Xygeni Documentation xygeni
search
home

XyDocs

    • Suspect Dependencies Detectors
      • Anomalous Dependency
        • Maven Anomalous Dependency
        • NPM Anomalous Dependency
        • NuGet Anomalous Dependency
        • PyPI Anomalous Dependency
      • Dependency Confusion
        • NPM Dependency Confusion
        • NPM Unscoped internal components
        • NuGet Dependency Confusion
        • PiP Dependency Confusion
      • Known Vulnerabilities
        • Dependency with important known vulnerabilities
      • Malware
        • DotNet Malware Dependency
        • Java Malware Dependency
        • NPM Malware Dependency
        • Python Malware Dependency
      • Suspicious Scripts
        • NPM Suspicious Scripts
        • PyPI Suspicious Scripts
      • Typosquatting
        • Maven Typosquatting
        • NPM Typosquatting
        • NuGet Typosquatting
        • PyPI Typosquatting
    • CI/CD Misconfigurations Detectors
      • Avoid Open Versions
        • Maven Avoid Open Versions
      • Avoid Public Repositories
        • Maven Avoid Public Repositories
        • NPM Avoid Public Repositories
        • NuGet Avoid Public Repositories
        • PyPI Avoid Public Repositories
      • CI/ CD Security
        • Avoid calls to Jenkins getInstance method
        • Branches configured to trigger a pipeline exposed to secrets has a correlating branch protection rule in the SCM
        • Build attestation framework should be used
        • CI/CD Bot should not be able to approve a code review
        • CI/CD argument values should not flow directly into workflows
        • Ensure that CI/CD apps do not use too broad permissions
        • Ensure that groups do not use too broad permissions.
        • Potential injected malicious code into files referenced by the pipeline configuration file
        • Pull Requests do not execute the pipelines modifications that they include
        • Repository should be associated with an approved CI/CD app
        • Secrets and Credentials at organization level should not widely shared
        • Secrets should be stored explicitly as encrypted GitHub Actions Secrets
        • Secrets used in workflows should not be echoed in the console
        • Signed Container Images
        • Suspicious Pull Request merge invocation
        • Unusual activity at CI/CD environments should be monitored
        • Webhook URL is not allowed
        • Workflows should not use insecure commands
      • CI/ CD Tools
        • Dangerous Workflow
        • Dependency Update Tool
        • Ensure all external dependencies used in the build process are locked
        • Ensure scanners are in place to identify and prevent sensitive data in pipeline files
        • Fuzzing
        • Inadequate Backups of Jenkins Instance
        • Lack of Secure Authentication
        • Lack of Secure Authorization
        • Lack of administrative monitor and logging
        • SAST in use
        • Secure Jenkins version
        • Token Permissions
        • Unsecured Communication
        • Use of Deprecated or Vulnerable Plugins
        • Workflow permissions are not minimal
      • CI/CD Security
        • Malicious script in a CI/CD pipeline.
      • Confusing Names
        • PyPI Confusing Names
      • Container Security
        • 'dnf clean all' missing
        • 'microdnf clean all' missing
        • 'yum clean all | packages' missing
        • 'zypper clean' missing
        • ADD instead of COPY
        • COPY with multiple sources must end destination with /
        • Container runs as root
        • Deprecated MAINTAINER used
        • Exposed port out of range
        • Multiple CMD instructions
        • Multiple ENTRYPOINT instructions
        • No HEALTHCHECK defined
        • RUN package-manager update instruction alone
        • RUN using sudo
        • SSH port exposed
        • WORKDIR path is not absolute
        • WORKDIR should not be mounted on system dirs
        • apk add is missing --no-cache
        • apt-get dist-upgrade used
        • apt-get missing –no-install-recommends
      • Lack Of Version Pinning
        • NPM Lack of Version Pinning
        • NuGet Lack of Version Pinning
        • PyPI Lack of Version Pinning
      • Malicious Image
        • Reverse Shell in Container Image
      • Package Managers
        • Insecure Package Registry webhook
      • Releases
        • Signed Releases
      • SCM
        • Binary artifacts found
        • Code Review
        • Ensure all checks have passed before merging new code
        • Ensure issues deletion is limited to specific users
        • Ensure maximum number of administrators are set for the organization
        • Ensure pipelines are automatically scanned for vulnerabilities
        • Ensure repository creation is limited to specific members
        • Ensure repository deletion is limited to specific users
        • Ensure strict base permissions are set for repositories
        • Ensure the organization is requiring members to use Multi-Factor Authentication (MFA)
        • Ensure two administrators are set for each repository
        • Ensure verification of signed commits for new changes before merging
        • Insecure Webhook
        • Security Policy
        • The Software Bill of Materials (SBOM) is not produced
        • Unprotected branch
        • Vulnerabilities
      • URL Dependency
        • NPM URL Dependency
        • PyPI URL Dependency
      • Use HTTPS With Remote Repositories
        • Maven Use HTTPS with remote repositories
        • NuGet Use HTTPS with remote repositories
        • PyPI Use HTTPS with remote repositories
    • Hardcoded Secrets Spotting
      • API Key
        • Abstract API Key
        • AccuWeather API key
        • Adafruit IO Key
        • Anthropic API key
        • Authress Service Client Access Key
      • API Token
        • Aiven Token
        • Akamai API Token
        • Alchemy API Key
        • Alibaba Cloud Access Key ID
        • Alibaba Cloud Secret Access Key
        • Amazon MWS Token
        • Amazon Web Services Keys ID
        • Amazon Web Services Keys Secret
        • Amazon Web Services Keys Token
        • Artifactory API Key
        • Artifactory Access Token
        • Atlassian API token
        • Auth0 Keys
        • Azure Personal Access Token
        • Azure Service Management Certificate
        • Bitbucket Repository Access Token
        • CircleCI Personal Token
        • CircleCI Project Token
        • Clockwork Key
        • Cloudant Keys
        • Cloudflare Credentials
        • Cloudflare Global API Key
        • Codacy API Token
        • Codacy Project Token
        • Codeclimate key
        • Codecov Token
        • Codecov Token in codecov Command
        • Confluent Keys
        • Contentful Content Delivery API Key
        • Contentful Content Management personal access token
        • Coveralls Config Token
        • Coveralls Token
        • Crates.io Key
        • Customer.io App Keys
        • Customer.io Track Encoded Keys
        • Customer.io Track Keys
        • Databricks Authentication Token
        • Datadog API Credentials
        • Digital Ocean OAuth Client Secret
        • DigitalOcean Spaces Keys
        • DigitalOcean Token
        • Discord Bot Token
        • Discord Oauth2 Keys
        • Docker Swarm Join Token
        • Docker Swarm Unlock Key
        • Dropbox App Credentials
        • Dropbox Key
        • Facebook App Keys
        • Firebase Cloud Messaging API Key
        • Flutterwave API Key
        • Gemfury credentials
        • Gemini API Key
        • GitHub token
        • GitLab Enterprise Personal Access Token
        • GitLab Personal Access Token
        • GitLab Personal Access Token in URL
        • Google API Key
        • Google OAuth2 Keys
        • Grafana Personal Token
        • Grafana Service Account Token
        • Heartland API Key
        • Heroku Platform Key
        • HubSpot API Key
        • Intercom Access Token
        • JSON Web Token
        • Kubernetes JWT
        • Line Messaging OAuth2 Keys
        • Line Token
        • Linkedin OAuth2 Keys
        • Linode Personal Access Token
        • Llama API Key
        • Mailchimp API Key
        • Mailgun Key
        • Midtrans API Key
        • Moneywave API Key
        • Npm Token
        • NuGet API Key
        • Okta Keys
        • Okta Token
        • OpenAI API Key
        • OpenWeatherMap Call Token
        • OpenWeatherMap URL Token
        • PayPal OAuth2 Keys
        • Planetscale API Key
        • Postman API Key
        • Pulumi Access Token
        • Pusher Channels Keys
        • Python Package Index API Token
        • RapidAPI Key
        • Razorpay API Key
        • RubyGems API Key
        • Salesforce Oauth2 Keys
        • Salesforce Refresh Tokens
        • Sendgrid API Key
        • Sentry Token
        • Shopify Generic App Token
        • Shopify Private App Token
        • Shopify Private Key
        • Shopify Private Key V2
        • Slack Access Token
        • Snyk Key
        • SonarQube Token
        • Spotify Keys
        • Square access token
        • Stripe Secret keys
