Xygeni Documentation xygeni
search
home

XyDocs

    • Suspect Dependencies Detectors
      • Dependency with important known vulnerabilities
      • DotNet Malware Dependency
      • Java Malware Dependency
      • Maven Anomalous Dependency
      • Maven Typosquatting
      • NPM Anomalous Dependency
      • NPM Dependency Confusion
      • NPM Malware Dependency
      • NPM Suspicious Scripts
      • NPM Typosquatting
      • NPM Unscoped internal components
      • NuGet Anomalous Dependency
      • NuGet Dependency Confusion
      • NuGet Typosquatting
      • PiP Dependency Confusion
      • PyPI Anomalous Dependency
      • PyPI Suspicious Scripts
      • PyPI Typosquatting
      • Python Malware Dependency
    • CI/CD Misconfigurations Detectors
      • 'dnf clean all' missing
      • 'microdnf clean all' missing
      • 'yum clean all | packages' missing
      • 'zypper clean' missing
      • ADD instead of COPY
      • Avoid calls to Jenkins getInstance method
      • Binary artifacts found
      • Branches configured to trigger a pipeline exposed to secrets has a correlating branch protection rule in the SCM
      • Build attestation framework should be used
      • CI/CD Bot should not be able to approve a code review
      • CI/CD argument values should not flow directly into workflows
      • COPY with multiple sources must end destination with /
      • Code Review
      • Container runs as root
      • Dangerous Workflow
      • Dependency Update Tool
      • Deprecated MAINTAINER used
      • Ensure all checks have passed before merging new code
      • Ensure all external dependencies used in the build process are locked
      • Ensure issues deletion is limited to specific users
      • Ensure maximum number of administrators are set for the organization
      • Ensure pipelines are automatically scanned for vulnerabilities
      • Ensure repository creation is limited to specific members
      • Ensure repository deletion is limited to specific users
      • Ensure scanners are in place to identify and prevent sensitive data in pipeline files
      • Ensure strict base permissions are set for repositories
      • Ensure that CI/CD apps do not use too broad permissions
      • Ensure that groups do not use too broad permissions.
      • Ensure the organization is requiring members to use Multi-Factor Authentication (MFA)
      • Ensure two administrators are set for each repository
      • Ensure verification of signed commits for new changes before merging
      • Exposed port out of range
      • Fuzzing
      • Inadequate Backups of Jenkins Instance
      • Insecure Package Registry webhook
      • Insecure Webhook
      • Lack of Secure Authentication
      • Lack of Secure Authorization
      • Lack of administrative monitor and logging
      • Malicious script in a CI/CD pipeline.
      • Maven Avoid Open Versions
      • Maven Avoid Public Repositories
      • Maven Use HTTPS with remote repositories
      • Multiple CMD instructions
      • Multiple ENTRYPOINT instructions
      • NPM Avoid Public Repositories
      • NPM Lack of Version Pinning
      • NPM URL Dependency
      • No HEALTHCHECK defined
      • NuGet Avoid Public Repositories
      • NuGet Lack of Version Pinning
      • NuGet Use HTTPS with remote repositories
      • Potential injected malicious code into files referenced by the pipeline configuration file
      • Pull Requests do not execute the pipelines modifications that they include
      • PyPI Avoid Public Repositories
      • PyPI Confusing Names
      • PyPI Lack of Version Pinning
      • PyPI URL Dependency
      • PyPI Use HTTPS with remote repositories
      • RUN package-manager update instruction alone
      • RUN using sudo
      • Repository should be associated with an approved CI/CD app
      • Reverse Shell in Container Image
      • SAST in use
      • SSH port exposed
      • Secrets and Credentials at organization level should not widely shared
      • Secrets should be stored explicitly as encrypted GitHub Actions Secrets
      • Secrets used in workflows should not be echoed in the console
      • Secure Jenkins version
      • Security Policy
      • Signed Container Images
      • Signed Releases
      • Suspicious Pull Request merge invocation
      • The Software Bill of Materials (SBOM) is not produced
      • Token Permissions
      • Unprotected branch
      • Unsecured Communication
      • Unusual activity at CI/CD environments should be monitored
      • Use of Deprecated or Vulnerable Plugins
      • Vulnerabilities
      • WORKDIR path is not absolute
      • WORKDIR should not be mounted on system dirs
      • Webhook URL is not allowed
      • Workflow permissions are not minimal
      • Workflows should not use insecure commands
      • apk add is missing --no-cache
      • apt-get dist-upgrade used
      • apt-get missing –no-install-recommends
    • Hardcoded Secrets Spotting
      • .htpasswd credentials
      • .pypirc credentials
      • Abstract API Key
      • AccuWeather API key
      • Adafruit IO Key
      • Aiven Token
      • Akamai API Token
      • Alchemy API Key
      • Alibaba Cloud Access Key ID
      • Alibaba Cloud Secret Access Key
      • Amazon MWS Token
      • Amazon Web Services Keys ID
      • Amazon Web Services Keys Secret
      • Amazon Web Services Keys Token
      • Anthropic API key
      • Artifactory API Key
      • Artifactory Access Token
      • Artifactory Encrypted Secret
      • Artifactory Identity Token
      • Atlassian API token
      • Atlassian OAuth2 Client Secret
      • Auth0 Keys
      • Authress Service Client Access Key
      • Azure Directory Application Secret
      • Azure Personal Access Token
      • Azure Service Management Certificate
      • Azure Storage Access Key
      • Base-64 encoded text
      • Basic Authentication Credentials
      • Bcrypt Hash
      • Bitbucket Basic Auth
      • Bitbucket Client ID
      • Bitbucket OAuth Access Key
      • Bitbucket Repository Access Token
      • CLI Secret
      • CLI Secret embedded in a shell script
      • CircleCI Personal Token
      • CircleCI Project Token
      • Clockwork Key
      • Cloudant Keys
      • Cloudflare Credentials
      • Cloudflare Global API Key
      • Codacy API Token
      • Codacy Project Token
      • Codeclimate key
      • Codecov Token
      • Codecov Token in codecov Command
      • Confluent Keys
      • Contentful Content Delivery API Key
      • Contentful Content Management personal access token
      • Coveralls Config Token
      • Coveralls Token
      • Crates.io Key
      • Credential with high entropy
      • Credentials File
      • Credit Card number
      • Cryptographic Private Key
      • Cryptographic Private Key Putty
      • Customer.io App Keys
      • Customer.io Track Encoded Keys
      • Customer.io Track Keys
      • Database Password
      • Database connection data
      • Databricks Authentication Token
      • Datadog API Credentials
      • Digital Ocean OAuth Client Secret
      • DigitalOcean Spaces Keys
      • DigitalOcean Token
      • Discord Bot Token
      • Discord Oauth2 Keys
      • Discord Webhook
      • Django Secret Key
      • Docker Swarm Join Token
      • Docker Swarm Unlock Key
      • Dockercfg Auth
      • Dropbox App Credentials
      • Dropbox Key
      • Facebook App Keys
