www/) or a fixed /tmp path, in JavaScript/TypeScript and Python.

Detects persistent cookies that carry a credential or personal secret, and session or authentication cookies given a literal lifetime longer than 31 days, in JavaScript/TypeScript (Express, Koa), Python, Java (Servlet Cookie, Spring ResponseCookie), PHP and Ruby on Rails.

Detects production front-end builds configured to publish source maps (webpack devtool, Vue productionSourceMap, Vite build.sourcemap, Next.js productionBrowserSourceMaps, Angular production sourceMap, GENERATE_SOURCEMAP=true), which serve the original source to every visitor.

Detects an Express application that is served or exported while no file of the project registers an error-handling middleware, so every failure falls through to Express's default handler.

Detects TODO, FIXME, HACK, XXX and BUG comments that admit a security gap (missing authorization, unsanitised input, disabled TLS verification, plain-text passwords...) in Python, JavaScript/TypeScript, Java, Go, C and C++.

Detects a buffer whose literal length is repeated as a bare number in a bounded read, copy or format call (fgets(line, 256, ...) for char line[256]) in C, C++ and Java, instead of sizeof(buf), buf.length or a named constant.

Detects directory listing switched on: serve-index in Node, Django show_indexes, aiohttp show_index and Flask-AutoIndex in Python, Tomcat listings and Jetty dirAllowed/setDirectoriesListed in Java, @fastify/static list: true, nginx autoindex on and Apache Options Indexes or All.

Detects password fields that display what is typed: <input>, Blazor InputText and MUI TextField elements for a password with type text or no type, ASP.NET Html.TextBoxFor, Rails text_field, Django CharField without PasswordInput, WTForms StringField, and Android EditText with inputType text.

An access decision is taken on a request-supplied path or resource name that is only decoded, parsed or canonicalised afterwards, so the check judges a different string from the one the code uses.

A command shell is reachable over HTTP: a shell interpreter copied into a web-served directory, a ScriptAlias onto /bin, or a CGI program that runs its request as a command.

ASP.NET request validation is switched off: ValidateRequest="false" on a page, validateRequest="false" or requestValidationMode="2.0" in Web.config, or [ValidateInput(false)] on an MVC action or controller.

A literal password is written into a Java EE / Jakarta EE deployment descriptor or application-server configuration file (web.xml, context.xml, server.xml, tomcat-users.xml, persistence.xml, *-ds.xml and similar).

Code that can never run: a statement after an unconditional return, throw, break or continue in the same block (JavaScript/TypeScript, Python), or a block guarded by a literal false condition (Java, JavaScript/TypeScript, Python).

A C or C++ function returns the address of a local array, local variable or by-value parameter, a local string's c_str(), a string_view of a local string, or a reference to a local object, leaving the caller with a dangling pointer.

A Python local variable is assigned a computed value that is overwritten in the same block before anything reads it (a dead store).

A security decision is taken on a plain, unsigned cookie that names identity or privilege (role, admin, user_id, username...), or such a cookie is written without a signature, in JavaScript/TypeScript, Python and PHP.

Reports a Java or Python SELECT, UPDATE or DELETE whose only WHERE condition is a key column compared with a request-supplied value, with no ownership condition in the query and no ownership check nearby.

Reports C, C++, Go and Java comparisons that can never be true: a size compared below zero, an unsigned variable compared below zero, one operand equal to two different constants, and an empty numeric range.

Reports C, C++, Go and Java comparisons that always hold: a size compared >= 0, an unsigned variable compared >= 0, x != A || x != B, two ranges covering every value, and an operand compared with itself (other than the NaN tests x != x and a float v == v).

Reports a Java or Kotlin Thread whose run() is called directly, so the work runs synchronously on the calling thread instead of on a new one.

Reports Java and Kotlin reads of a remote URL through openStream(), readText(), IOUtils/Resources helpers, ImageIO.read(url) or two-argument copyURLToFile, none of which can set a connect or read timeout.

Reports an Enterprise JavaBean that obtains, creates, replaces or defines classes with a class loader, which the EJB specification forbids.

Reports a public or protected clone() in a non-final Java class that builds its copy itself instead of starting from super.clone(), so subclasses receive an object of the wrong class.

Reports a Java or Kotlin class that overrides equals(Object) without hashCode(), or hashCode() without equals(Object), judged per class including nested classes.

Reports public static final array fields and interface array constants in Java and public static readonly arrays in C#, whose elements any code can overwrite. Zero-length arrays, non-public fields, collections and test files are not reported.

Reports Java overrides of Object.finalize() declared public and Kotlin member finalize() functions left at the default public visibility. Protected finalizers, overloads with parameters, calls and test files are not reported.

Reports a return statement inside a finally block in Java, JavaScript/TypeScript and Python, which discards any exception from the try block. Returns inside lambdas, callbacks or nested functions in the block are not reported.

Reports synchronized (lock) blocks in Java and Kotlin that contain no code. Blocks with statements and synchronized methods are not reported.

Reports explicit Java calls to finalize() on any receiver or as a bare statement. super.finalize() inside a finalizer, declarations, overloads with arguments and test files are not reported.

Reports an integer literal of 0x1000 or above cast to a pointer and assigned, returned or bound by #define in C and C++. Null and sentinel values, poison patterns, integer casts, comparisons and test files are not reported.

Reports the address of a scalar variable cast to a structure pointer in C and C++. Casts of structures (the sockaddr idiom), arrays and pointer values are not reported.

Reports calls to C library functions that exist only on some platforms (Annex K *_s functions, Microsoft-only names, BSD and GNU extensions) in files with no platform guard. Guarded files, platform-specific paths and project-provided implementations are not reported.

A fixed file name in a shared temporary directory is written or chmod'ed without O_EXCL/O_NOFOLLOW, a path is checked with access()/lstat() and then opened by name, or os.Readlink is given a request or command-line path.

Reports Java code that copies a password returned as char[] (Console.readPassword, JPasswordField/PasswordCallback/KeyStore.PasswordProtection getPassword) into an immutable String, or reads JPasswordField.getText(), so the secret can no longer be wiped from memory.

Reports a JPA @Entity, @Embeddable or @MappedSuperclass, or a CDI @SessionScoped or @ConversationScoped bean, whose class declaration neither implements Serializable or Externalizable nor extends another class.

Reports Java == and != between two variables declared as boxed numbers or value objects (Integer, Long, BigDecimal, UUID, Date...), and comparisons of an object with a freshly constructed wrapper or a boxed valueOf(), which compare references instead of values.

Reports Java comparisons of a String with a string literal or with another String variable by == or !=, and C comparisons of a char pointer with a string literal, which compare references or addresses rather than content.

Reports URLs that carry an interpolated password, API key, client secret or token as a query parameter (including ?key= given a variable named for an API key), request helpers given such a key in their params object, and HTML forms that submit a password field by GET.

Reports servlet handlers and JSP scriptlets that convert a request parameter or header into a number, decimal, UUID or date outside any try block, so a malformed value throws out of the servlet.

Reports server code (Express/Koa, Django/Flask, PHP) that bases an authorisation decision on a role or admin flag taken from the request body, query, URL parameters, headers or unsigned cookies.

Reports browser JavaScript that decides authentication itself: a literal login or role flag written to localStorage, sessionStorage or document.cookie, such a flag read back to gate the page, or a password or PIN compared with a string literal.

Reports SO_REUSEPORT set with setsockopt (C/C++, Python), SetsockoptInt (Go) or reuse_port=True (Python asyncio), and SO_REUSEADDR in Winsock code that never sets SO_EXCLUSIVEADDRUSE: options that let a second socket bind the same port.

Reports a counted or count-down loop (C/C++, Java, Go) whose bound is a number parsed from argv, getenv, scanf, a request parameter or header, with no upper limit checked or clamped before the loop.

Reports a Java public static final field (or interface constant) initialised with a mutable collection, Date, SimpleDateFormat, StringBuilder, Arrays.asList, EnumSet or a Guava Lists/Maps/Sets.newXxx call, whose contents any code can change.

Reports Java double-checked lazy initialisation (check, synchronized, same check) on a field of the same file that is not declared volatile.

Reports Java XML parser calls that explicitly enable external references: external entities or DTDs on, disallow-doctype-decl or secure processing off, ACCESS_EXTERNAL_* opened, or XInclude on.

Reports session, token and auth cookies sent without Secure: Django/Flask *_COOKIE_SECURE = False, set_cookie without secure=True, res.cookie, reply.setCookie or cookie.serialize without secure: true, secure: false in cookie options, document.cookie without ; Secure, Java cookies and Spring ResponseCookie without setSecure/secure(true), and server.servlet.session.cookie.secure=false.

Reports a comment (whole-line, block or trailing) in Go, Java, JavaScript/TypeScript or Python that records a credential value (password, secret, API key, token) rather than describing one.

Reports a Python assert in application code that validates request data or enforces an access decision; a caller can trigger AssertionError and python -O removes the check.

Reports ActiveX controls marked safe for scripting or initialisation (IObjectSafety, CATID_SafeForScripting, .rgs category GUIDs) and pages that instantiate command- or file-capable ActiveX objects.

Reports a Python DB-API cursor opened in a function and never closed, used as a context manager, returned, or released with its connection.

Reports a change-password handler (Python, JavaScript/TypeScript, Java, C#) that writes the new password from the request without first verifying the user's current password.

Reports PHP code that turns request data into local variables: extract() on superglobals or request arrays, single-argument parse_str(), import_request_variables() and $$key assignments over a superglobal.

Reports a JSONP endpoint that writes a client-supplied callback name into a script response without validating it.

Reports regular-expression replacements evaluated as code (PHP preg_replace /e, mb_ereg_replace 'e', Perl s///ee) and PHP preg_replace patterns taken from the request.

Reports host and URL allow-list regular expressions with an unescaped dot in the host name, no end anchor after the domain, or a domain-only pattern with no start anchor.

Reports PHP and Java file paths built from request input with a fixed extension appended, where a NUL byte can truncate the path and drop the suffix.

Detects a program variable whose name comes from the request: Python globals()/locals()/vars() indexed or updated with request data, Ruby instance_variable_set/get with params in the name, PHP variable variables named by a superglobal, and JavaScript global[...] or window[...] indexed by req input.

Detects C and C++ calls whose arguments are wrong on the call line: memset with value and length transposed, printf-family calls whose literal format does not match the argument count, and open()/openat() with O_CREAT but no mode.

Detects TODO, FIXME, XXX and HACK comments whose text admits an unresolved security gap (missing authentication, CSRF protection, validation or escaping, disabled TLS verification, a hard-coded secret, code called insecure or vulnerable) in Go, Java, Kotlin, JavaScript/TypeScript, PHP, Python and Ruby.

Detects access checks that grant access when they fail: an except/catch handler in an auth, permission, verify, token or policy function that returns true, calls next() without the error, or swallows the exception and falls through to return true. Java, JavaScript/TypeScript and Python.

Detects authorization decisions that are memoised without expiry: Python @lru_cache/@cache, Spring @Cacheable and JavaScript memoize() on functions such as has_permission, isAdmin, canEdit or getUserRoles, so a revoked permission keeps being granted.

Detects insecure direct object references: an ORM or repository lookup by an id taken from the request (req.params, request.GET, Rails params, @PathVariable) with no owner or authorization check nearby, and owner keys such as UserId filled from the request body. Java, JavaScript/TypeScript, Python and Ruby.

Detects weak forgotten-password flows: reset tokens, OTPs and temporary passwords from a non-cryptographic source (random, Math.random, java.util.Random, time), reset links built from the Host header, and resets decided by a security question. JavaScript/TypeScript, Python and Java.

Detects upload file names classified by something other than their final extension: the extension taken from the first dot (split('.')[1], indexOf('.'), explode('.')[1]) or an allowlist tested as a substring ('.png' in name, includes('.jpg'), contains(".pdf"), unanchored regexes), so shell.php.jpg passes. Java, JavaScript/TypeScript, Python and PHP.

Reports a plain (unsigned) cookie whose name is a privilege flag or role, such as isAdmin, role or access_level, being set or read back in JavaScript/TypeScript, Python, Java or Kotlin. Signed cookies and server-side sessions are not reported.

Reports an XPath query that is built by concatenation, formatting or an f-string and then compiled or evaluated (Java javax.xml.xpath and dom4j; Python lxml, elementpath and ElementTree; a Python expression assembled in an `io.StringIO` with `write()` counts as built). Parameterised queries, constant expressions and operands the enclosing method proves constant are not reported.

Reports a response header (Flask/Django headers, Express/Fastify setHeader/set/header/append, Node writeHead, Koa ctx.set) whose value is a request value, directly or through a variable, with no encoder or sanitiser. Constant and encoded values are not reported.

Reports login code that locks or disables an account once a failed-attempt counter reaches a threshold, in a file that gives the lock no expiry, and django-axes AXES_COOLOFF_TIME = None. Locks with an expiry and administrator deactivation are not reported.

Reports upload handlers (multer, formidable, express-fileupload, Flask/Werkzeug, FastAPI, Django request.FILES and FileExtensionValidator) that decide on a file from the extension of the name the client sent, in a file that never inspects the content.

Reports an access-control check that compares the raw request path or URL (getRequestURI or Kotlin requestURI, req.path/url/originalUrl, request.path) with a '/...' literal or a regex test anchored on '/' and then denies or allows access, in Java, Kotlin, JavaScript/TypeScript and Python. Normalised paths and route registration are not reported.

Reports a setuid/seteuid/setreuid/setresuid drop followed by a setgid/setgroups call (wrong order), and a drop to another user in a file that never calls setgroups or initgroups, in C, C++ and Python. Raising to root and drops back to getuid() are not reported.

Reports a request value (cookie, header, query or body field) that is base64/hex-decoded and parsed, or decrypted with AES in CBC/ECB/CTR mode, in a Python or JavaScript/TypeScript file with no MAC, signature or authenticated-encryption check.

Reports a WSDL or XSD that publishes a credential value, a credentialed endpoint address or a debug/internal operation, and JAX-WS, spyne and WCF service methods with such names that end up in the generated WSDL.

Reports a Java XQuery (XQJ, Saxon, BaseX, eXist/XML:DB, MarkLogic XCC) query built by concatenation or formatting of a non-constant value and passed to the engine.

Reports Python exec/eval of non-literal code with a stripped __builtins__ used as a sandbox, and Electron webPreferences that turn renderer isolation off (contextIsolation: false, nodeIntegration: true, sandbox: false).

Reports an if/elif that grants access (next(), login, a session admin flag, return True) because the client address or a Referer/X-Forwarded-For/X-Real-IP header matched, with no authenticated identity in the condition.

Reports a hidden request parameter, header or cookie compared to a hard-coded value whose branch grants access, or whose name is itself a privilege (admin, role, backdoor, bypass).

Reports a TODO/FIXME/XXX/HACK comment in Python or JavaScript/TypeScript production code that records a missing, disabled or bypassed security control.

An uploaded file is stored under the name the client sent, so a name such as CON, NUL, AUX, COM1 or LPT1 opens a Windows device instead of a file. Stripping directories with basename or GetFileName does not prevent it.

Reports Java static fields of non-thread-safe types (SimpleDateFormat, DecimalFormat, MessageDigest, Cipher, Mac, Matcher...) and C/C++ calls to static-buffer libc functions (strtok, localtime, gmtime, getpwuid, gethostbyname...) in files that start threads.

Reports a catch clause inside a Java static initializer whose body is empty or only prints, logs or prints the stack trace, leaving the class loaded with partly initialised static state.

Reports an Express, Koa-style or Fastify handler that sends a response without returning, so the next statement (or the first one after the if-block, or after a braceless one-line `if`) writes to the same response again. Node.js and TypeScript.

Reports Java synchronized blocks on interned Strings or boxed values, and Lock.lock() calls with no finally block that unlocks the same lock.

Reports Python and Node.js code that unconditionally sets OAUTHLIB_INSECURE_TRANSPORT, GIT_SSL_NO_VERIFY, PYTHONHTTPSVERIFY=0, NODE_TLS_REJECT_UNAUTHORIZED=0 or an empty CURL_CA_BUNDLE/REQUESTS_CA_BUNDLE in its own environment.

Reports Python and Node.js code that reads, writes, queries or sends on a file, socket, stream, descriptor or database connection after closing or releasing it in the same block, including use of a file after its with-block ends.

Reports Python code where HTTP request or socket data reaches os.chroot(), sys.path, site.addsitedir() or PATH/PYTHONPATH/LD_LIBRARY_PATH/LD_PRELOAD, letting a remote party define what the process trusts.

Reports accessors and methods that call themselves unconditionally with the same arguments (Python, JavaScript/TypeScript, Java), and Python sys.setrecursionlimit() raised to 50000 or more.

Reports C and C++ code that closes the same FILE*, descriptor or DIR* twice, locks a pthread mutex again before unlocking it, or unlocks it twice, in straight-line code.

Reports C and C++ calls to gets(), and to strcpy/strcat/sprintf/vsprintf/scanf-family functions in the forms that can overflow their destination: a non-constant unmeasured source, a %s without precision, a %s or %[ without width.

Detects C and C++ allocations whose size multiplies a count parsed or received from outside the program, with no overflow or range check between the read and the allocation.

Detects lengths, sizes and file offsets narrowed to a type too small to hold them: C/C++ 8- and 16-bit variables or casts from strlen, read or ftell, int from ftell/lseek, and Java int/short casts of long sizes and times.

Detects calculations that are wrong for every input: integer division or remainder by a literal zero in C, C++ and Java, and Java Math.abs() of a hash or unbounded random value, which can stay negative.

Detects C and C++ calls with visibly swapped arguments: memset value and length transposed, copies whose destination is named like the source and the source like the destination, and stdio calls given the stream first.