        • Stripe Webhook Secret
        • Telegram Bot Token
        • Tencent Cloud Keys
        • Terraform Cloud Token
        • Travis Personal Token
        • Trello Keys
        • Twitch API Keys
        • Vultr Key
        • WePay API Token
        • Webex App Keys
        • Xygeni.io Token
        • Xygeni.io user / organization token
        • Zendesk Token
        • Zoom API JWT
        • mapbox Token
        • reCAPTCHA Key
      • Access Key
        • Artifactory Identity Token
        • Atlassian OAuth2 Client Secret
        • Azure Storage Access Key
        • Bitbucket OAuth Access Key
        • Cloudant Keys
        • Generic API key / token
        • Google Cloud Service Account Key
        • IBM Cloud Access Key
        • IBM Cloud Object Storage Key
        • Mend API Key
        • Mend User Key
        • Twitter Access Key
        • Veracode API Credentials
        • Zoom API JWT Keys
        • Zoom API Keys
        • Zoom SDK Keys
      • Access Token
        • Splunk Authentication Token
      • Crypto Key
        • Cryptographic Private Key
        • Cryptographic Private Key Putty
      • Data Storage Secret
        • Database Password
        • Database connection data
        • LDAP Credentials
        • MSSQL Credentials
        • MongoDB Password
        • MySQL Credentials Assignment
        • MySQL Credentials CLI
        • ODBC Connection String
        • Password in MongoDB Connection String
        • PostgreSQL Credentials Assignment
        • PostgreSQL Credentials Password file
        • RabbitMQ Address
        • RabbitMQ Password
        • RabbitMQ Password in URL
        • Redis CLI Credentials
        • Redis Credentials Assignment
        • Redis Password in URL
      • Encryption Keys
        • WordPress Security Key
      • Generic Secret
        • Azure Directory Application Secret
        • Base-64 encoded text
        • CLI Secret
        • CLI Secret embedded in a shell script
        • Credential with high entropy
        • Credentials File
        • Credit Card number
        • Discord Webhook
        • Django Secret Key
        • Generic Secret
        • Hubspot Webhook
        • Kubernetes Secret
        • Microsoft Teams Webhook
        • Potential information leak through comments
        • SMTP Assignment
        • SMTP Password
        • SSH Password
        • SSH Password Assignment
        • Slack API/Signing Secret
        • Slack Incoming Webhook URL
        • Twilio Webhook
      • OAuth Secret
        • Square OAuth secret
      • OAuth Token
        • HubSpot OAuth Token
        • NPM OAuth Token
      • Other
        • Cloudflare Credentials
        • HashiCorp Vault Unseal Key
        • Kubernetes User Certificate
      • Password
        • .htpasswd credentials
        • .pypirc credentials
        • Artifactory Encrypted Secret
        • Basic Authentication Credentials
        • Bitbucket Basic Auth
        • Bitbucket Client ID
        • Dockercfg Auth
        • Hardcoded password
        • Jira Basic Auth
        • Password in Maven pom.xml
        • Password in Maven settings.xml
        • Rails Master Key
        • Rails Secret Key Base
        • Snowflake Password
        • Snowflake Password in URI
        • Splunk Admin Password
        • VISA Basic Auth
        • passwd-like credentials
        • pip.conf credential
        • pip.conf proxy credential
      • Password Hash
        • Bcrypt Hash
      • Url
        • Hardcoded URL
    • IaC Flaws
      • AWS
        • ALB listening on HTTP
        • API Gateway has endpoint not private
        • API Gateway has no SSL certificate
        • API Gateway has no X-Ray active
        • AWS AMI Encryption is not enabled
        • AWS AMI is shared with multiple accounts
        • AWS EBS volume is not encrypted
        • AWS ElastiCache Redis cluster with encryption for data at rest is disabled
        • AWS RDS DB cluster encryption is disabled
        • AWS Redshift cluster is not encrypted
        • AWS Redshift cluster is publicly accessible
        • AWS Redshift using default port
        • AWS SQS server side encryption is not enabled
        • An unknown port has been exposed in the EC2 group
        • Auto Scaling group has no ELB group
        • Autoscaling launch configuration has no data in the volumes encrypted
        • Batch job has privileged container
        • CMK is unusable
        • CMK rotation is disabled
        • CloudFormation has no stack policy
        • CloudFormation has the stack retention disabled
        • CloudFormation stack notifications are disabled
        • CloudFormation without template
        • CloudFront distribution without strict security headers policy
        • CloudFront has no configured web application firewall
        • CloudFront logging is disabled
        • CloudTrail has no the SNS topic name configured
        • CloudTrail has the logging disabled
        • CloudTrail is not integrated with CloudWatch
        • CloudTrail log file validation is disabled
        • CloudTrail multi region disabled
        • CloudWatch has no retention period
        • CodeBuild Project encryption is disabled
        • CodeBuild Project is not encrypted
        • Configuration aggregator has no all regions enabled
        • Data stored in Aurora is unencrypted at rest
        • EBS volume is not encrypted
        • EC2 Instance using default VPC
        • EC2 group has HTTP port open to internet
        • EC2 group has SQL analysis services port publicly accessible
        • EC2 group has no restrict access to administration ports
        • EC2 instance has public IP
        • EC2 instance should not have public IP
        • EC2 instance without VPC
        • EC2 security group has unrestricted traffic access
        • EC2 with EBS not optimized
        • ECR image repository has public access
        • ECR image scan on push is disabled
        • ECR image tag is mutable
        • ECS Service admin role is present
        • ECS Service task has network mode different to awsvpc
        • ECS Service without running task
        • ECS Task definition has secrets in the container environment in plain text
        • EFS is not encrypted
        • EFS without tags
        • ELB use weak ciphers
        • ElastiCache using default port
        • ElastiCache without VPC
        • Ensure ALB protocol is HTTPS
        • Ensure AWS EKS cluster security group is not overly permissive to all traffic
        • Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0
        • Ensure AWS IAM password policy does not allow password reuse
        • Ensure AWS IAM policy does not allow assume role permission across all services
        • Ensure AppSync has Field-Level logs enabled
        • Ensure AppSync has Logging enabled
        • Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption
        • Ensure CloudTrail logs are encrypted at rest using KMS CMKs
        • Ensure Code artifact Domain is encrypted by KMS using a customer managed Key (CMK)
        • Ensure DAX encryption at rest is not disabled
        • Ensure DB instance gets all minor upgrades automatically
        • Ensure DMS replication instance is not publicly accessible
        • Ensure DocDB TLS is not disabled
        • Ensure DocumentDB is encrypted at rest
        • Ensure DynamoDB Point-In-Time Recovery (PITR) is enabled
        • Ensure DynamoDB point in time recovery is enabled
        • Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK)
        • Ensure EFS is securely encrypted
        • Ensure Elasticsearch Domain enforces HTTPS
        • Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions
        • Ensure Glue Data Catalog Encryption is enabled
        • Ensure IAM policy documents do not allow * as a statement’s action
        • Ensure IAM role allows only specific services or principals to assume it
        • Ensure KMS key policy does not contain wildcard (*) principal
        • Ensure Kinesis Stream is securely encrypted
        • Ensure Neptune Cluster instance is not publicly available
        • Ensure Neptune logging is enabled
        • Ensure Neptune storage is securely encrypted
        • Ensure Redshift cluster encryption at rest is enabled
        • Ensure Redshift cluster is not publicly accessible
        • Ensure Redshift uses SSL
        • Ensure S3 Bucket ACL doesn’t allow public write
        • Ensure S3 buckets are encrypted with KMS by default
        • Ensure SQS policy does not allow ALL (*) actions
        • Ensure SageMaker Endpoint is encrypted
        • Ensure SageMaker Notebook is encrypted at rest using KMS CMK
        • Ensure all Elasticsearch has node-to-node encryption enabled
        • Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit
        • Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token
        • Ensure all data stored in the SNS topic is encrypted
        • Ensure no IAM policies documents allow * as a statement’s actions
        • Ensure no hard-coded secrets exist in EC2 user data
        • Ensure no hard-coded secrets exist in lambda environment
        • Ensure that ALB drops HTTP headers
        • Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager
        • Ensure that Secrets Manager secret is encrypted using KMS CMK
        • Ensure that Timestream database is encrypted with KMS CMK
        • Ensure that Workspace root volumes are encrypted
        • Ensure that Workspace user volumes are encrypted
        • Glue Security Configuration has encryption disabled
        • Glue component has a security configuration associated
        • GuardDuty is not enabled at organization level
        • IAM Assume role policy without ExternalId or MFA
        • IAM Group without users
        • IAM Password is unchangeable in the policy
        • IAM Password policy has no expire
        • IAM Password policy has no reuse prevention
        • IAM Password policy has no the minimum length
        • IAM Password policy without lowercase letter
        • IAM Password policy without number
        • IAM Password policy without uppercase letter
        • IAM database is not enabled
        • IAM policy grants 'AssumeRole' permission to all principals
        • IAM policy grants 'AssumeRole' permission to all services
        • IAM policy has allowed full administrative privileges for all resources
        • IAM policy has granted full permissions to resources
        • IAM policy is attached to user
        • IAM policy with full wildcard administrative privileges
        • KMS Key has a vulnerable policy
        • Kinesis is not encrypted with KMS
        • Lambda function has no tags
        • Lambda function without X-Ray tracing
        • Lambda permission principal contains a wildcard
        • Launch configurations do not have encrypted EBS volumes
        • Load Balancer has deletion protection disabled
        • Load balancer is using insecure TLS policy
        • MSK Cluster encryption at rest or in transit is disabled
        • Public facing ALB not protected by WAF
        • RDS cluster without backup plan
        • RDS has automatic minor upgrades disabled
        • RDS has been defined with public interface
        • RDS has been defined with public subnet
        • RDS has opened a large scope
        • RDS using default port
        • RDS with backup disabled
        • Redis version is not compliant with AWS PCI DSS
        • Remote Desktop Port is open to all internet
        • S3 Bucket ACL allows public read access
        • S3 Bucket CORS is allowed for all origins
        • S3 Bucket SSE disabled
        • S3 Bucket has Read access for all authenticated users
        • S3 Bucket has all actions allowed for any principal
        • S3 Bucket has allowed Delete Action from all principals
        • S3 Bucket has allowed Get Action from all principals
        • S3 Bucket has allowed List Action from all principals
        • S3 Bucket has allowed Put Action from all principals
        • S3 Bucket has allowed access for all principals
        • S3 Bucket has public Read access
        • S3 Bucket logging is not enabled
        • S3 Bucket without versioning
        • S3 Storage is not protected with SSE
        • S3 bucket has block public ACLs disabled
        • SES Policy allow actions for all principals
        • SNS Topic is publicly accessible
        • SQS Policy allow all actions
        • SQS Policy has dangerous access for all principals
        • SQS Queue is exposed
        • SQS without server side encryption
        • The CA certificate for the RDS is outdated
        • The CIDR IP has public interface
        • The CloudFront has a default SSL certificate
        • The CloudFront has an insecure protocol version
        • The connection between CloudFront and the origin server has HTTP allowed
        • The encryption for the EFS is without KMS
        • The log files in CloudTrail are not encrypted with KMS
        • The storage in the RDS is not encrypted
        • User data contains a base64 encoded private key
        • User data shell script is not encoded
        • Verify CloudFront Distribution Viewer Certificate is using TLS v1.2
      • Ansible
        • CosmosDB has no range ip filter configured
        • Do not create files without permissions control
        • Do not install the latest packages with package managers
        • Do not log passwords
        • Do not use deprecated modules
        • Do not use integers to octal file permissions in YAML
        • Do not use the latest checkout
        • Do not use the same owner and group to transfer files
      • Azure
        • A sensitive port for TCP or UDP protocols is open for the whole network
        • AKS monitoring logging is not enabled
        • Active Directory Administrator is not configured for SQL server
        • Active Directory account has predictable username as 'Admin' or 'Root'
        • App Service is not registered with an Azure Active Directory account
        • Application Gateway WAF has essential rules disabled
        • Azure App Service Web app authentication is Off
        • Azure App Service Web app does not redirect HTTP to HTTPS
        • Azure App Services FTP deployment is AllAllowed
        • Azure Data factory public network access enabled
        • Azure Kubernetes Cluster without RBAC enabled
        • Azure Kubernetes Service has no network policy configured
        • Azure Linux scale uses password authentication
        • Azure MariaDB database server with SSL connection disabled
        • Azure SQL Server threat detection alerts are not enabled for all threat types
        • Azure SQL server audit log retention is too low
        • Azure SQL server auditing is disabled
        • Azure VM data disk is encrypted with the default encryption key instead of ADE/CMK
        • Azure Virtual Network has no a Network Security Group
        • Azure WAF policy disabled or without Detection or Prevention modes
        • Azure application gateway does not have WAF enabled
        • Azure default network access for Storage Account is allowed
        • Azure front door does not have WAF enabled
        • Azure front door does not use WAF in Detection or Prevention modes
        • Azure function app authentication is off
        • Azure key vault is not recoverable
        • Azure linux instance with password authentication
        • CosmosDB without tags
        • Do not allow public access container or its blobs
        • Do not allow the admin user to login to the container registry
        • Do not put the storage account access as public
        • Ensure Azure MariaDB servers dont have public network access
        • Ensure Azure subscriptions with custom roles have minimum permissions
        • Ensure RDP Internet access is restricted
        • Ensure SSH Internet access is restricted
        • Ensure all keys have an expiration date
        • Ensure all secrets have an expiration date
        • Ensure public access level for Blob Containers is set to private
        • Ensure that 'Send Alerts To' is enabled for MSSQL servers
        • Ensure that Azure Defender is set to On Container Registries
        • Ensure that Azure Defender is set to On for App Services.
        • Ensure that Azure Defender is set to On for Kubernetes
        • Ensure that Azure Defender is set to On for Servers
        • Ensure that standard pricing tier is selected
        • Front Door WAF has essential rules disabled
        • Key vault key is not backed by HSM
        • Log profile is not capturing all activities
        • MSSQL servers do not have email service and co-administrators enabled
        • MySQL is not using the latest version of TLS encryption servers
        • No Network Security Group is attached to the Virtual Machine
        • Non SSL Redis Cache port is enabled
        • PostgreSQL checkpoint logging is not enabled
        • PostgreSQL connection throttling is not enabled
        • PostgreSQL connections logging is not enabled
        • PostgreSQL disconnections logging is not enabled
        • PostgreSQL duration logging is not enabled
        • PostgreSQL log retention is not enabled
        • Role definition has enabled custom role creation
        • Role-Based Access Control (RBAC) is disabled for AKS
        • SQL Server is not using the latest version of TLS encryption
        • SQL databases allow ingress from 0.0.0.0/0
        • SQL servers do not enable data security policy
        • SSL is disabled for MySQL
        • SSL is disabled for PostgresSQL
        • Secure transfer required is not enabled
        • Send email notification for high severity alerts is not enabled
        • Send email notification for high severity alerts to admins is not enabled
        • Storage account does not use the latest version of TLS encryption
        • Storage for critical data not encrypted with Customer Managed Key
        • The IP configuration allow a lot of IPs
        • The Key Vault is not soft delete
        • The SQL Server Admin account has predictable username as 'Admin' or 'Root'
        • The active log retention is lower than 365 days
        • The application gateway has no firewall configured
        • The configured minimum TLS version is not the latest version