      • Firebase Cloud Messaging API Key
      • Flutterwave API Key
      • Gemfury credentials
      • Gemini API Key
      • Generic API key / token
      • Generic Secret
      • GitHub token
      • GitLab Enterprise Personal Access Token
      • GitLab Personal Access Token
      • GitLab Personal Access Token in URL
      • Google API Key
      • Google Cloud Service Account Key
      • Google OAuth2 Keys
      • Grafana Personal Token
      • Grafana Service Account Token
      • Hardcoded URL
      • Hardcoded password
      • HashiCorp Vault Unseal Key
      • Heartland API Key
      • Heroku Platform Key
      • HubSpot API Key
      • HubSpot OAuth Token
      • Hubspot Webhook
      • IBM Cloud Access Key
      • IBM Cloud Object Storage Key
      • Intercom Access Token
      • JSON Web Token
      • Jira Basic Auth
      • Kubernetes JWT
      • Kubernetes Secret
      • Kubernetes User Certificate
      • LDAP Credentials
      • Line Messaging OAuth2 Keys
      • Line Token
      • Linkedin OAuth2 Keys
      • Linode Personal Access Token
      • Llama API Key
      • MSSQL Credentials
      • Mailchimp API Key
      • Mailgun Key
      • Mend API Key
      • Mend User Key
      • Microsoft Teams Webhook
      • Midtrans API Key
      • Moneywave API Key
      • MongoDB Password
      • MySQL Credentials Assignment
      • MySQL Credentials CLI
      • NPM OAuth Token
      • Npm Token
      • NuGet API Key
      • ODBC Connection String
      • Okta Keys
      • Okta Token
      • OpenAI API Key
      • OpenWeatherMap Call Token
      • OpenWeatherMap URL Token
      • Password in Maven pom.xml
      • Password in Maven settings.xml
      • Password in MongoDB Connection String
      • PayPal OAuth2 Keys
      • Planetscale API Key
      • PostgreSQL Credentials Assignment
      • PostgreSQL Credentials Password file
      • Postman API Key
      • Potential information leak through comments
      • Pulumi Access Token
      • Pusher Channels Keys
      • Python Package Index API Token
      • RabbitMQ Address
      • RabbitMQ Password
      • RabbitMQ Password in URL
      • Rails Master Key
      • Rails Secret Key Base
      • RapidAPI Key
      • Razorpay API Key
      • Redis CLI Credentials
      • Redis Credentials Assignment
      • Redis Password in URL
      • RubyGems API Key
      • SMTP Assignment
      • SMTP Password
      • SSH Password
      • SSH Password Assignment
      • Salesforce Oauth2 Keys
      • Salesforce Refresh Tokens
      • Sendgrid API Key
      • Sentry Token
      • Shopify Generic App Token
      • Shopify Private App Token
      • Shopify Private Key
      • Shopify Private Key V2
      • Slack API/Signing Secret
      • Slack Access Token
      • Slack Incoming Webhook URL
      • Snowflake Password
      • Snowflake Password in URI
      • Snyk Key
      • SonarQube Token
      • Splunk Admin Password
      • Splunk Authentication Token
      • Spotify Keys
      • Square OAuth secret
      • Square access token
      • Stripe Secret keys
      • Stripe Webhook Secret
      • Telegram Bot Token
      • Tencent Cloud Keys
      • Terraform Cloud Token
      • Travis Personal Token
      • Trello Keys
      • Twilio Webhook
      • Twitch API Keys
      • Twitter Access Key
      • VISA Basic Auth
      • Veracode API Credentials
      • Vultr Key
      • WePay API Token
      • Webex App Keys
      • WordPress Security Key
      • Xygeni.io Token
      • Xygeni.io user / organization token
      • Zendesk Token
      • Zoom API JWT
      • Zoom API JWT Keys
      • Zoom API Keys
      • Zoom SDK Keys
      • mapbox Token
      • passwd-like credentials
      • pip.conf credential
      • pip.conf proxy credential
      • reCAPTCHA Key
    • IaC Flaws
      • A sensitive port for TCP or UDP protocols is open for the whole network
      • AKS monitoring logging is not enabled
      • ALB listening on HTTP
      • API Gateway has endpoint not private
      • API Gateway has no SSL certificate
      • API Gateway has no X-Ray active
      • API server without certificate / private key
      • AWS AMI Encryption is not enabled
      • AWS AMI is shared with multiple accounts
      • AWS EBS volume is not encrypted
      • AWS ElastiCache Redis cluster with encryption for data at rest is disabled
      • AWS RDS DB cluster encryption is disabled
      • AWS Redshift cluster is not encrypted
      • AWS Redshift cluster is publicly accessible
      • AWS Redshift using default port
      • AWS SQS server side encryption is not enabled
      • Active Directory Administrator is not configured for SQL server
      • Active Directory account has predictable username as 'Admin' or 'Root'
      • An unknown port has been exposed in the EC2 group
      • Anonymous authentication on Kubelet server is allowed
      • Apiserver allows weak cryptographic ciphers
      • Apiserver does not set TLS key and certificate
      • App Service is not registered with an Azure Active Directory account
      • Application Gateway WAF has essential rules disabled
      • Authorization mode AlwaysAllow allows all requests
      • Authorization mode does not include node
      • Auto Scaling group has no ELB group
      • Autoscaling launch configuration has no data in the volumes encrypted
      • Azure App Service Web app authentication is Off
      • Azure App Service Web app does not redirect HTTP to HTTPS
      • Azure App Services FTP deployment is AllAllowed
      • Azure Data factory public network access enabled
      • Azure Kubernetes Cluster without RBAC enabled
      • Azure Kubernetes Service has no network policy configured
      • Azure Linux scale uses password authentication
      • Azure MariaDB database server with SSL connection disabled
      • Azure SQL Server threat detection alerts are not enabled for all threat types
      • Azure SQL server audit log retention is too low
      • Azure SQL server auditing is disabled
      • Azure VM data disk is encrypted with the default encryption key instead of ADE/CMK
      • Azure Virtual Network has no a Network Security Group
      • Azure WAF policy disabled or without Detection or Prevention modes
      • Azure application gateway does not have WAF enabled
      • Azure default network access for Storage Account is allowed
      • Azure front door does not have WAF enabled
      • Azure front door does not use WAF in Detection or Prevention modes
      • Azure function app authentication is off
      • Azure key vault is not recoverable
      • Azure linux instance with password authentication
      • Batch job has privileged container
      • BigQuery dataset is public accessible
      • CMK is unusable
      • CMK rotation is disabled
      • Certificate Authority for apiserver not set
      • Certificate or Key file not set for etcd
      • Certificate or private key not set for peer authentication on etcd
      • Check if the Google compute firewall allows unrestricted RDP access
      • Client certificate / key for apiserver not set
      • Cloud Storage Anonymous or Publicly Accessible
      • Cloud Storage Bucket should have versioning enabled
      • Cloud storage bucket should have logging enabled
      • CloudFormation has no stack policy
      • CloudFormation has the stack retention disabled
      • CloudFormation stack notifications are disabled
