Xygeni Documentation xygeni
search
home

XyDocs

    • Suspect Dependencies Detectors
      • Anomalous Dependency
        • Maven Anomalous Dependency
        • NPM Anomalous Dependency
        • NuGet Anomalous Dependency
        • PyPI Anomalous Dependency
      • Dependency Confusion
        • NPM Dependency Confusion
        • NPM Unscoped internal components
        • NuGet Dependency Confusion
        • PiP Dependency Confusion
      • Known Vulnerabilities
        • Dependency with important known vulnerabilities
      • Malware
        • DotNet Malware Dependency
        • Java Malware Dependency
        • NPM Malware Dependency
        • Python Malware Dependency
      • Suspicious Scripts
        • NPM Suspicious Scripts
        • PyPI Suspicious Scripts
      • Typosquatting
        • Maven Typosquatting
        • NPM Typosquatting
        • NuGet Typosquatting
        • PyPI Typosquatting
    • CI/CD Misconfigurations Detectors
      • Avoid Open Versions
        • Maven Avoid Open Versions
      • Avoid Public Repositories
        • Maven Avoid Public Repositories
        • NPM Avoid Public Repositories
        • NuGet Avoid Public Repositories
        • PyPI Avoid Public Repositories
      • CI/ CD Security
        • Avoid calls to Jenkins getInstance method
        • Branches configured to trigger a pipeline exposed to secrets has a correlating branch protection rule in the SCM
        • Build attestation framework should be used
        • CI/CD Bot should not be able to approve a code review
        • CI/CD argument values should not flow directly into workflows
        • Ensure that CI/CD apps do not use too broad permissions
        • Ensure that groups do not use too broad permissions.
        • Potential injected malicious code into files referenced by the pipeline configuration file
        • Pull Requests do not execute the pipelines modifications that they include
        • Repository should be associated with an approved CI/CD app
        • Secrets and Credentials at organization level should not widely shared
        • Secrets should be stored explicitly as encrypted GitHub Actions Secrets
        • Secrets used in workflows should not be echoed in the console
        • Signed Container Images
        • Suspicious Pull Request merge invocation
        • Unusual activity at CI/CD environments should be monitored
        • Webhook URL is not allowed
        • Workflows should not use insecure commands
      • CI/ CD Tools
        • Dangerous Workflow
        • Dependency Update Tool
        • Ensure all external dependencies used in the build process are locked
        • Ensure scanners are in place to identify and prevent sensitive data in pipeline files
        • Fuzzing
        • Inadequate Backups of Jenkins Instance
        • Lack of Secure Authentication
        • Lack of Secure Authorization
        • Lack of administrative monitor and logging
        • SAST in use
        • Secure Jenkins version
        • Token Permissions
        • Unsecured Communication
        • Use of Deprecated or Vulnerable Plugins
        • Workflow permissions are not minimal
      • CI/CD Security
        • Malicious script in a CI/CD pipeline.
      • Confusing Names
        • PyPI Confusing Names
      • Container Security
        • 'dnf clean all' missing
        • 'microdnf clean all' missing
        • 'yum clean all | packages' missing
        • 'zypper clean' missing
        • ADD instead of COPY
        • COPY with multiple sources must end destination with /
        • Container runs as root
        • Deprecated MAINTAINER used
        • Exposed port out of range
        • Multiple CMD instructions
        • Multiple ENTRYPOINT instructions
        • No HEALTHCHECK defined
        • RUN package-manager update instruction alone
        • RUN using sudo
        • SSH port exposed
        • WORKDIR path is not absolute
        • WORKDIR should not be mounted on system dirs
        • apk add is missing --no-cache
        • apt-get dist-upgrade used
        • apt-get missing –no-install-recommends
      • Lack Of Version Pinning
        • NPM Lack of Version Pinning
        • NuGet Lack of Version Pinning
        • PyPI Lack of Version Pinning
      • Malicious Image
        • Reverse Shell in Container Image
      • Package Managers
        • Insecure Package Registry webhook
      • Releases
        • Signed Releases
      • SCM
        • Binary artifacts found
        • Code Review
        • Ensure all checks have passed before merging new code
        • Ensure issues deletion is limited to specific users
        • Ensure maximum number of administrators are set for the organization
        • Ensure pipelines are automatically scanned for vulnerabilities
        • Ensure repository creation is limited to specific members
        • Ensure repository deletion is limited to specific users
        • Ensure strict base permissions are set for repositories
        • Ensure the organization is requiring members to use Multi-Factor Authentication (MFA)
        • Ensure two administrators are set for each repository
        • Ensure verification of signed commits for new changes before merging
        • Insecure Webhook
        • Security Policy
        • The Software Bill of Materials (SBOM) is not produced
        • Unprotected branch
        • Vulnerabilities
      • URL Dependency
        • NPM URL Dependency
        • PyPI URL Dependency
      • Use HTTPS With Remote Repositories
        • Maven Use HTTPS with remote repositories
        • NuGet Use HTTPS with remote repositories
        • PyPI Use HTTPS with remote repositories
    • Hardcoded Secrets Spotting
      • API Key
        • Abstract API Key
        • AccuWeather API key
        • Adafruit IO Key
        • Anthropic API key
        • Authress Service Client Access Key
        • PostHog API key
        • PostHog Personal API key
        • Twilio API Key
        • Twilio Account SID
        • Twilio Auth Token
      • API Token
        • Aiven Token
        • Akamai API Token
        • Alchemy API Key
        • Alibaba Cloud Access Key ID
        • Alibaba Cloud Secret Access Key
        • Amazon MWS Token
        • Amazon Web Services Keys ID
        • Amazon Web Services Keys Secret
        • Amazon Web Services Keys Token
        • Artifactory API Key
        • Artifactory Access Token
        • Atlassian API token
        • Auth0 Keys
        • Azure Personal Access Token
        • Azure Service Management Certificate
        • Bitbucket Repository Access Token
        • CircleCI Personal Token
        • CircleCI Project Token
        • Clockwork Key
        • Cloudant Keys
        • Cloudflare Credentials
        • Cloudflare Global API Key
        • Codacy API Token
        • Codacy Project Token
        • Codeclimate key
        • Codecov Token
        • Codecov Token in codecov Command
        • Confluent Keys
        • Contentful Content Delivery API Key
        • Contentful Content Management personal access token
        • Coveralls Config Token
        • Coveralls Token
        • Crates.io Key
        • Customer.io App Keys
        • Customer.io Track Encoded Keys
        • Customer.io Track Keys
        • Databricks Authentication Token
        • Datadog API Credentials
        • Digital Ocean OAuth Client Secret
        • DigitalOcean Spaces Keys
        • DigitalOcean Token
        • Discord Bot Token
        • Discord Oauth2 Keys
        • Docker Swarm Join Token
        • Docker Swarm Unlock Key
        • Dropbox App Credentials
        • Dropbox Key
        • Facebook App Keys
        • Firebase Cloud Messaging API Key
        • Flutterwave API Key
        • Gemfury credentials
        • Gemini API Key
        • GitHub token
        • GitLab Enterprise Personal Access Token
        • GitLab Personal Access Token
        • GitLab Personal Access Token in URL
        • Google API Key
        • Google OAuth2 Keys
        • Grafana Personal Token
        • Grafana Service Account Token
        • Heartland API Key
        • Heroku Platform Key
        • HubSpot API Key
        • Intercom Access Token
        • JSON Web Token
        • Kubernetes JWT
        • Line Messaging OAuth2 Keys
        • Line Token
        • Linkedin OAuth2 Keys
        • Linode Personal Access Token
        • Llama API Key
        • Mailchimp API Key
        • Mailgun Key
        • Midtrans API Key
        • Moneywave API Key
        • Npm Token
        • NuGet API Key
        • Okta Keys
        • Okta Token
        • OpenAI API Key
        • OpenWeatherMap Call Token
        • OpenWeatherMap URL Token
        • PayPal OAuth2 Keys
        • Planetscale API Key
        • Postman API Key
        • Pulumi Access Token
        • Pusher Channels Keys
        • Python Package Index API Token
        • RapidAPI Key
        • Razorpay API Key
        • RubyGems API Key
        • Salesforce Oauth2 Keys
        • Salesforce Refresh Tokens
        • Sendgrid API Key
        • Sentry Token
        • Shopify Generic App Token
        • Shopify Private App Token
        • Shopify Private Key
        • Shopify Private Key V2
        • Slack Access Token
        • Snyk Key
        • SonarQube Token
        • Spotify Keys
        • Square access token
        • Stripe Secret keys
        • Stripe Webhook Secret
        • Telegram Bot Token
        • Tencent Cloud Keys
        • Terraform Cloud Token
        • Travis Personal Token
        • Trello Keys
        • Twitch API Keys
        • Vultr Key
        • WePay API Token
        • Webex App Keys
        • Xygeni.io Token
        • Xygeni.io user / organization token
        • Zendesk Token
        • Zoom API JWT
        • mapbox Token
        • reCAPTCHA Key
      • Access Key
        • Artifactory Identity Token
        • Atlassian OAuth2 Client Secret
        • Azure Storage Access Key
        • Bitbucket OAuth Access Key
        • Cloudant Keys
        • Generic API key / token
        • Google Cloud Service Account Key
        • IBM Cloud Access Key
        • IBM Cloud Object Storage Key
        • Mend API Key
        • Mend User Key
        • Twitter Access Key
        • Veracode API Credentials
        • Zoom API JWT Keys
        • Zoom API Keys
        • Zoom SDK Keys
      • Access Token
        • Splunk Authentication Token
      • Crypto Key
        • Cryptographic Private Key
        • Cryptographic Private Key Putty
      • Data Storage Secret
        • Database Password
        • Database connection data
        • LDAP Credentials
        • MSSQL Credentials
        • MongoDB Password
        • MySQL Credentials Assignment
        • MySQL Credentials CLI
        • ODBC Connection String
        • Password in MongoDB Connection String
        • PostgreSQL Credentials Assignment
        • PostgreSQL Credentials Password file
        • RabbitMQ Address
        • RabbitMQ Password
        • RabbitMQ Password in URL
        • Redis CLI Credentials
        • Redis Credentials Assignment
        • Redis Password in URL
      • Encryption Keys
        • WordPress Security Key
      • Generic Secret
        • Azure Directory Application Secret
        • Base-64 encoded text
        • CLI Secret
        • CLI Secret embedded in a shell script
        • Credential with high entropy
        • Credentials File
        • Credit Card number