        • The container register has no locks
        • The firewall rule allowing a lot of hosts to access
        • The firewall rule allowing unrestricted access to Redis
        • The storage account has http traffic allowed
        • The web application has http traffic allowed
        • Trusted Microsoft Services should be enabled for Storage Account access
        • UDP Internet access is not restricted
        • Unencrypted Data Lake Store accounts
        • Unrestricted access to SQL Server
        • Virtual Machine extensions are installed
        • Web App does not use the latest version of TLS encryption
      • Docker
        • Container runs as root
        • Healthcheck instructions have not been added to container image
        • SSH port exposed
        • Unpinned version for base image
      • GCP
        • BigQuery dataset is public accessible
        • Check if the Google compute firewall allows unrestricted RDP access
        • Cloud Storage Anonymous or Publicly Accessible
        • Cloud Storage Bucket should have versioning enabled
        • Cloud storage bucket should have logging enabled
        • Cluster Master Authentication Disabled
        • Compute instances must be launched with Shielded VM enabled
        • Compute instances shouldn’t be accessible from the Internet
        • DNSSEC Using RSASHA1
        • DNSSEC must be enabled for Cloud DNS
        • Defaults Kubernetes Engine Clusters should not be configured to use the default service account
        • GCP SQL Instance should not have insecure Cross DB Ownership Chaining On
        • Google Compute Engine VM instances should not enable serial ports
        • Google Compute Network should not use a firewall rule that allows all ports
        • Google Compute Network should not use a firewall rule that allows port range
        • Google Compute Network should not use default firewall rule
        • Google Compute SSL Policy Weak Chyper Suits is Enabled
        • Google Compute Subnetwork should have Private Google Access enabled
        • Google Firewall should not allow SSH access (port 22) from the Internet (public CIDR block)
        • Google Kubernetes Engine (GKE) Basic Authentication must be disabled
        • Instances must not be configured to use the Default Service Account that has full access to all Cloud APIs
        • Instances must not have IP forwarding enabled
        • KMS encryption keys should be rotated every 90 days or less
        • Kubernetes Clusters must be configured with labels
        • Kubernetes Clusters must be created with Alias IP ranges enabled
        • Kubernetes Clusters must be created with Client Certificate enabled
        • Kubernetes Clusters must be created with Private Clusters enabled
        • Kubernetes Engine Clusters must have Legacy Authorization set to disabled
        • Kubernetes Engine Clusters must have Network Policy enabled
        • Kubernetes Engine Clusters must have Stackdriver Logging enabled
        • Kubernetes Engine Clusters must have Stackdriver Monitoring enabled
        • Management Kubernetes nodes must have auto upgrades set to true
        • Master authorized networks must be enabled in GKE clusters
        • MySQL Instance With Local Infile On
        • PostgreSQL Misconfigured Logging Duration Flag
        • PostgreSQL database 'log_min_messages' flag isn’t set to a valid value
        • PostgreSQL database 'log_temp_files' flag isn’t set to '0'
        • PostgreSQL database instance should have a 'log_checkpoints' flag with its value set to 'on'
        • PostgreSQL database instance should have a 'log_connections' flag with its value set to 'on'
        • SQL DB Instance Publicly Accessible
        • SQL Instance Backup Disabled
        • SQL Instance With SSL Disabled
        • SQL Instance should not have Contained Database Authentication On
        • The node image should be Container-Optimized OS(COS)
        • VM Instance With Full Cloud Access
        • VM Instance should block project-wide SSH keys
        • VM disks for critical VMs must be encrypted with Customer-Supplied Encryption Keys (CSEK) or Customer-Managed Encryption Keys (CMEK)
        • VM instance should have OSLogin enabled
      • Github
        • Ensure GitHub Actions secrets are encrypted
      • Kubernetes
        • API server without certificate / private key
        • Anonymous authentication on Kubelet server is allowed
        • Apiserver allows weak cryptographic ciphers
        • Apiserver does not set TLS key and certificate
        • Authorization mode AlwaysAllow allows all requests
        • Authorization mode does not include node
        • Certificate Authority for apiserver not set
        • Certificate or Key file not set for etcd
        • Certificate or private key not set for peer authentication on etcd
        • Client certificate / key for apiserver not set
        • Container is privileged
        • Container runs with AllowPrivilegeEscalation
        • Controller Manager bound to non loop-back insecure address
        • Controller Manager has profiling active
        • Controller Manager with invalid --root-ca-file argument
        • Controller Manager without RotateKubeletServerCertificate set
        • Controller Manager without individual service account credentials
        • Docker daemon socket exposed to containers
        • Encryption providers are not properly configured
        • Etcd uses self-signed certificates
        • Excessive CertificateSigningRequests approval permission
        • Excessive RoleBindings / ClusterRoleBindings permissions
        • Excessive permissions to escalate roles
        • Excessive wildcard permissions
        • Excessive write permissions over admission webhook
        • Explicit request-timeout not set
        • Garbage collector on pod termination is not active
        • HTTPS not enabled between apiserver and kubelets
        • Highly privileged CAP_SYS_ADMIN granted
        • Host network namespace sharing is allowed
        • Host process ID namespace sharing is allowed
        • IPC namespace sharing is allowed
        • Insecure bind address
        • Insecure bind port
        • Kubelet client certificate rotation is disabled
        • No Certificate Authority file set for etcd
        • No client authentication on etcd service
        • No client certificate for peer authentication in etcd
        • No service account public key file
        • Persistent audit log not enabled
        • Scheduler service bound to loop-back insecure address
        • Service account lookup not set
        • The admission control plugin AlwaysAdmit is set
        • The admission control plugin AlwaysPullImages is not set
        • The admission control plugin NodeRestriction is not set
    • Code Tampering Detection
      • CI/ CD
        • Build File Modification
        • Workflow File Modification
      • Configuration
        • CODEOWNERS File Modification
        • Configuration File Modification
        • Env File Modification
        • Shell Script Modification
      • Custom Critical File
        • Custom Critical File Modification
      • Descriptor
        • Dependency Descriptor File Modification
      • IaC Template
        • IaC File Modification
      • Policy
        • Security Policy File Modification
      • Security Tool Configuration
        • Modification of Security Tool Configuration
    • Code Security - Malware
      • Execution
        • Decoded Code Execution
        • Decrypted Code Execution
        • Downloaded Code Execution
        • Malicious Command Execution
        • Obfuscated Code Execution
        • Silent execution
        • System Registry Code Execution
        • Unusual File Execution
      • File
        • Masquerade File Type
      • Network
        • Suspicious Blockchain Payload
        • Suspicious Request
        • Suspicious URL
      • Package
        • Malicious Installation Scripts
      • Registry
        • System Registry Tampering
      • Sensitive Data
        • Browser Sensitive Data Enumeration
        • Sensitive Data Enumeration
        • Sensitive Data Exfiltration
        • Sensitive File Exfiltration
        • Sensitive File encryption
      • System
        • Bidirectional Characters
        • Clipboard Hijacker
        • Execution Policy Bypass
        • Impair Defenses: Disabled Tools
        • Invisible Characters
        • Obfuscated Code
        • Process Termination
        • Suspicious Scheduled system service
        • Virtualization Sandbox Evasion
    • Code Security - Vulnerabilities
      • CSharp
        • .Net access restriction subverted (Reflection)
        • ASP.Net Custom Errors Disabled
        • ASP.Net Unsafe Authentication Forms
        • ASP.Net Unsafe Cookies Configuration
        • Anonymous LDAP Bind
        • Buffer Overflow
        • Code Injection During Deserialization
        • Connection String Parameter Pollution
        • Cookie Poisoning
        • Cookies In Security Decision
        • Cross Site Request Forgery ('CSRF')
        • Cross Site Scripting ('XSS')
        • Cross-site scripting protection disabled