      • CloudFormation without template
      • CloudFront distribution without strict security headers policy
      • CloudFront has no configured web application firewall
      • CloudFront logging is disabled
      • CloudTrail has no the SNS topic name configured
      • CloudTrail has the logging disabled
      • CloudTrail is not integrated with CloudWatch
      • CloudTrail log file validation is disabled
      • CloudTrail multi region disabled
      • CloudWatch has no retention period
      • Cluster Master Authentication Disabled
      • CodeBuild Project encryption is disabled
      • CodeBuild Project is not encrypted
      • Compute instances must be launched with Shielded VM enabled
      • Compute instances shouldn’t be accessible from the Internet
      • Configuration aggregator has no all regions enabled
      • Container is privileged
      • Container runs as root
      • Container runs with AllowPrivilegeEscalation
      • Controller Manager bound to non loop-back insecure address
      • Controller Manager has profiling active
      • Controller Manager with invalid --root-ca-file argument
      • Controller Manager without RotateKubeletServerCertificate set
      • Controller Manager without individual service account credentials
      • CosmosDB has no range ip filter configured
      • CosmosDB without tags
      • DNSSEC Using RSASHA1
      • DNSSEC must be enabled for Cloud DNS
      • Data stored in Aurora is unencrypted at rest
      • Defaults Kubernetes Engine Clusters should not be configured to use the default service account
      • Do not allow public access container or its blobs
      • Do not allow the admin user to login to the container registry
      • Do not create files without permissions control
      • Do not install the latest packages with package managers
      • Do not log passwords
      • Do not put the storage account access as public
      • Do not use deprecated modules
      • Do not use integers to octal file permissions in YAML
      • Do not use the latest checkout
      • Do not use the same owner and group to transfer files
      • Docker daemon socket exposed to containers
      • EBS volume is not encrypted
      • EC2 Instance using default VPC
      • EC2 group has HTTP port open to internet
      • EC2 group has SQL analysis services port publicly accessible
      • EC2 group has no restrict access to administration ports
      • EC2 instance has public IP
      • EC2 instance should not have public IP
      • EC2 instance without VPC
      • EC2 security group has unrestricted traffic access
      • EC2 with EBS not optimized
      • ECR image repository has public access
      • ECR image scan on push is disabled
      • ECR image tag is mutable
      • ECS Service admin role is present
      • ECS Service task has network mode different to awsvpc
      • ECS Service without running task
      • ECS Task definition has secrets in the container environment in plain text
      • EFS is not encrypted
      • EFS without tags
      • ELB use weak ciphers
      • ElastiCache using default port
      • ElastiCache without VPC
      • Encryption providers are not properly configured
      • Ensure ALB protocol is HTTPS
      • Ensure AWS EKS cluster security group is not overly permissive to all traffic
      • Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0
      • Ensure AWS IAM password policy does not allow password reuse
      • Ensure AWS IAM policy does not allow assume role permission across all services
      • Ensure AppSync has Field-Level logs enabled
      • Ensure AppSync has Logging enabled
      • Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption
      • Ensure Azure MariaDB servers dont have public network access
      • Ensure Azure subscriptions with custom roles have minimum permissions
      • Ensure CloudTrail logs are encrypted at rest using KMS CMKs
      • Ensure Code artifact Domain is encrypted by KMS using a customer managed Key (CMK)
      • Ensure DAX encryption at rest is not disabled
      • Ensure DB instance gets all minor upgrades automatically
      • Ensure DMS replication instance is not publicly accessible
      • Ensure DocDB TLS is not disabled
      • Ensure DocumentDB is encrypted at rest
      • Ensure DynamoDB Point-In-Time Recovery (PITR) is enabled
      • Ensure DynamoDB point in time recovery is enabled
      • Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK)
      • Ensure EFS is securely encrypted
      • Ensure Elasticsearch Domain enforces HTTPS
      • Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions
      • Ensure GitHub Actions secrets are encrypted
      • Ensure Glue Data Catalog Encryption is enabled
      • Ensure IAM policy documents do not allow * as a statement’s action
      • Ensure IAM role allows only specific services or principals to assume it
      • Ensure KMS key policy does not contain wildcard (*) principal
      • Ensure Kinesis Stream is securely encrypted
      • Ensure Neptune Cluster instance is not publicly available
      • Ensure Neptune logging is enabled
      • Ensure Neptune storage is securely encrypted
      • Ensure RDP Internet access is restricted
      • Ensure Redshift cluster encryption at rest is enabled
      • Ensure Redshift cluster is not publicly accessible
      • Ensure Redshift uses SSL
      • Ensure S3 Bucket ACL doesn’t allow public write
      • Ensure S3 buckets are encrypted with KMS by default
      • Ensure SQS policy does not allow ALL (*) actions
      • Ensure SSH Internet access is restricted
      • Ensure SageMaker Endpoint is encrypted
      • Ensure SageMaker Notebook is encrypted at rest using KMS CMK
      • Ensure all Elasticsearch has node-to-node encryption enabled
      • Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit
      • Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token
      • Ensure all data stored in the SNS topic is encrypted
      • Ensure all keys have an expiration date
      • Ensure all secrets have an expiration date
      • Ensure no IAM policies documents allow * as a statement’s actions
      • Ensure no hard-coded secrets exist in EC2 user data
      • Ensure no hard-coded secrets exist in lambda environment
      • Ensure public access level for Blob Containers is set to private
      • Ensure that 'Send Alerts To' is enabled for MSSQL servers
      • Ensure that ALB drops HTTP headers
      • Ensure that Azure Defender is set to On Container Registries
      • Ensure that Azure Defender is set to On for App Services.
      • Ensure that Azure Defender is set to On for Kubernetes
      • Ensure that Azure Defender is set to On for Servers
      • Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager
      • Ensure that Secrets Manager secret is encrypted using KMS CMK
      • Ensure that Timestream database is encrypted with KMS CMK
      • Ensure that Workspace root volumes are encrypted
      • Ensure that Workspace user volumes are encrypted
      • Ensure that standard pricing tier is selected
      • Etcd uses self-signed certificates
      • Excessive CertificateSigningRequests approval permission
      • Excessive RoleBindings / ClusterRoleBindings permissions
      • Excessive permissions to escalate roles
      • Excessive wildcard permissions