        • Discord Webhook
        • Django Secret Key
        • Generic Secret
        • Hubspot Webhook
        • Kubernetes Secret
        • Microsoft Teams Webhook
        • Potential information leak through comments
        • SMTP Assignment
        • SMTP Password
        • SSH Password
        • SSH Password Assignment
        • Slack API/Signing Secret
        • Slack Incoming Webhook URL
        • Twilio Webhook
      • OAuth Secret
        • Square OAuth secret
      • OAuth Token
        • HubSpot OAuth Token
        • NPM OAuth Token
      • Other
        • Cloudflare Credentials
        • HashiCorp Vault Unseal Key
        • Kubernetes User Certificate
      • Password
        • .htpasswd credentials
        • .pypirc credentials
        • Artifactory Encrypted Secret
        • Basic Authentication Credentials
        • Bitbucket Basic Auth
        • Bitbucket Client ID
        • Dockercfg Auth
        • Hardcoded password
        • Jira Basic Auth
        • Password in Maven pom.xml
        • Password in Maven settings.xml
        • Rails Master Key
        • Rails Secret Key Base
        • Snowflake Password
        • Snowflake Password in URI
        • Splunk Admin Password
        • VISA Basic Auth
        • passwd-like credentials
        • pip.conf credential
        • pip.conf proxy credential
      • Password Hash
        • Bcrypt Hash
      • Url
        • Hardcoded URL
    • IaC Flaws
      • AWS
        • ALB listening on HTTP
        • API Gateway has endpoint not private
        • API Gateway has no SSL certificate
        • API Gateway has no X-Ray active
        • AWS AMI Encryption is not enabled
        • AWS AMI is shared with multiple accounts
        • AWS EBS volume is not encrypted
        • AWS ElastiCache Redis cluster with encryption for data at rest is disabled
        • AWS RDS DB cluster encryption is disabled
        • AWS Redshift cluster is not encrypted
        • AWS Redshift cluster is publicly accessible
        • AWS Redshift using default port
        • AWS SQS server side encryption is not enabled
        • An unknown port has been exposed in the EC2 group
        • Auto Scaling group has no ELB group
        • Autoscaling launch configuration has no data in the volumes encrypted
        • Batch job has privileged container
        • CMK is unusable
        • CMK rotation is disabled
        • CloudFormation has no stack policy
        • CloudFormation has the stack retention disabled
        • CloudFormation stack notifications are disabled
        • CloudFormation without template
        • CloudFront distribution without strict security headers policy
        • CloudFront has no configured web application firewall
        • CloudFront logging is disabled
        • CloudTrail has no the SNS topic name configured
        • CloudTrail has the logging disabled
        • CloudTrail is not integrated with CloudWatch
        • CloudTrail log file validation is disabled
        • CloudTrail multi region disabled
        • CloudWatch has no retention period
        • CodeBuild Project encryption is disabled
        • CodeBuild Project is not encrypted
        • Configuration aggregator has no all regions enabled
        • Data stored in Aurora is unencrypted at rest
        • EBS volume is not encrypted
        • EC2 Instance using default VPC
        • EC2 group has HTTP port open to internet
        • EC2 group has SQL analysis services port publicly accessible
        • EC2 group has no restrict access to administration ports
        • EC2 instance has public IP
        • EC2 instance should not have public IP
        • EC2 instance without VPC
        • EC2 security group has unrestricted traffic access
        • EC2 with EBS not optimized
        • ECR image repository has public access
        • ECR image scan on push is disabled
        • ECR image tag is mutable
        • ECS Service admin role is present
        • ECS Service task has network mode different to awsvpc
        • ECS Service without running task
        • ECS Task definition has secrets in the container environment in plain text
        • EFS is not encrypted
        • EFS without tags
        • ELB use weak ciphers
        • ElastiCache using default port
        • ElastiCache without VPC
        • Ensure ALB protocol is HTTPS
        • Ensure AWS EKS cluster security group is not overly permissive to all traffic
        • Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0
        • Ensure AWS IAM password policy does not allow password reuse
        • Ensure AWS IAM policy does not allow assume role permission across all services
        • Ensure AppSync has Field-Level logs enabled
        • Ensure AppSync has Logging enabled
        • Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption
        • Ensure CloudTrail logs are encrypted at rest using KMS CMKs
        • Ensure Code artifact Domain is encrypted by KMS using a customer managed Key (CMK)
        • Ensure DAX encryption at rest is not disabled
        • Ensure DB instance gets all minor upgrades automatically
        • Ensure DMS replication instance is not publicly accessible
        • Ensure DocDB TLS is not disabled
        • Ensure DocumentDB is encrypted at rest
        • Ensure DynamoDB Point-In-Time Recovery (PITR) is enabled
        • Ensure DynamoDB point in time recovery is enabled
        • Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK)
        • Ensure EFS is securely encrypted
        • Ensure Elasticsearch Domain enforces HTTPS
        • Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions
        • Ensure Glue Data Catalog Encryption is enabled
        • Ensure IAM policy documents do not allow * as a statement’s action
        • Ensure IAM role allows only specific services or principals to assume it
        • Ensure KMS key policy does not contain wildcard (*) principal
        • Ensure Kinesis Stream is securely encrypted
        • Ensure Neptune Cluster instance is not publicly available
        • Ensure Neptune logging is enabled
        • Ensure Neptune storage is securely encrypted
        • Ensure Redshift cluster encryption at rest is enabled
        • Ensure Redshift cluster is not publicly accessible
        • Ensure Redshift uses SSL
        • Ensure S3 Bucket ACL doesn’t allow public write
        • Ensure S3 buckets are encrypted with KMS by default
        • Ensure SQS policy does not allow ALL (*) actions
        • Ensure SageMaker Endpoint is encrypted
        • Ensure SageMaker Notebook is encrypted at rest using KMS CMK
        • Ensure all Elasticsearch has node-to-node encryption enabled
        • Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit
        • Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token
        • Ensure all data stored in the SNS topic is encrypted
        • Ensure no IAM policies documents allow * as a statement’s actions
        • Ensure no hard-coded secrets exist in EC2 user data
        • Ensure no hard-coded secrets exist in lambda environment
        • Ensure that ALB drops HTTP headers
        • Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager
        • Ensure that Secrets Manager secret is encrypted using KMS CMK
        • Ensure that Timestream database is encrypted with KMS CMK
        • Ensure that Workspace root volumes are encrypted
        • Ensure that Workspace user volumes are encrypted
        • Glue Security Configuration has encryption disabled
        • Glue component has a security configuration associated
        • GuardDuty is not enabled at organization level
        • IAM Assume role policy without ExternalId or MFA
        • IAM Group without users
        • IAM Password is unchangeable in the policy
        • IAM Password policy has no expire
        • IAM Password policy has no reuse prevention
        • IAM Password policy has no the minimum length
        • IAM Password policy without lowercase letter
        • IAM Password policy without number
        • IAM Password policy without uppercase letter
        • IAM database is not enabled
        • IAM policy grants 'AssumeRole' permission to all principals
        • IAM policy grants 'AssumeRole' permission to all services
        • IAM policy has allowed full administrative privileges for all resources
        • IAM policy has granted full permissions to resources
        • IAM policy is attached to user
        • IAM policy with full wildcard administrative privileges
        • KMS Key has a vulnerable policy
        • Kinesis is not encrypted with KMS
        • Lambda function has no tags
        • Lambda function without X-Ray tracing
        • Lambda permission principal contains a wildcard
        • Launch configurations do not have encrypted EBS volumes
        • Load Balancer has deletion protection disabled
        • Load balancer is using insecure TLS policy
        • MSK Cluster encryption at rest or in transit is disabled
        • Public facing ALB not protected by WAF
        • RDS cluster without backup plan
        • RDS has automatic minor upgrades disabled
        • RDS has been defined with public interface
        • RDS has been defined with public subnet
        • RDS has opened a large scope
        • RDS using default port
        • RDS with backup disabled
        • Redis version is not compliant with AWS PCI DSS
        • Remote Desktop Port is open to all internet
        • S3 Bucket ACL allows public read access
        • S3 Bucket CORS is allowed for all origins
        • S3 Bucket SSE disabled
        • S3 Bucket has Read access for all authenticated users
        • S3 Bucket has all actions allowed for any principal
        • S3 Bucket has allowed Delete Action from all principals
        • S3 Bucket has allowed Get Action from all principals
        • S3 Bucket has allowed List Action from all principals
        • S3 Bucket has allowed Put Action from all principals
        • S3 Bucket has allowed access for all principals
        • S3 Bucket has public Read access
        • S3 Bucket logging is not enabled
        • S3 Bucket without versioning
        • S3 Storage is not protected with SSE
        • S3 bucket has block public ACLs disabled
        • SES Policy allow actions for all principals
        • SNS Topic is publicly accessible
        • SQS Policy allow all actions
        • SQS Policy has dangerous access for all principals
        • SQS Queue is exposed
        • SQS without server side encryption
        • The CA certificate for the RDS is outdated
        • The CIDR IP has public interface
        • The CloudFront has a default SSL certificate
        • The CloudFront has an insecure protocol version
        • The connection between CloudFront and the origin server has HTTP allowed
        • The encryption for the EFS is without KMS
        • The log files in CloudTrail are not encrypted with KMS
        • The storage in the RDS is not encrypted
        • User data contains a base64 encoded private key
        • User data shell script is not encoded
        • Verify CloudFront Distribution Viewer Certificate is using TLS v1.2
      • Ansible
        • CosmosDB has no range ip filter configured
        • Do not create files without permissions control
        • Do not install the latest packages with package managers
        • Do not log passwords