Detects C and C++ printf- and scanf-family calls whose literal format asks for a different number of arguments than are passed, and open()/openat() with O_CREAT but no mode.

Detects C and C++ printf- and scanf-family calls whose argument type visibly mismatches its conversion: size_t to %d, non-strings to %s, std::string without .c_str(), and scanf targets passed by value.

Detects calls given a wrong argument value: strncat bounded by the whole buffer, strncpy bounded by strlen of its source, sizes of sizeof(buf) + N, invalid fopen modes, and file permissions written in decimal instead of octal (C, C++, Python, Go, PHP, JavaScript, TypeScript, Ruby).

Detects C and C++ bounded writes whose size is sizeof a different array than the destination they write, such as snprintf(name, sizeof(path), ...) or read(fd, header, sizeof(body)).

Reports the result of malloc, calloc, realloc, strdup, strndup, fopen or getenv dereferenced (p->f, p[i], *p, or passed to strcpy, memset, fprintf, strlen, atoi and similar) before any NULL test, including getenv() passed straight to such a call or used to construct a std::string.

Reports a Flask/FastAPI route decorator or a Django path()/re_path()/url() entry that repeats a route already registered in the same file, so only one of the two handlers is ever dispatched.

Reports an EJB (@Stateless, @Stateful, @Singleton, @MessageDriven or a SessionBean/EntityBean/MessageDrivenBean) that creates threads, listens on sockets, uses java.io file streams, loads native code, synchronizes, calls System.exit, or replaces the standard streams, security manager or a class loader, all of which the EJB specification reserves to the container.

Reports Java comparisons that cannot mean what they say: compareTo()/compare() tested with == or != against 1 or -1, x.equals(null), and == or != against Double.NaN or Float.NaN.

Reports a PHP header('Location: ...') or wp_redirect() not followed by exit/die/return/throw, and a Laravel, Flask, Django or Starlette redirect built as a bare statement and never returned, so the handler keeps executing after the redirect.

Reports Java Optional values unwrapped with get()/getAsInt()/getAsLong()/getAsDouble() without a presence check: findById(...).get() and other Spring Data finders such as findByUsername(...).get(), findFirst().get(), stream max/min(...).get(), OptionalInt max().getAsInt(), and an Optional (or var assigned from a finder) whose get() is not preceded by isPresent()/isEmpty().

Reports Java casts to int, short, char or byte of a long file or content size (File.length(), Files.size(), FileChannel.size(), getContentLengthLong(), HttpEntity.getContentLength(), MultipartFile/ZipEntry getSize(), getFilePointer()), directly or through a long variable that is not bounds-checked first.

Reports Python containment checks that compare characters instead of path components: os.path.commonprefix(...) compared with == or !=, and startswith() on a realpath/abspath/normpath/resolve() path against a base directory with no trailing separator.

Reports chown(), lchown(), fchown() and fchownat() calls in C and C++ whose path, uid or gid comes from the command line or the environment, directly or through one or two assignments a few lines above, unless a condition validates the value first.

Reports C and C++ source that disables a compiler warning built to catch memory-safety or format-string defects: MSVC C4996/C4789/C6386 and similar, GCC/clang -Wformat-security, -Wstringop-overflow, -Warray-bounds and similar, and _CRT_SECURE_NO_WARNINGS.

The path argument of a Python or PHP file-system call (open, send_file, os.remove, include, file_get_contents...) comes from the HTTP request, directly or through a variable assigned from it. Java path traversal is reported by VNX-JAVA-009 and Node.js path traversal by VNX-NODE-010.

Reports Python chmod calls (including the chmod command run through os.system or subprocess) that make a file world-writable, os.umask() values that leave others-write unmasked, and chmod of key or credential files to a mode that others can read.

Reports C and C++ code the optimiser may delete: a memset/bzero of a secret buffer that nothing reads before it is freed or goes out of scope, and pointer-wraparound checks (p + n < p) on pointers, which are undefined behaviour.

Reports dangerous operations (commands, file writes and deletes, reflection, SQL, SMS, component launches, device identifiers) performed inside Android @JavascriptInterface methods, which any script in the WebView can call.

Reports Java getResourceAsStream()/getResource() results, which are null when the resource is missing, that are dereferenced or handed to a consumer such as Properties.load() before any null check.

Reports Java catch blocks that drop an InterruptedException without restoring the interrupt, rethrowing or leaving the work, and catch blocks that handle a JVM Error (OutOfMemoryError, StackOverflowError, ...) without rethrowing or ending the process.

Reports Python web applications configured to answer unhandled exceptions with the framework's debug traceback page: FastAPI/Starlette debug=True, Tornado debug/serve_traceback, Bottle debug, CherryPy show_tracebacks, Sanic/Quart run(debug=True) and web.py debugerror.

Reports TLS configuration that lets peers negotiate SSL 2/3, TLS 1.0 or TLS 1.1, or offers an RC4, DES, NULL, EXPORT or anonymous cipher suite, in Go, Java and Python.

A password is passed straight into a fast general-purpose digest with no salt, so equal passwords get equal hashes and a precomputed table recovers them. Reported, when the hashed argument names a password (password, passwd, passphrase, pwd, pw, $pass, $pass_new, getPassword(), a subscript or .get() keyed by a password field such as form["new_password"] or request.json.get("password")) or a variable assigned from one a few lines above: Python hashlib.md5/sha1/sha224/sha256/sha384/sha512/sha3_*/blake2*/new(...) (also from-imported) and <hashlib object>.update(password); Java MessageDigest <md>.digest(password...)/<md>.update(password...) and MessageDigest.getInstance(...).digest(password...), commons-codec DigestUtils.md5Hex/sha1Hex/sha256Hex/... and Guava Hashing.md5()/sha1()/sha256()/sha512().hashString/hashBytes; PHP md5()/sha1()/crc32()/hash('<alg>', ...); Node crypto.createHash(...).update(password) on one line, as a chained call split over lines, or through a variable (const h = crypto.createHash(...); h.update(password)). A call argument split onto the next line is followed. Not reported: an argument or a neighbouring update() that mixes in a salt or pepper, password KDFs (pbkdf2_hmac, scrypt, bcrypt, argon2, PBEKeySpec, password_hash, scryptSync), HMAC, digests of tokens, nonces, password-reset values, file contents or other non-password data, string literals and comments. Weak iteration counts and broken algorithms are other rules (VNX-CRYPTO-007, VNX-327). A password passed straight into a fast digest call (md5($pass), hashlib.sha256(password.encode()), createHash('sha256').update(password), DigestUtils.sha256Hex(password)) is reported by VNX-CRYPTO-007, a password hashed with a fast hash, whose fix (a salted password KDF) is this rule's fix too; this rule keeps the shapes that rule does not read, such as a password reached through a variable, a subscript or a hasher fed on a later line.

A dangerous multi-character sequence (an HTML tag other than script, vbscript:, &&, $(, a SQL or script keyword) is neutralised by deleting it once, so input that rebuilds it after the deletion passes through. Traversal, script-tag and javascript: removals are reported by VNX-182.

Reports a password hash or KDF salted with a literal constant, a salt-named constant that reaches the hash call, a fixed bcrypt salt, or the user's own username or email, in Go, Java, JavaScript/TypeScript and Python.

Reports free() of an offset pointer (p + n, &buf[i], ++p) and of a heap pointer that was advanced after allocation without being moved back, in C and C++.

Reports memory released by a routine that does not match its allocator: new[] with free or delete, new with free or delete[], malloc memory with delete, alloca memory with free, and unique_ptr<T> owning new T[n], in C and C++.

Reports free() or delete of an address that never came from the heap: the address of a variable, a stack or file-scope array, or a string literal, in C and C++.

Reports a Go mutex or Java lock acquired a second time in the same or a nested block while the first acquisition is still held: Go Lock/RLock twice (deadlock), Java ReentrantLock lock() twice and read-to-write lock upgrade.

Reports a Go mutex or Java lock released a second time without being re-acquired: two unlocks in one block, an unlock in a try block repeated in its finally, and a Go explicit Unlock in a function that already defers it.

Reports Java fields declared public that hold secret material: non-final public password, secret, API key, private key, token or credential fields of a string-like type, public PrivateKey/SecretKey/KeyPair/KeyStore fields, and public final char[]/byte[] secrets.

Reports public no-argument Java methods that return a private key or secret field as is: PrivateKey/SecretKey/KeyPair/KeyStore fields, char[]/byte[] password or key buffers, and String secret or API key fields.

Reports Java and C# null guards joined to a dereference of the same variable by the non-short-circuit operators & and |, as in x != null & x.m(), which still dereferences x when it is null.

Reports Python loops and comprehensions that open a new file or socket handle per element and keep it open, which exhausts the process's descriptor limit on large input.

Reports configuration that disables or removes a framework limit on what one request can make the server allocate: Django upload limits set to None, Flask MAX_CONTENT_LENGTH None, Flask-Limiter disabled, sys.set_int_max_str_digits(0), unbounded express, body-parser, koa-body or koa-bodyparser limits, multer without limits, and a huge socket.io maxHttpBufferSize.

Reports C and C++ code that loses the only pointer to memory it still owns: p = realloc(p, n), and a pointer given a fresh allocation while its previous block was neither freed nor handed off.

Reports Java methods that acquire a socket, file stream, JDBC connection or Files stream into a local variable outside try-with-resources and never close, return or hand it off, and file streams created inline for a consumer that does not close them.

Reports Python functions that assign a file or socket handle to a local name and never close it, return it or hand it off in that function.

Untrusted XML parsed by Python standard-library parsers or xmltodict, and libxml2 expansion limits switched off (lxml huge_tree, LIBXML_PARSEHUGE, libxmljs huge).

Allow-list validation regexes anchored at only one end, or bounded by a length and anchored at neither, tested with a search-semantics API; Ruby ^/$ line anchors in validation.

Production code or configuration that switches logging or the audit trail off outright: logging.disable(), root or audit loggers at OFF, silent winston/pino loggers, console methods replaced, CloudTrail enable_logging = false.

Root logging at DEBUG/TRACE/ALL, wire-level HTTP or SQL-parameter logging, and whole-environment dumps in production code and configuration.

RSA encryption or decryption with PKCS#1 v1.5 or no padding in Java, Kotlin, Python, Node.js, Go, PHP, Ruby and C#.

Windows driver reads of a METHOD_NEITHER Type3InputBuffer, Irp->UserBuffer or KMDF unsafe user buffer with no ProbeForRead, ProbeForWrite, MmProbeAndLockPages or WdfRequestProbeAndLock call nearby.

Unparenthesised expressions whose precedence differs from their evident intent: assignment of a compared call, x & MASK == 0, x << 8 + y, !x === y, "a" + flag ? x : y, a + b ?? 0.

Role, admin or login-state cookies read through unsigned cookie APIs and used in a comparison or condition.

C/C++ getwd(), realpath() into an array smaller than PATH_MAX, and PathCanonicalize/PathCombine/PathAppend into an array smaller than MAX_PATH.

C/C++ indexing with strlen()-1 or a read()/recv() result that is never checked, and literal negative indexes on declared arrays.

C/C++ off-by-one accesses: X[sizeof(X)], X[N] on an array declared X[N], loops bounded by i <= N, and a full-size read() followed by X[n] = 0.

C/C++ malloc/calloc/realloc/alloca/new[] sized by a number parsed from input (atoi, strtol, scanf, ntohl, std::stoi) with no upper bound checked first.

Single-pass deletion of script tags, javascript: schemes, ../ sequences or shell metacharacters with replace()/re.sub()/replaceAll() in Python and JavaScript.

HTML escaping or script stripping that replaces only the first occurrence: JavaScript replace() with a string or non-global regex, Python replace(..., 1).

Path, command and header sanitising that replaces only the first ../, .., shell metacharacter or CR/LF: JavaScript replace() with a string or non-global regex, Python replace(..., 1).

Path or command sanitising that strips special elements only at the start or end: strip('./'), lstrip('../'), _.trimStart(s, './'), re.sub(r'^(\.\./)+', '', p).

Reports the registration of a credential-checking HTTP route (a path segment login, log-in, signin, sign-in, logon, token, otp, verify-otp, 2fa, mfa, authenticate, reset-password, forgot-password or password-reset, or a segment ending in login/signin/logon such as devlogin or admin-login) that accepts POST: Express/Koa-style routers (app/router/server/fastify .post/.all, including an array of paths and a Koa named route), a chained router.route('/login').post(...), a hapi or fastify route object (server.route({ method: 'POST', path: '/login' })), NestJS @Post/@All, Flask @app.route(..., methods=[...POST...]) and @bp.post, FastAPI @app.post/@router.post, and Django path()/re_path() in urls.py. It is reported only when nothing limits how often it can be tried: no limiter, brute-force or throttle middleware on the route itself (loginLimiter, brute.prevent, @limiter.limit, @Throttle, RateLimiter dependency, a django-ratelimit @ratelimit decorator on the view the urls.py entry names), no app-wide limiter in the project (app.use(limiter|rateLimit(...)), koa-ratelimit, @fastify/rate-limit, rate-limiter-flexible, NestJS ThrottlerGuard, flask-limiter or slowapi default_limits, django-axes, django-ratelimit middleware), no path-scoped app.use('<prefix>', rateLimit(...)) covering the route, and no account-lockout bookkeeping (failedLoginAttempts, lockedUntil, lockout). Not reported: GET-only routes, other paths, commented or quoted routes, client calls (axios.post, api.post), test and example files. A limiter enforced by a reverse proxy or API gateway is invisible to this rule.

Reports home-grown CAPTCHA code in JavaScript/TypeScript and Python that an automated client can solve without solving the challenge: (1) the challenge text or digits come from a predictable generator (Math.random(), or random.choice/choices/randint/randrange/random/sample/getrandbits) on a line that names a captcha, inside a function or class whose name contains captcha, or in a file whose name contains captcha; (2) the expected answer is sent to the client: res.json/res.send/ctx.body/jsonify/JsonResponse with an answer or solution key (including the shorthand { answer }), with a captcha object's .text/.answer/.solution/.code, or with a variable built a few lines above as an object holding an answer/solution key or returned by svgCaptcha.create; (3) verification fails open, so a request naming an unknown CAPTCHA id passes: an accept condition `if (!stored || given === stored.answer)` / `if not stored or ...` / `if stored is None or ... == ...`, or a reject condition that only fires when the stored CAPTCHA exists, `if (stored && stored.answer !== given)` / `if stored is not None and stored.answer != given`. Not reported: fail-closed checks (`if (!stored || stored.answer !== given)` rejecting), crypto.randomInt/randomBytes, secrets, random.SystemRandom, randomness outside captcha code, responses that omit the answer (svgCaptcha's .data), answers stored server side, third-party services (reCAPTCHA, hCaptcha, Turnstile), comments and test files.

A C/C++ call writes into a byte buffer with a length that does not come from that buffer. Reported: (1) memcpy, memmove, memset, strncpy, read, recv, pread, fgets, snprintf, vsnprintf or fread (element size 1) into a char/unsigned char/uint8_t/u_char array declared with a numeric size (a literal or a #define of a literal) in the 80 lines above, either in the same function or at file scope, whose length is a larger number or #define, or sizeof() of another, larger array that is not the copy's source (that shape is VNX-806); (2) memcpy, memmove, memset, strncpy, read, recv or pread whose length is a conversion result: a network or text conversion (ntohs, ntohl, be16toh/be32toh/le16toh/le32toh, atoi, atol, atoll, strtol, strtoul, strtoll, strtoull, std::stoi/stol/stoul/stoull) written inline as the length, or a variable (optionally plus, minus or times a constant) assigned from one in the ten lines above, with no clamp on the assignment itself (MIN/min/clamp or a ternary), no comparison of that variable (<, >, MIN/min) between the conversion and the call, and no allocation of the destination sized by it. Not reported: lengths written as sizeof(dst), equal or smaller numeric lengths, non-byte arrays (an int[10] memset by 40 bytes is correct), an array declared in another function (a pointer parameter of the same name), counts whose size cannot be resolved in the file, and comments.

A C/C++ copy into a destination buffer is bounded by the size of the SOURCE instead of the destination, so a long source overruns the destination: memcpy, memmove, strncpy, strncat, strlcpy, strlcat, wcsncpy, wcsncat, wmemcpy or wmemmove whose count is strlen(src), wcslen(src) or sizeof(src) of the same expression passed as the source (optionally + 1), a variable assigned from one of those in the ten lines above, or, for a C++ string, s.size()/s.length() with s.c_str()/s.data() as the source. Calls broken across up to three lines are read whole. Not reported: a destination allocated in the twelve lines above (malloc/calloc/realloc/alloca/strdup/new[]/kmalloc, sized from the source), a destination that is itself a container's buffer (v.data(), &s[0]), a length compared with something (a <, >, <= or >= on strlen(src), the length variable or sizeof(dst)) in the twelve lines above or on the call line, a count wrapped in MIN/min, a string-literal or address-of (&x) source, calls spelled inside string literals, and comments. Reading from a source pointer, an unknown destination capacity and cross-function flows are out of scope.

Reports an authorization decision taken on a value the client sends and can set to anything: an if/elif/else-if/switch condition, or a boolean assignment with a comparison, that reads a cookie, request header, query, body or path parameter (Express req.cookies/headers/query/body/params, with optional chaining, req.get()/req.header(); Flask/Django request.cookies/COOKIES/headers/META/args/GET/POST/form/values; Java request.getParameter/getHeader on any request or req variable, a Cookie from getCookies() compared by getName()/getValue(), Spring @RequestHeader/@CookieValue/@RequestParam parameters; FastAPI Header()/Cookie()/Query() parameters) where the input's name says what it decides (admin, role, root, superuser, staff, privilege, permission, access level, authenticated, authorized, logged-in) or it is compared with a privileged literal ('admin', 'administrator', 'root', 'superuser', 'staff', 'owner', 'moderator', 'auditor'). The value may be read on the same line, assigned to a variable up to 15 lines above, or destructured from the request object (const { role } = req.cookies). Not reported: server-side state (req.session, req.signedCookies, req.user, request.user, request.getSession(), isUserInRole), a condition that also consults server-side identity (req.body.role === 'admin' && !req.user.isAdmin, which guards against escalation), inputs that decide nothing privileged (theme, language, a non-empty check), logging or passing the value on without a decision, Referer/User-Agent checks, credential comparisons, string literals, comments and test files. A cookie named for a privilege or login state and decided on where it is read is reported by VNX-784 instead.