      • Excessive write permissions over admission webhook
      • Explicit request-timeout not set
      • Front Door WAF has essential rules disabled
      • GCP SQL Instance should not have insecure Cross DB Ownership Chaining On
      • Garbage collector on pod termination is not active
      • Glue Security Configuration has encryption disabled
      • Glue component has a security configuration associated
      • Google Compute Engine VM instances should not enable serial ports
      • Google Compute Network should not use a firewall rule that allows all ports
      • Google Compute Network should not use a firewall rule that allows port range
      • Google Compute Network should not use default firewall rule
      • Google Compute SSL Policy Weak Chyper Suits is Enabled
      • Google Compute Subnetwork should have Private Google Access enabled
      • Google Firewall should not allow SSH access (port 22) from the Internet (public CIDR block)
      • Google Kubernetes Engine (GKE) Basic Authentication must be disabled
      • GuardDuty is not enabled at organization level
      • HTTPS not enabled between apiserver and kubelets
      • Healthcheck instructions have not been added to container image
      • Highly privileged CAP_SYS_ADMIN granted
      • Host network namespace sharing is allowed
      • Host process ID namespace sharing is allowed
      • IAM Assume role policy without ExternalId or MFA
      • IAM Group without users
      • IAM Password is unchangeable in the policy
      • IAM Password policy has no expire
      • IAM Password policy has no reuse prevention
      • IAM Password policy has no the minimum length
      • IAM Password policy without lowercase letter
      • IAM Password policy without number
      • IAM Password policy without uppercase letter
      • IAM database is not enabled
      • IAM policy grants 'AssumeRole' permission to all principals
      • IAM policy grants 'AssumeRole' permission to all services
      • IAM policy has allowed full administrative privileges for all resources
      • IAM policy has granted full permissions to resources
      • IAM policy is attached to user
      • IAM policy with full wildcard administrative privileges
      • IPC namespace sharing is allowed
      • Insecure bind address
      • Insecure bind port
      • Instances must not be configured to use the Default Service Account that has full access to all Cloud APIs
      • Instances must not have IP forwarding enabled
      • KMS Key has a vulnerable policy
      • KMS encryption keys should be rotated every 90 days or less
      • Key vault key is not backed by HSM
      • Kinesis is not encrypted with KMS
      • Kubelet client certificate rotation is disabled
      • Kubernetes Clusters must be configured with labels
      • Kubernetes Clusters must be created with Alias IP ranges enabled
      • Kubernetes Clusters must be created with Client Certificate enabled
      • Kubernetes Clusters must be created with Private Clusters enabled
      • Kubernetes Engine Clusters must have Legacy Authorization set to disabled
      • Kubernetes Engine Clusters must have Network Policy enabled
      • Kubernetes Engine Clusters must have Stackdriver Logging enabled
      • Kubernetes Engine Clusters must have Stackdriver Monitoring enabled
      • Lambda function has no tags
      • Lambda function without X-Ray tracing
      • Lambda permission principal contains a wildcard
      • Launch configurations do not have encrypted EBS volumes
      • Load Balancer has deletion protection disabled
      • Load balancer is using insecure TLS policy
      • Log profile is not capturing all activities
      • MSK Cluster encryption at rest or in transit is disabled
      • MSSQL servers do not have email service and co-administrators enabled
      • Management Kubernetes nodes must have auto upgrades set to true
      • Master authorized networks must be enabled in GKE clusters
      • MySQL Instance With Local Infile On
      • MySQL is not using the latest version of TLS encryption servers
      • No Certificate Authority file set for etcd
      • No Network Security Group is attached to the Virtual Machine
      • No client authentication on etcd service
      • No client certificate for peer authentication in etcd
      • No service account public key file
      • Non SSL Redis Cache port is enabled
      • Persistent audit log not enabled
      • PostgreSQL Misconfigured Logging Duration Flag
      • PostgreSQL checkpoint logging is not enabled
      • PostgreSQL connection throttling is not enabled
      • PostgreSQL connections logging is not enabled
      • PostgreSQL database 'log_min_messages' flag isn’t set to a valid value
      • PostgreSQL database 'log_temp_files' flag isn’t set to '0'
      • PostgreSQL database instance should have a 'log_checkpoints' flag with its value set to 'on'
      • PostgreSQL database instance should have a 'log_connections' flag with its value set to 'on'
      • PostgreSQL disconnections logging is not enabled
      • PostgreSQL duration logging is not enabled
      • PostgreSQL log retention is not enabled
      • Public facing ALB not protected by WAF
      • RDS cluster without backup plan
      • RDS has automatic minor upgrades disabled
      • RDS has been defined with public interface
      • RDS has been defined with public subnet
      • RDS has opened a large scope
      • RDS using default port
      • RDS with backup disabled
      • Redis version is not compliant with AWS PCI DSS
      • Remote Desktop Port is open to all internet
      • Role definition has enabled custom role creation
      • Role-Based Access Control (RBAC) is disabled for AKS
      • S3 Bucket ACL allows public read access
      • S3 Bucket CORS is allowed for all origins
      • S3 Bucket SSE disabled
      • S3 Bucket has Read access for all authenticated users
      • S3 Bucket has all actions allowed for any principal
      • S3 Bucket has allowed Delete Action from all principals
      • S3 Bucket has allowed Get Action from all principals
      • S3 Bucket has allowed List Action from all principals
      • S3 Bucket has allowed Put Action from all principals
      • S3 Bucket has allowed access for all principals
      • S3 Bucket has public Read access
      • S3 Bucket logging is not enabled
      • S3 Bucket without versioning
      • S3 Storage is not protected with SSE
      • S3 bucket has block public ACLs disabled
      • SES Policy allow actions for all principals
      • SNS Topic is publicly accessible
      • SQL DB Instance Publicly Accessible
      • SQL Instance Backup Disabled
      • SQL Instance With SSL Disabled
      • SQL Instance should not have Contained Database Authentication On
      • SQL Server is not using the latest version of TLS encryption
      • SQL databases allow ingress from 0.0.0.0/0
      • SQL servers do not enable data security policy
      • SQS Policy allow all actions
      • SQS Policy has dangerous access for all principals
      • SQS Queue is exposed
      • SQS without server side encryption
      • SSH port exposed
      • SSL is disabled for MySQL
      • SSL is disabled for PostgresSQL
      • Scheduler service bound to loop-back insecure address
      • Secure transfer required is not enabled
      • Send email notification for high severity alerts is not enabled