        • Do not use deprecated modules
        • Do not use integers to octal file permissions in YAML
        • Do not use the latest checkout
        • Do not use the same owner and group to transfer files
      • Azure
        • A sensitive port for TCP or UDP protocols is open for the whole network
        • AKS monitoring logging is not enabled
        • Active Directory Administrator is not configured for SQL server
        • Active Directory account has predictable username as 'Admin' or 'Root'
        • App Service is not registered with an Azure Active Directory account
        • Application Gateway WAF has essential rules disabled
        • Azure App Service Web app authentication is Off
        • Azure App Service Web app does not redirect HTTP to HTTPS
        • Azure App Services FTP deployment is AllAllowed
        • Azure Data factory public network access enabled
        • Azure Kubernetes Cluster without RBAC enabled
        • Azure Kubernetes Service has no network policy configured
        • Azure Linux scale uses password authentication
        • Azure MariaDB database server with SSL connection disabled
        • Azure SQL Server threat detection alerts are not enabled for all threat types
        • Azure SQL server audit log retention is too low
        • Azure SQL server auditing is disabled
        • Azure VM data disk is encrypted with the default encryption key instead of ADE/CMK
        • Azure Virtual Network has no a Network Security Group
        • Azure WAF policy disabled or without Detection or Prevention modes
        • Azure application gateway does not have WAF enabled
        • Azure default network access for Storage Account is allowed
        • Azure front door does not have WAF enabled
        • Azure front door does not use WAF in Detection or Prevention modes
        • Azure function app authentication is off
        • Azure key vault is not recoverable
        • Azure linux instance with password authentication
        • CosmosDB without tags
        • Do not allow public access container or its blobs
        • Do not allow the admin user to login to the container registry
        • Do not put the storage account access as public
        • Ensure Azure MariaDB servers dont have public network access
        • Ensure Azure subscriptions with custom roles have minimum permissions
        • Ensure RDP Internet access is restricted
        • Ensure SSH Internet access is restricted
        • Ensure all keys have an expiration date
        • Ensure all secrets have an expiration date
        • Ensure public access level for Blob Containers is set to private
        • Ensure that 'Send Alerts To' is enabled for MSSQL servers
        • Ensure that Azure Defender is set to On Container Registries
        • Ensure that Azure Defender is set to On for App Services.
        • Ensure that Azure Defender is set to On for Kubernetes
        • Ensure that Azure Defender is set to On for Servers
        • Ensure that standard pricing tier is selected
        • Front Door WAF has essential rules disabled
        • Key vault key is not backed by HSM
        • Log profile is not capturing all activities
        • MSSQL servers do not have email service and co-administrators enabled
        • MySQL is not using the latest version of TLS encryption servers
        • No Network Security Group is attached to the Virtual Machine
        • Non SSL Redis Cache port is enabled
        • PostgreSQL checkpoint logging is not enabled
        • PostgreSQL connection throttling is not enabled
        • PostgreSQL connections logging is not enabled
        • PostgreSQL disconnections logging is not enabled
        • PostgreSQL duration logging is not enabled
        • PostgreSQL log retention is not enabled
        • Role definition has enabled custom role creation
        • Role-Based Access Control (RBAC) is disabled for AKS
        • SQL Server is not using the latest version of TLS encryption
        • SQL databases allow ingress from 0.0.0.0/0
        • SQL servers do not enable data security policy
        • SSL is disabled for MySQL
        • SSL is disabled for PostgresSQL
        • Secure transfer required is not enabled
        • Send email notification for high severity alerts is not enabled
        • Send email notification for high severity alerts to admins is not enabled
        • Storage account does not use the latest version of TLS encryption
        • Storage for critical data not encrypted with Customer Managed Key
        • The IP configuration allow a lot of IPs
        • The Key Vault is not soft delete
        • The SQL Server Admin account has predictable username as 'Admin' or 'Root'
        • The active log retention is lower than 365 days
        • The application gateway has no firewall configured
        • The configured minimum TLS version is not the latest version
        • The container register has no locks
        • The firewall rule allowing a lot of hosts to access
        • The firewall rule allowing unrestricted access to Redis
        • The storage account has http traffic allowed
        • The web application has http traffic allowed
        • Trusted Microsoft Services should be enabled for Storage Account access
        • UDP Internet access is not restricted
        • Unencrypted Data Lake Store accounts
        • Unrestricted access to SQL Server
        • Virtual Machine extensions are installed
        • Web App does not use the latest version of TLS encryption
      • Docker
        • Container runs as root
        • Healthcheck instructions have not been added to container image
        • SSH port exposed
        • Unpinned version for base image
      • GCP
        • BigQuery dataset is public accessible
        • Check if the Google compute firewall allows unrestricted RDP access
        • Cloud Storage Anonymous or Publicly Accessible
        • Cloud Storage Bucket should have versioning enabled
        • Cloud storage bucket should have logging enabled
        • Cluster Master Authentication Disabled
        • Compute instances must be launched with Shielded VM enabled
        • Compute instances shouldn’t be accessible from the Internet
        • DNSSEC Using RSASHA1
        • DNSSEC must be enabled for Cloud DNS
        • Defaults Kubernetes Engine Clusters should not be configured to use the default service account
        • GCP SQL Instance should not have insecure Cross DB Ownership Chaining On
        • Google Compute Engine VM instances should not enable serial ports
        • Google Compute Network should not use a firewall rule that allows all ports
        • Google Compute Network should not use a firewall rule that allows port range
        • Google Compute Network should not use default firewall rule
        • Google Compute SSL Policy Weak Chyper Suits is Enabled
        • Google Compute Subnetwork should have Private Google Access enabled
        • Google Firewall should not allow SSH access (port 22) from the Internet (public CIDR block)
        • Google Kubernetes Engine (GKE) Basic Authentication must be disabled
        • Instances must not be configured to use the Default Service Account that has full access to all Cloud APIs
        • Instances must not have IP forwarding enabled
        • KMS encryption keys should be rotated every 90 days or less
        • Kubernetes Clusters must be configured with labels
        • Kubernetes Clusters must be created with Alias IP ranges enabled
        • Kubernetes Clusters must be created with Client Certificate enabled
        • Kubernetes Clusters must be created with Private Clusters enabled
        • Kubernetes Engine Clusters must have Legacy Authorization set to disabled
        • Kubernetes Engine Clusters must have Network Policy enabled
        • Kubernetes Engine Clusters must have Stackdriver Logging enabled
        • Kubernetes Engine Clusters must have Stackdriver Monitoring enabled
        • Management Kubernetes nodes must have auto upgrades set to true
        • Master authorized networks must be enabled in GKE clusters
        • MySQL Instance With Local Infile On
        • PostgreSQL Misconfigured Logging Duration Flag
        • PostgreSQL database 'log_min_messages' flag isn’t set to a valid value
        • PostgreSQL database 'log_temp_files' flag isn’t set to '0'
        • PostgreSQL database instance should have a 'log_checkpoints' flag with its value set to 'on'
        • PostgreSQL database instance should have a 'log_connections' flag with its value set to 'on'
        • SQL DB Instance Publicly Accessible
        • SQL Instance Backup Disabled
        • SQL Instance With SSL Disabled
        • SQL Instance should not have Contained Database Authentication On
        • The node image should be Container-Optimized OS(COS)
        • VM Instance With Full Cloud Access
        • VM Instance should block project-wide SSH keys
        • VM disks for critical VMs must be encrypted with Customer-Supplied Encryption Keys (CSEK) or Customer-Managed Encryption Keys (CMEK)
        • VM instance should have OSLogin enabled
      • Github
        • Ensure GitHub Actions secrets are encrypted
      • Kubernetes
        • API server without certificate / private key
        • Anonymous authentication on Kubelet server is allowed
        • Apiserver allows weak cryptographic ciphers
        • Apiserver does not set TLS key and certificate
        • Authorization mode AlwaysAllow allows all requests
        • Authorization mode does not include node
        • Certificate Authority for apiserver not set
        • Certificate or Key file not set for etcd
        • Certificate or private key not set for peer authentication on etcd
        • Client certificate / key for apiserver not set
        • Container is privileged
        • Container runs with AllowPrivilegeEscalation
        • Controller Manager bound to non loop-back insecure address
        • Controller Manager has profiling active
        • Controller Manager with invalid --root-ca-file argument
        • Controller Manager without RotateKubeletServerCertificate set
        • Controller Manager without individual service account credentials
        • Docker daemon socket exposed to containers
        • Encryption providers are not properly configured
        • Etcd uses self-signed certificates
        • Excessive CertificateSigningRequests approval permission
        • Excessive RoleBindings / ClusterRoleBindings permissions
        • Excessive permissions to escalate roles
        • Excessive wildcard permissions
        • Excessive write permissions over admission webhook
        • Explicit request-timeout not set
        • Garbage collector on pod termination is not active
        • HTTPS not enabled between apiserver and kubelets
        • Highly privileged CAP_SYS_ADMIN granted
        • Host network namespace sharing is allowed
        • Host process ID namespace sharing is allowed
        • IPC namespace sharing is allowed
        • Insecure bind address
        • Insecure bind port
        • Kubelet client certificate rotation is disabled
        • No Certificate Authority file set for etcd
        • No client authentication on etcd service
        • No client certificate for peer authentication in etcd
        • No service account public key file