A Java object that one instance serves every request thread (a class extending HttpServlet/GenericServlet/HttpFilter, a servlet filter extending OncePerRequestFilter/GenericFilterBean or implementing javax/jakarta Filter, a Servlet or HandlerInterceptor implementation, or a Spring @RestController/@Controller/@Service/@Component/@Repository singleton) keeps mutable state in a field and a request-handling method writes it with no synchronization: an assignment, compound assignment or ++/-- of a non-final, non-volatile field, or a mutating call (put, add, remove, clear, merge, compute*, append...) on a field holding a HashMap, ArrayList, HashSet, LinkedList, TreeMap, LinkedHashMap, ArrayDeque or StringBuilder, declared with that type or declared final as a Map/List/Set and given one in a constructor. Concurrent requests then race on it (lost updates, corrupted collections, one user's data shown to another). Not reported: writes inside a synchronized method or synchronized block, writes while an explicit Lock taken in the method (lock()/writeLock().lock()) is still held, Atomic*, Concurrent*, CopyOnWrite*, ThreadLocal, Collections.synchronized* and volatile fields, injected fields (@Autowired/@Inject/@Value/@Resource), writes in constructors, static initialisers, init()/afterPropertiesSet()/@PostConstruct methods and setters, locals and parameters that shadow the field, classes that are not shared (entities, DTOs), beans scoped prototype/request/session, test files and comments.

Java code synchronizes, but on a monitor that does not give the intended mutual exclusion. Reported: synchronized (new X()) (a fresh lock each call, so nothing is excluded); synchronized on a local variable assigned new ... in the same method; synchronized (Thread.currentThread()) (each thread locks itself); synchronized on a string literal, Boolean.TRUE/FALSE, Integer/Long/String.valueOf or .intern(), or a String/Integer/Long/Short/Byte/Boolean/Character field or variable, final or not (interned and cached values are shared with unrelated code); synchronized (getClass()) (a subclass instance locks a different Class object); synchronized on a java.util.concurrent Lock/ReentrantLock/ReadWriteLock/StampedLock/Semaphore object, field or local (its intrinsic monitor is unrelated to lock()/unlock()); synchronized on a non-final field that a method other than a constructor reassigns (threads end up holding different monitors); and a write to a static non-final field inside a non-static synchronized method, which locks the instance while the data is shared by every instance. Not reported: synchronized (this), on a final Object or collection field, on X.class, on a non-final field assigned only in a constructor, on a local obtained from a shared map or a lock-stripe array, static synchronized methods, a static write inside a synchronized (X.class) block, comments and strings.

A C/C++ pointer is built from data an attacker controls, so dereferencing it reads or writes an attacker-chosen address. Reported: (1) a cast to a pointer type (C-style, including function-pointer casts and (T *)(uintptr_t), or reinterpret_cast<T *>) applied directly to a text-to-integer conversion (strtoul, strtoull, strtol, strtoll, atoi, atol, atoll, std::stoul/stoull/stol/stoll/stoi); (2) the same cast, possibly through an integer cast ((T *)(uintptr_t)v) and including a dereferenced store (*(T *)v = x), applied to a variable assigned from such a conversion or filled by sscanf/fscanf/scanf (any conversion, such as %lx or SCNxPTR) in the ten lines above; (3) sscanf/fscanf/scanf reading a %p conversion; (4) a pointer read out of a buffer received from recv, recvfrom, read or fread in the 30 lines above through a pointer-to-pointer cast (*(T **)(buf + n)); (5) in a Linux ioctl handler (a function taking struct file * and unsigned long arg, the signature possibly spread over three lines), arg cast to a pointer type without __user, which dereferences a user-space address directly instead of copying it with copy_from_user. Not reported: integer conversions that stay integers, (void __user *)arg, an integer passed through a void * to pthread_create/thrd_create/g_idle_add-style callbacks, thread or callback arguments cast back to their context type, pointers to a validated table entry (&table[idx]), printf %p, and comments.

Reports C and C++ pointer offsets and indexes that are out of range by construction: an array indexed at its own size or element count, a non-byte pointer offset by a sizeof value (scaled twice), and a <= loop bound at an array's size that indexes the same array.

Reports a C or C++ local pointer declared without an initialiser whose first mention in the function dereferences it (*p, p->f, p[i], strcpy(p, ...), memset(p, ...), delete p) before anything stores an address in it.

Reports C and C++ pointers, references and iterators kept past the lifetime of their target: a local's address stored through an out-parameter, in a global or in a field of a pointer parameter, a pointer to a block-scoped local used after the block, and C++ iterators or references used after the container may have reallocated.

Reports a C or C++ file, descriptor, directory, SQLite connection or Windows handle that is closed while the code below still uses it (fclose then fprintf, close then recv, closedir then readdir, sqlite3_close then sqlite3_errmsg, CloseHandle then WriteFile).

Reports XML parser settings that explicitly turn on DOCTYPE/DTD processing in Java, C#, Python (lxml), PHP (libxml, XMLReader) and Ruby (Nokogiri, libxml-ruby), letting a document declare its own entities or pull an external DTD.

Reports each line of a C or C++ signal handler that calls a function outside the POSIX async-signal-safe list (stdio, the heap, syslog, exit, localtime, pthread locking, std::cout, new/delete), directly or through a helper defined in the same file.

Reports the registration lines that install one C or C++ signal handler for two or more signals when the handler does non-reentrant work (unsafe calls, directly or through a same-file helper) and no sa_mask blocks the other signals while it runs.

Reports a lock release that runs on a path where the lock may not be held: Java unlock() after a discarded tryLock(), in a finally whose try acquires with lockInterruptibly()/tryLock(), or of a lock the file never acquires; Python release() after a discarded non-blocking acquire(); pthread unlock after a discarded trylock; C++ std::mutex unlock() after a discarded try_lock().

Detects lock-order inversion in Java: one path takes lock A then B while another path in the same file takes B then A, through nested synchronized blocks, synchronized instance methods or explicit lock() calls.

Detects while loops whose condition compares a variable with a bound when the body never changes either side and has no break, return or throw, so the loop can never end. Java, JavaScript/TypeScript and Python.

Detects pass-the-hash authentication: a stored password hash compared directly with a value from the request, without hashing a password on the server. Python, Java and JavaScript/TypeScript.

Detects Stripe calls that move money (charges, payment intents, refunds, transfers, payouts, top-ups) made without an idempotency key, so a retried or double-submitted request performs the action twice. Python and JavaScript/TypeScript.

Detects values encoded for the wrong output context: URL encoding (encodeURIComponent, urllib.parse.quote) used for HTML, and quote-less HTML escaping (html.escape(quote=False), cgi.escape) used inside an attribute value. JavaScript/TypeScript and Python.

Detects a signed integer from untrusted input that is checked only against a maximum and then used as an array or list index, so a negative value passes. Python, Java, C and C++.

Reports a monetary value read from the HTTP request (amount, price, total, discount, cost, fee, balance) used as the amount charged, an order total or discount, or an account balance change, in JavaScript/TypeScript and Python.

Reports workflow state decided by the client: a status, paid, approved or verified field set from a request value, or an if that advances the workflow because a request parameter says so, in Java, JavaScript/TypeScript and Python.

A user's role, group or privilege flag is taken from the request, a user model defaults its role or admin flag to an administrative value, or a sign-up function puts the new account into an administrative group (Python, JavaScript/TypeScript).

A generic socket address is cast to a family-specific structure without checking its family, or a C++ base-class pointer or reference is downcast by static_cast, std::static_pointer_cast or a C cast without checking its dynamic type.

A Python route, Django view or Graphene resolver deletes records or serves an /admin path with no authorization decorator, dependency, in-handler check or project-wide guard.

Authorization decided by a client-sent header, cookie or privilege-named query value, a role checked as a substring, a Python assert used as the check, or a JavaScript if that assigns the role instead of comparing it.

A C or C++ local scalar, pointer or struct is read before it is assigned (or assigned only under an if with no else), or a stack char array or malloc/new[] buffer is used as a string before anything writes it.

A Java private object field that nothing in its class assigns and no framework annotation fills is dereferenced, so its first use throws NullPointerException.

An XML document is assembled as text with an HTTP request value spliced into a tag literal (concatenation, interpolation, format strings), in a file that works with XML, so the value can rewrite the document's structure.

A C or C++ file descriptor, socket or FILE stream is read, written, queried or closed again after close/fclose in the same function, with no reassignment or exit in between.

A Netty channelRead that neither releases nor forwards its message, a Java reference-count field updated with ++/-- outside synchronization, or a CPython extension that returns Py_None without Py_INCREF or releases a borrowed reference (including one PyArg_ParseTuple stored).

Reports a credential check that also accepts a hard-coded master password or token beside the real verification, or a built-in username and password pair compared to literals.

Detects HTTP request data naming a script, plugin or native library file that the process loads or executes, in Java, Python, Node.js and Go.

Reports Python setattr() whose attribute name comes from HTTP request data, so the client chooses which attribute it overwrites.

Reports mass assignment in JavaScript/TypeScript: the whole request body written onto a model (Object.assign, new Model, ORM create/update, Prisma data, MongoDB $set). Ruby mass assignment is reported by VNX-RUBY-006.

Reports an outbound HTTP request in Python whose URL or host comes from the incoming request, inline, interpolated or through a variable. JavaScript/TypeScript is VNX-NODE-009; a fetch whose response is relayed back is VNX-441.

Reports an Android WakeLock or WifiLock acquired with acquire() and no timeout, in Java and Kotlin.

Reports Java code that opens a plain TCP socket or listener to a non-loopback peer without TLS, so the bytes can be altered in transit.

Reports an Android BroadcastReceiver.onReceive that reads data from the intent without checking its action or sender, in Java and Kotlin.

Reports an <activity>, <activity-alias>, <service>, <receiver> or <provider> in AndroidManifest.xml that declares android:exported="true" and no android:permission (a provider without android:permission needs both android:readPermission and android:writePermission; with only one, its other side is open and it is reported): any app on the device can start, bind, broadcast to or query it (CWE-926). The finding is on the android:exported line, and the start tag may span several lines. Not reported: the launcher activity (an intent-filter with category LAUNCHER or LEANBACK_LAUNCHER, which must be exported), components that are not exported or protected by a permission, components of an <application> that declares android:permission (the default for every component), components the manifest merger removes (tools:node="remove"), commented-out elements (single-line or inside a multi-line comment), and XML files other than AndroidManifest.xml. Components exported implicitly by an intent-filter on old target SDKs are not reported, because the target SDK is not known from the manifest line.

Reports an Android broadcast that any installed app can receive (CWE-927) in Java and Kotlin: sendBroadcast(i), sendOrderedBroadcast(i, null[, resultReceiver, ...]) or sendBroadcastAsUser(i, user) with no receiver permission (the call's arguments may start on the next line), where i is built a few lines above as an implicit Intent (new Intent(), new Intent("action") or new Intent(ACTION_CONSTANT), Kotlin Intent(...)) and no setPackage/setComponent/setClass/setClassName (or package/component assignment) makes it explicit before the send; the same call with the implicit Intent built inline; and every sendStickyBroadcast/sendStickyOrderedBroadcast, whose extras any app can read back. Not reported: a broadcast with a permission argument, explicit Intents (new Intent(context, Receiver.class) or one given a package or component), LocalBroadcastManager sends, comments and strings. Intents built in another method or passed in as a parameter are not followed.

CWE-928 is the OWASP Top Ten 2013 view; this rule reports its most concrete Kotlin manifestation, a broken or obsolete symmetric cipher (A6 Sensitive Data Exposure). Java is reported by VNX-CRYPTO-004 (Broken or obsolete cipher, CWE-327), which reads the same JCA and Bouncy Castle forms, so a weak cipher in a .java file is one finding rather than two; this rule reads .kt files only. Reported in Kotlin: Cipher, SecretKeyFactory or KeyGenerator .getInstance with DES, DESede/TripleDES/3DES, RC4/ARCFOUR, RC2 or Blowfish (any mode and padding, the argument possibly on the next line) or a password-based scheme built on one (PBEWithMD5AndDES, PBEWithSHA1AndDESede, PBEWithSHAAnd40BitRC4), Bouncy Castle new DESEngine/DESedeEngine/RC4Engine/RC2Engine/BlowfishEngine(), the same algorithm passed through a String constant assigned in the same file, new SecretKeySpec(key, "DES"/"RC4"/...), and new DESKeySpec/DESedeKeySpec. Not reported: AES, ChaCha20 and RSA transformations, algorithm names in comments, log messages or other string literals not passed to a crypto API, and identifiers that only start with DES (DESCRIPTOR, DESIGN). A constant defined in another file is not followed.

CWE-929 is an OWASP Top Ten 2013 category with no code shape of its own; this rule reports the concrete Java/Kotlin signal it was generated for, a collision-broken digest: MessageDigest.getInstance("MD5"/"MD2"/"MD4"/"SHA-1"/"SHA1"/"SHA"), with the argument possibly on the next line, the same name passed through a String constant assigned in the same file or as commons-codec MessageDigestAlgorithms.MD2/MD5/SHA_1, Apache commons-codec DigestUtils.md5/md5Hex/sha1/sha1Hex/sha/shaHex/md2 (and getMd5Digest/getSha1Digest), Spring DigestUtils.md5Digest/md5DigestAsHex, and Guava Hashing.md5()/Hashing.sha1(). Not reported: SHA-2 and SHA-3 digests, algorithm names in comments and strings, and digests whose surrounding code names a non-security purpose (an ETag, checksum, CRC, cache key, fingerprint, de-duplication, a Gravatar URL or the RFC 6455 WebSocket accept key). In a .java file only MD2 and MD4 are reported here: an MD5 or SHA-1 digest in Java is reported by VNX-CRYPTO-001 (MD5) and VNX-CRYPTO-002 (SHA-1), or by VNX-327 when it protects a password or token, which read every Java shape this rule reads. Kotlin, which those rules do not read, keeps all four algorithms here.

HTTP request data placed into a CRLF-delimited mail header or protocol line (SMTP commands, raw headers, PHP mail() headers, email.mime headers) without removing CR/LF.

CWE-930 is an OWASP Top Ten 2013 category (broken authentication and session management) with no code shape of its own; this rule reports the concrete device-level authorization signal it was generated for: Java or Kotlin code that launches the su binary to run commands as root, through Runtime.getRuntime().exec("su"), exec("su -c ..."), exec(new String[]{"su", ...}) or exec(arrayOf("su", ...)), new ProcessBuilder("su", ...), ProcessBuilder(listOf/Arrays.asList("su", ...)) or processBuilder.command("su", ...), with su named bare or by an absolute path (/system/xbin/su, /su/bin/su) and the argument list possibly starting on the next line; a command array whose first element is su assigned a few lines before the exec; and the libsuperuser Shell.SU.run(...) and early libsu Shell.su(...) root-shell helpers. Whatever the root shell runs bypasses the Android permission model. Not reported: root detection (which su, ls /system/xbin/su, File("/system/xbin/su").exists(), Shell.SU.available(), Superuser.apk checks), non-root shells (Shell.SH.run), other commands, comments and strings, and test code (src/test, src/androidTest, *Test.java).

CWE-931 is an OWASP Top Ten 2013 category with no code shape of its own; this rule reports the concrete missing-authorization configuration it was generated for, in Java and Kotlin: Spring Security anyRequest().permitAll() and WebFlux anyExchange().permitAll() (also split across lines, and the Kotlin DSL authorize(anyRequest/anyExchange, permitAll)); a matcher (requestMatchers, antMatchers, mvcMatchers, regexMatchers, pathMatchers or the Kotlin authorize) for "/**", an admin, management or internal path segment at any depth (/admin/**, /api/admin/**, also inside new AntPathRequestMatcher(...)), the whole /actuator tree or EndpointRequest.toAnyEndpoint() directly followed by permitAll() (the matcher's arguments may span several lines); web.ignoring() on such a path, which takes it out of Spring Security altogether; and a JAX-RS/Jakarta @PermitAll on a method annotated @DELETE, @PUT or @PATCH. Not reported: permitAll on public paths (login, static assets, /actuator/health, and an admin area's own login page and assets such as /admin/login or /admin/css/**), a sensitive matcher that is given a role before a later permitAll on the same line, formLogin()/logout() permitAll, @PermitAll on GET or POST methods (login and registration are public by design), StrictMode policies, comments and strings.

CWE-932 is an OWASP Top Ten 2013 category with no code shape of its own; this rule reports the concrete C/C++ hardening signal it was generated for, source that turns off a compiler memory-safety defence for the code that follows: #pragma GCC/clang optimize("no-stack-protector"/"-fno-stack-protector"), __attribute__((no_stack_protector)) and __attribute__((optimize(..., "no-stack-protector"))) (also after other attributes in the list, and inside #pragma clang attribute push), [[gnu::no_stack_protector]], #undef _FORTIFY_SOURCE that is not followed by a non-zero redefinition, #define _FORTIFY_SOURCE 0, and MSVC #pragma strict_gs_check(off) and __declspec(safebuffers). Not reported: optimisation-level pragmas and attributes (O0, O2, O3; optimize("O0") is the usual secure-zeroing idiom), _FORTIFY_SOURCE set to 1-3, comments (including a trailing comment after code) and string literals, and test or fuzzing code. Build-system flags (-fno-stack-protector in a Makefile) are out of scope.