      • Send email notification for high severity alerts to admins is not enabled
      • Service account lookup not set
      • Storage account does not use the latest version of TLS encryption
      • Storage for critical data not encrypted with Customer Managed Key
      • The CA certificate for the RDS is outdated
      • The CIDR IP has public interface
      • The CloudFront has a default SSL certificate
      • The CloudFront has an insecure protocol version
      • The IP configuration allow a lot of IPs
      • The Key Vault is not soft delete
      • The SQL Server Admin account has predictable username as 'Admin' or 'Root'
      • The active log retention is lower than 365 days
      • The admission control plugin AlwaysAdmit is set
      • The admission control plugin AlwaysPullImages is not set
      • The admission control plugin NodeRestriction is not set
      • The application gateway has no firewall configured
      • The configured minimum TLS version is not the latest version
      • The connection between CloudFront and the origin server has HTTP allowed
      • The container register has no locks
      • The encryption for the EFS is without KMS
      • The firewall rule allowing a lot of hosts to access
      • The firewall rule allowing unrestricted access to Redis
      • The log files in CloudTrail are not encrypted with KMS
      • The node image should be Container-Optimized OS(COS)
      • The storage account has http traffic allowed
      • The storage in the RDS is not encrypted
      • The web application has http traffic allowed
      • Trusted Microsoft Services should be enabled for Storage Account access
      • UDP Internet access is not restricted
      • Unencrypted Data Lake Store accounts
      • Unpinned version for base image
      • Unrestricted access to SQL Server
      • User data contains a base64 encoded private key
      • User data shell script is not encoded
      • VM Instance With Full Cloud Access
      • VM Instance should block project-wide SSH keys
      • VM disks for critical VMs must be encrypted with Customer-Supplied Encryption Keys (CSEK) or Customer-Managed Encryption Keys (CMEK)
      • VM instance should have OSLogin enabled
      • Verify CloudFront Distribution Viewer Certificate is using TLS v1.2
      • Virtual Machine extensions are installed
      • Web App does not use the latest version of TLS encryption
    • Code Tampering Detection
      • Build File Modification
      • CODEOWNERS File Modification
      • Configuration File Modification
      • Custom Critical File Modification
      • Dependency Descriptor File Modification
      • Env File Modification
      • IaC File Modification
      • Modification of Security Tool Configuration
      • Security Policy File Modification
      • Shell Script Modification
      • Workflow File Modification
    • Code Security - Malware
      • Bidirectional Characters
      • Browser Sensitive Data Enumeration
      • Clipboard Hijacker
      • Decoded Code Execution
      • Decrypted Code Execution
      • Downloaded Code Execution
      • Execution Policy Bypass
      • Impair Defenses: Disabled Tools
      • Invisible Characters
      • Malicious Command Execution
      • Malicious Installation Scripts
      • Masquerade File Type
      • Obfuscated Code
      • Obfuscated Code Execution
      • Process Termination
      • Sensitive Data Enumeration
      • Sensitive Data Exfiltration
      • Sensitive File Exfiltration
      • Sensitive File encryption
      • Silent execution
      • Suspicious Request
      • Suspicious Scheduled system service
      • Suspicious URL
      • System Registry Code Execution
      • System Registry Tampering
      • Unusual File Execution
      • Virtualization Sandbox Evasion
    • Code Security - Vulnerabilities
      • Go
        • Avoid Native Calls
        • Connection String Parameter Pollution
        • Dangerous API
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
        • Improper neutralization of data within XPath expressions ('XPath Injection')
        • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
        • Information Exposure Through Debug Log
        • Insecure File Permissions
        • Insecure SSL Version
        • Insecure Transport
        • Integer Overflow or Wraparound
        • Log Forging
        • OS Command Injection
        • Regex Injection
        • SQL Injection
        • Server Side Request Forgery ('SSRF')
        • Server-side Template Injection
        • Sleep Injection
        • URL Redirection to Untrusted Site ('Open Redirect')
        • Unsafe Cookie
        • Use of a broken or risky cryptographic algorithm
        • Weak Hash Algorithm
      • Java
        • Anonymous LDAP Bind
        • Avoid Direct Database Connection
        • Avoid Explicit Socket
        • Avoid Explicit Thread Management
        • Avoid JVM Exit
        • Avoid Leftover Debug Code
        • Avoid Native Calls
        • Avoid Non Serializable Objects Stored
        • Code Injection
        • Code Injection During Deserialization
        • Connection String Parameter Pollution
        • Cookie Poisoning
        • Cookies In Security Decision
        • Cross Site History Manipulation ('XSHM')
        • Cross Site Request Forgery ('CSRF')
        • Cross Site Scripting ('XSS')
        • Cross-site scripting protection disabled
        • Dangerous API
        • Dangerous Hostname Check
        • Database Access Control
        • Execution After Redirect ('EAR')
        • External Control Of Configuration Setting
        • Format String Injection
        • HTTP Parameter Pollution
        • HTTP Splitting
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Hardcoded Cryptographic Salt
        • Improper Validation Of Array Index
        • Inadequate Padding
        • Information Exposure Through Debug Log
        • Information Exposure Through Error Message
        • Information Exposure Through External Request
        • Input Path Not Canonicalized
        • Input Path Not Normalized
        • Insecure Randomness
        • Insecure SSL
        • Insecure Transport
        • Insufficient Key Size
        • Insufficient Session Expiration
        • JSON Injection
        • JWT Signature Verification Bypass
        • LDAP Injection
        • Log Forging
        • Mail Command Injection
        • NoSQL Injection
        • Non Random IV With CBC Mode
        • OS Command Injection
        • Observable Timing Discrepancy
        • Open Redirect
        • Password In Redirect
        • Path Traversal
        • Plaintext Storage In Cookie
        • Plaintext Storage Of Password
        • Potential Infinite Loop
        • Process Control
        • Race Condition Format
        • Race Condition Matcher
        • Race Condition Servlet
        • Reflected File Download
        • Regex Injection
        • Regular expression Denial of Service ('ReDoS')
        • Resource Injection
        • SQL Injection ('SQLi')
        • Same Origin Method Execution ('SOME')
        • Security Check In Overridable Method
        • Serializable Class Containing Sensitive Data
        • Server Side Request Forgery ('SSRF')
        • Sleep Injection
        • Spring XSS Protection Disabled
        • Static Database Connection
        • Too Broad Cors Policy