        • Dangerous API
        • Dangerous Hostname Check
        • Debug Features Enabled
        • Dynamic code injection in scripting API
        • HTTP Parameter Pollution
        • HTTP Splitting
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Hardcoded Cryptographic Salt
        • Improper neutralization of data within XPath expressions ('XPath Injection')
        • Improper neutralization of special elements used in a command ('Command Injection')
        • Inadequate Padding
        • Information Exposure Through Error Message
        • Insecure Randomness
        • Insecure SSL
        • Insecure Transport
        • Insufficient Key Size
        • Insufficient Session Expiration
        • JWT Signature Verification Bypass
        • LDAP Injection
        • Log Forging
        • Mail Command Injection
        • NoSQL Injection
        • Non Random IV With CBC Mode
        • Observable Timing Discrepancy
        • Open Redirect
        • P/Invoke declarations should not be safe critical
        • Password In Redirect
        • Path Traversal
        • Plaintext Storage In Cookie
        • Process Control
        • Regex Injection
        • Regular expression Denial of Service ('ReDoS')
        • Request Validation Disabled
        • SQL Injection ('SQLi')
        • Server Side Request Forgery ('SSRF')
        • Trust Boundary Violation
        • Unsafe Cookie
        • Unsafe Reflection
        • User Controlled Primary Key
        • Weak Encryption Algorithm
        • Weak Hash Algorithm
        • Weak Password Hash
        • XAML Injection
        • XML Entity Injection
        • XML Injection
        • Zip Slip
      • Go
        • Anonymous LDAP Bind
        • Avoid Native Calls
        • Code Injection
        • Connection String Parameter Pollution
        • Cookie Poisoning
        • Cookies In Security Decision
        • Cross Site Request Forgery (CSRF)
        • Dangerous API
        • DoS Decompression Bomb
        • Error unhandled
        • Execution After Redirect ('EAR')
        • Format String Injection
        • HTTP Parameter Pollution
        • HTTP Splitting
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Hardcoded Cryptographic Salt
        • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
        • Improper neutralization of data within XPath expressions ('XPath Injection')
        • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
        • Inadequate Padding
        • Information Exposure Through Debug Log
        • Information Exposure Through Error Message
        • Information Exposure Through External Request
        • Insecure Authentication
        • Insecure File Permissions
        • Insecure Randomness
        • Insecure SSL
        • Insecure SSL Version
        • Insecure Temporary File
        • Insecure Transport
        • Insufficient Key Size
        • Integer Overflow or Wraparound
        • JSON Injection
        • JSONP Hijacking
        • JWT Signature Verification Bypass
        • LDAP Injection
        • Log Forging
        • Mail Command Injection
        • Missing SSH host key verification
        • NoSQL Injection
        • OS Command Injection
        • Observable Timing Discrepancy
        • Password In Redirect
        • Plaintext Storage In Cookie
        • Plaintext Storage Of Password
        • Profiling Endpoint Exposed
        • Regex Injection
        • Resource Injection
        • SQL Injection
        • Serializable Class Containing Sensitive Data
        • Server Insecure Transport
        • Server Side Request Forgery ('SSRF')
        • Server-side Template Injection
        • Sleep Injection
        • Slowloris Attack
        • Socket Binding To All Interfaces
        • Too Broad Cors Policy
        • Trust Boundary Violation
        • URL Redirection to Untrusted Site ('Open Redirect')
        • Unsafe Cookie
        • Unsafe Reflection
        • Unsafe Session Configuration
        • Use of a broken or risky cryptographic algorithm
        • Use of a broken or risky cryptographic mode of operation
        • Use of a weak cryptographic initialization vector
        • User Controlled Primary Key
        • Weak Hash Algorithm
        • Weak Password Hash
        • XML Injection
        • Zip Slip
      • Html
        • Autocomplete Enabled for Sensitive Fields
        • Forms Without CSRF Protection
        • Hidden Sensitive Fields
        • Inline JavaScript Event Handler
        • Input Fields Without Validation Attributes
        • Insecure Authentication via HTTP GET
        • Insecure Iframe Configuration
        • Insecure Meta Tags
        • Insecure Resource
        • JavaScript Protocol Urls
        • Missing Frame Ancestors Protection
        • Missing Resource Integrity
        • Missing Tabnabbing Protection
        • Unmasked Password Fields
        • Unsafe Content Security Policy
      • Java
        • Android Application Backup Allowed
        • Android Debugging Enabled
        • Android Fragment Injection
        • Android Missing Receiver Permission
        • Android Screenshot Allowed
        • Android Sensitive Keyboard Cache
        • Android Sticky Broadcast
        • Android URI Permission Manipulation
        • Android Unrestricted Broadcast
        • Android Webview Content Access Enabled
        • Android Webview Debugging Enabled
        • Android Webview File Access Enabled
        • Android Webview JavaScript Enabled
        • Android Webview JavaScript Interface Annotation
        • Android World Writeable Readable File Permission
        • Anonymous LDAP Bind
        • Avoid Direct Database Connection
        • Avoid Explicit Socket
        • Avoid Explicit Thread Management
        • Avoid JVM Exit
        • Avoid Leftover Debug Code
        • Avoid Native Calls
        • Avoid Non Serializable Objects Stored
        • Code Injection
        • Code Injection During Deserialization
        • Connection String Parameter Pollution
        • Cookie Poisoning
        • Cookies In Security Decision
        • Cross Site History Manipulation ('XSHM')
        • Cross Site Request Forgery ('CSRF')
        • Cross Site Scripting ('XSS')
        • Cross-site scripting protection disabled
        • Dangerous API
        • Dangerous Hostname Check
        • Database Access Control
        • Execution After Redirect ('EAR')
        • External Control Of Configuration Setting
        • Format String Injection
        • HTTP Parameter Pollution
        • HTTP Splitting
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Hardcoded Cryptographic Salt
        • Implicitly Exported Android Component
        • Improper Validation Of Array Index
        • Inadequate Padding
        • Information Exposure Through Debug Log
        • Information Exposure Through Error Message
        • Information Exposure Through External Request
        • Input Path Not Canonicalized
        • Input Path Not Normalized
        • Insecure Authentication
        • Insecure Randomness
        • Insecure SSL
        • Insecure Transport
        • Insecure Transport Configuration
        • Insufficient Key Size
        • Insufficient Session Expiration
        • Intent Forwarding
        • JSON Injection
        • JWT Signature Verification Bypass
        • LDAP Injection
        • Log Forging
        • Mail Command Injection
        • Missing Certificate Pinning
        • NoSQL Injection
        • Non Random IV With CBC Mode
        • OS Command Injection
        • Observable Timing Discrepancy
        • Open Redirect
        • Password In Redirect
        • Path Traversal
        • Plaintext Storage In Cookie
        • Plaintext Storage Of Password
        • Potential Infinite Loop
        • Privilege Escalation Vulnerability
        • Process Control
        • Race Condition Format
        • Race Condition Matcher
        • Race Condition Servlet
        • Reflected File Download
        • Regex Injection
        • Regular expression Denial of Service ('ReDoS')
        • Resource Injection
        • SMS Monitoring
        • SQL Injection ('SQLi')
        • Same Origin Method Execution ('SOME')
        • Security Check In Overridable Method
        • Serializable Class Containing Sensitive Data
        • Server Side Request Forgery ('SSRF')
        • Sleep Injection
        • Spring XSS Protection Disabled
        • Static Database Connection
        • Third-Party Package Context Code Execution
        • Too Broad App Permissions
        • Too Broad Cors Policy
        • Trust Boundary Violation
        • Unchecked Input In Loop Condition
        • Unhandled SSL Exception
        • Unprotected Storage of Credentials
        • Unrestricted Request Mapping
        • Unsafe Cookie
        • Unsafe Reflection
        • Use of a broken or risky cryptographic mode of operation
        • Use of a weak cryptographic initialization vector
        • User Controlled Primary Key
        • View Manipulation
        • Weak Encryption Algorithm
        • Weak Hash Algorithm
        • Weak Password Hash
        • Web.xml security misconfigurations
        • XML Entity Injection
        • XML Injection