CWE-933 is the OWASP Top Ten 2013 Security Misconfiguration category with no code shape of its own; this rule reports the concrete misconfiguration it was generated for, a page that loads executable script over plain http://, which anyone on the network path can replace with their own code. Reported: a <script> tag whose src is an http:// URL in HTML and server-side template files (.html, .htm, .php, .jsp, .erb, .ejs, .cshtml, .aspx, .vue, .svelte, .jsx, .tsx, Jinja, Twig, Handlebars and similar), with any quoting or letter case and with the src attribute on a later line of the start tag; and in JavaScript/TypeScript, an element made by document.createElement("script") whose src is set to an http:// URL a few lines later (el.src = or el.setAttribute("src", ...)), and $.getScript/jQuery.getScript or a worker's importScripts called with an http:// URL. Not reported: https:// and protocol-relative or relative src values, loopback development servers (localhost, 127.0.0.1, 0.0.0.0, [::1]), http:// URLs on links, images or inside inline script code, HTML comments (single-line or multi-line), test files, and script URLs assembled at run time. A tag with an integrity attribute is still reported: on an HTTPS page the browser blocks the script as mixed content, and on an HTTP page the attacker can rewrite the tag itself.

Reports a Spring or JAX-RS handler mapped to an admin, management or staff path and explicitly opened to everyone with @PermitAll / permitAll(). Unguarded admin routes in Python are VNX-306, in JavaScript, TypeScript and Go VNX-425.

Reports CSRF protection switched off in Laravel (wildcard $except, removed middleware, withoutMiddleware), Symfony (csrf_protection: false, form option) and Kotlin Spring Security (csrf { disable() }).

Reports a Maven or Gradle build file pinning log4j-core before 2.16.0, log4j 1.x, commons-collections 3.2.1 or earlier, commons-collections4 4.0 or commons-text 1.5 to 1.9.

Reports Python redirects whose destination is request data, and Java/Kotlin server-side forwards (getRequestDispatcher, Spring forward:) and Kotlin redirects built from request input without validation.

Reports an Android deep-link URI (or a query parameter or path segment read from it) passed to a WebView load, Intent.parseUri or a component selector without first checking its scheme, host or value.

HTTP request data reaches eval, new Function, vm, string setTimeout, Python eval/exec/compile, PHP eval/assert/create_function/call_user_func, or Ruby eval/instance_eval/class_eval/module_eval, directly or through a variable.

Reports a browser window 'message' listener (addEventListener, onmessage, jQuery .on) whose handler never reads event.origin or event.source.

Reports postMessage(data, '*') to another window, and Android implicit broadcasts that carry extras with no receiver permission or target package.

Reports a Node.js server that sets Access-Control-Allow-Origin to '*' or to the request's unchecked Origin, calls cors() or registers @fastify/cors with no options, origin: true or an origin callback that accepts everything, or calls NestJS enableCors() with no options or creates the app with cors: true.

Reports MongoDB queries built from untrusted data in Python, PHP and Java: $where clauses built from formatted strings, filters taken from a parsed request body or a PHP request array, and JSON query strings built by concatenation.

HTTP request data becomes the source of a Jinja2, Mako, Django, EJS, Pug, Handlebars, Nunjucks, lodash, ERB, Erubi, Haml, Slim or Rails render inline: template, directly or through a variable.

PHP include/require statements whose path carries request data (superglobals, php://input, filter_input, $request->input), inline or through a variable, with no basename(), cast or allowlist check.

Detects a production Android build made debuggable (android:debuggable="true" in AndroidManifest.xml, or debuggable / isDebuggable in the release build type) and android:allowBackup="true" on an application with no backup or data-extraction rules.

Detects a JavaScript-enabled Android WebView (Java/Kotlin) that loads a URL or HTML from an Intent, deep link, Fragment arguments, external storage or a cleartext http:// address, an evaluateJavascript call built from such a value, a JavaScript bridge added in such a file, and file:// pages given universal or file access.

Detects an activity, activity-alias, service, receiver or provider in a production AndroidManifest.xml that is exported (android:exported="true", or an intent-filter with no exported attribute) and requires no permission, excluding components that answer platform actions such as the launcher, deep links and system broadcasts.

Detects a password, token, secret, API or private key, PIN or session id written with putString() to a plain (not Encrypted) SharedPreferences editor in Java or Kotlin, where the key or value names the credential and the value is not encrypted or hashed first.

Detects cleartextTrafficPermitted="true" on the base-config, or on a domain-config naming a non-loopback host, of an Android network security configuration, and android:usesCleartextTraffic="true" on an application with no networkSecurityConfig, outside debug and test source sets.

Detects a <string> resource in an Android res/values*/ file whose name marks it as a credential (api key, secret, token, password, private or signing key) and whose value is a credential-shaped literal, not UI text, a placeholder, a reference or a public Firebase/Facebook client id.

Detects Java and Kotlin Cipher.getInstance() calls that select AES in ECB mode: an AES/ECB transformation, bare "AES" or KeyProperties.KEY_ALGORITHM_AES (the provider default is ECB), a KeyProperties concatenation or template with BLOCK_MODE_ECB, or a constant holding one of those.

Reports a shell eval, or a bash/sh/zsh/ksh/dash -c or su/runuser -c command string (or a find -exec/xargs sh -c script that pastes {} into its code), whose text contains a variable, positional parameter, dynamic command substitution or the output of a download or decoder, so the shell re-parses data as code.

Reports a shell script that runs code it has just downloaded with curl or wget without verifying it: piped into an interpreter (directly or through filters such as base64 -d), passed to one as a command or process substitution, or saved and run with no checksum or signature check in between.

In a shell script that does not enable errexit, reports an unchecked cd followed by a relative-path delete, an integrity check whose result nothing reads, and (without nounset) rm -r of a path built from a variable that can be empty.

Reports an unquoted expansion of a value the script's caller controls (a script-level positional parameter, or a variable assigned from one, from read or from OPTARG) used as a command argument or a [ ] / test operand, where word splitting and globbing turn it into extra arguments.

Reports a literal credential in a shell script or .env file: an assignment or command-prefix assignment to a PASSWORD/SECRET/TOKEN/API_KEY-style name, a literal Authorization/X-Api-Key header token, a literal after a credential flag (--password, mysql -p, sshpass -p, curl -u, docker login -p, redis-cli -a), or a user:password pair in a connection URL. Placeholders, runtime references and single-word local defaults are not reported.

Reports an IFS change that escapes the code that needed it: a function that sets IFS without local IFS or a restore, a script-level IFS change never restored, export IFS, and IFS taken from a positional parameter or OPTARG.

Reports an unquoted $(...) or backtick substitution used as a command argument, or a for loop over a file or text listing, where word splitting and globbing break its output into extra arguments. Quoted, assigned, arithmetic, command-position and single-token outputs are not reported.

Reports C and C++ copies of unknown length into a buffer without a size: gets() and _getws() always; strcpy, stpcpy, strcat and their wide, multibyte, TCHAR and lstrcpy/lstrcat forms when the source is not a literal or macro; sprintf/wsprintf with an unbounded %s and vsprintf; scanf-family %s or %[ without a field width. Bounded APIs, measured or size-checked copies, literal sources (including const arrays initialised from a literal), declarations and comments are not reported.

Reports C and C++ printf-family calls whose format argument is not a string literal: a string printed as the format with nothing after it (printf(buf), fprintf(fp, msg), syslog(LOG_ERR, msg), snprintf(buf, n, s), BSD warn/err), and a format taken from argv, getenv or input read in the 25 lines above. Literal, macro and gettext formats, variadic wrappers and comments are not reported.

Reports C and C++ calls that hand a non-constant string to a shell (system, popen, _popen, _wsystem, p2open, std::system, execl of sh -c) when the command comes from argv, getenv or input, or was composed nearby with sprintf/snprintf/asprintf %s, strcat/strcpy or C++ string concatenation, and wordexp() without WRDE_NOCMD. Literal commands, exec without a shell, validated or quoted input, wrapper parameters and comments are not reported.

Reports a C, C++ or Objective-C pointer used after free(), g_free, kfree, OPENSSL_free or delete: a dereference, a call that takes it or a return of it within 15 lines on the same path, before it is reassigned and before the path leaves, plus a for loop that advances through the pointer its body frees. Nulled or reassigned pointers, comparisons, other branches, saved next pointers, macros and comments are not reported.

Reports a C or C++ allocation (malloc, realloc, calloc, aligned_alloc and common wrappers) whose size multiplies or adds a count parsed or received in the 30 lines above (atoi/strtol family, ntohl, getenv, scanf/fread/read/recv out-arguments) with no overflow check. Checked or clamped counts, 8- and 16-bit counts, plain calloc(n, size), and sizes from constants or internal lengths are not reported.

Reports C, C++ and Objective-C stack allocations with an unbounded run-time size: alloca, _alloca and __builtin_alloca whose size names a variable or call, strdupa of a non-literal, and variable-length arrays sized by strlen() or by a count parsed or received just above. Constant sizes, sizes compared or clamped first, _malloca, declarations, macros and comments are not reported.

MD5 is computed through a hash or signature API: Python hashlib.md5()/hashlib.new('md5') (module and from-import aliases resolved), PyCryptodome MD5.new() and cryptography hashes.MD5(); Node.js crypto.createHash('md5')/createSign('RSA-MD5'), CryptoJS.MD5() and the md5/blueimp-md5/js-md5/spark-md5 packages under the name they are imported as; Go crypto/md5 md5.New/md5.Sum (aliased import resolved) and x509.MD5WithRSA; Java MessageDigest/Signature.getInstance("MD5"/"MD5withRSA") with the name given literally, through a variable, field or constant (also one declared on another class) that holds it, directly, in a ternary, or from a getProperty/@Value lookup that resolves to the value the project's .properties or YAML files give the key, else the lookup default, commons-codec DigestUtils.md5*, Guava Hashing.md5() and BouncyCastle MD5Digest; Ruby Digest::MD5 and OpenSSL::Digest.new('MD5'); PHP md5(), md5_file(), hash('md5') and openssl_digest(..., 'md5'). MD5 collisions are cheap to produce, so it must not protect integrity, signatures, tokens or passwords; use SHA-256 or stronger (argon2/bcrypt/scrypt for passwords). Not reported: HMAC-MD5 (hmac.new(k, m, hashlib.md5), createHmac('md5'), hmac.New(md5.New, k), HmacMD5, hash_hmac('md5')), PBKDF2 or HKDF over MD5, Python calls declaring usedforsecurity=False, a field, header or method merely named md5, the import alone and constants such as md5.Size, the algorithm named inside a string literal (an SQL md5() call) or a comment, documentation, and test files. An MD5 digest that protects a security value is reported by a more precise rule instead, so the line is reported once: a password passed straight into it by VNX-CRYPTO-007 (a password hashed with a fast hash), and one with a password, secret, token, session id, cookie, signature, salt, nonce, CSRF value or API key named around the call by VNX-327 (a broken hash protecting a security value).

Reports SHA-1 computed through a hash or signature API in Python, Node.js, Go, Java, Ruby and PHP (hashlib.sha1, createHash('sha1'), sha1.Sum, x509.SHA1WithRSA, MessageDigest.getInstance("SHA-1"), Digest::SHA1, sha1()), with imports and aliases resolved. HMAC-SHA1, PBKDF2-HMAC-SHA1, the WebSocket accept key, usedforsecurity=False, names merely containing sha1, comments, strings and test files are not reported.

Reports block ciphers set up in ECB mode in Python, Node.js, Go, Java, Ruby and PHP: MODE_ECB, modes.ECB(), '*-ecb' cipher names, Java '*/ECB/*' or bare "AES", "DES", "DESede" or "Blowfish" transformations (literal, variable or getProperty default), NewECBEncrypter and hand-written per-block Encrypt loops. Other modes, RSA/ECB/* and AES key-wrap transformations, guards against ECB, single-block operations, overridden property defaults, comments and test vectors are not reported.

Reports construction of DES, Triple DES, RC4, RC2, Blowfish, CAST5 or IDEA ciphers in Python, Node.js, Go, Java, Ruby and PHP (PyCryptodome/cryptography, createCipheriv names, crypto/des and crypto/rc4, Cipher.getInstance transformations and SecretKeySpec algorithms, OpenSSL::Cipher, openssl_encrypt and mcrypt). TLS cipher-suite deny-lists, names in lists or comparisons, block-size constants, lookalike names, comments, strings and test files are not reported.

Reports TLS clients told to accept any certificate or host name in Python (verify=False, CERT_NONE, unverified contexts), Node.js (rejectUnauthorized: false, NODE_TLS_REJECT_UNAUTHORIZED=0)and Go (InsecureSkipVerify: true); Java trust managers and host-name verifiers are reported by VNX-JAVA-006. Values from configuration, branches honouring an insecure option, custom pinning and test files are not reported.

Reports RSA key generation with a modulus below 2048 bits, given literally or through a constant in the same file, in Python (cryptography, PyCryptodome, python-rsa, pyOpenSSL), Go (rsa.GenerateKey), Java (RSA KeyPairGenerator.initialize, RSAKeyGenParameterSpec) and Node.js (generateKeyPair modulusLength, WebCrypto subtle.generateKey, node-forge, node-rsa). Sizes from configuration, EC/DSA/symmetric keys and test files are not reported.

Reports a password-named value hashed with a fast general-purpose hash (MD5, SHA-1, SHA-2, SHA-3, BLAKE2) in Python, Node.js, Java, PHP, Ruby and Go, including through a helper named for the hash (Md5Sum(password)), and password KDFs with too low a work factor: PBKDF2 under 10,000 iterations and bcrypt cost under 10. Non-password hashing, the Have I Been Pwned SHA-1 range lookup, helpers defined elsewhere and test files are not reported.

Reports a MAC, signature, digest or secret token checked with ordinary equality (==, !=, ===, !==, Java equals/Arrays.equals, Go bytes.Equal) in Python, Node.js, Go, Java, PHP and Ruby, any equality on a line that computes an HMAC, and a hand-written byte loop with an early return in MAC or signature code, when the comparison verifies a supplied value (a request input, a handler parameter, a verify-named function or a value hashed just above). Comparisons where neither side is supplied, presence checks, constants, lexer token kinds, hash-named values and constant-time APIs are not reported.

Detects a value from rand(), random(), the drand48 family, std::rand() or a <random> engine such as std::mt19937 becoming a token, nonce, salt, IV, key, password, session id, CSRF token or OTP in C, C++ and Objective-C code. Ordinary rand() use for sampling, shuffling and jitter is not reported.

Detects a constant IV, nonce or salt (a string or byte literal, a literal byte array, or a zero-filled buffer) passed to a cipher, AEAD or password KDF call in Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++/Objective-C, Rust, C#, PHP and Ruby, directly or through a variable assigned that constant. Random, ciphertext-derived and in-place-filled IVs are not reported.

Detects C# SQL statements whose text is built from non-constant values (concatenation, interpolation, string.Format, StringBuilder) and executed through ADO.NET commands and data adapters, CommandText, EF Core raw SQL, Dapper, LINQ to SQL or NHibernate.

Detects C# Process.Start, ProcessStartInfo FileName/Arguments and PowerShell AddScript calls that receive HTTP request data or action parameters, and shells (cmd, sh, bash, PowerShell) given a command line built from non-constant values, including through ArgumentList after -c or /c and CliWrap WithArguments.

Detects C# XML parsers given an XmlUrlResolver, DTD processing enabled without XmlResolver = null on frameworks where the default resolver fetches entities, and XmlDocument/XmlTextReader parses that are unsafe by default on .NET Framework 4.5.1 and older.

Detects C# deserialisation through BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter and ObjectStateFormatter, Json.NET TypeNameHandling without a SerializationBinder, JavaScriptSerializer with a type resolver, MessagePack typeless deserialisation, and serializers whose root type comes from Type.GetType on data.

Detects ASP.NET MVC and ASP.NET Core MVC controller actions reachable by a cross-site form ([HttpPost], [AcceptVerbs(HttpVerbs.Post)], and PUT/DELETE/PATCH where method override applies) with no anti-forgery validation on the action, the controller, a base controller or a global filter.

Detects C# calls to System.Random (Next, NextInt64, NextDouble, NextBytes, GetItems) whose result becomes a password, token, key, salt, nonce, IV, session or CSRF value, an OTP or a reset code.

Detects C# Path.Combine/Path.Join, MapPath and file-system APIs (File, Directory, FileStream, StreamReader, PhysicalFile, TransmitFile, SaveAs) whose path argument contains HTTP request data, an uploaded file name, an archive entry name (zip slip) or a controller action parameter, without Path.GetFileName or a GetFullPath/StartsWith containment check.

Detects C# HttpClient, WebClient, WebRequest.Create, HttpRequestMessage, RestClient, Flurl and BaseAddress/RequestUri URLs whose scheme and host come from HTTP request data or a controller action parameter, with no host allowlist check.

Reports C# code that creates or invokes MD5, SHA-1, DES, 3DES, RC2, RC4, MD4/MD2 or PBKDF1 through the .NET or BouncyCastle crypto APIs, including SHA-1/MD5 signatures and algorithms requested by name. HMAC, RSA-OAEP, PBKDF2, protocol-fixed hashes (WebSocket, Gravatar, ETag, Content-MD5), analyzer-suppressed code, comments, strings and test projects are not reported.

Reports C# source that hardcodes the password of a database or cache connection: a Password=/Pwd= value in a connection-string literal, or a literal assigned to the Password of a ConnectionStringBuilder, Redis ConfigurationOptions or RabbitMQ ConnectionFactory. Passwords from configuration, format and interpolation holes, placeholders, SQL text, comments, test projects and configuration files are not reported.