        • Trust Boundary Violation
        • Unchecked Input In Loop Condition
        • Unhandled SSL Exception
        • Unrestricted Request Mapping
        • Unsafe Cookie
        • Unsafe Reflection
        • User Controlled Primary Key
        • View Manipulation
        • Weak Encryption Algorithm
        • Weak Hash Algorithm
        • Weak Password Hash
        • Web.xml security misconfigurations
        • XML Entity Injection
        • XML Injection
        • XPath Injection
      • JavaScript / TypeScript
        • Angular Cross Site Scripting
        • CORS Policy is too broad
        • Client-side Template Injection
        • Code Injection
        • Code injection during object deserialization
        • Code injection with javascript: URL in JSX
        • Cookie Poisoning
        • Cross Site Request Forgery (CSRF)
        • Cross-site scripting protection disabled
        • Do not use eval()
        • HTML escape disabled in Vue component
        • HTTP Strict Transport Security (HSTS) not set
        • Hardcoded Cryptographic Key
        • Improper Certificate Validation
        • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
        • Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
        • Improper neutralization of XML entities ('Xml Entity Injection')
        • Improper neutralization of data within XPath expressions ('XPath Injection')
        • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
        • Information Exposure Through Error Message
        • Insecure Randomness
        • Insecure Transport
        • Insufficient Cryptographic Key Length
        • No clickjacking protection configured
        • NoSQL Injection
        • OS Command Injection
        • Plaintext Storage In Cookie
        • Potential loop with unreachable exit condition ('Infinite Loop')
        • Prevent MIME Sniffing
        • React dangerouslySetInnerHTML should not be used
        • ReactDOM.findDOMNode() should not be used
        • Regex Injection
        • Regular Expression DoS
        • Resource Injection
        • SQL Injection
        • Sensitive data in HTML5 Web Storage
        • Server Insecure Transport
        • Server Side Request Forgery ('SSRF')
        • Server-side Template Injection
        • Strict Contextual Escaping (SCE) disabled
        • Too Broad Message Posting
        • URL Redirection to Untrusted Site ('Open Redirect')
        • Unsafe Cookie
        • Unsafe JQuery Plugin
        • Use of a broken or risky cryptographic algorithm
        • Use of a broken or risky cryptographic mode of operation
        • Use of a weak password hashing
        • Weak Hash Algorithm
        • X-Powered-By header must be disabled
      • Php
        • CakePHP Unsafe Configuration
        • CakePHP Unsafe Session Configuration
        • Code Injection
        • Code injection during object deserialization
        • CodeIgniter Unsafe Session Configuration
        • Connection String Parameter Pollution
        • Cookies In Security Decision
        • Cross Site Request Forgery (CSRF)
        • Dangerous File Upload
        • Do not use $_REQUEST
        • Do not use eval()
        • Execution After Redirect ('EAR')
        • External Variable Modification
        • Format String Injection
        • HTTP Parameter Pollution
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Hardcoded Cryptographic Salt
        • Improper Control of filename for include / require statement ('Include File Injection')
        • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
        • Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
        • Improper neutralization of XML entities ('Xml Entity Injection')
        • Improper neutralization of data within XPath expressions ('XPath Injection')
        • Improper neutralization of external input used within a CSV or Excel formula ('Formula Injection')
        • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
        • Inadequate Padding
        • Information Exposure Through Debug Log
        • Information Exposure Through Error Message
        • Insecure Randomness
        • Insecure Transport
        • LDAP Injection
        • Laravel Unsafe Session Configuration
        • Log Forging
        • Mail Command Injection
        • Mail Content Injection
        • Mail Header Manipulation
        • NoSQL Injection
        • OS Command Injection
        • Password In Redirect
        • Regex Injection
        • Regular Expression DoS
        • Resource Injection
        • SQL Injection
        • Server Side Request Forgery ('SSRF')
        • Sleep Injection
        • Symfony No Use Default Secret
        • Too Broad Cors Policy
        • Trust Boundary Violation
        • Twig No Use Debug
        • Twig XSS protection disabled
        • URL Redirection to Untrusted Site ('Open Redirect')
        • Unsafe Configuration
        • Unsafe Cookie
        • Unsafe Session Configuration
        • Use of a broken or risky cryptographic algorithm
        • Use of a broken or risky cryptographic mode of operation
        • Use of a weak cryptographic initialization vector
        • User Controlled Primary Key
        • Weak Hash Algorithm
        • Weak Password Hash
        • Zend/ Laminas Unsafe Session Configuration
      • Python
        • Anonymous LDAP Bind
        • Code Injection
        • Code injection during object deserialization
        • Connection String Parameter Pollution
        • Cookie Poisoning
        • Cookies In Security Decision
        • Cross Site Request Forgery (CSRF)
        • Django Missing Permissions Check
        • Django Password Requirements Not Enforced
        • Django Unsafe Configuration
        • Django Unsafe Session Configuration
        • Django XSS Protection Disabled
        • Do not use assert
        • Do not use compile()
        • Do not use eval()
        • Execution After Redirect ('EAR')
        • External Request DoS
        • Flask Unsafe Configuration
        • Flask XSS Protection Disabled
        • HTTP Parameter Pollution
        • HTTP Splitting
        • Hardcoded Credentials
        • Hardcoded Cryptographic Key
        • Hardcoded Cryptographic Salt
        • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
        • Improper Request Certificate Verification
        • Improper neutralization of XML entities ('Xml Entity Injection')
        • Improper neutralization of data within XPath expressions ('XPath Injection')
        • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
        • Information Exposure Through Debug Log
        • Information Exposure Through Error Message
        • Information Exposure Through External Request
        • Insecure Authentication
        • Insecure File Permissions
        • Insecure Parser
        • Insecure Randomness
        • Insecure SSL Version
        • Insecure Temporary File
        • Insecure Transport
        • Insufficient Key Size
        • JSON Injection
        • JWT Signature Verification Bypass
        • Jinja XSS Protection Disabled
        • LDAP Injection
        • Log Forging
        • Mail Command Injection
        • Mako XSS Protection Disabled
        • Missing Resource Integrity Check
        • Missing SSH Host Key Verification
        • NoSQL Injection
        • OS Command Injection
        • Observable Timing Discrepancy
        • Password In Redirect