        • Persistent audit log not enabled
        • Scheduler service bound to loop-back insecure address
        • Service account lookup not set
        • The admission control plugin AlwaysAdmit is set
        • The admission control plugin AlwaysPullImages is not set
        • The admission control plugin NodeRestriction is not set
    • Code Tampering Detection
      • CI/ CD
        • Build File Modification
        • Workflow File Modification
      • Configuration
        • CODEOWNERS File Modification
        • Configuration File Modification
        • Env File Modification
        • Shell Script Modification
      • Custom Critical File
        • Custom Critical File Modification
      • Descriptor
        • Dependency Descriptor File Modification
      • IaC Template
        • IaC File Modification
      • Policy
        • Security Policy File Modification
      • Security Tool Configuration
        • Modification of Security Tool Configuration
    • Code Security - Malware
      • Execution
        • Decoded Code Execution
        • Decrypted Code Execution
        • Downloaded Code Execution
        • Malicious Command Execution
        • Obfuscated Code Execution
        • Silent execution
        • System Registry Code Execution
        • Unusual File Execution
      • File
        • Masquerade File Type
      • Network
        • Suspicious Blockchain Payload
        • Suspicious Request
        • Suspicious URL
      • Package
        • Malicious Installation Scripts
      • Registry
        • System Registry Tampering
      • Sensitive Data
        • Browser Sensitive Data Enumeration
        • Sensitive Data Enumeration
        • Sensitive Data Exfiltration
        • Sensitive File Exfiltration
        • Sensitive File encryption
      • System
        • Bidirectional Characters
        • Clipboard Hijacker
        • Execution Policy Bypass
        • Impair Defenses: Disabled Tools
        • Invisible Characters
        • Obfuscated Code
        • Process Termination
        • Suspicious Scheduled system service
        • Virtualization Sandbox Evasion
    • Code Security - Vulnerabilities
      • C / C++
        • Access Control
          • Null ACL in SetSecurityDescriptorDacl may allow all access
          • Too-permissive umask values
        • Buffer Overflow
          • Direct write into stack buffer may cause stack-based buffer overflow
          • Incorrect use of sizeof() on a malloc’ed pointer type
          • Incorrect use of strncat() may lead to buffer overflow
          • Incorrect use of strncpy/stpncpy/strlcpy with wrong buffer size
          • Missing null termination after strncpy/stpncpy
          • Off-by-one error in buffer size calculation
          • Pointer subtraction between unrelated memory objects
          • Unsafe use of snprintf/vsnprintf return value may cause buffer overflow
          • Unsafe use of strlcpy/strlcat return value may cause buffer overflow
          • Use of insecure gets() function with no bounds checking
          • Use of insecure scanf-family functions prone to buffer overflow
          • Use of insecure sprintf/vsprintf functions prone to buffer overflow
          • Use of insecure unbounded string copy/concatenation functions
        • Command Injection
          • Command injection via exec functions
          • Possible executable path hijacking
        • Cryptography
          • Insecure cipher algorithm
          • Insecure hashing algorithm
          • Usage of insufficient random number generator
          • Use of insecure rand/srand PRNG not suitable for security contexts
          • Use of weak or non-cryptographic hash algorithm in security context
        • Denial Of Service
          • Regular expression with inefficient worst-case complexity (ReDoS)
        • Format String
          • Format string vulnerability from externally controlled format argument
        • Integer Overflow
          • Integer overflow from unsafe use of strlen() in arithmetic
          • Integer overflow or wraparound in arithmetic calculation
          • Integer truncation from casting to a smaller primitive type
          • Meaningless comparison of unsigned variable against negative value
          • Unsafe signed-to-unsigned or unsigned-to-signed integer conversion
        • Memory Management
          • Calling free() on memory not allocated by malloc/calloc/realloc
          • Double free of previously deallocated memory
          • Exposure of memory addresses that may defeat ASLR
          • Function returns the address of a stack-allocated variable
          • Mismatched C++ memory allocation and deallocation functions
          • Mismatched memory allocation and deallocation functions
          • Unchecked return value of malloc/calloc/realloc
          • Use of insecure alloca() with no guarantee of valid memory allocation
          • Use of previously freed memory
          • Use of putenv() with a pointer to a stack variable
        • Miscellaneous
          • Access to attacker-controlled command-line arguments or environment variables
          • Assert used as the only validation for untrusted input
          • Call to a potentially insecure function that should be reviewed
          • Common typo patterns that change application logic
          • High-entropy string assignment that may contain a hardcoded secret
          • Incorrect argument order in memset() call
          • Missing break statement in switch case causing fall-through
          • Missing default case in switch statement
          • Missing return statement in non-void function
          • Overlapping source and destination in sprintf/snprintf
          • Unchecked return value of scanf-family functions
          • Uncontrolled search path element
          • Usage of deprecated function (getlogin)
          • Use of atoi/atol/atof with no error handling or overflow checking
          • Use of obsolete function (getpass)
        • Privilege Management
          • Incorrect order of setuid/setgid calls may allow privilege escalation
          • Return values not checked when attempting to drop privileges
          • Unchecked return value of setuid/seteuid may leave elevated privileges
        • Race Condition
          • Incorrect order of setuid/setgid calls may allow privilege escalation
          • Insecure use of vfork function
          • Time-of-check time-of-use (TOCTOU) race condition in file operations
          • Unchecked return value of setuid/seteuid may leave elevated privileges
          • Use of deprecated signal() API instead of sigaction()
        • Resource Availability
          • Missing error check on read() susceptible to file descriptor exhaustion
        • Temp File
          • Insecure temporary file creation
      • CSharp
        • Access Control
          • .Net access restriction subverted (Reflection)
          • Anonymous LDAP Bind
        • Api
          • Dangerous API
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery ('CSRF')
          • Insufficient Session Expiration
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • JWT Signature Verification Bypass
          • Weak Encryption Algorithm
          • Weak Hash Algorithm
          • Weak Password Hash
        • Information Leak
          • Hardcoded Credentials
          • Information Exposure Through Error Message
          • Insecure Transport
          • Observable Timing Discrepancy
          • Password In Redirect
          • Plaintext Storage In Cookie
          • Trust Boundary Violation
        • Injection
          • Code Injection During Deserialization
          • Cookie Poisoning
          • Cross Site Scripting ('XSS')
          • Dynamic code injection in scripting API
          • HTTP Parameter Pollution
          • HTTP Splitting
          • Improper neutralization of data within XPath expressions ('XPath Injection')
          • Improper neutralization of special elements used in a command ('Command Injection')
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • NoSQL Injection
          • Open Redirect
          • Process Control
          • Regex Injection
          • SQL Injection ('SQLi')
          • Unsafe Reflection
          • XAML Injection
          • XML Entity Injection
          • XML Injection
        • Memory Access
          • Buffer Overflow
        • Misconfiguration
          • ASP.Net Custom Errors Disabled
          • ASP.Net Unsafe Authentication Forms
          • ASP.Net Unsafe Cookies Configuration
          • Cross-site scripting protection disabled
          • Debug Features Enabled
          • Insecure SSL
          • Request Validation Disabled
          • Unsafe Cookie
          • User Controlled Primary Key
        • Path Resolution
          • Path Traversal
          • Zip Slip
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
          • Insufficient Key Size
          • Non Random IV With CBC Mode
        • Privilege
          • P/Invoke declarations should not be safe critical
        • Resource Management
          • Connection String Parameter Pollution
          • Regular expression Denial of Service ('ReDoS')
        • Risky Values
          • Dangerous Hostname Check
      • Go
        • Access Control
          • Anonymous LDAP Bind
          • Insecure File Permissions
          • Socket Binding To All Interfaces
        • Api
          • Avoid Native Calls
          • Dangerous API
          • Insecure Temporary File
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery (CSRF)
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • JWT Signature Verification Bypass
          • Use of a broken or risky cryptographic algorithm
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak cryptographic initialization vector
          • Weak Hash Algorithm
          • Weak Password Hash
        • Entry Points
          • Profiling Endpoint Exposed
        • Information Leak
          • Hardcoded Credentials
          • Information Exposure Through Debug Log
          • Information Exposure Through Error Message
          • Information Exposure Through External Request
          • Insecure Authentication
          • Insecure Transport
          • JSONP Hijacking
          • Observable Timing Discrepancy
          • Password In Redirect
          • Plaintext Storage In Cookie
          • Plaintext Storage Of Password
          • Serializable Class Containing Sensitive Data
          • Server Insecure Transport
          • Trust Boundary Violation
        • Injection
          • Code Injection
          • Cookie Poisoning
          • Format String Injection
          • HTTP Parameter Pollution
          • HTTP Splitting
          • Improper neutralization of data within XPath expressions ('XPath Injection')
          • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
          • JSON Injection
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • NoSQL Injection
          • OS Command Injection
          • Regex Injection
          • Resource Injection
          • SQL Injection
          • Server-side Template Injection
          • Sleep Injection
          • URL Redirection to Untrusted Site ('Open Redirect')
          • Unsafe Reflection
          • XML Injection
        • Misconfiguration
          • Insecure SSL
          • Insecure SSL Version