        • XPath Injection
      • JavaScript / TypeScript
        • Allocation Of Resources Without Limits
        • Angular Cross Site Scripting
        • CORS Policy is too broad
        • Client-side Template Injection
        • Code Injection
        • Code injection during object deserialization
        • Code injection with javascript: URL in JSX
        • Cookie Poisoning
        • Cross Site Request Forgery (CSRF)
        • Cross-site scripting protection disabled
        • Do not use eval()
        • HTML escape disabled in Vue component
        • HTTP Strict Transport Security (HSTS) not set
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Improper Certificate Validation
        • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
        • Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
        • Improper neutralization of XML entities ('Xml Entity Injection')
        • Improper neutralization of data within XPath expressions ('XPath Injection')
        • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
        • Information Exposure Through Error Message
        • Insecure Randomness
        • Insecure SSL
        • Insecure Transport
        • Insufficient Cryptographic Key Length
        • JWT Signature Verification Bypass
        • No clickjacking protection configured
        • NoSQL Injection
        • OS Command Injection
        • Plaintext Storage In Cookie
        • Potential loop with unreachable exit condition ('Infinite Loop')
        • Prevent MIME Sniffing
        • React dangerouslySetInnerHTML should not be used
        • ReactDOM.findDOMNode() should not be used
        • Regex Injection
        • Regular Expression DoS
        • Resource Injection
        • SQL Injection
        • Sensitive data in HTML5 Web Storage
        • Server Insecure Transport
        • Server Side Request Forgery ('SSRF')
        • Server-side Template Injection
        • Strict Contextual Escaping (SCE) disabled
        • Too Broad Message Posting
        • URL Redirection to Untrusted Site ('Open Redirect')
        • Unsafe Cookie
        • Unsafe JQuery Plugin
        • Use of a broken or risky cryptographic algorithm
        • Use of a broken or risky cryptographic mode of operation
        • Use of a weak password hashing
        • Weak Hash Algorithm
        • X-Powered-By header must be disabled
        • Zip Slip
      • Kotlin
        • Android Application Backup Allowed
        • Android Debugging Enabled
        • Android Fragment Injection
        • Android Missing Receiver Permission
        • Android Screenshot Allowed
        • Android Sensitive Keyboard Cache
        • Android Sticky Broadcast
        • Android URI Permission Manipulation
        • Android Unrestricted Broadcast
        • Android Webview Content Access Enabled
        • Android Webview Debugging Enabled
        • Android Webview File Access Enabled
        • Android Webview JavaScript Enabled
        • Android Webview JavaScript Interface Annotation
        • Android World Writeable Readable File Permission
        • Anonymous LDAP Bind
        • Avoid Native Calls
        • Code Injection
        • Code Injection During Deserialization
        • Connection String Parameter Pollution
        • Cookie Poisoning
        • Cookies In Security Decision
        • Cross Site Request Forgery ('CSRF')
        • Cross Site Scripting ('XSS')
        • Cross-site scripting protection disabled
        • Format String Injection
        • HTTP Parameter Pollution
        • HTTP Splitting
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Hardcoded Cryptographic Salt
        • Implicitly Exported Android Component
        • Inadequate Padding
        • Information Exposure Through Debug Log
        • Information Exposure Through Error Message
        • Information Exposure Through External Request
        • Insecure Authentication
        • Insecure Randomness
        • Insecure SSL
        • Insecure Transport
        • Insecure Transport Configuration
        • Insufficient Key Size
        • Intent Forwarding
        • JWT Signature Verification Bypass
        • LDAP Injection
        • Log Forging
        • Mail Command Injection
        • Missing Certificate Pinning
        • NoSQL Injection
        • OS Command Injection
        • Observable Timing Discrepancy
        • Open Redirect
        • Password In Redirect
        • Path Traversal
        • Plaintext Storage In Cookie
        • Plaintext Storage Of Password
        • Privilege Escalation Vulnerability
        • Process Control
        • Reflected File Download
        • Regex Injection
        • Regular expression Denial of Service ('ReDoS')
        • Resource Injection
        • SMS Monitoring
        • SQL Injection ('SQLi')
        • Same Origin Method Execution ('SOME')
        • Serializable Class Containing Sensitive Data
        • Server Side Request Forgery ('SSRF')
        • Sleep Injection
        • Spring XSS Protection Disabled
        • Third-Party Package Context Code Execution
        • Too Broad App Permissions
        • Too Broad Cors Policy
        • Trust Boundary Violation
        • Unhandled SSL Exception
        • Unprotected Storage of Credentials
        • Unrestricted Request Mapping
        • Unsafe Cookie
        • Unsafe Reflection
        • Use of a broken or risky cryptographic mode of operation
        • Use of a weak cryptographic initialization vector
        • User Controlled Primary Key
        • View Manipulation
        • Weak Encryption Algorithm
        • Weak Hash Algorithm
        • Weak Password Hash
        • XML Entity Injection
        • XPath Injection
        • Zip Slip
      • Php
        • CakePHP Unsafe Configuration
        • CakePHP Unsafe Session Configuration
        • Code Injection
        • Code injection during object deserialization
        • CodeIgniter Unsafe Session Configuration
        • Connection String Parameter Pollution
        • Cookies In Security Decision
        • Cross Site Request Forgery (CSRF)
        • Dangerous File Upload
        • Do not use $_REQUEST
        • Do not use eval()
        • Execution After Redirect ('EAR')
        • External Variable Modification
        • Format String Injection
        • HTTP Parameter Pollution
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Hardcoded Cryptographic Salt
        • Improper Control of filename for include / require statement ('Include File Injection')
        • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
        • Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
        • Improper neutralization of XML entities ('Xml Entity Injection')
        • Improper neutralization of data within XPath expressions ('XPath Injection')
        • Improper neutralization of external input used within a CSV or Excel formula ('Formula Injection')
        • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
        • Inadequate Padding
        • Information Exposure Through Debug Log
        • Information Exposure Through Error Message
        • Insecure Randomness
        • Insecure Transport
        • LDAP Injection
        • Laravel Unsafe Session Configuration
        • Log Forging
        • Mail Command Injection
        • Mail Content Injection
        • Mail Header Manipulation
        • NoSQL Injection
        • OS Command Injection
        • Password In Redirect
        • Regex Injection
        • Regular Expression DoS
        • Resource Injection
        • SQL Injection
        • Server Side Request Forgery ('SSRF')
        • Sleep Injection
        • Symfony No Use Default Secret
        • Too Broad Cors Policy
        • Trust Boundary Violation
        • Twig No Use Debug
        • Twig XSS protection disabled
        • URL Redirection to Untrusted Site ('Open Redirect')
        • Unsafe Configuration
        • Unsafe Cookie
        • Unsafe Session Configuration
        • Use of a broken or risky cryptographic algorithm
        • Use of a broken or risky cryptographic mode of operation
        • Use of a weak cryptographic initialization vector
        • User Controlled Primary Key
        • Weak Hash Algorithm
        • Weak Password Hash
        • Zend/ Laminas Unsafe Session Configuration
      • Python
        • Anonymous LDAP Bind
        • Code Injection
        • Code injection during object deserialization
        • Connection String Parameter Pollution
        • Cookie Poisoning
        • Cookies In Security Decision
        • Cross Site Request Forgery (CSRF)
        • Django Missing Permissions Check
        • Django Password Requirements Not Enforced
        • Django Unsafe Configuration
        • Django Unsafe Session Configuration
        • Django XSS Protection Disabled
        • Do not use assert
        • Do not use compile()
        • Do not use eval()
        • Execution After Redirect ('EAR')
        • External Request DoS
        • Flask Unsafe Configuration
        • Flask XSS Protection Disabled
        • HTTP Parameter Pollution
        • HTTP Splitting
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Hardcoded Cryptographic Salt
        • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
        • Improper Request Certificate Verification
        • Improper neutralization of XML entities ('Xml Entity Injection')
        • Improper neutralization of data within XPath expressions ('XPath Injection')
        • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
        • Information Exposure Through Debug Log
        • Information Exposure Through Error Message
        • Information Exposure Through External Request
        • Insecure Authentication
        • Insecure File Permissions
        • Insecure Parser
        • Insecure Randomness
        • Insecure SSL Version
        • Insecure Temporary File
        • Insecure Transport
        • Insufficient Key Size
        • JSON Injection
        • JWT Signature Verification Bypass
        • Jinja XSS Protection Disabled
        • LDAP Injection
        • Log Forging
        • Mail Command Injection
        • Mako XSS Protection Disabled
        • Missing Resource Integrity Check
        • Missing SSH Host Key Verification
        • NoSQL Injection
        • OS Command Injection
        • Observable Timing Discrepancy
        • Password In Redirect
        • Plaintext Storage In Cookie
        • Regex Injection
        • Regular Expression DoS
        • Resource Injection
        • SQL Injection
        • Server Insecure Transport
        • Server Side Request Forgery ('SSRF')
        • Server-side Template Injection
        • Sleep Injection
        • Socket Binding To All Interfaces
        • Template XSS Protection Disabled
        • Too Broad Cors Policy
        • Trust Boundary Violation
        • URL Redirection to Untrusted Site ('Open Redirect')
        • Unsafe Cookie
        • Unsafe Logging Configuration
        • Unsafe Reflection
        • Use of a broken or risky cryptographic algorithm
        • Use of a broken or risky cryptographic mode of operation
        • Use of a weak cryptographic initialization vector
        • User Controlled Primary Key
        • Weak Hash Algorithm
        • Weak Password Hash
        • Zip Slip
      • Swift
        • Avoid Native Calls
        • Cleartext Transmission of Sensitive Information
        • Cleartext storage of sensitive information in an application preference store
        • Code Injection During Deserialization
        • Command Injection
        • Connection String Parameter Pollution
        • Cookie Poisoning
        • Cross Site Scripting ('XSS')
        • Dangerous Hostname Check
        • Deprecated UIWebView Usage
        • Externally Controlled Format String
        • General Pasteboard Access
        • HTTP Response Splitting
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Hardcoded Cryptographic Salt
        • Improper input validation using regular expressions without anchors
        • Inadequate Padding
        • Insecure Randomness
        • Insecure SSL
        • Insecure Temporary File
        • Insecure Transport
        • Insufficient Key Size
        • JWT Signature Verification Bypass
        • JavaScript injection in a web view
        • NoSQL Injection
        • Non Random IV with CBC Mode
        • Open Redirect
        • Path Traversal
        • Predicate Injection
        • Regex Injection
        • Regular expression Denial of Service ('ReDoS')
        • SQL Injection ('SQLi')
        • Sensitive Information Logging
        • Server-Side Request Forgery (SSRF)
        • Unprotected File Storage
        • Unsafe Cookie
        • Unsafe HTML filtering using regular expressions
        • Unsafe Reflection
        • Untrusted Pointer Dereference
        • Weak Biometric Access Control Flags
        • Weak Biometric Authentication
        • Weak Encryption Algorithm
        • Weak Encryption Mode of Operation
        • Weak Hash Algorithm
        • Weak Keychain ACL (Device Passcode)
        • Weak Keychain Accessibility
        • Weak Password Hash
        • WebView loaded without restricting base URL
        • XML External Entity (XXE)
    • DAST Detectors
      • Access Control
        • Access Control Issue - Improper Authentication
        • Access Control Issue - Improper Authorization
        • Bypassing 403
        • CORS Header
        • Cross-Domain JavaScript Source File Inclusion
        • Cross-Domain Misconfiguration
        • Fetch Metadata Request Headers
        • Insecure HTTP Method
        • Insufficient Site Isolation Against Spectre Vulnerability
        • Permissions Policy Header Not Set
      • Authentication
        • Authentication Request Identified
        • JWT Scan Rule
        • Possible Username Enumeration
        • Use of SAML
        • Username Hash Found
        • Weak Authentication Method
      • Buffer Overflow
        • Buffer Overflow
      • CRLF Injection
        • CRLF Injection
      • Clickjacking
        • Anti-clickjacking Header
      • Code Injection
        • Server Side Code Injection
      • Cross-Site Request Forgery
        • Absence of Anti-CSRF Tokens
        • Anti-CSRF Tokens Check
        • Cross Site Request Forgery
      • Cross-Site Scripting
        • Cross Site Scripting (DOM Based)
        • Cross Site Scripting (Persistent)
        • Cross Site Scripting (Persistent) - Prime
        • Cross Site Scripting (Persistent) - Spider
        • Cross Site Scripting (Reflected)
        • Cross-site Scripting
        • Dangerous JS Functions
        • Out of Band XSS
        • User Controllable HTML Element Attribute (Potential XSS)
        • User Controllable JavaScript Event (XSS)
        • Web Browser XSS Protection Not Enabled
      • File Inclusion
        • File Upload
        • Remote File Inclusion
      • Fingerprinting
        • Client-Side Data Flow
        • GraphQL
        • Modern Web Application
        • Retrieved from Cache
        • Tech Detection Passive Scanner
        • User Agent Fuzzer
        • Verification Request Identified
        • ZAP is Out of Date
      • Information Disclosure
        • .env Information Leak
        • .htaccess Information Leak
        • Application Error Disclosure
        • Backup File Disclosure
        • Base64 Disclosure
        • Cloud Metadata Potentially Exposed
        • Directory Browsing
        • ELMAH Information Leak
        • HTTP Server Response Header
        • Hash Disclosure - MD4 / MD5
        • Hidden File Found
        • Image Exposes Location or Privacy Data
        • In Page Banner Information Leak
        • Information Disclosure - Debug Error Messages
        • Information Disclosure - Sensitive Information in HTTP Referrer Header
        • Information Disclosure - Sensitive Information in URL
        • Information Disclosure - Suspicious Comments
        • PII Disclosure
        • Private IP Disclosure
        • Proxy Disclosure
        • Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
        • Source Code Disclosure - /WEB-INF Folder
        • Source Code Disclosure - CVE-2012-1823
        • Source Code Disclosure - File Inclusion
        • Source Code Disclosure - Git
        • Source Code Disclosure - PHP
        • Source Code Disclosure - SVN
        • Spring Actuator Information Leak
        • Timestamp Disclosure - Unix
        • Trace.axd Information Leak
        • WSDL File Detection
        • X-AspNet-Version Response Header
        • X-Backend-Server Header Information Leak
        • X-ChromeLogger-Data (XCOLD) Header Information Leak
        • X-Debug-Token Information Leak
      • Injection
        • Advanced SQL Injection
        • Exponential Entity Expansion (Billion Laughs Attack)
        • Expression Language Injection
        • Format String Error
        • Generic Padding Oracle
        • HTTP Parameter Override
        • HTTP Parameter Pollution
        • Integer Overflow Error
        • LDAP Injection
        • NoSQL Injection - MongoDB
        • NoSQL Injection - MongoDB (Time Based)
        • Parameter Tampering
        • SOAP Action Spoofing
        • SOAP XML Injection
        • SQL Injection
        • SQL Injection - Hypersonic SQL (Time Based)
        • SQL Injection - MsSQL (Time Based)
        • SQL Injection - MySQL (Time Based)
        • SQL Injection - Oracle (Time Based)
        • SQL Injection - PostgreSQL (Time Based)
        • SQL Injection - SQLite (Time Based)
        • XPath Injection
        • XSLT Injection
      • OS Command Injection
        • Remote OS Command Injection
        • Remote OS Command Injection (Time Based)
      • Path Traversal
        • Path Traversal
      • Redirect
        • Big Redirect Detected (Potential Sensitive Information Leak)
        • External Redirect
        • Off-site Redirect
      • Remote Code Execution
        • Java Serialization Object
        • Log4Shell
        • Remote Code Execution (React2Shell)
        • Remote Code Execution - CVE-2012-1823
        • Remote Code Execution - Shell Shock
        • Spring4Shell
        • Text4shell (CVE-2022-42889)
      • Security Misconfiguration
        • Apache Range Header DoS (CVE-2011-3192)
        • CSP
        • Charset Mismatch
        • Content Cacheability
        • Content Security Policy (CSP) Header Not Set