Reports a Dockerfile whose final stage runs as root: no USER in the stage that becomes the image (USER does not carry across FROM), or a last USER of root, 0 or ContainerAdministrator.

Reports a FROM, COPY --from or RUN --mount=from that names an external image by :latest, a floating tag (alpine, slim, lts, stable) or no tag, with no @sha256 digest, including images resolved through an ARG default.

Reports credential-named Dockerfile ARG and ENV instructions: ENV with a literal secret, a literal fallback or one copied from a declared build arg, any credential ARG, and a password embedded in an ENV/ARG URL.

Reports a Dockerfile ADD that downloads an http(s) URL or a git repository with no --checksum, in every ADD form; git sources pinned to a full commit are not reported.

Reports privileged containers: privileged: true on a Compose service or directly under a Kubernetes securityContext, and in Dockerfiles RUN --security=insecure, a LABEL RUN/INSTALL with --privileged, or docker/podman run --privileged.

Reports a Dockerfile ADD that copies local files or directories that are not archives, where COPY does the same without ADD's implicit tar extraction.

Reports a Dockerfile whose final stage runs a service (EXPOSE or a server CMD/ENTRYPOINT, possibly inherited from an earlier stage) but declares no HEALTHCHECK.

Reports apt-get/apt, apk, yum/dnf/microdnf and zypper install commands in a Dockerfile RUN step that leave at least one package without a pinned version.

Reports a go.mod that requires a remote module but has no go.sum beside it, or whose go.sum is excluded by a .gitignore, once per go.mod on its first require directive. Standard-library-only modules, all-local replacements and testdata/fixture modules are not reported.

Reports exec.Command/CommandContext running a shell with -c (or /C, -Command) and a script built with fmt.Sprintf or concatenation, or read from the HTTP request, and a program name that is itself formatted or request-supplied. Constant scripts, positional parameters, shell-quoted values and formatted arguments to a fixed program are not reported.

Reports database/sql, sqlx, pgx and GORM query calls whose SQL is built with fmt.Sprintf or concatenation so a value lands where a bind parameter belongs (inside quotes, after a comparison, IN/VALUES/LIMIT), or that embed a request value anywhere. Parameterised queries, %d, server-chosen identifiers, placeholder lists and quoted identifiers are not reported.

Reports InsecureSkipVerify set to the constant true in a tls.Config literal or assignment. A value from a variable, flag or environment, true inside an if on the insecure option itself, a config with its own VerifyPeerCertificate/VerifyConnection, comments, strings and test code (including test-support packages such as httptest and testutil) are not reported.

Reports http.Redirect, gin/echo/fiber Redirect and hand-written Location headers whose destination starts with a request value, directly, through a variable, or behind a prefix that does not pin the host ("//", "https://", a bare "/"). Fixed hosts or paths, validated destinations and configuration values are not reported.

Reports outbound HTTP requests, reverse proxies, net/tls dials and websocket dials whose URL or address starts with a request value (query, form, path parameter header, or a decoded or unmarshalled JSON body field), directly, via url.Parse or a variable, or behind a prefix that does not pin the host. Fixed hosts, configured destinations, allowlisted values and guarded dialers are not reported; a HasPrefix test against a bare scheme is normalisation, not a check.

Reports a file read, listed or served (os.Open, os.ReadFile, os.ReadDir, ioutil.ReadFile, http.ServeFile, gin/echo/fiber file responses) from a path holding a request value, inline, through a variable or through one filepath.Join/Sprintf built from it. filepath.Base, IsLocal, Rel, HasPrefix on the cleaned path, table lookups, os.Root, and operator-supplied paths are not reported; HasPrefix on the raw value is.

Reports a math/rand or math/rand/v2 call (Read, Intn, Int63, Uint64, IntN...) whose line, the line its value flows into, or the enclosing function name says the value is a token, password, secret, nonce, salt, OTP, PIN, CSRF value, session id, key or reset code. crypto/rand, jitter, backoff, sampling and shuffling outside secret-named functions, and test code are not reported.

Detect Go code that renders a text/template template into an HTTP response, or loads .html files with text/template, so request data reaches the page unescaped (XSS).

Detect Go code that constructs DES, Triple DES, RC4, Blowfish, CAST5, TEA or XTEA ciphers, or enables RC4/3DES TLS cipher suites or 3DES/arcfour SSH ciphers, which are broken or deprecated for protecting data.

Detect Go code that decodes gob data from an HTTP request body (net/http, gin, echo, fiber, fasthttp) or an accepted network connection, directly or through a variable, which lets a client exhaust memory and stack.

Detect Go code that writes a query, form or route parameter into an HTTP response header (net/http, gin, echo, fiber, fasthttp), inline or through a variable, without neutralising or constraining it.

Detect Go code that extracts a zip or tar entry to a path built from the entry's name (or writes its Linkname as a symlink) without checking the result stays inside the destination directory.

Detects sync.Mutex.Lock() or sync.RWMutex.RLock() calls that can leave the mutex held: the function returns, panics or continues its loop on a path that never reaches an Unlock, or never unlocks and no other function releases it, and no deferred Unlock covers it.

Detects a positive WaitGroup.Add() inside the go func literal it counts, where the parent's Wait() can run first and return early; Add calls in the parent, local WaitGroups and goroutines already counted by the parent are not reported.

Detects values parsed with strconv.Atoi, ParseInt or ParseUint that are later converted, in the same function and without a range check, to a type that cannot hold the parsed range: truncation, sign flip or unsigned-to-signed overflow.

Detects fmt.Sprintf SQL that puts a string verb where SQL expects a literal (quoted, or after a comparison) and is run by Exec/Query/QueryRow/Prepare, sqlx or GORM Raw/Where/Order, inline or through a variable; other verb positions only when fed a request value. Integer verbs, placeholder builders, quoted or converted values and self-built fragments are not reported.

Detects files created, written, renamed or linked (os.Create, os.WriteFile, os.OpenFile with a write flag, os.MkdirAll, os.Rename, gin SaveUploadedFile) at a path built from HTTP request data or a multipart filename, with no filepath.Base, IsLocal, prefix check on the cleaned path or os.Root confining it. Read-only opens and server-chosen names are not reported.

Detects pprof and expvar debug handlers served on a listener bound to every interface: the default mux when net/http/pprof or expvar is imported, a mux or router carrying the debug handlers (including chi middleware.Profiler), or a gin engine with gin-contrib pprof. An all-interfaces address held in a constant of the same file counts as the literal. Loopback and flag- or config-supplied addresses, and public listeners without debug handlers, are not reported.

Detects template.HTML, HTMLAttr, JS, CSS, URL and Srcset conversions applied to request data, markup built with Sprintf or concatenation, a function parameter, or a variable assigned from one of those. Constant markup, sanitised or escaped values and executed template output are not reported.

Detects HTML written to an http.ResponseWriter (fmt.Fprintf/Fprint/Fprintln, io.WriteString, w.Write, gin c.Data, echo c.HTML) with a non-constant value spliced into the markup unescaped. Escaped and numeric values, constants, plain-text or JSON handlers and writes to builders or files are not reported.

Detects request data, the request body or a caller-supplied parameter passed as code to an embedded interpreter or expression engine (goja, otto, yaegi, gopher-lua, govaluate, expr, gval, cel-go, tengo, starlark) or parsed as an html/template or text/template. Constant, embedded and configured scripts are not reported.

Detects SQL text where a value is concatenated in a literal position (after a quote or a comparison) and the statement is run by a database call or is a complete statement; other positions only when the value is request data. Bind-parameter numbers, converted or quoted values and self-built fragments are not reported.

Detects an HTTP request parameter reaching a command, SQL query text, file path, outbound request, redirect or raw response in the same function, inline or through one or two assignments, with no conversion, escaping, allowlist or validation on the way. Bind arguments and values only logged or compared are not reported.

Detects a redirect (http.Redirect, gin/echo/fiber Redirect, a Location header) whose target is a query, form or route parameter, directly or through one variable built from it, with no allowlist or host check first.

Detects an uploaded multipart file saved to disk under the client's own file name (FileHeader.Filename) by a handler that never checks the file's extension or content type.

Detects a file opened, written, removed or served (os, ioutil, http.ServeFile, gin/echo/fiber file helpers) with a path built from a request value that was not reduced with filepath.Base, IsLocal, Rel or a prefix check first.

Detects a password hashed with a fast unsalted digest (md5, sha1, sha256, sha512 Sum or a hasher written with it, an MD5/SHA helper, or a digest stored in a password-named field) instead of bcrypt, scrypt, Argon2id or PBKDF2.

Detects a well-known weak or default password (admin, password, 123456, changeme, postgres...) written into Go source as a credential: a password variable or field, a setter or SetBasicAuth, connection-string userinfo, or an env/flag/viper default.

Detects a cookie sent to the browser without Secure: an http.Cookie, fiber.Cookie or gorilla sessions.Options literal with Secure absent or false, gin SetCookie with secure=false, a hand-written Set-Cookie header without Secure, csrf.Secure(false), or a gorilla cookie store whose Options are never set.

Detects JWT claims used without signature verification in Go: alg none accepted via UnsafeAllowNoneSignatureType, jwx WithVerify(false), ParseUnverified/ParseInsecure/UnsafeClaimsWithoutVerification/jwx jws.Parse in request handlers with no later verification, and parse errors that are discarded without a token.Valid check.

Detects JWT expiry that is never enforced in Go: claims validation turned off (WithoutClaimsValidation, SkipClaimsValidation, jwx WithValidate(false)), go-jose Claims with no Validate call, and tokens issued from a claims literal or a jwx builder with no exp/ExpiresAt/Expiry.

Detects Go JWT verification (golang-jwt Parse/ParseWithClaims/NewParser, jwx Parse, go-jose ParseSigned) with no audience check in its arguments or its file, and go-oidc configs with SkipClientIDCheck: true.

Detects Go OAuth flows that redirect to, or configure, a redirect_uri taken from the request without comparing it against the client's registered redirect URIs.

Detects Go cookies sent to the browser without HttpOnly (http.Cookie, fiber.Cookie, gorilla sessions Options, gin SetCookie, default cookie stores), excluding deletion, CSRF double-submit and client-side cookies.

Detects Go code that uses ECB mode: NewECBEncrypter/NewECBDecrypter, or a cipher.Block encrypting successive slices in a loop with no chaining.

Detects Go web applications that serve HTML pages, templates or static files while no production Go file sets browser security headers directly or through middleware. Reported once per file.

Detects Go handlers that bind a request body into a value and then save that same value whole (GORM Create/Save/Updates, Mongo InsertOne, repository Insert/Update), allowing mass assignment.

Detects Go HTTP login handlers (declared Login/SignIn/Authenticate handlers or inline login routes) when nothing in the project's production Go code rate-limits requests or locks accounts after failed attempts.

Detects Go logging calls (log, slog, zap, logrus, zerolog, any logger) whose arguments carry a password, token, secret, API key, private key, card number or Authorization header.

Detect Go TLS configuration that sets MinVersion or MaxVersion (or an options field such as TLSMinVersion) to SSL 3.0, TLS 1.0 or TLS 1.1 (by constant, raw protocol number, a local variable or a package-level constant holding one, a Traefik-style string option or an Envoy TlsParameters enum), enabling negotiation of deprecated protocol versions.

Reports GraphQL servers that hard-code introspection, GraphiQL or Playground on (introspection: true, graphiql: true, playground: true in JavaScript/TypeScript; graphiql=True or introspection=True in Python GraphQL views), exposing the full schema.

Reports unbounded GraphQL operation batching switched on with a literal true: Apollo allowBatchedHttpRequests, graphql-yoga batching, Mercurius allowBatchedQueries, or batch=True on a Python GraphQLView.

Reports GraphQL operation documents (JavaScript/TypeScript and Python) built by interpolating or concatenating request data, directly or through a variable assigned from the request, instead of passing it in the variables map.

Reports JavaScript/TypeScript GraphQL servers (Apollo Server, graphql-yoga, NestJS GraphQLModule, express-graphql, Mercurius) in a project that nowhere suppresses graphql-js 'Did you mean' field suggestions.

Reports Jinja2, Django and Nunjucks templates that mark an output expression |safe or |safeseq, or switch autoescape off, unless the value is a literal, already escaped/JSON-encoded, or a CSRF token or form field.

Reports Runtime.exec() commands and shell ProcessBuilder scripts built at run time from concatenation, String.format or request values, directly or through a variable assigned a few lines above.

Reports Spring Boot configuration that exposes all or sensitive actuator endpoints over HTTP (include=*, env, heapdump, shutdown, jolokia...), enables shutdown, or disables Boot 1.x actuator security.

Reports JDBC, JdbcTemplate, Hibernate native and Android SQLite queries whose SQL text is concatenated or formatted from run-time values instead of bound through ? placeholders.

Reports Java XML parser factories (DOM, SAX, StAX, dom4j, JDOM, and Transformer/Schema factories that load sources) created without disabling DTDs or external entities, and settings that re-enable them.

Reports unfiltered ObjectInputStream.readObject(), XMLDecoder, XStream.fromXML() without a type allowlist, permissive Jackson default typing and SerializationUtils.deserialize(), which can run gadget chains on attacker-controlled bytes.

Reports Java code that disables TLS server authentication: empty checkServerTrusted(), always-true HostnameVerifier/TrustStrategy implementations and lambdas, and trust-all constants such as NoopHostnameVerifier and TrustAllStrategy.

Reports sendRedirect(), Spring redirect: views, RedirectView and Location headers whose target is a request value or a variable assigned from one, unless it is prefixed with a fixed path, looked up in an allowlist or guarded.

Reports Java outbound requests (URL, RestTemplate, WebClient, HttpClient, OkHttp, Jsoup, Socket) whose URL or host is a request value or a variable assigned from one, unless a fixed host prefixes it or a guard checks it.

Reports Java file and path APIs (new File, FileInputStream/FileOutputStream, FileReader/FileWriter, Paths.get, Path.of, Path.resolve, Files.*, FileSystemResource) whose path argument carries servlet request data, an upload file name or an annotated Spring/JAX-RS handler parameter, directly or through up to five local assignments, unless the path is checked for containment or reduced to a bare file name.

Reports Spring Security configurations that switch CSRF protection off for browser-facing applications: csrf().disable(), csrf(c -> c.disable()), csrf(AbstractHttpConfigurer::disable), WebFlux CsrfSpec::disable, CSRF ignored for every path, and csrf disabled=true in XML configuration. Stateless bearer-token APIs and test configurations are not reported.

Reports SpEL, OGNL, Jakarta EL, ScriptEngine, MVEL, JEXL and Bean Validation message-template calls whose expression argument carries HTTP request data or the validated value, directly or through up to five local assignments. Constant expressions and request data bound as variables are not reported.

Reports JNDI DirContext.search, Spring LdapTemplate search/find and LdapQueryBuilder filter, and UnboundID Filter.create/SearchRequest/search calls whose filter or base DN carries HTTP request data, directly or through up to five local assignments, or that concatenate a String method parameter into a filter or DN value. Parameterised {0} filters, encoded values and Spring filter objects are not reported.

Reports XPath.evaluate/compile, dom4j selectNodes/selectSingleNode and Jaxen XPath constructors whose expression carries HTTP request data, or concatenates a String method parameter into a quoted value, directly or through a local built a few lines above. Variable-resolver expressions, encoded values and constants are not reported.

Reports archive extraction code that builds an output path (new File, FileOutputStream, Paths.get, Path.resolve, Files.copy and similar) from a ZipEntry, JarEntry or Commons Compress entry name without a canonical-path or normalize-and-startsWith containment check.

Reports EntityManager and Hibernate Session createQuery/createNativeQuery calls whose JPQL, HQL or SQL text carries HTTP request data, or concatenates a String method parameter into a value position, directly or through a local built a few lines above. Named and positional parameters, constants and entity names are not reported.

Reports values drawn from java.util.Random, ThreadLocalRandom, Math.random or RandomStringUtils that are used as tokens, session IDs, nonces, passwords, salts, OTPs or keys. SecureRandom and non-secret uses such as jitter, shuffling and sampling are not reported.

Detects Java code that passes a request parameter, header, query string or path info (or a Spring @RequestParam, @PathVariable, @RequestHeader or @CookieValue argument) to HttpServletResponse.setHeader(), addHeader() or sendRedirect() without stripping CR and LF, enabling HTTP response splitting and header injection.

Detects javax.crypto.Cipher instances created for RSA with PKCS#1 v1.5 padding or no padding (including the bare "RSA" transformation, which defaults to PKCS1Padding), inline or through a constant, which are vulnerable to Bleichenbacher-style padding oracle attacks. Use RSA/ECB/OAEPWithSHA-256AndMGF1Padding instead.

Detects symmetric and signing keys written into Java source: SecretKeySpec, PBEKeySpec, JJWT signWith/setSigningKey, auth0 Algorithm.HMAC* and Keys.hmacShaKeyFor given a string, decoded or byte-array literal, or a constant holding one. Keys embedded in source can be extracted from any copy of the binary.

Detects fixed initialization vectors and GCM nonces in Java: IvParameterSpec and GCMParameterSpec built from a literal, a constant byte array or string, or a zero-filled buffer that is never randomised. Reusing the same IV with the same key undermines the security of CBC, CTR, and GCM modes.

Detects SLF4J, Log4j, java.util.logging and android.util.Log calls whose arguments pass a password, token, secret, API key or credential value, or a request parameter or header read by such a name (not just the word in the message text), exposing it in log files and monitoring systems.

Detects File.createTempFile() in the shared temp directory (created with umask permissions, often world-readable) and fixed or user-derived file names under /tmp or java.io.tmpdir, which are open to symlink and pre-creation attacks.

Detects Java upload handlers that write a MultipartFile, Servlet Part or commons FileItem to disk under the client-supplied filename with no extension or content-type check, enabling remote code execution via malicious file upload.