          • Missing SSH host key verification
          • Too Broad Cors Policy
          • Unsafe Cookie
          • Unsafe Session Configuration
          • User Controlled Primary Key
        • Other
          • Execution After Redirect ('EAR')
        • Path Resolution
          • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
          • Zip Slip
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
          • Insufficient Key Size
        • Resource Management
          • Connection String Parameter Pollution
          • DoS Decompression Bomb
          • Slowloris Attack
        • Risky Values
          • Error unhandled
          • Integer Overflow or Wraparound
      • Html
        • Access Control
          • Hidden Sensitive Fields
          • Insecure Iframe Configuration
          • Missing Frame Ancestors Protection
          • Missing Resource Integrity
          • Missing Tabnabbing Protection
          • Unsafe Content Security Policy
        • Authentication
          • Forms Without CSRF Protection
        • Information Leak
          • Autocomplete Enabled for Sensitive Fields
          • Insecure Authentication via HTTP GET
          • Insecure Meta Tags
          • Insecure Resource
          • Unmasked Password Fields
        • Injection
          • Inline JavaScript Event Handler
          • Input Fields Without Validation Attributes
          • JavaScript Protocol Urls
      • Java
        • Access Control
          • Android Missing Receiver Permission
          • Android Sticky Broadcast
          • Android Unrestricted Broadcast
          • Android Webview JavaScript Enabled
          • Android Webview JavaScript Interface Annotation
          • Android World Writeable Readable File Permission
          • Anonymous LDAP Bind
          • Database Access Control
          • Implicitly Exported Android Component
          • Intent Forwarding
          • Privilege Escalation Vulnerability
          • Too Broad App Permissions
        • Api
          • Avoid Direct Database Connection
          • Avoid Explicit Socket
          • Avoid Explicit Thread Management
          • Avoid JVM Exit
          • Avoid Native Calls
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery ('CSRF')
          • Insufficient Session Expiration
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • JWT Signature Verification Bypass
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak cryptographic initialization vector
          • Weak Encryption Algorithm
          • Weak Hash Algorithm
          • Weak Password Hash
        • Entry Points
          • Android Debugging Enabled
          • Android Webview Debugging Enabled
          • Avoid Leftover Debug Code
        • Exception Management
          • Unhandled SSL Exception
        • Information Leak
          • Android Application Backup Allowed
          • Android Screenshot Allowed
          • Android Sensitive Keyboard Cache
          • Android Webview Content Access Enabled
          • Android Webview File Access Enabled
          • Hardcoded Credentials
          • Information Exposure Through Debug Log
          • Information Exposure Through Error Message
          • Information Exposure Through External Request
          • Insecure Authentication
          • Insecure Transport
          • Observable Timing Discrepancy
          • Password In Redirect
          • Plaintext Storage In Cookie
          • Plaintext Storage Of Password
          • SMS Monitoring
          • Serializable Class Containing Sensitive Data
          • Trust Boundary Violation
        • Injection
          • Android Fragment Injection
          • Android URI Permission Manipulation
          • Code Injection
          • Code Injection During Deserialization
          • Cookie Poisoning
          • Cross Site History Manipulation ('XSHM')
          • Cross Site Scripting ('XSS')
          • External Control Of Configuration Setting
          • Format String Injection
          • HTTP Parameter Pollution
          • HTTP Splitting
          • Improper Validation Of Array Index
          • JSON Injection
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • NoSQL Injection
          • OS Command Injection
          • Open Redirect
          • Process Control
          • Reflected File Download
          • Regex Injection
          • Resource Injection
          • SQL Injection ('SQLi')
          • Same Origin Method Execution ('SOME')
          • Security Check In Overridable Method
          • Sleep Injection
          • Third-Party Package Context Code Execution
          • Unchecked Input In Loop Condition
          • Unsafe Reflection
          • View Manipulation
          • XML Entity Injection
          • XML Injection
          • XPath Injection
        • Misconfiguration
          • Cross-site scripting protection disabled
          • Insecure SSL
          • Insecure Transport Configuration
          • Missing Certificate Pinning
          • Spring Security Debug Enabled
          • Spring XSS Protection Disabled
          • Too Broad Cors Policy
          • Unprotected Storage of Credentials
          • Unrestricted Request Mapping
          • Unsafe Cookie
          • User Controlled Primary Key
          • Web.xml security misconfigurations
        • Other
          • Dangerous API
          • Execution After Redirect ('EAR')
        • Path Resolution
          • Input Path Not Canonicalized
          • Input Path Not Normalized
          • Path Traversal
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
          • Insufficient Key Size
          • Non Random IV With CBC Mode
        • Resource Management
          • Connection String Parameter Pollution
          • Potential Infinite Loop
          • Regular expression Denial of Service ('ReDoS')
        • Risky Values
          • Avoid Non Serializable Objects Stored
          • Dangerous Hostname Check
        • Synchronization
          • Race Condition Format
          • Race Condition Matcher
          • Race Condition Servlet
          • Static Database Connection
      • JavaScript / TypeScript
        • Authentication
          • Cross Site Request Forgery (CSRF)
          • Improper Certificate Validation
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • Insufficient Cryptographic Key Length
          • JWT Signature Verification Bypass
          • Use of a broken or risky cryptographic algorithm
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak password hashing
          • Weak Hash Algorithm
        • Information Leak
          • Hardcoded Credentials
          • Information Exposure Through Error Message
          • Insecure Transport
          • Plaintext Storage In Cookie
          • Sensitive data in HTML5 Web Storage
          • Server Insecure Transport
          • Too Broad Message Posting
        • Injection
          • Angular Cross Site Scripting
          • Client-side Template Injection
          • Code Injection
          • Code injection during object deserialization
          • Code injection with javascript: URL in JSX
          • Cookie Poisoning
          • HTML escape disabled in Vue component
          • Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
          • Improper neutralization of XML entities ('Xml Entity Injection')
          • Improper neutralization of data within XPath expressions ('XPath Injection')
          • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
          • NoSQL Injection
          • OS Command Injection
          • Regex Injection
          • Resource Injection
          • SQL Injection
          • Server-side Template Injection
          • URL Redirection to Untrusted Site ('Open Redirect')
          • Unsafe JQuery Plugin
        • Misconfiguration
          • CORS Policy is too broad
          • Cross-site scripting protection disabled
          • HTTP Strict Transport Security (HSTS) not set
          • Insecure SSL
          • Prevent MIME Sniffing
          • Strict Contextual Escaping (SCE) disabled
          • Unsafe Cookie
          • X-Powered-By header must be disabled
        • Path Resolution
          • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
          • Zip Slip
        • Predictability
          • Hardcoded Cryptographic Key
          • Insecure Randomness
        • Resource Management
          • Allocation Of Resources Without Limits
          • Potential loop with unreachable exit condition ('Infinite Loop')
          • Regular Expression DoS
        • Risky Values
          • Do not use eval()
          • React dangerouslySetInnerHTML should not be used
          • ReactDOM.findDOMNode() should not be used
          • SolidJS innerHTML should not be used without sanitization
        • UI
          • No clickjacking protection configured
      • Kotlin
        • Access Control
          • Android Missing Receiver Permission
          • Android Sticky Broadcast
          • Android Unrestricted Broadcast
          • Android Webview JavaScript Enabled
          • Android Webview JavaScript Interface Annotation
          • Android World Writeable Readable File Permission
          • Anonymous LDAP Bind
          • Implicitly Exported Android Component
          • Intent Forwarding
          • Privilege Escalation Vulnerability
          • Too Broad App Permissions
        • Api
          • Avoid Native Calls
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery ('CSRF')
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • JWT Signature Verification Bypass
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak cryptographic initialization vector
          • Weak Encryption Algorithm
          • Weak Hash Algorithm
          • Weak Password Hash
        • Entry Points
          • Android Debugging Enabled
          • Android Webview Debugging Enabled
        • Exception Management
          • Unhandled SSL Exception
        • Information Leak
          • Android Application Backup Allowed
          • Android Screenshot Allowed
          • Android Sensitive Keyboard Cache
          • Android Webview Content Access Enabled
          • Android Webview File Access Enabled
          • Hardcoded Credentials
          • Information Exposure Through Debug Log
          • Information Exposure Through Error Message
          • Information Exposure Through External Request
          • Insecure Authentication
          • Insecure Transport
          • Observable Timing Discrepancy
          • Password In Redirect
          • Plaintext Storage In Cookie
          • Plaintext Storage Of Password
          • SMS Monitoring
          • Serializable Class Containing Sensitive Data
          • Trust Boundary Violation
        • Injection
          • Android Fragment Injection
          • Android URI Permission Manipulation
          • Code Injection
          • Code Injection During Deserialization
          • Cookie Poisoning
          • Cross Site Scripting ('XSS')
          • Format String Injection
          • HTTP Parameter Pollution
          • HTTP Splitting
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • NoSQL Injection
          • OS Command Injection
          • Open Redirect
          • Process Control
          • Reflected File Download
          • Regex Injection
          • Resource Injection
          • SQL Injection ('SQLi')