        • Content-Type Header Missing
        • HTTP Only Site
        • HTTP to HTTPS Insecure Transition in Form Post
        • HTTPS Content Available via HTTP
        • HTTPS to HTTP Insecure Transition in Form Post
        • Heartbleed OpenSSL Vulnerability
        • Heartbleed OpenSSL Vulnerability (Indicative)
        • Httpoxy - Proxy Header Misuse
        • Insecure Component
        • Re-examine Cache-control Directives
        • Relative Path Confusion
        • Reverse Tabnabbing
        • Script Served From Malicious Domain (polyfill)
        • Secure Pages Include Mixed Content
        • Strict-Transport-Security Header
        • Sub Resource Integrity Attribute Missing
        • User Controllable Charset
        • Vulnerable JS Library
        • Web Cache Deception
        • X-Content-Type-Options Header Missing
      • Server-Side Include Injection
        • Server Side Include
      • Server-Side Request Forgery
        • Server Side Request Forgery
      • Server-Side Template Injection
        • Server Side Template Injection
        • Server Side Template Injection (Blind)
      • Session Fixation
        • Session Fixation
      • Session Management
        • Cookie No HttpOnly Flag
        • Cookie Poisoning
        • Cookie Slack Detector
        • Cookie Without Secure Flag
        • Cookie without SameSite Attribute
        • GET for POST
        • Insecure JSF ViewState
        • Loosely Scoped Cookie
        • Session ID in URL Rewrite
        • Session Management Response Identified
        • Viewstate
      • XML External Entity
        • XML External Entity Attack
    • Unusual Activity Detection
      • Anomalous plugin installed
      • Auditing Configuration Modification
      • Anomalous fork
      • Anomalous Pull Request
      • Branch protection disabled
      • Commit anomalous
      • Commit bypassed branch protection
      • Compliance Framework Removed
      • Compliance Framework Updated
      • CI Token Scope Modified
      • DAST Profile Modified
      • Environment Unprotected
      • Failed login attempts
      • Commit force pushed
      • Feature Flag Updated
      • Member received Admin permissions
      • Organization deleted
      • Organization renamed
      • Organization Publicized
      • IP Restrictions Updated
      • Potential Script Injection Attack
      • Organization MFA requirement disabled
      • Manually Triggered Housekeeping
      • Pull Request merged without passing the status checks
      • Project Default Branch Updated
      • Repository archived
      • Repository deleted
      • Repository publicized
      • Repository Renamed
      • Repository unarchived
      • Stale Pull Request merged
      • Tag force pushed
      • Status Check Modification
      • Team received Admin permissions
      • Unsigned commit
      • Unusual Login
      • Unusual long time build job
  • Compliance Assessment Standards
    • CIS Software Supply Chain Security benchmark
      • 1.1.1 Ensure any changes to code are tracked in a version control platform
      • 1.1.10 Ensure open branches are up-to-date before merge
      • 1.1.11 Ensure all open comments are resolved before allowing code change merging
      • 1.1.12 Ensure verification of signed commits for new changes before merging
      • 1.1.13 Ensure linear history is required
      • 1.1.14 Ensure branch protection rules are enforced for administrators
      • 1.1.15 Ensure pushing or merging of new code is restricted to specific individuals or teams
      • 1.1.16 Ensure force push code to branches is denied
      • 1.1.17 Ensure protected branch deletions are denied
      • 1.1.3 Ensure any change to code receives approval of a minimum strongly authenticated users
      • 1.1.4 Ensure previous approvals are dismissed when updates are introduced to a code change proposal
      • 1.1.5 Ensure there are restrictions on who can dismiss code change reviews
      • 1.1.6 Ensure code owners are set for extra sensitive code or configuration
      • 1.1.8 Ensure inactive branches are periodically reviewed and removed
      • 1.1.9 Ensure all checks have passed before merging new code
      • 1.2.1 Ensure all public repositories contain a SECURITY.md file
      • 1.2.2 Ensure repository creation is limited to specific members
      • 1.2.3 Ensure repository deletion is limited to specific users
      • 1.2.4 Ensure issue deletion is limited to specific users
      • 1.3.1 Ensure inactive users are reviewed and removed periodically
      • 1.3.3 Ensure maximum number of administrators are set for the organization
      • 1.3.5 Ensure the organization is requiring members to use Multi-Factor Authentication (MFA)
      • 1.3.7 Ensure two administrators are set for each repository
      • 1.3.8 Ensure strict base permissions are set for repositories
      • 1.3.9 Ensure an organization’s identity is confirmed with a "Verified" badge
      • 2.3.1 Ensure all build steps are defined as code
      • 2.3.5 Ensure access to build process triggering is minimized
      • 2.3.7 Ensure pipelines are automatically scanned for vulnerabilities
      • 2.3.8 Ensure scanners are in place to identify and prevent sensitive data in pipeline files
      • 2.4.2 Ensure all external dependencies used in the build process are locked
      • 2.4.6 Ensure pipeline steps sign the Software Bill of Materials (SBOM) produced
      • 3.1.7 Ensure dependencies are pinned to a specific, verified version
      • 3.2.2 Ensure packages are automatically scanned for known vulnerabilities
      • 3.2.3 Ensure packages are automatically scanned for license implications
      • 4.2.3 Ensure user access to the package registry utilizes Multi-Factor Authentication (MFA)
      • 4.2.5 Ensure anonymous access to artifacts is revoked
      • 4.3.4 Ensure webhooks of the package registry are secured
    • OWASP Software Component Verification Standard
      • OWASP SCVS Unknown Components
    • OpenSSF FLOSS
      • Basic project website content
    • OpenSSF Scorecard
      • Branch protection
      • CI Tests: Does the project run tests in CI?
      • Code Review
      • Contributors
      • Dangerous Workflow
      • Dependency Update Tool
      • Fuzzing
      • License Declaration
      • Maintained
      • No Binary Artifacts
      • OpenSSF Best Practices badge
      • Packaging
      • Pinned Dependencies
      • SAST in use
      • Security Policy
      • Signed Releases
      • Token Permissions
      • Vulnerabilities
      • Webhooks
    • ESF Securing the Software Supply Chain DEV
      • Are all of your builds continuously built and tested?
      • Are code check-ins gated by code collaborators and source control to prevent anyone from accidentally or intentionally submitting unreviewed code changes?
      • Do you ensure only required modules are included in the product?
      • Do you have and adhere to responsible disclosure requirements for all externally identified vulnerabilities?
      • Do you have and use security tools for Software Composition Analysis?
      • Do you perform binary composition analysis of the final package?
      • Do you perform input fuzzing as part of a regular process for your component or product’s inputs?
      • Do you perform nightly builds with automated regression and security test to quickly detect problems with recent builds?
      • Do you track all third-party components you use directly and all internal components in a secure and persistent repository?
      • Do you use the toolchain to automatically gather information that informs security decision-making?
      • Does the project use a static code analysis tool?
      • Does the project use tools to help update its dependencies?
      • Does the team require code reviews for all code and build scripts / configuration changes?
      • Does your release confirmation that binaries are digitally signed?
      • Does your release include an SBOM?
      • The project should not have generated executable (binary) artifacts in the source repository.
  • XyDocs
  • Code Security - Malware

Supported Malware detectors

The detectors for malware evidences listed below are classified by their resource kind.

Execution

  • Decoded Code Execution

  • Decrypted Code Execution

  • Downloaded Code Execution

  • Malicious Command Execution

  • Obfuscated Code Execution

  • Silent execution

  • System Registry Code Execution

  • Unusual File Execution

File

  • Masquerade File Type

Network

  • Suspicious Blockchain Payload

  • Suspicious Request

  • Suspicious URL

Package

  • Malicious Installation Scripts

Registry

  • System Registry Tampering

Sensitive Data

  • Browser Sensitive Data Enumeration

  • Sensitive Data Enumeration

  • Sensitive Data Exfiltration

  • Sensitive File encryption

  • Sensitive File Exfiltration

System

  • Bidirectional Characters

  • Clipboard Hijacker

  • Execution Policy Bypass

  • Impair Defenses: Disabled Tools

  • Invisible Characters

  • Obfuscated Code

  • Process Termination

  • Suspicious Scheduled system service

  • Virtualization Sandbox Evasion

© 2025 Xygeni. All rights reserved