Detects DocumentBuilderFactory, SAXParserFactory, dom4j SAXReader, JDOM SAXBuilder and XMLInputFactory instances that never disable DOCTYPE declarations (or enable secure processing, or turn off SUPPORT_DTD), leaving the application open to XML entity expansion denial-of-service attacks.

Detects passwords written into Java production source as string literals: password-named fields and variables, DriverManager.getConnection, setPassword, Properties keys, credential constructors, KeyStore passwords and backdoor equals() checks. Placeholders, property keys, labels and test code are not reported.

Detects Spring and servlet handlers that serve a file (FileSystemResource, UrlResource, PathResource, InputStreamResource, copyToByteArray, Files.readAllBytes/copy) whose path comes from a request value, when the handler makes no authorisation decision (no @PreAuthorize/@Secured, Principal, Authentication or owner check).

Detects Spring Security configurations that disable all default security headers, X-Frame-Options, HSTS or X-Content-Type-Options, in the chained, lambda and method-reference DSL forms. xssProtection().disable(), sameOrigin()/deny() and test code are not reported.

Detects JDBC Statement/Connection, Spring JdbcTemplate and Android SQLiteDatabase calls whose SQL is assembled in a StringBuilder or StringBuffer with an append() of a non-constant value. SQL concatenated or formatted into a String is reported by VNX-JAVA-003.

Detects DocumentBuilderFactory, SAXParserFactory and XMLReaderFactory parsers that are never hardened (disallow-doctype-decl, external-general-entities false, secure processing or ACCESS_EXTERNAL_DTD), and external entities explicitly switched on. StAX, TransformerFactory and SchemaFactory are covered by VNX-JAVA-004.

Reports Java code that writes servlet request data into an HTML response without output encoding: response.getWriter() and PrintWriter/JspWriter/ServletOutputStream writes, JSP scriptlet expressions and out.print, and values returned from Spring methods that produce text/html, unless the value passed through an HTML encoder, was parsed to a number, folded to a constant, or the response is not HTML.

A JWT is accepted without its signature being checked: verify_signature False or verify=False (Python), jsonwebtoken decode() of a request token in a file that never verifies, jwt-simple noVerify, golang-jwt ParseUnverified alone, jjwt parse() after setSigningKey, Auth0 JWT.decode() alone, ruby-jwt JWT.decode(t, k, false), and .NET RequireSignedTokens = false or a pass-through SignatureValidator.

A JWT is issued with no expiry: jwt.sign / new SignJWT (JS/TS), jwt.encode (Python), Jwts.builder() / JWT.create() (Java), jwt.NewWithClaims (Go), JWT.encode (Ruby) and JWT::encode (PHP) where neither the call nor a payload, claims or options variable defined just above sets exp, expiresIn, setExpiration, withExpiresAt or ExpiresAt.

A JWT signing or verification key is a string literal: passed straight to jwt.sign/verify, express-jwt, jwt.encode/decode, JWT.encode/decode, JWT::encode, new Key(), jjwt signWith/setSigningKey, Algorithm.HMAC256, SignedString([]byte(...)) or SymmetricSecurityKey, assigned to a variable used as the key, or assigned to a JWT-named setting in code, .properties or YAML.

A JWT is signed with, or a verifier accepts, the 'none' algorithm: an algorithm/algorithms option naming 'none' or PyJWT algorithm=None (Python, JS/TS, Ruby), jose UnsecuredJWT, Auth0 Algorithm.none(), jjwt Jwts.parser().unsecured(), and golang-jwt SigningMethodNone or UnsafeAllowNoneSignatureType.

A password, password hash, secret, API key, SSN or card number is put into JWT claims: in the payload of jwt.sign / SignJWT, jwt.encode, JWT.encode, JWT::encode or jwt.NewWithClaims, in a payload variable built just above, in a jjwt .claim() / Auth0 .withClaim(), or as a json-tagged field of a Go struct embedding jwt.RegisteredClaims.

Audience or issuer validation is switched off (verify_aud/verify_iss False in Python, ValidateAudience/ValidateIssuer = false in C#), or a token is verified against an identity provider's shared JWKS with no audience check in the file (jsonwebtoken, jose, express-jwt, Auth0 java-jwt, Spring Security NimbusJwtDecoder/JwtDecoders, golang-jwt).

Detects Kotlin Cipher.getInstance() calls that select ECB mode for any block cipher (AES, DES, DESede, Blowfish and others): an X/ECB transformation, a bare block-cipher name whose provider default is ECB, a template or concatenation with ECB in the mode position, or a constant holding one of those. RSA/ECB is not reported.

Detects RSA, DSA and Diffie-Hellman key pairs and DSA/DH domain parameters generated with fewer than 2048 bits in Kotlin: KeyPairGenerator.initialize(), AlgorithmParameterGenerator.init(), RSAKeyGenParameterSpec, Android keystore setKeySize() and Bouncy Castle RSAKeyGenerationParameters.

Detects Kotlin session and credential cookies sent without HttpOnly (servlet, Spring ResponseCookie, Ktor, Javalin, http4k, Micronaut, raw Set-Cookie headers) and HttpOnly explicitly disabled, so injected scripts cannot steal them.

Detects Kotlin plain TCP sockets (java.net.Socket, ServerSocket, NIO channels, SocketFactory.getDefault(), Ktor raw sockets) opened to or listening on a non-loopback address in a file that never applies TLS.

Detects MD5, SHA-1, MD2 and MD4 hashing in Kotlin through MessageDigest, Signature, Apache Commons DigestUtils, Guava Hashing, Spring Security MD4/MD5/SHA-1 password encoders and (for credentials) Okio, excluding HMAC, SHA1PRNG, the WebSocket handshake digest and Content-MD5 transfer checksums.

Reports user input read from an HTTP request, or a variable named as user input, spliced into the instruction text of an LLM prompt (f-string, template literal, concatenation, format), letting the user override the instructions.

Reports LLM response text, read directly or through up to two assignments, passed to eval(), exec(), os.system(), subprocess, or JavaScript eval/new Function/vm/child_process exec, enabling code execution through prompt injection.

Reports Anthropic, OpenAI and Groq API keys by their prefixes, and high-entropy literals assigned to LLM-provider key variables or passed to provider clients; placeholders and environment lookups are ignored.

Reports user input read from an HTTP request, or a variable named as user data, interpolated into an LLM system prompt (system role, system= argument, SystemMessage, PromptTemplate.from_template, a system prompt builder).

Reports LangChain code and shell execution capabilities given to an agent (PythonREPLTool, PythonAstREPLTool, ShellTool, BashProcess, create_python_agent, LLMMathChain, PALChain, load_tools python_repl/terminal, allow_dangerous_code=True).

Reports LLM response text, read directly or through up to two assignments, executed as SQL or interpolated into a query at execute(), text(), raw(), read_sql() or SQLDatabase.run().

Reports torch.load() calls, including multi-line calls and aliases, that do not pass weights_only=True or pass weights_only=False, since torch.load unpickles the file and can execute code from an untrusted checkpoint.

A package.json that declares dependencies has no committed lock file (package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, bun.lock, deno.lock) in its directory or a workspace root, so installs re-resolve floating ranges.

Reports eval(), new Function()/Function(), vm.runIn*Context/compileFunction/new vm.Script with a non-constant argument, and setTimeout/setInterval given a code string built from variables.

Reports child_process exec()/execSync() called with a command built by template-literal interpolation or concatenation, or a variable assigned such a string or a request value nearby.

Reports an Express app created with express() when nothing in the same npm package applies helmet(), lusca or explicit security headers.

Reports HTML written into the DOM of a JavaScript or TypeScript file from a non-constant value (insertAdjacentHTML, document.write, React dangerouslySetInnerHTML) that is not sanitized. innerHTML/outerHTML assignments are reported by VNX-NODE-027.

Reports lodash deep merge/set, deepmerge-style modules, $.extend(true, ...) and objectPath/dotProp.set called with request data (directly or via a nearby variable), which can write Object.prototype.

Reports SQL built with template-literal interpolation or concatenation (directly or via a nearby variable) passed to mysql, pg, sequelize, knex raw, TypeORM where conditions, Prisma $queryRawUnsafe or sqlite calls.

Reports redirects (res.redirect, ctx.redirect, reply.redirect, NextResponse.redirect, res.location, Location headers, window.location) whose target starts with request-controlled data and is not validated.

Reports a server-side HTTP request (fetch, axios, http(s).get/request, got, needle, superagent, undici, request, or curl/wget run as a subprocess) whose destination URL or host comes from req.query/body/params/headers/cookies or Koa ctx, directly or through a variable assigned from one. Fixed-host URLs and allowlisted destinations are not reported, and a request whose response is relayed back to the client is reported by VNX-441 instead.

Reports an fs/fs.promises/fs-extra call or res.sendFile/res.download whose path argument comes from req.query/params/body/url, Koa ctx or a handler that destructures its request ({ params }), directly or through a variable assigned from one (path.join included). Paths reduced with path.basename, checked with startsWith or an anchored regex, and sendFile with a root option are not reported.

Reports a template engine (ejs, pug/jade, Handlebars, nunjucks, lodash _.template, doT, Mustache, Eta, Squirrelly, swig) compiling or rendering a template source taken from req.query/body/params or Koa ctx, directly or through a variable or a concatenation built from one. User data passed as the render context is not reported.

Reports raw HTML written into the DOM by jQuery .html(), Vue v-html and Svelte {@html}, and by insertAdjacentHTML, document.write and dangerouslySetInnerHTML in HTML pages and components, from a DOM source, from markup spliced together with a non-literal, or from response data. innerHTML assignments are VNX-NODE-027's; the other sinks in JavaScript files are VNX-NODE-005's.

Reports a shell command built from req.query/body/params/headers or Koa ctx and run through child_process exec/execSync (by module alias, destructured import or promisify wrapper), spawn/execFile with shell: true or sh -c, shelljs exec or execa's command API. Argument arrays without a shell and escaped values are not reported.

Reports a MongoDB query filter (find, findOne, update*, delete*, count, aggregate...) taken from req.query/body or Koa ctx, as the whole filter or as a member value, or a $where clause built from any request value. Cast or $eq-wrapped values, sanitised input, findById and SQL ORM where: filters are not reported.

Reports a ws WebSocket server created without a verifyClient callback in a file that never checks the Origin header, and a Socket.IO server whose cors origin is '*' or true (or origins '*:*') without allowRequest, both of which allow Cross-Site WebSocket Hijacking.

Reports new RegExp()/RegExp() or String.match/matchAll compiling a pattern taken from req.query/body/params/headers or Koa ctx, directly or through a variable or concatenation built from one. Escaped input, RE2 and regex literals are not reported.

Reports node-serialize unserialize() and serialize-to-js deserialize() called with a non-constant value; both evaluate JavaScript embedded in the payload. Not reported: serialize(), constant arguments, other libraries' deserialize(), comments and strings.

Reports jsonwebtoken decode() in a file that never calls verify(), and a jsonwebtoken algorithms list containing 'none'. Not reported: decode-then-verify, a token the server issued itself, the browser jwt-decode package, jwt-simple, tests and comments.

Reports a string literal used as the key of jwt.sign/verify, session/JWT middleware, cookieParser, Koa/cookie-session keys or createHmac, directly or through a constant, and literal jwtSecret/sessionSecret-style config values. Not reported: env or config lookups, env fallbacks, tests, examples/ and comments.

Reports Node crypto.createCipher()/createDecipher() through crypto or any name bound to the crypto module, inline require('crypto') or a named import. Not reported: createCipheriv/createDecipheriv, node-forge's createCipher, same-named methods, comments and strings.

Reports noent: true (inline, across lines or in an options object) in files using libxmljs/libxmljs2, and libxml2-wasm's XML_PARSE_NOENT flag. Not reported: noent false or omitted, a noent key in files without libxml, a bare import, comments and strings.

Reports shelljs exec() whose command carries an Express/Koa/Lambda request value, directly or through variables assigned from one. Not reported: constant or program-built commands (release scripts), other shelljs commands, RegExp.exec, child_process (VNX-NODE-003), comments and strings.

Reports js-yaml 3 load()/loadAll() of request data or an uploaded file without a safe schema, and load() with DEFAULT_FULL_SCHEMA. Not reported: safeLoad, safe schemas, the program's own files, projects on js-yaml 4+, the yaml package, comments and strings.

Reports window 'message' handlers (inline or a named function in the same file) that never read event.origin or event.source, and postMessage(data, '*') to another window. Not reported: worker, WebSocket and port listeners, posts to the page's own window, explicit target origins, comments and strings.

Reports express-session or cookie-session options that set secure: false or httpOnly: false, and express-session configurations that never set cookie.secure, so the session id travels over plain HTTP or is readable by page scripts.

Reports spawn(), spawnSync(), execFile(), execFileSync() and execa() calls that enable a shell (shell: true or a shell path) while the command or an argument is not a constant, so shell metacharacters in that value run as commands.

Reports innerHTML/outerHTML assignments (= or +=) in JavaScript, TypeScript and inline page scripts whose value is not a constant and is not passed through DOMPurify or an escape/sanitize helper.

Reports the express() app or HTML-serving http.createServer handler of a Node.js project that sends HTML but sets no Content-Security-Policy anywhere (no helmet(), CSP middleware, header or meta tag), and helmet configured with contentSecurityPolicy: false.

Reports session and credential cookies set from Node.js without HttpOnly: res.cookie()/cookie.serialize() calls lacking httpOnly: true, Set-Cookie header literals without the attribute, and any cookie options with httpOnly: false.

Reports TURN relays that forward to loopback, private or link-local peers: node-turn servers, coturn allow-loopback-peers or private allowed-peer-ip settings, and turnserver.conf files with no denied-peer-ip.

Reports console, logger (winston, pino, bunyan) and debug-package calls that pass a variable or property named as a password, secret, token, API key, credential, authorization header, CVV, SSN or card number; words in the message text alone are not reported.

Reports bypassSecurityTrustHtml, Style, Script, Url and ResourceUrl calls whose argument is not a constant, since Angular stops sanitising the value and user data becomes cross-site scripting.

Detect an application's composer.json that requires Composer packages but has no composer.lock committed beside it, so every install re-resolves version ranges.

Detect a request value ($_GET, $_POST, $_COOKIE, php://input, Laravel request accessors) reaching exec(), system(), passthru(), shell_exec(), popen(), proc_open(), pcntl_exec(), the backtick operator or eval() without escapeshellarg() or validation.

Detect include, require, include_once and require_once statements whose path contains a request value, inline or through a variable assigned from one, enabling Local and Remote File Inclusion.

Detect header('Location: ...') and Refresh headers, wp_redirect() and PSR-7 withHeader('Location') whose destination is decided by a request value, enabling open redirects. Framework redirect helpers are reported by VNX-PHP-022.

Detect file_get_contents(), fopen(), copy(), image readers, curl_init(), CURLOPT_URL, get_headers(), fsockopen(), wp_remote_get(), Laravel Http and Guzzle client calls whose URL is decided by a request value, enabling SSRF.

Detect unserialize() and maybe_unserialize() on a request value (superglobals, php://input, request accessors, also wrapped in base64_decode() and similar) without an allowed_classes restriction.

Detect request data imported as local variables: extract() of superglobals or request data, parse_str()/mb_parse_str() without a result array, $$key or $GLOBALS[$key] assignment in a foreach over a superglobal, and import_request_variables().

Detect calls to phpinfo() in production PHP code, which disclose the PHP build, configuration, file paths, environment variables and request headers.

Detects preg_replace() and preg_filter() calls whose pattern literal (inline, split across lines, in an array of patterns, or in a variable assigned just above) carries the e modifier, which evaluates the replacement as PHP code. preg_replace_callback(), patterns without e and the call inside a comment or string are not reported.

Detects loose comparisons (==, !=, <>) that decide an authentication or integrity check: a hash result compared with a variable or a 0e literal, user input compared with a non-literal secret value, and strcmp() of user input tested with == 0 or negation. Strict comparisons, hash_equals(), password_verify() and input compared with a constant are not reported.

Detects request input concatenated or interpolated into SQL text passed to mysql(i)_query(), pg_query(), PDO/mysqli/SQLite3 query/exec/prepare, WordPress $wpdb->get_results()/get_row()/get_var() and Laravel DB::select/whereRaw-style calls, inline, through a variable or through a query string built from one. Bound parameters, escaped or integer-cast values, digit-validated values and single-quoted literals are not reported.

Detects request input written into the response without HTML encoding: echo, print, <?= ?>, printf() and die()/exit() of a superglobal or a variable read from one, an HTML fragment built with such a value (the $html .= pattern), and an echoed heredoc that interpolates one. Values passed through htmlspecialchars(), htmlentities(), (int) or json_encode() are not reported.

Detects XML parsing configured for entity expansion: simplexml_load_*(), new SimpleXMLElement(), DOMDocument load/loadXML and XMLReader open/xml with LIBXML_NOENT or LIBXML_DTDLOAD (inline, across lines or via a flags variable), substituteEntities/resolveExternals set to true, XMLReader SUBST_ENTITIES/LOADDTD enabled, and libxml_disable_entity_loader(false).

Detects session IDs a client can choose: session_id() given a $_GET/$_POST/$_REQUEST/$_COOKIE value (directly or via a variable read from one), a Laravel/Symfony session ->setId() given request input, and ini_set() enabling session.use_trans_sid or disabling session.use_only_cookies or session.use_strict_mode. A getter call or a generated ID is not reported.

Detects uploads stored under a client-chosen name with no extension allowlist: move_uploaded_file() whose destination contains $_FILES[...]['name'] or request input (directly or through variables built from it), and UploadedFile move()/storeAs() given getClientOriginalName() or getClientOriginalExtension() (inline or through a variable). An extension check against an allowlist, or a generated name, suppresses the finding; a client MIME-type check does not.