          • Same Origin Method Execution ('SOME')
          • Sleep Injection
          • Third-Party Package Context Code Execution
          • Unsafe Reflection
          • View Manipulation
          • XML Entity Injection
          • XPath Injection
        • Misconfiguration
          • Cross-site scripting protection disabled
          • Insecure SSL
          • Insecure Transport Configuration
          • Missing Certificate Pinning
          • Spring XSS Protection Disabled
          • Too Broad Cors Policy
          • Unprotected Storage of Credentials
          • Unrestricted Request Mapping
          • Unsafe Cookie
          • User Controlled Primary Key
        • Path Resolution
          • Path Traversal
          • Zip Slip
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
          • Insufficient Key Size
        • Resource Management
          • Connection String Parameter Pollution
          • Regular expression Denial of Service ('ReDoS')
      • Objective-C
        • Auth
          • Biometric authentication should be hardware and keychain backed.
        • Code
          • The App may contain banned API(s). These API(s) are insecure and must not be used.
        • Cryptography
          • SHA1 is a weak hash known to have hash collisions.
          • The App uses ECB mode in Cryptographic encryption algorithm.
          • Weak Hash algorithm used.
        • Network
          • App allows self signed or invalid SSL certificates. App is vulnerable to MITM attacks.
          • UIWebView in App ignore SSL errors and accept any SSL Certificate.
        • Platform
          • User input in "loadHTMLString" will result in JavaScript Injection.
        • Storage
          • Hardcoded sensitive information.
          • The App logs information. Sensitive information should never be logged.
          • The file has no special protections associated with it.
      • Php
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery (CSRF)
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • Use of a broken or risky cryptographic algorithm
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak cryptographic initialization vector
          • Weak Hash Algorithm
          • Weak Password Hash
        • Information Leak
          • Hardcoded Credentials
          • Information Exposure Through Debug Log
          • Information Exposure Through Error Message
          • Insecure Transport
          • Password In Redirect
          • Trust Boundary Violation
          • Twig No Use Debug
        • Injection
          • Code Injection
          • Code injection during object deserialization
          • External Variable Modification
          • Format String Injection
          • HTTP Parameter Pollution
          • Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
          • Improper neutralization of XML entities ('Xml Entity Injection')
          • Improper neutralization of data within XPath expressions ('XPath Injection')
          • Improper neutralization of external input used within a CSV or Excel formula ('Formula Injection')
          • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • Mail Content Injection
          • Mail Header Manipulation
          • NoSQL Injection
          • OS Command Injection
          • Regex Injection
          • Resource Injection
          • SQL Injection
          • Sleep Injection
          • URL Redirection to Untrusted Site ('Open Redirect')
        • Misconfiguration
          • CakePHP Unsafe Configuration
          • CakePHP Unsafe Session Configuration
          • CodeIgniter Unsafe Session Configuration
          • Laravel Unsafe Session Configuration
          • Too Broad Cors Policy
          • Twig XSS protection disabled
          • Unsafe Configuration
          • Unsafe Cookie
          • Unsafe Session Configuration
          • User Controlled Primary Key
          • Zend/ Laminas Unsafe Session Configuration
        • Other
          • Execution After Redirect ('EAR')
        • Path Resolution
          • Dangerous File Upload
          • Improper Control of filename for include / require statement ('Include File Injection')
          • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
        • Resource Management
          • Connection String Parameter Pollution
          • Regular Expression DoS
        • Risky Values
          • Do not use $_REQUEST
          • Do not use eval()
          • Symfony No Use Default Secret
      • Python
        • Access Control
          • Anonymous LDAP Bind
          • Django Missing Permissions Check
          • Insecure File Permissions
          • Socket Binding To All Interfaces
        • Api
          • Insecure Temporary File
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery (CSRF)
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • JWT Signature Verification Bypass
          • Use of a broken or risky cryptographic algorithm
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak cryptographic initialization vector
          • Weak Hash Algorithm
          • Weak Password Hash
        • Information Leak
          • Hardcoded Credentials
          • Information Exposure Through Debug Log
          • Information Exposure Through Error Message
          • Information Exposure Through External Request
          • Insecure Authentication
          • Insecure Transport
          • Observable Timing Discrepancy
          • Password In Redirect
          • Plaintext Storage In Cookie
          • Server Insecure Transport
          • Trust Boundary Violation
        • Injection
          • Code Injection
          • Code injection during object deserialization
          • Cookie Poisoning
          • HTTP Parameter Pollution
          • HTTP Splitting
          • Improper neutralization of XML entities ('Xml Entity Injection')
          • Improper neutralization of data within XPath expressions ('XPath Injection')
          • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
          • JSON Injection
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • NoSQL Injection
          • OS Command Injection
          • Regex Injection
          • Resource Injection
          • SQL Injection
          • Server-side Template Injection
          • Sleep Injection
          • URL Redirection to Untrusted Site ('Open Redirect')
          • Unsafe Cookie
          • Unsafe Reflection
        • Misconfiguration
          • Django Unsafe Configuration
          • Django Unsafe Session Configuration
          • Django XSS Protection Disabled
          • Flask Unsafe Configuration
          • Flask XSS Protection Disabled
          • Improper Request Certificate Verification
          • Insecure Parser
          • Insecure SSL Version
          • Jinja XSS Protection Disabled
          • Mako XSS Protection Disabled
          • Missing Resource Integrity Check
          • Missing SSH Host Key Verification
          • Template XSS Protection Disabled
          • Too Broad Cors Policy
          • Unsafe Cookie
          • Unsafe Logging Configuration
          • User Controlled Primary Key
        • Other
          • Execution After Redirect ('EAR')
        • Path Resolution
          • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
          • Zip Slip
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Insecure Randomness
          • Insufficient Key Size
        • Resource Management
          • Connection String Parameter Pollution
          • External Request DoS
          • Regular Expression DoS
        • Risky Values
          • Django Password Requirements Not Enforced
          • Do not use assert
          • Do not use compile()
          • Do not use eval()
      • Ruby
        • Attribute Restriction
          • Attribute Restriction
        • Authentication
          • Authentication
        • Basic Auth
          • Basic Auth
        • Command Injection
          • Command Injection
        • Cross-Site Request Forgery
          • Cross-Site Request Forgery: Missing protect_from_forgery
          • Cross-Site Request Forgery: Skipping CSRF or authentication checks by default
          • Cross-Site Request Forgery: Versions with CSRF token forgery vulnerability
        • Cross-Site Scripting
          • Cross-Site Scripting: HTML escaping is disabled for JSON output
          • Cross-Site Scripting: I18n XSS (CVE-2013-4491)
          • Cross-Site Scripting: Missing JSON encoding (CVE-2015-3226)
          • Cross-Site Scripting: Number helpers XSS vulnerabilities in certain versions
          • Cross-Site Scripting: Rails versions with SafeBuffer bug
          • Cross-Site Scripting: Strip_tags vulnerabilities
          • Cross-Site Scripting: Unescaped output in views
          • Cross-Site Scripting: Unsafe uses of select() helper
          • Cross-Site Scripting: Unsafe uses of select_tag() in some versions of Rails 3.x
          • Cross-Site Scripting: Unsanitized href Values
          • Cross-Site Scripting: Versions before 2.3.14 which have a vulnerable escape method
          • Cross-Site Scripting: Versions which do not escape single quotes (CVE-2012-3464)
          • Cross-Site Scripting: Versions with vulnerable sanitize and sanitize_css
          • Cross-Site Scripting: Vunerable uses of sanitize (CVE-2022-32209)
          • Cross-Site Scripting: XSS in Render Calls
          • Cross-Site Scripting: XSS in calls to content_tag
          • Cross-Site Scripting: XSS in link_to in versions before 3.0
          • Cross-Site Scripting: XSS vulnerability in translate helper
          • Cross-Site Scripting: simple_format XSS (CVE-2013-6416)
        • Dangerous Eval
          • Dangerous Eval
        • Dangerous Send
          • Dangerous Send
        • Default Routes
          • Default Routes: Filter Skipping (Rails 3.0-3.0.9)
          • Default Routes: General Warning
        • Denial Of Service
          • Denial of Service: Digest authentication DoS vulnerability
          • Denial of Service: Header DoS (CVE-2013-6414)
          • Denial of Service: Mime type denial of service (CVE-2016-0751)
          • Denial of Service: Route DoS (CVE-2015-7581)
          • Denial of Service: Searches regexes including user input
          • Denial of Service: Symbol DoS
          • Denial of Service: Versions with ActiveRecord symbol denial of service
          • Denial of Service: XML denial of service (CVE-2015-3227)
          • Denial of Service: render :text DoS (CVE-2014-0082)
        • Directory Traversal
          • Directory Traversal
        • Divide By Zero
          • Divide by Zero
        • Dynamic Render Path
          • Dynamic Render Path
        • File Access
          • File Access: Possible file access using user input
          • File Access: Versions with JRuby XML parsing backend
          • File Access: Versions with file existence disclosure vulnerability
        • Format Validation
          • Format Validation
        • HTTP Verb Confusion
          • HTTP Verb Confusion
        • Information Disclosure
          • Information Disclosure
        • Mail Link
          • Mail Link
        • Mass Assignment
          • Mass Assignment: Dangerous attr_accessible Attributes
          • Mass Assignment: General Mass Assignment
          • Mass Assignment: Mass assignment using without_protection