        • Plaintext Storage In Cookie
        • Regex Injection
        • Regular Expression DoS
        • Resource Injection
        • SQL Injection
        • Server Insecure Transport
        • Server Side Request Forgery ('SSRF')
        • Server-side Template Injection
        • Sleep Injection
        • Socket Binding To All Interfaces
        • Template XSS Protection Disabled
        • Too Broad Cors Policy
        • Trust Boundary Violation
        • URL Redirection to Untrusted Site ('Open Redirect')
        • Unsafe Cookie
        • Unsafe Logging Configuration
        • Unsafe Reflection
        • Use of a broken or risky cryptographic algorithm
        • Use of a broken or risky cryptographic mode of operation
        • Use of a weak cryptographic initialization vector
        • User Controlled Primary Key
        • Weak Hash Algorithm
        • Weak Password Hash
        • Zip Slip
    • Unusual Activity Detection
      • Anomalous plugin installed
      • Auditing Configuration Modification
      • Anomalous fork
      • Anomalous Pull Request
      • Branch protection disabled
      • Commit anomalous
      • Commit bypassed branch protection
      • Compliance Framework Removed
      • Compliance Framework Updated
      • CI Token Scope Modified
      • DAST Profile Modified
      • Environment Unprotected
      • Failed login attempts
      • Commit force pushed
      • Feature Flag Updated
      • Member received Admin permissions
      • Organization deleted
      • Organization renamed
      • Organization Publicized
      • IP Restrictions Updated
      • Potential Script Injection Attack
      • Organization MFA requirement disabled
      • Manually Triggered Housekeeping
      • Pull Request merged without passing the status checks
      • Project Default Branch Updated
      • Repository archived
      • Repository deleted
      • Repository publicized
      • Repository Renamed
      • Repository unarchived
      • Stale Pull Request merged
      • Tag force pushed
      • Status Check Modification
      • Team received Admin permissions
      • Unsigned commit
      • Unusual Login
      • Unusual long time build job
  • Compliance Assessment Standards
    • CIS Software Supply Chain Security benchmark
      • 1.1.1 Ensure any changes to code are tracked in a version control platform
      • 1.1.10 Ensure open branches are up-to-date before merge
      • 1.1.11 Ensure all open comments are resolved before allowing code change merging
      • 1.1.12 Ensure verification of signed commits for new changes before merging
      • 1.1.13 Ensure linear history is required
      • 1.1.14 Ensure branch protection rules are enforced for administrators
      • 1.1.15 Ensure pushing or merging of new code is restricted to specific individuals or teams
      • 1.1.16 Ensure force push code to branches is denied
      • 1.1.17 Ensure protected branch deletions are denied
      • 1.1.3 Ensure any change to code receives approval of a minimum strongly authenticated users
      • 1.1.4 Ensure previous approvals are dismissed when updates are introduced to a code change proposal
      • 1.1.5 Ensure there are restrictions on who can dismiss code change reviews
      • 1.1.6 Ensure code owners are set for extra sensitive code or configuration
      • 1.1.8 Ensure inactive branches are periodically reviewed and removed
      • 1.1.9 Ensure all checks have passed before merging new code
      • 1.2.1 Ensure all public repositories contain a SECURITY.md file
      • 1.2.2 Ensure repository creation is limited to specific members
      • 1.2.3 Ensure repository deletion is limited to specific users
      • 1.2.4 Ensure issue deletion is limited to specific users
      • 1.3.1 Ensure inactive users are reviewed and removed periodically
      • 1.3.3 Ensure maximum number of administrators are set for the organization
      • 1.3.5 Ensure the organization is requiring members to use Multi-Factor Authentication (MFA)
      • 1.3.7 Ensure two administrators are set for each repository
      • 1.3.8 Ensure strict base permissions are set for repositories
      • 1.3.9 Ensure an organization’s identity is confirmed with a "Verified" badge
      • 2.3.1 Ensure all build steps are defined as code
      • 2.3.5 Ensure access to build process triggering is minimized
      • 2.3.7 Ensure pipelines are automatically scanned for vulnerabilities
      • 2.3.8 Ensure scanners are in place to identify and prevent sensitive data in pipeline files
      • 2.4.2 Ensure all external dependencies used in the build process are locked
      • 2.4.6 Ensure pipeline steps sign the Software Bill of Materials (SBOM) produced
      • 3.1.7 Ensure dependencies are pinned to a specific, verified version
      • 3.2.2 Ensure packages are automatically scanned for known vulnerabilities
      • 3.2.3 Ensure packages are automatically scanned for license implications
      • 4.2.3 Ensure user access to the package registry utilizes Multi-Factor Authentication (MFA)
      • 4.2.5 Ensure anonymous access to artifacts is revoked
      • 4.3.4 Ensure webhooks of the package registry are secured
    • OWASP Software Component Verification Standard
      • OWASP SCVS Unknown Components
    • OpenSSF FLOSS
      • Basic project website content
    • OpenSSF Scorecard
      • Branch protection
      • CI Tests: Does the project run tests in CI?
      • Code Review
      • Contributors
      • Dangerous Workflow
      • Dependency Update Tool
      • Fuzzing
      • License Declaration
      • Maintained
      • No Binary Artifacts
      • OpenSSF Best Practices badge
      • Packaging
      • Pinned Dependencies
      • SAST in use
      • Security Policy
      • Signed Releases
      • Token Permissions
      • Vulnerabilities
      • Webhooks
    • ESF Securing the Software Supply Chain DEV
      • Are all of your builds continuously built and tested?
      • Are code check-ins gated by code collaborators and source control to prevent anyone from accidentally or intentionally submitting unreviewed code changes?
      • Do you ensure only required modules are included in the product?
      • Do you have and adhere to responsible disclosure requirements for all externally identified vulnerabilities?
      • Do you have and use security tools for Software Composition Analysis?
      • Do you perform binary composition analysis of the final package?
      • Do you perform input fuzzing as part of a regular process for your component or product’s inputs?
      • Do you perform nightly builds with automated regression and security test to quickly detect problems with recent builds?
      • Do you track all third-party components you use directly and all internal components in a secure and persistent repository?
      • Do you use the toolchain to automatically gather information that informs security decision-making?
      • Does the project use a static code analysis tool?
      • Does the project use tools to help update its dependencies?
      • Does the team require code reviews for all code and build scripts / configuration changes?
      • Does your release confirmation that binaries are digitally signed?
      • Does your release include an SBOM?
      • The project should not have generated executable (binary) artifacts in the source repository.
  • XyDocs
  • Unusual Activity Detection