A password is hashed with MD5 or SHA-1, fast unsalted digests that GPUs and rainbow tables reverse in bulk. Reported: md5(), sha1(), hash('md5'|'sha1'|'md4'|'md2', ...) and MD5-crypt (crypt() with a '$1$' salt) when an argument names a password (a variable, property or array key such as $pass, $pass_new, $password, $userPassword, $pwd, $_POST['password'], $input['passwd']) or when the result is assigned to one ($user->password = md5(...), $hashedPassword = sha1(...), 'password' => md5(...)). Not reported: password_hash()/password_verify(), md5/sha1 of non-credential data (cache keys, ETags, checksums, md5_file(), the SHA-1 prefix sent to the Have I Been Pwned range API), hash('sha256', ...) (a fast hash for passwords is still weak but outside this rule), a digest of nothing but a random generator stored under a password name (substr(md5(rand()), 0, 8) generating a temporary password), password-reset tokens, lookalike names such as $bypass, and the call inside a comment or a string literal. A password passed straight into md5()/sha1()/hash('md5'|'sha1', ...) ($pass = md5($pass), md5($_POST['password']), sha1($salt . $password)) is reported by VNX-CRYPTO-007, a password hashed with a fast hash, and not here; this rule keeps the PHP shapes that rule does not read: MD5-crypt, hash('md4'|'md2'), and a digest stored under a password name ($user->password = md5($input['secret']), 'password' => md5(...)). Other MD5/SHA-1 uses are reported by VNX-327, VNX-CRYPTO-001 and VNX-CRYPTO-002.

Detects ldap_search(), ldap_list() or ldap_read() receiving a request value (superglobal or Laravel/Symfony request accessor, inline or through a variable assigned a few lines above) in its filter or base DN without ldap_escape() or validation.

Detects var_dump(), print_r(), var_export(), debug_zval_dump(), dump() or dd() writing a whole $_SESSION, $_SERVER, $_ENV, $_COOKIE, $GLOBALS or getenv() to the response, including echoed return-mode print_r()/var_export() (also through a variable echoed later); single elements, logging and tests are not reported.

Detects openssl_encrypt()/openssl_decrypt() with an AES/ARIA/Camellia CBC method (literal, variable, class constant or define()) and mcrypt CBC calls in files that compute no MAC (hash_hmac(), HASH_HMAC, sodium_crypto_auth()), leaving ciphertext open to bit flipping and padding oracles.

Detects disabled TLS verification in PHP HTTP clients: CURLOPT_SSL_VERIFYPEER/VERIFYHOST set to false, 0 or '', Guzzle 'verify' => false or RequestOptions::VERIFY => false, Laravel Http::withoutVerifying() and stream context 'verify_peer' => false, outside tests.

Detects a $guarded = [] property declaration and Model::unguard() without reguard() in Laravel application code; seeders, factories, migrations, pivot models, framework/vendor models and tests are not reported.

Detects Laravel/CodeIgniter redirect(), redirect()->to()/away(), Redirect::to()/away(), Symfony $this->redirect() and RedirectResponse whose destination starts with a request value, inline or via a nearby variable, unless a literal prefix pins the host or path or the value is validated. Raw Location headers and wp_redirect() are reported by VNX-PHP-004.

Detects anonymous or unauthenticated ldap_bind()/ldap_bind_ext() calls (no password, null DN, null or empty password) and logins that pass a request password to ldap_bind() without first rejecting an empty value.

Detects mb_ereg_replace()/mb_eregi_replace() whose options argument is a literal containing the 'e' (evaluate) modifier or comes from the request, and mb_regex_set_options() with 'e', which make PHP evaluate the replacement as code.

Reports calls to the PHP mcrypt functions that encrypt, decrypt or set up a cipher (mcrypt_encrypt/decrypt, mcrypt_cbc/cfb/ecb/ofb, mcrypt_module_open, mcrypt_generic, mdecrypt_generic, mcrypt_create_iv), directly or through call_user_func. Sizing and teardown helpers, same-named methods, polyfill definitions and mentions in strings or comments are not reported.

Reports session writes whose key comes from the request: $_SESSION[$_GET[...]] = ..., a variable or foreach key read from a superglobal or $request and then used as a $_SESSION key or a Session::put/session()->put/$session->set/set_userdata key, and whole request arrays merged into $_SESSION. Fixed or prefixed keys, nested keys under a fixed outer key, reads, and allowlist-checked keys are not reported.

Detect a Pipfile without Pipfile.lock, and a pyproject.toml managed by Poetry, PDM or uv that declares dependencies but has no lock file, leaving every install to re-resolve version ranges.

Detect eval() and exec() (and Pillow ImageMath.eval) called on a non-constant argument, which executes arbitrary code when any part of it is user-controlled.

Detect pickle-format deserialization (pickle, cPickle, _pickle, dill, cloudpickle load/loads/Unpickler, including aliases and imported names, and unsafe jsonpickle.decode), which executes code embedded in the data.

Detect yaml.unsafe_load() and yaml.load() calls with no Loader or with Loader/UnsafeLoader/CLoader, which let a YAML document construct arbitrary Python objects.

Detect values from Python's random module assigned to, passed as or returned from security-named values (passwords, tokens, nonces, salts, OTPs, session ids), where the secrets module is required.

Detect Django deployment settings modules that set DEBUG = True or default DEBUG to on when the environment variable is unset, exposing tracebacks, settings and SQL to any visitor.

Detect subprocess calls that run a non-constant command line through the shell (shell=True, getoutput, create_subprocess_shell, or an explicit sh -c list), enabling command injection when any interpolated part is user-controlled.

Detect the Werkzeug interactive debugger switched on in Flask code (app.run(debug=True), app.debug = True, config DEBUG = True, run_simple(use_debugger=True), DebuggedApplication(evalex=True)), which allows remote code execution through the debugger console.

Detect Jinja2, Flask and Django template configuration that turns autoescaping off (autoescape=False, an Environment with no autoescape in web code, or {% autoescape false %}), which renders user-supplied template variables without HTML escaping and enables cross-site scripting.

Detect TLS certificate verification turned off in requests or httpx: verify=False on a request call or on an httpx Client, AsyncClient or HTTPTransport (multi-line calls too), and session.verify = False, outside tests, strings, docstrings and comments.

Detect SQL text built with an f-string, % formatting, .format() or + from a variable and passed to execute(), asyncpg fetch(), pandas read_sql(), Django raw()/extra()/RawSQL or SQLAlchemy text(), directly or through a variable assigned a few lines above.

Detect request data (directly, through an assignment, a route parameter or a formatted string) used as the template source of render_template_string(), from_string() or a Jinja2, Mako, Django or Tornado Template(), which lets an attacker run template code on the server.

Detect ML and data loaders that unpickle under the hood: joblib.load, pandas.read_pickle, numpy.load(allow_pickle=True), torch.load without weights_only=True and Keras load_model(safe_mode=False), including aliases and from-imports. Plain pickle is reported by VNX-PY-003.

Detect Python XML parsers configured to resolve external entities (SAX external-entity features on, lxml resolve_entities=True or no_network=False, xmltodict disable_entities=False) or lxml parsing request data with the default parser, which can expose local files and internal network resources (XXE).

Detect request data (Flask, Django, DRF or a Flask/FastAPI route parameter) used as the pattern of re or regex compile, match, search, findall, sub or split without re.escape(), which lets an attacker submit a catastrophically backtracking pattern (ReDoS).

Detect Python web code that writes the whole request body to a model: **request.data into create/update, SQLAlchemy .values() or a model constructor, Query.update(request body), __dict__.update(request.json), an unguarded setattr loop over request keys, or a ModelSerializer/ModelForm with fields = '__all__'.

A password is hashed with MD5 or SHA-1 in a .py file. Reported: hashlib.md5()/hashlib.sha1() (also through `import hashlib as h` and `from hashlib import md5, sha1 as x`), hashlib.new('md5'|'sha1', ...) and PyCryptodome MD5.new()/SHA1.new()/SHA.new() whose argument names a password (password, passwd, passphrase, pwd, pw, a request field keyed 'pass'/'password'), whose argument is a variable assigned from such a value in the 8 lines above, or an .update(password) on a hasher created by one of those calls in the 10 lines above; a call broken across lines is read on its next line. Both algorithms are fast and broken, so a dumped hash is cracked offline in hours; use argon2id, bcrypt, scrypt or PBKDF2 with a high iteration count. Not reported: MD5/SHA-1 of data that is not a password (cache keys, ETags, file checksums), a call with usedforsecurity=False (HTTP digest auth), hashing a password reset token, SHA-256 and the password KDFs, and the calls in comments or string literals. A password passed straight into the call (hashlib.md5(password.encode()), md5(password) after from hashlib import md5, hashlib.new('sha1', password)) is reported by VNX-CRYPTO-007, which covers the same weakness across more algorithms and languages, and not here; this rule keeps the Python shapes that rule does not read: a password reached through a variable assigned a few lines above, a request field read by key, PyCryptodome MD5.new()/SHA1.new(), and an .update(password) on a hasher created earlier.

Detect Python code that generates a temporary file name without creating the file: tempfile.mktemp() (module aliases and from-imports included) and Python 2 os.tempnam()/os.tmpnam(). mkstemp, NamedTemporaryFile, mkdtemp and pytest's tmp_path_factory.mktemp() are not reported.

Detect Python code that passes paramiko AutoAddPolicy or WarningPolicy to set_missing_host_key_policy() (directly or through a variable), or defines a MissingHostKeyPolicy whose missing_host_key() accepts every key. RejectPolicy, imports and isinstance checks are not reported.

Detect Python code that extracts a tar archive (TarFile.extractall()/extract()) with no filter= (or filter='fully_trusted'), no filtering members= and no member path check above it. filter='data', a validating members function, a global extraction_filter and zipfile extraction are not reported.

Detect Python code that selects or allows SSLv2, SSLv3, TLS 1.0 or TLS 1.1: ssl PROTOCOL_* and pyOpenSSL *_METHOD constants, minimum_version/maximum_version (or urllib3 ssl_minimum_version/ssl_maximum_version) set to an old TLSVersion, pyOpenSSL set_min_proto_version()/set_max_proto_version() given an old *_VERSION, and options &= ~OP_NO_*. PROTOCOL_SSLv23/TLS, TLSv1_2 constants, OP_NO_* disabling and comparisons are not reported.

Reports SQL assembled by joining a list of pieces, one of them built from a variable, and passed to execute(), executemany(), executescript(), Django objects.raw() or pandas read_sql(). SQL built in one expression is reported by VNX-PY-011.

Reports an application Gemfile with no Gemfile.lock beside it (or a gems.rb with no gems.locked), so every bundle install resolves floating ranges afresh; gem libraries (gemspec), test fixtures and vendored gems are not reported.

Reports eval/instance_eval/class_eval/module_eval and shell-string system, exec, spawn, Kernel#open, IO.popen, backticks and %x() when request input reaches them directly or through a nearby variable, including system("sh", "-c", cmd); other argument-list forms, escaped input and constant-table lookups are not reported.

Reports Marshal.load/restore, Oj.load in object mode, Oj.object_load, JSON.load and JSON.parse with create_additions when request input, a Base64-decoded blob, an HTTP body or a socket read reaches them; local files and round trips are not reported.

Reports ActiveRecord query methods (where, order, select, group, pluck, find_by_sql, execute, select_all, ...) given SQL that interpolates, concatenates or formats request input, a variable assigned from it, or a parameter of the enclosing method or scope lambda, also on the line after the parenthesis, in an array or in Arel.sql; placeholders, hash conditions, to_i/quote values and allowlist-checked input are not reported.

Reports .html_safe, raw(), <%== %>, Haml != and Slim == applied to a model attribute, variable, method result or an interpolated string with a dynamic part, in Ruby, ERB, Haml and Slim; fixed literals, escaped values, translations and Rails helpers are not reported.

Reports request parameters reaching ActiveRecord create/update/new/assign_attributes/find_or_create_by and similar calls without a strong-parameters allowlist, every params.permit! call, and permit lists (single- or multi-line) that admit admin, role or permissions attributes outside admin controllers.

Reports YAML.load (and YAML::load), Psych.load, YAML.unsafe_load, load_stream, load_documents, load_file and unsafe_load_file when request input, an upload, a Base64-decoded blob or an HTTP body reaches them; safe_load, permitted_classes and the application's own files are not reported.

Reports Open3 pipeline, popen and capture calls in their single-string (shell) form when the command string interpolates, concatenates or formats request input, or is request input itself, including the sh -c argument form. Other argument-list forms, constants and Shellwords-escaped input are not reported.

Reports send, public_send, __send__ and try calls whose method name comes from params, request or cookies data, directly or through a variable assigned nearby, unless an allowlist check guards it.

Reports Ruby code that sets or passes OpenSSL::SSL::VERIFY_NONE (or verify_mode = 0), disabling TLS certificate verification; comparisons, none-mode option tables, comments, strings and test files are not reported.

Reports a Cargo.toml that declares dependencies but has no Cargo.lock in its own or any ancestor directory; workspace members covered by the root lock, manifests with empty dependency tables, and test/fixture/example manifests are not reported.

Reports .unwrap() or .expect() applied directly to parsing, deserialising or decoding a runtime value (str::parse, serde_json/toml from_str, String::from_utf8, base64/hex decode, Url::parse, Regex::new on a variable); literals, other unwraps and test code are not reported.

Reports unsafe blocks and expressions, unsafe fn declarations and unsafe impls that carry no safety justification (a // SAFETY: comment or a # Safety doc section); documented unsafe and the word unsafe in strings, comments and lint attributes are not reported.

Reports std/tokio process::Command that runs a shell (sh, bash, cmd, powershell) with -c//C/-Command and a non-literal command string, or whose program comes from a request extractor; constant shell commands and user input passed as a separate .arg() are not reported.

Reports panic!(), and .unwrap()/.expect() on a fallible I/O, parse, decode, database or await result, in the body of the function that directly encloses them when it returns Result (including io::Result, anyhow::Result and crate aliases); lock().unwrap(), literal parses, other return types and test code are not reported.

Reports a lossy `as` cast (narrowing, signed to unsigned, or unsigned to signed of the same width) of an integer just parsed or decoded from runtime data (parse::<T>(), from_str_radix, from_be_bytes, read_u32); widening casts, casts of values that were not decoded, and range-checked values are not reported.

Reports +, -, * and << on an integer just parsed or decoded from runtime data (parse::<T>(), from_str_radix, from_be_bytes, read_u32); checked/saturating/wrapping calls, values bounded by a comparison or min/clamp, and values that were not decoded are not reported.

Reports an axum or actix-web request value (Path/Query/Json/Form extractor, web::Path, match_info) that reaches .join, Path::new, File::open, std/tokio fs calls or NamedFile::open in the same handler; canonicalize+starts_with, '..' rejection, file_name() and integer extractors are not reported.

Reports a hard-coded AWS access key ID (AKIA, ASIA, ABIA, ACCA or A3T prefix plus 16 base32 characters), excluding AWS's documented EXAMPLE keys, placeholders, detector patterns and test files.

Reports a committed PEM private key (RSA, EC, DSA, OpenSSH or PKCS#8) whose armour line is followed by real base64 key material, excluding code that builds or strips the armour, placeholders, public keys, prose examples and test certificates.

Reports a hard-coded, high-entropy 40-character AWS secret access key assigned to an AWS secret-key name, a Terraform AWS secret_key, Go's NewStaticCredentials, or an SDK credentials constructor (Java, .NET, Ruby, PHP), excluding the documented example key, placeholders, hex digests, environment references and test files.

Reports a hard-coded GitHub token (ghp_, gho_, ghu_, ghs_, ghr_, github_pat_) or GitLab access token (glpat-) in any file, excluding placeholders, truncated tokens, prefix checks, environment and CI-secret references and test files.

Reports a hard-coded Google Cloud, Maps or Firebase API key (AIza plus 35 URL-safe base64 characters) in any file, excluding placeholders, longer tokens, prefix checks, environment references and test files.

Reports a hard-coded Stripe secret key (sk_live_ or sk_test_ plus 24 or more characters) in any file, excluding Stripe's published documentation keys, placeholders, publishable and restricted keys, environment references and test files.

Reports a hard-coded Slack token (xoxb-, xoxp-, xoxa-, xoxo-, xoxr-, xoxs- with a numeric id) or incoming-webhook/workflow URL in any file, excluding Slack's documented example webhook, placeholders, configured base URLs, environment references and test files.

Reports a database connection URL that embeds a literal password (PostgreSQL, MySQL, MongoDB, Redis, SQL Server, CockroachDB, JDBC password= parameters and Go MySQL DSNs), excluding interpolated and placeholder passwords, localhost databases, prose and example files, and test code.

Detects a full SendGrid API key (SG.<22>.<43>, delimited and high-entropy) in any file outside tests, fixtures, lock files and minified bundles; placeholder and wrong-length lookalikes are not reported.

Detects npm access tokens (npm_ + 36 characters), PyPI and TestPyPI API tokens, literal auth tokens in .npmrc and .yarnrc.yml (npmAuthToken, npmAuthIdent) and literal .pypirc passwords, in any file outside tests; environment references and npm_config_* identifiers are not reported.

Detects a signed JSON Web Token that decodes (JSON header and payload, alg other than none, not expired) in any file outside tests and prose; the jwt.io sample token, Supabase anon keys and the Supabase local demo keys are not reported.

Detects a server that answers cross-origin requests from any website: Access-Control-Allow-Origin echoing the request Origin without an allowlist check, set to *, or CORS middleware configured for every origin.

Detects cookies whose HttpOnly or Secure protection is switched off, and session or authentication cookies issued without HttpOnly, across Node, Python, Go, Java, .NET, PHP and Ruby.