          • Mass Assignment: Potentially dangerous attributes allowed via permit
          • Mass Assignment: Strong params bypass in CVE-2014-3514
        • Missing Authorization
          • Missing Authorization
        • Missing Encryption
          • Missing Encryption
        • Nested Attributes
          • Nested Attributes: Nested attributes vulnerability (CVE-2015-7577)
          • Nested Attributes: Nested attributes vulnerability in Rails 2.3.9 and 3.0.0
        • Path Traversal
          • Path Traversal: CVE-2018-3760
          • Path Traversal: Unexpected Pathname behavior
        • Redirect
          • Redirect
        • Remote Code Execution
          • Remote Code Execution: JSON parsing vulnerabilities CVE-2013-0333 and CVE-2013-0269
          • Remote Code Execution: Render that might be vulnerable to CVE-2016-0752
          • Remote Code Execution: Unsafe deserialization of objects
          • Remote Code Execution: Unsafe reflection
          • Remote Code Execution: Unsafe reflection to access methods
          • Remote Code Execution: Use of Marshal for cookie serialization
          • Remote Code Execution: Uses of serialize in versions vulnerable to CVE-2013-0277
          • Remote Code Execution: YAML parsing vulnerabilities (CVE-2013-0156)
        • Response Splitting
          • Response Splitting
        • Reverse Tabnabbing
          • Reverse Tabnabbing
        • SQL Injection
          • SQL Injection: General SQL Injection
          • SQL Injection: Quote_table_name vulnerability in versions before 2.3.14
          • SQL Injection: Several SQL CVEs
          • SQL Injection: Unsafe find_by_* Usage
        • SSL Verification Bypass
          • SSL Verification Bypass
        • Security
          • EOLRails
          • EOLRuby
          • Send File
        • Session Manipulation
          • Session Manipulation
        • Session Setting
          • Session Setting
        • Template Injection
          • Template Injection
        • Timing Attack
          • Timing Attack
        • Unscoped Find
          • Unscoped Find
        • Weak Cryptography
          • Weak Cryptography
        • Weak Hash
          • Weak Hash
      • Rust
        • Command Injection
          • Command injection via user-controlled input
        • Cryptography
          • Use of non-cryptographic random number generator in security context
          • Use of weak or non-cryptographic hash algorithm in security context
        • Tls
          • TLS/SSL certificate verification disabled
        • Unsafe Code
          • Unsafe block usage requires manual audit
        • Untrusted Input
          • Untrusted input used in security decision
      • Scala
        • Cookie
          • Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
          • Information Exposure Through Persistent Cookies
          • Sensitive Cookie Without 'HttpOnly' Flag
          • Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
          • Trust Boundary Violation
        • Cors
          • Permissive Cross-domain Policy with Untrusted Domains
        • Cryptography
          • Improper Certificate Validation
          • Inadequate Encryption Strength
          • Inadequate encryption strength
          • Incorrect Behavior Order
          • Missing Support for Integrity Check
          • Use of RSA Algorithm without OAEP
          • Use of a Broken or Risky Cryptographic Algorithm
        • Endpoint
          • Cleartext transmission of sensitive information
          • Improper Certificate Validation
          • URL Redirection to Untrusted Site ('Open Redirect')
          • Use of less trusted source
        • File
          • Improper limitation of a pathname to a restricted directory ('Path Traversal')
        • Form
          • Improper validation of unsafe equivalence in input
        • Inject
          • Expression injection (OGNL)
          • External Control of System or Configuration Setting
          • Files or Directories Accessible to External Parties
          • Improper Control of Generation of Code ('Code Injection')
          • Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
          • Improper Neutralization of CRLF Sequences ('CRLF Injection')
          • Improper Neutralization of Special Elements in Data Query Logic
          • Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
          • Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
          • Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
          • Improper limitation of a pathname to a restricted directory ('Path Traversal')
        • Ldap
          • Improperly implemented security check for standard
        • Password
          • Use of Hard-coded Password
        • Perm
          • Incorrect Permission Assignment for Critical Resource
          • Insecure inherited permissions
        • Script
          • Improper Control of Generation of Code ('Code Injection')
        • Smtp
          • Improper Neutralization of Special Elements used in a Command
          • Improper Validation of Certificate with Host Mismatch
        • Ssrf
          • Server-Side Request Forgery (SSRF)
        • Strings
          • Collapse of data into unsafe value
          • Improper Handling of Unicode Encoding
          • Incorrect Type Conversion or Cast
          • Use of Externally-Controlled Format String
        • Templateinjection
          • Improper Control of Generation of Code ('Code Injection')
        • Unsafe
          • Exposure of sensitive system information to an unauthorized control sphere
          • External Control of System or Configuration Setting
          • Information Exposure Through an Error Message
        • Xml
          • Deserialization of Untrusted Data
          • Weak authentication
          • XML injection (aka Blind XPath injection)
        • Xpathi
          • Improper Restriction of XML External Entity Reference ('XXE')
        • Xss
          • Improper Neutralization of Input During Web Page Generation
          • Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
        • Xxe
          • Improper Restriction of XML External Entity Reference ('XXE')
      • Swift
        • Api
          • Avoid Native Calls
          • Insecure Temporary File
        • Authentication
          • Weak Biometric Access Control Flags
          • Weak Biometric Authentication
          • Weak Keychain ACL (Device Passcode)
        • Cryptography
          • JWT Signature Verification Bypass
          • Weak Encryption Algorithm
          • Weak Encryption Mode of Operation
          • Weak Hash Algorithm
          • Weak Password Hash
        • Incorrect Validation
          • Improper input validation using regular expressions without anchors
          • Unsafe HTML filtering using regular expressions
        • Information Leak
          • Cleartext Transmission of Sensitive Information
          • Cleartext storage of sensitive information in an application preference store
          • General Pasteboard Access
          • Hardcoded Credentials
          • Insecure Transport
          • Sensitive Information Logging
          • Unprotected File Storage
          • Weak Keychain Accessibility
        • Injection
          • Code Injection During Deserialization
          • Command Injection
          • Cookie Poisoning
          • Cross Site Scripting ('XSS')
          • Externally Controlled Format String
          • HTTP Response Splitting
          • JavaScript injection in a web view
          • NoSQL Injection
          • Open Redirect
          • Predicate Injection
          • Regex Injection
          • SQL Injection ('SQLi')
          • Server-Side Request Forgery (SSRF)
          • Unsafe Reflection
          • WebView loaded without restricting base URL
        • Memory Management
          • Untrusted Pointer Dereference
        • Misconfiguration
          • Deprecated UIWebView Usage
          • Insecure SSL
          • Unsafe Cookie
          • XML External Entity (XXE)
        • Path Resolution
          • Path Traversal
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
          • Insufficient Key Size
          • Non Random IV with CBC Mode
        • Resource Management
          • Connection String Parameter Pollution
          • Regular expression Denial of Service ('ReDoS')
        • Risky Values
          • Dangerous Hostname Check
    • DAST Detectors
      • Access Control
        • Access Control Issue - Improper Authentication
        • Access Control Issue - Improper Authorization
        • Bypassing 403
        • CORS Header
        • Cross-Domain JavaScript Source File Inclusion
        • Cross-Domain Misconfiguration
        • Fetch Metadata Request Headers
        • Insecure HTTP Method
        • Insufficient Site Isolation Against Spectre Vulnerability
        • Permissions Policy Header Not Set
      • Authentication
        • Authentication Request Identified
        • JWT Scan Rule
        • Possible Username Enumeration
        • Use of SAML
        • Username Hash Found
        • Weak Authentication Method
      • Buffer Overflow
        • Buffer Overflow
      • CRLF Injection
        • CRLF Injection
      • Clickjacking
        • Anti-clickjacking Header
      • Code Injection
        • Server Side Code Injection
      • Cross-Site Request Forgery
        • Absence of Anti-CSRF Tokens
        • Anti-CSRF Tokens Check
        • Cross Site Request Forgery
      • Cross-Site Scripting
        • Cross Site Scripting (DOM Based)
        • Cross Site Scripting (Persistent)
        • Cross Site Scripting (Persistent) - Prime
        • Cross Site Scripting (Persistent) - Spider
        • Cross Site Scripting (Reflected)
        • Cross-site Scripting
        • Dangerous JS Functions
        • Out of Band XSS
        • User Controllable HTML Element Attribute (Potential XSS)
        • User Controllable JavaScript Event (XSS)
        • Web Browser XSS Protection Not Enabled
      • File Inclusion
        • File Upload
        • Remote File Inclusion
      • Fingerprinting
        • Client-Side Data Flow
        • GraphQL
        • Modern Web Application
        • Retrieved from Cache
        • Tech Detection Passive Scanner
        • User Agent Fuzzer
        • Verification Request Identified
        • ZAP is Out of Date
      • Information Disclosure
        • .env Information Leak
        • .htaccess Information Leak
        • Application Error Disclosure
        • Backup File Disclosure
        • Base64 Disclosure
        • Cloud Metadata Potentially Exposed
        • Directory Browsing
        • ELMAH Information Leak
        • HTTP Server Response Header
        • Hash Disclosure - MD4 / MD5
        • Hidden File Found
        • Image Exposes Location or Privacy Data
        • In Page Banner Information Leak
        • Information Disclosure - Debug Error Messages
        • Information Disclosure - Sensitive Information in HTTP Referrer Header
        • Information Disclosure - Sensitive Information in URL
        • Information Disclosure - Suspicious Comments
        • PII Disclosure
        • Private IP Disclosure
        • Proxy Disclosure
        • Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
        • Source Code Disclosure - /WEB-INF Folder
        • Source Code Disclosure - CVE-2012-1823