Supported Unusual Activity detectors

The detectors for Unusual Activities listed below are classified by the target resource.

Organization

  • Auditing configuration modified

  • CICD token scope modified

  • CICD token unprotected

  • Compliance framework deleted

  • Compliance framework modified

  • DAST profile modified

  • Environment unprotected

  • Feature flag updated

  • IP restrictions updated

  • Manually triggered housekeeping

  • Organization MFA requirement disabled

  • Organization deleted

  • Organization publicized

  • Organization renamed

Repository

  • Anomalous fork

  • Anomalous Pull Request

  • Commit force pushed

  • Member received Admin permissions

  • Pull Request merged without passing the status checks

  • Repository archived

  • Repository deleted

  • Repository publicized

  • Repository renamed

  • Repository unarchived

  • Potential Script Injection Attack

  • Stale Pull Request merged

  • Tag force pushed

  • Team received Admin permissions

Branch

  • Commit anomalous

  • Commit bypassed branch protection

  • Branch protection disabled

  • Default branch updated

  • Status check requirements modified

  • Unsigned commit

Jenkins Login

  • Failed login attempts

  • Unusual Login

Jenkins Plugin

  • Anomalous plugin installed

Jenkins Project

  • Unusual long time build job

© 2025 Xygeni. All rights reserved