Detects a literal password assigned to a variable, field, key or keyword argument named password, passwd, passphrase, secret_key or *_pwd, passed to a password setter, PHP define() or an XML property, or written as a bare value in a config file or docker-compose environment list, outside tests, templates and placeholders.

Detects JWTs issued unsigned or accepted as unsigned: the none algorithm among the allowed or signing algorithms, an alg none header, and unsigned-token APIs (jjwt unsecured() and parseClaimsJwt, PlainJWT, UnsecuredJWT, SigningMethodNone). Signature verification switched off for a signed token is reported by VNX-JWT-001.

Detects commands and tool settings that disable TLS certificate verification: curl -k/--insecure, wget --no-check-certificate, git sslVerify false, GIT_SSL_NO_VERIFY, NODE_TLS_REJECT_UNAUTHORIZED=0, npm strict-ssl false, pip --trusted-host, kubectl --insecure-skip-tls-verify (and kubeconfig insecure-skip-tls-verify: true), Ansible validate_certs: no and PowerShell -SkipCertificateCheck.

Reports redis://, amqp://, ftp://, telnet:// and ldap:// connection URLs that point at a remote host or carry a password, which send credentials and data in cleartext. Loopback, placeholder and credential-free compose service hosts, TLS schemes, comments and tests are not reported.

Reports hardcoded Anthropic (sk-ant-), OpenAI project/service-account/admin (sk-proj-, sk-svcacct-, sk-admin-) and Hugging Face (hf_) API keys of full length and real-key entropy. Placeholders, environment lookups, prefix checks and test paths are not reported.

Reports a committed Google Cloud service account key: a private_key PEM with a real body near type service_account, in JSON, escaped JSON, YAML, TOML or an object literal. Code that only reads or type-checks a key file, placeholder keys and test paths are not reported.

Reports hardcoded GitLab tokens (glpat-, gldt-, glrt-, glrtr-, glcbt-, gloas-, glptt-, glagent-, glft-, glimt-, glffct-, glsoat-) with real-token entropy. CI variable references, prefix and regex validation code, placeholders and test paths are not reported.

Detects a hardcoded Twilio auth token or API key secret: a 32-character secret assigned to a Twilio-named variable in a Twilio context, or passed beside an Account SID or API key SID to a Twilio client. A SID on its own is an identifier and is not reported.

Reports logging and print calls across 14 languages whose arguments carry a password, secret, API key, private key or access/refresh token value. Message text alone, descriptive names, masked or hashed values and presence checks are not reported.

Reports attacker-controlled github.event data (PR title/body/head ref, issue and comment bodies, commit messages and authors, toJSON of the event) expanded with ${{ }} inside a run: or script: block of a workflow or composite action. env: indirection, with: inputs, if: conditions and safe contexts are not reported.

Detects JavaScript/TypeScript (including script in .vue, .svelte and .html files) that writes an access token, refresh token, ID token, JWT or API key into localStorage, where any script on the origin, including an XSS payload, can read it.

Detect Azure Storage account keys (88-character base64 values) hardcoded next to a storage-key name, an AccountKey= connection-string segment, an access_key/ARM_ACCESS_KEY setting, the az --account-key flag, a shared-key credential constructor or a Blob/Queue/Table/Share service client, without flagging the public Azurite key or unrelated base64 hashes.

Detect DigitalOcean personal access tokens (dop_v1_ followed by exactly 64 hex characters) hardcoded in any file, ignoring placeholders, the bare prefix and test paths.

Detect Hugging Face user access tokens (hf_ followed by 34 to 40 letters or digits) hardcoded in code, notebooks and config, ignoring placeholders, hf_-prefixed CamelCase identifiers and test paths.

Detect npm access tokens (npm_ followed by exactly 36 letters or digits) in any file, and legacy UUID auth tokens written literally in .npmrc, .yarnrc or .yarnrc.yml (or echoed into one as //registry/:_authToken=), ignoring ${NPM_TOKEN} references, npm_config_* names and placeholders.

Detect PyPI and TestPyPI API tokens (pypi-AgEIcHlwaS5vcmc or pypi-AgENdGVzdC5weXBpLm9yZw followed by the macaroon body) hardcoded in .pypirc, workflows, Makefiles and scripts.

Detect Google OAuth client secrets (GOCSPX- followed by 28 characters, or a legacy 24-character client_secret beside a *.apps.googleusercontent.com client id) hardcoded in any file.

Detect Mailgun private API keys (key- plus 32 characters, or the 32-8-8 hex form) hardcoded in files that name Mailgun, ignoring pubkey- validation keys and unrelated key- values.

Detect PGP/GPG private key blocks committed to a repository: the BEGIN PGP PRIVATE KEY BLOCK header followed by armoured key material, not the header used as a constant or in documentation.

Reports an AWS Bedrock long-term API key: the ABSK prefix followed by 109 to 269 base64 characters, standing alone (not embedded in a longer base64 run). Placeholder and example values, test and fixture paths, and short-term bedrock-api-key- tokens (which expire within hours) are not reported.

Reports an Alibaba Cloud RAM AccessKey ID: a standalone token of LTAI followed by 12 or 20 letters and digits (the 16- and 24-character ID formats), in either case. A token made of letters only in a single case, placeholder values and test or fixture paths are not reported; the AccessKey secret is covered by VNX-SEC-161 and STS keys by VNX-SEC-145.

Reports a DigitalOcean API token: a standalone dop_v1_ personal access token, doo_v1_ OAuth access token or dor_v1_ OAuth refresh token followed by exactly 64 hex characters. Placeholder values and test or fixture paths are not reported.

Reports a Heroku platform API key: a standalone v2 key (HRKU-AA followed by 58 characters), or a legacy UUID-format key assigned to a name that contains heroku and key, token or secret (HEROKU_API_KEY=..., heroku_api_token: ..., ENV['HEROKU_API_KEY'] ||= ...), or sent as a Bearer token on a line that calls api.heroku.com. A bare UUID without that context, placeholder or example UUIDs and test or fixture paths are not reported.

Reports a HashiCorp Vault token: a standalone hvs. service token (24 or more base62 characters, so root and namespaced tokens are included), an hvb. batch token (138 to 300 characters), or a legacy s. service token (24 characters) only where it is assigned to a Vault token setting (VAULT_TOKEN=, vault_token:, X-Vault-Token:) or passed to vault login. A bare s.-prefixed word, a short hvs. run with no digit (a property access on a variable named hvs), a token = line inside a multi-line vault block, placeholders and test or fixture paths are not reported.

Reports a Terraform Cloud / Terraform Enterprise API token: a standalone token of 14 letters and digits, .atlasv1., and 60 or more base64url characters, in any file including .tfvars and .terraformrc. Placeholders and test or fixture paths are not reported.

Reports a GitLab personal, project or group access token: a standalone glpat- token followed by 20 or more base64url characters (the legacy 20-character form and the longer routable form). Placeholders, a body of lower-case words such as glpat-personal-access-token-here, and test or fixture paths are not reported; other GitLab token types are VNX-SEC-040.

Reports a GitLab infrastructure token by its documented prefix and body shape: pipeline trigger (glptt- + 40 hex), deploy (gldt-), runner authentication (glrt-), runner registration (GR1348941), Kubernetes agent (glagent-), CI job (glcbt-), OAuth application secret (gloas-), incoming mail (glimt-), feature-flag client (glffct-), feed (glft-) and SCIM (glsoat-) tokens. A prefix without a token body of the right length, placeholders and test or fixture paths are not reported; glpat- access tokens are VNX-SEC-039.

Reports Atlassian Cloud API tokens (ATATT3 prefix, and legacy 24-character tokens assigned to Jira/Confluence/Atlassian token fields) written into files.

Reports complete Slack incoming, workflow and trigger webhook URLs (hooks.slack.com) written into files; placeholder URLs are not reported.

Reports Twilio API key SIDs (SK followed by exactly 32 lowercase hex characters, standing alone) written into files.

Reports complete Microsoft Teams incoming webhook URLs (webhook.office.com/webhookb2 and legacy outlook.office.com/webhook) written into files.

Reports Discord bot tokens whose first segment is the base64 of a numeric Discord snowflake id, written into files.

Reports Square access tokens (EAAA plus 56-64 characters, or legacy sq0atp- OAuth tokens) standing alone in files; EAAA inside base64 blobs is not reported.

Reports Shopify tokens (shpat_, shpca_, shppa_, shpss_ followed by exactly 32 hex characters) written into files.

Reports OpenAI project, service-account and admin keys (sk-proj-, sk-svcacct-, sk-admin- with a body of 40+ characters) written into files.

Reports a complete Anthropic Admin API key (sk-ant-admin01-, a 93-character body and the AA terminator) in any file; prefixes, truncated keys, placeholders and test paths are not reported.

Reports a Google API key (AIza + 35 characters) on or within eight lines of a Gemini, PaLM, Vertex AI or Google GenAI SDK reference; Firebase web config keys and AIza keys with no generative-AI context are left to the generic GCP key rules.

Reports a RubyGems.org API key (rubygems_ + exactly 48 hex characters) in any file; bare prefixes, longer identifiers, placeholders and CI secret references are not reported.

Reports a JFrog Artifactory API key (AKCp + 69 alphanumerics) or reference token (cmVmd + 59 alphanumerics) as a whole token in any file; lookalikes inside longer base64 runs and placeholders are not reported.

Reports a SonarQube or SonarCloud token (squ_, sqp_ or sqa_ + exactly 40 hex characters) in any file; identifiers that only share the prefix, placeholders and CI secret references are not reported.

Reports a Datadog API key (32 hex) or application key (40 hex) assigned to a Datadog key name, or to a generic api_key/app_key/apiKeyAuth (including map entries and the Go client Key wrapper) in Datadog configuration; bare hex strings, the public RUM client token and variable references are not reported.

Reports New Relic user (NRAK-), insert (NRII-), ingest license (…NRAL) and browser (NRJS-) keys as whole tokens; the browser key inside the public NREUM loader snippet and placeholders are not reported.

Reports Sentry user (sntryu_ + 64 hex), organisation (sntrys_eyJ…) and legacy 64-hex auth tokens assigned to SENTRY_AUTH_TOKEN, .sentryclirc or sentry-cli --auth-token; DSNs, bare prefixes and placeholders are not reported.

Reports a hard-coded Grafana service account token (glsa_), Grafana Cloud access policy token (glc_eyJ...) or legacy Grafana API key (eyJrIjoi...), but not bare prefixes, placeholders, ordinary JWTs or tokens read from the environment.

Reports a hard-coded Notion integration token (ntn_ + 11 digits + 35 alphanumerics, or a legacy secret_ token in a file that names Notion), but not bare prefixes, placeholders or tokens read from the environment.

Reports a hard-coded Linear personal API key (lin_api_ + 40 alphanumerics) or OAuth access token (lin_oauth_ + 64 hex), but not bare prefixes, placeholders, lookalike identifiers or keys read from the environment.

Reports a hard-coded Airtable personal access token (pat + 14 alphanumerics + . + 64 hex) or a legacy key-prefixed API key when Airtable is named on that line or up to three code lines above it, but not placeholders, ordinary key-prefixed identifiers or tokens read from the environment.

Reports a PostgreSQL connection URL (postgres://, postgresql+driver://, jdbc:postgresql) that embeds a literal password, but not interpolated or default passwords, localhost servers, documentation or example files.

Reports a MySQL or MariaDB connection URL (mysql://, mariadb://, mysql+driver://, jdbc:mysql) that embeds a literal password, but not interpolated or default passwords, localhost servers, documentation or example files.

Reports a MongoDB connection URL (mongodb://, mongodb+srv://) that embeds a literal password, but not interpolated or default passwords, localhost servers, documentation or example files.

Reports a Redis connection URL (redis://, rediss://, including the empty-user redis://:password@host form) that embeds a literal password, but not interpolated or default passwords, localhost servers, documentation or example files.

Detects literal HTTP Basic credentials: a "Basic <base64>" header value that decodes to a real user:password pair.

Detects literal HTTP Bearer tokens: a "Bearer <token>" value of 20+ high-entropy characters written into code, scripts or request files.

Detects curl invocations that pass a literal user:password (or an API key as the user) with -u/--user.

Detects 64-hex Ethereum private keys assigned to a private-key name, passed to a wallet, signer or transaction-signing call, or listed in a Hardhat accounts array.

Detects age identities (AGE-SECRET-KEY-1 or the post-quantum AGE-SECRET-KEY-PQ-1, followed by 58 Bech32 characters) in any file.

Detects 1Password service account tokens (ops_eyJ...) and account Secret Keys (A3-XXXXXX-...) in any file.

Detects captured GitLab session cookie values (_gitlab_session with a 32-hex session id) in any file.

Detects high-entropy literals (20+ characters, letters and digits) assigned to a name that ends in a credential word such as api_key, secret, token or password.

Reports an http(s), ws(s), ftp(s) or sftp URL that embeds a literal user:password pair, excluding interpolated and placeholder passwords, loopback and example hosts, database schemes, docs and test files.

Reports each credential entry with a literal value in the data: or stringData: block of a committed Kubernetes Secret manifest, excluding templated, referenced, SOPS-encrypted, empty and placeholder values and other kinds such as SealedSecret.

Reports a literal WireGuard private or preshared key (a 32-byte base64 key) in a wg-quick configuration, or assigned to a private-key name in a WireGuard-related YAML, JSON, Nix, .env, NetworkManager, RouterOS, OpenWrt or Go file.

Reports a whole Telegram Bot API token (bot id, a colon and a 35-character AA... secret) in any file, excluding placeholders, low-entropy bodies, environment references and test files.

Reports a whole Mapbox public access token (pk.eyJ... with its signature) in any file, excluding secret sk. tokens, placeholders, environment references, minified and test files.

Reports a whole Doppler personal token (dp.pt. and 43 characters) in any file, excluding service, CLI and service-account tokens, placeholders, truncated tokens, environment references and test files.

Reports a whole GitHub fine-grained personal access token (github_pat_ with its 22 and 59 character parts) in any file, excluding placeholders, truncated tokens, prefix checks, CI-secret references and test files.

Reports a whole GitHub OAuth (gho_), App user-to-server (ghu_), installation (ghs_) or refresh (ghr_) token in any file, excluding classic and fine-grained PATs, prefix lists, truncated tokens, placeholders and test files.

Detects passwords, API keys, client secrets, tokens and private keys given as string literals in Swift declarations, assignments, argument labels, dictionaries and HTTP header values, password comparisons with a literal, and Bearer/Basic Authorization literals; placeholders, lookup keys, identifier and path constants, interpolated strings and test files are not reported.

Detects a password, token, secret, API key or credential value passed to or interpolated into NSLog, print, debugPrint, dump or CocoaLumberjack DDLog*, logged by os_log with %{public}, or interpolated into os.Logger with privacy: .public.

Detects a password, token, secret, API key, PIN or other credential written to UserDefaults/NSUserDefaults (set, setValue, setObject) or kept in a SwiftUI @AppStorage property, both of which store an unencrypted plist.

Detects Swift code that accepts a server certificate without validating it: URLCredential(trust:) built without evaluating or pinning the trust, Alamofire DisabledTrustEvaluator/.disableEvaluation, kCFStreamSSLValidatesCertificateChain false, setAllowsAnyHTTPSCertificate, Starscream disableSSLCertValidation/allowSelfSigned, and a Network.framework verify block that always completes true.

Detects WKPreferences.javaScriptCanOpenWindowsAutomatically assigned true, and the first use per file of the deprecated UIWebView type, both of which widen what page JavaScript can do in an iOS app.

Detects the libc rand/random/drand48 family and GameplayKit random sources (directly or through a source variable) used to produce a token, nonce, salt, key, IV, PIN, OTP or password in Swift; arc4random, SystemRandomNumberGenerator and .random(in:) are CSPRNG-backed on Apple platforms and are not reported.

Detect S3 buckets and objects in Terraform whose ACL grants access to everyone: public-read, public-read-write or authenticated-read canned ACLs, or grants to the AllUsers or AuthenticatedUsers groups, unless the bucket's own public access block (in any file) or the module's inputs neutralise them.

Detect AWS security group ingress in Terraform that admits any address (0.0.0.0/0 or ::/0) through inline ingress blocks (block or attribute form), aws_security_group_rule, aws_vpc_security_group_ingress_rule or the terraform-aws-modules security-group module, except a listener on exactly port 80 or 443.

Detect AWS database instances in Terraform (aws_db_instance, aws_rds_cluster_instance, aws_redshift_cluster, aws_redshiftserverless_workgroup, aws_dms_replication_instance or an RDS module) configured with publicly_accessible = true.

Detect IAM policy statements in Terraform that allow every action (Action "*" in jsonencode, heredoc or one-line escaped JSON policies, actions = ["*"] in aws_iam_policy_document or an Azure custom role), skipping statements whose own Effect is Deny.

Detect EBS volumes in Terraform created without encryption at rest: encrypted = false on volumes, snapshot copies, instance block devices and launch templates, or an aws_ebs_volume that sets neither encrypted nor snapshot_id, unless the account enables EBS encryption by default.

Detect EC2 instances and launch templates in Terraform that leave the token-less IMDSv1 enabled (http_tokens = "optional" in resources or the ec2-instance/autoscaling modules, metadata_options without http_tokens, or no metadata_options), which lets SSRF steal IAM credentials from the metadata endpoint.

Detect EKS clusters in Terraform whose Kubernetes API endpoint is public to the whole internet: endpoint_public_access = true or left at its public default without a restricting public_access_cidrs, or an EKS module with public access turned on.

Detect literal AWS access key ids (AKIA/ASIA) and 40-character secret keys hardcoded in Terraform provider blocks, s3 backends, .tfvars files, function environment maps and ECS name/value environment entries, which expose IAM credentials to anyone who can read the repository or its history.