        • Source Code Disclosure - File Inclusion
        • Source Code Disclosure - Git
        • Source Code Disclosure - PHP
        • Source Code Disclosure - SVN
        • Spring Actuator Information Leak
        • Timestamp Disclosure - Unix
        • Trace.axd Information Leak
        • WSDL File Detection
        • X-AspNet-Version Response Header
        • X-Backend-Server Header Information Leak
        • X-ChromeLogger-Data (XCOLD) Header Information Leak
        • X-Debug-Token Information Leak
      • Injection
        • Advanced SQL Injection
        • Exponential Entity Expansion (Billion Laughs Attack)
        • Expression Language Injection
        • Format String Error
        • Generic Padding Oracle
        • HTTP Parameter Override
        • HTTP Parameter Pollution
        • Integer Overflow Error
        • LDAP Injection
        • NoSQL Injection - MongoDB
        • NoSQL Injection - MongoDB (Time Based)
        • Parameter Tampering
        • SOAP Action Spoofing
        • SOAP XML Injection
        • SQL Injection
        • SQL Injection - Hypersonic SQL (Time Based)
        • SQL Injection - MsSQL (Time Based)
        • SQL Injection - MySQL (Time Based)
        • SQL Injection - Oracle (Time Based)
        • SQL Injection - PostgreSQL (Time Based)
        • SQL Injection - SQLite (Time Based)
        • XPath Injection
        • XSLT Injection
      • OS Command Injection
        • Remote OS Command Injection
        • Remote OS Command Injection (Time Based)
      • Path Traversal
        • Path Traversal
      • Redirect
        • Big Redirect Detected (Potential Sensitive Information Leak)
        • External Redirect
        • Off-site Redirect
      • Remote Code Execution
        • Java Serialization Object
        • Log4Shell
        • Remote Code Execution (React2Shell)
        • Remote Code Execution - CVE-2012-1823
        • Remote Code Execution - Shell Shock
        • Spring4Shell
        • Text4shell (CVE-2022-42889)
      • Security Misconfiguration
        • Apache Range Header DoS (CVE-2011-3192)
        • CSP
        • Charset Mismatch
        • Content Cacheability
        • Content Security Policy (CSP) Header Not Set
        • Content-Type Header Missing
        • HTTP Only Site
        • HTTP to HTTPS Insecure Transition in Form Post
        • HTTPS Content Available via HTTP
        • HTTPS to HTTP Insecure Transition in Form Post
        • Heartbleed OpenSSL Vulnerability
        • Heartbleed OpenSSL Vulnerability (Indicative)
        • Httpoxy - Proxy Header Misuse
        • Insecure Component
        • Re-examine Cache-control Directives
        • Relative Path Confusion
        • Reverse Tabnabbing
        • Script Served From Malicious Domain (polyfill)
        • Secure Pages Include Mixed Content
        • Strict-Transport-Security Header
        • Sub Resource Integrity Attribute Missing
        • User Controllable Charset
        • Vulnerable JS Library
        • Web Cache Deception
        • X-Content-Type-Options Header Missing
      • Server-Side Include Injection
        • Server Side Include
      • Server-Side Request Forgery
        • Server Side Request Forgery
      • Server-Side Template Injection
        • Server Side Template Injection
        • Server Side Template Injection (Blind)
      • Session Fixation
        • Session Fixation
      • Session Management
        • Cookie No HttpOnly Flag
        • Cookie Poisoning
        • Cookie Slack Detector
        • Cookie Without Secure Flag
        • Cookie without SameSite Attribute
        • GET for POST
        • Insecure JSF ViewState
        • Loosely Scoped Cookie
        • Session ID in URL Rewrite
        • Session Management Response Identified
        • Viewstate
      • XML External Entity
        • XML External Entity Attack
    • Unusual Activity Detection
      • Anomalous plugin installed
      • Auditing Configuration Modification
      • Anomalous fork
      • Anomalous Pull Request
      • Branch protection disabled
      • Commit anomalous
      • Commit bypassed branch protection
      • Compliance Framework Removed
      • Compliance Framework Updated
      • CI Token Scope Modified
      • DAST Profile Modified
      • Environment Unprotected
      • Failed login attempts
      • Commit force pushed
      • Feature Flag Updated
      • Member received Admin permissions
      • Organization deleted
      • Organization renamed
      • Organization Publicized
      • IP Restrictions Updated
      • Potential Script Injection Attack
      • Organization MFA requirement disabled
      • Manually Triggered Housekeeping
      • Pull Request merged without passing the status checks
      • Project Default Branch Updated
      • Repository archived
      • Repository deleted
      • Repository publicized
      • Repository Renamed
      • Repository unarchived
      • Stale Pull Request merged
      • Tag force pushed
      • Status Check Modification
      • Team received Admin permissions
      • Unsigned commit
      • Unusual Login
      • Unusual long time build job
  • Compliance Assessment Standards
    • CIS Software Supply Chain Security benchmark
      • 1.1.1 Ensure any changes to code are tracked in a version control platform
      • 1.1.10 Ensure open branches are up-to-date before merge
      • 1.1.11 Ensure all open comments are resolved before allowing code change merging
      • 1.1.12 Ensure verification of signed commits for new changes before merging
      • 1.1.13 Ensure linear history is required
      • 1.1.14 Ensure branch protection rules are enforced for administrators
      • 1.1.15 Ensure pushing or merging of new code is restricted to specific individuals or teams
      • 1.1.16 Ensure force push code to branches is denied
      • 1.1.17 Ensure protected branch deletions are denied
      • 1.1.3 Ensure any change to code receives approval of a minimum strongly authenticated users
      • 1.1.4 Ensure previous approvals are dismissed when updates are introduced to a code change proposal
      • 1.1.5 Ensure there are restrictions on who can dismiss code change reviews
      • 1.1.6 Ensure code owners are set for extra sensitive code or configuration
      • 1.1.8 Ensure inactive branches are periodically reviewed and removed
      • 1.1.9 Ensure all checks have passed before merging new code
      • 1.2.1 Ensure all public repositories contain a SECURITY.md file
      • 1.2.2 Ensure repository creation is limited to specific members
      • 1.2.3 Ensure repository deletion is limited to specific users
      • 1.2.4 Ensure issue deletion is limited to specific users
      • 1.3.1 Ensure inactive users are reviewed and removed periodically
      • 1.3.3 Ensure maximum number of administrators are set for the organization
      • 1.3.5 Ensure the organization is requiring members to use Multi-Factor Authentication (MFA)
      • 1.3.7 Ensure two administrators are set for each repository
      • 1.3.8 Ensure strict base permissions are set for repositories
      • 1.3.9 Ensure an organization’s identity is confirmed with a "Verified" badge
      • 2.3.1 Ensure all build steps are defined as code
      • 2.3.5 Ensure access to build process triggering is minimized
      • 2.3.7 Ensure pipelines are automatically scanned for vulnerabilities
      • 2.3.8 Ensure scanners are in place to identify and prevent sensitive data in pipeline files
      • 2.4.2 Ensure all external dependencies used in the build process are locked
      • 2.4.6 Ensure pipeline steps sign the Software Bill of Materials (SBOM) produced
      • 3.1.7 Ensure dependencies are pinned to a specific, verified version
      • 3.2.2 Ensure packages are automatically scanned for known vulnerabilities
      • 3.2.3 Ensure packages are automatically scanned for license implications
      • 4.2.3 Ensure user access to the package registry utilizes Multi-Factor Authentication (MFA)
      • 4.2.5 Ensure anonymous access to artifacts is revoked
      • 4.3.4 Ensure webhooks of the package registry are secured
    • OWASP Software Component Verification Standard
      • OWASP SCVS Unknown Components
    • OpenSSF FLOSS
      • Basic project website content
    • OpenSSF Scorecard
      • Branch protection
      • CI Tests: Does the project run tests in CI?
      • Code Review
      • Contributors
      • Dangerous Workflow
      • Dependency Update Tool
      • Fuzzing
      • License Declaration
      • Maintained
      • No Binary Artifacts
      • OpenSSF Best Practices badge
      • Packaging
      • Pinned Dependencies
      • SAST in use
      • Security Policy
      • Signed Releases
      • Token Permissions
      • Vulnerabilities
      • Webhooks
    • ESF Securing the Software Supply Chain DEV
      • Are all of your builds continuously built and tested?
      • Are code check-ins gated by code collaborators and source control to prevent anyone from accidentally or intentionally submitting unreviewed code changes?
      • Do you ensure only required modules are included in the product?
      • Do you have and adhere to responsible disclosure requirements for all externally identified vulnerabilities?
      • Do you have and use security tools for Software Composition Analysis?
      • Do you perform binary composition analysis of the final package?
      • Do you perform input fuzzing as part of a regular process for your component or product’s inputs?
      • Do you perform nightly builds with automated regression and security test to quickly detect problems with recent builds?
      • Do you track all third-party components you use directly and all internal components in a secure and persistent repository?
      • Do you use the toolchain to automatically gather information that informs security decision-making?
      • Does the project use a static code analysis tool?
      • Does the project use tools to help update its dependencies?
      • Does the team require code reviews for all code and build scripts / configuration changes?
      • Does your release confirmation that binaries are digitally signed?
      • Does your release include an SBOM?
      • The project should not have generated executable (binary) artifacts in the source repository.
  • XyDocs
  • Code Security - Malware

Supported Malware detectors

The detectors for malware evidences listed below are classified by their resource kind.

Execution

  • Decoded Code Execution

  • Decrypted Code Execution

  • Downloaded Code Execution

  • Malicious Command Execution

  • Obfuscated Code Execution

  • Silent execution

  • System Registry Code Execution

  • Unusual File Execution

File

  • Masquerade File Type

Network

  • Suspicious Blockchain Payload

  • Suspicious Request

  • Suspicious URL

Package

  • Malicious Installation Scripts

Registry

  • System Registry Tampering

Sensitive Data

  • Browser Sensitive Data Enumeration

  • Sensitive Data Enumeration

  • Sensitive Data Exfiltration

  • Sensitive File encryption

  • Sensitive File Exfiltration

System

  • Bidirectional Characters

  • Clipboard Hijacker

  • Execution Policy Bypass

  • Impair Defenses: Disabled Tools

  • Invisible Characters

  • Obfuscated Code

  • Process Termination

  • Suspicious Scheduled system service

  • Virtualization Sandbox Evasion

© 2025 Xygeni. All rights reserved