Xygeni Documentation
search
home

XyDocs

    • Suspect Dependencies Detectors
      • Anomalous Dependency
        • Maven Anomalous Dependency
        • NPM Anomalous Dependency
        • NuGet Anomalous Dependency
        • PyPI Anomalous Dependency
      • Dependency Confusion
        • NPM Dependency Confusion
        • NPM Unscoped internal components
        • NuGet Dependency Confusion
        • PiP Dependency Confusion
      • Known Vulnerabilities
        • Dependency with important known vulnerabilities
      • Malware
        • DotNet Malware Dependency
        • Java Malware Dependency
        • NPM Malware Dependency
        • Python Malware Dependency
      • Suspicious Scripts
        • NPM Suspicious Scripts
        • PyPI Suspicious Scripts
      • Typosquatting
        • Maven Typosquatting
        • NPM Typosquatting
        • NuGet Typosquatting
        • PyPI Typosquatting
    • CI/CD Misconfigurations Detectors
      • Avoid Open Versions
        • Maven Avoid Open Versions
      • Avoid Public Repositories
        • Maven Avoid Public Repositories
        • NPM Avoid Public Repositories
        • NuGet Avoid Public Repositories
        • PyPI Avoid Public Repositories
      • CI/ CD Security
        • Avoid calls to Jenkins getInstance method
        • Branches configured to trigger a pipeline exposed to secrets has a correlating branch protection rule in the SCM
        • Build attestation framework should be used
        • CI/CD Bot should not be able to approve a code review
        • CI/CD argument values should not flow directly into workflows
        • Ensure that CI/CD apps do not use too broad permissions
        • Ensure that groups do not use too broad permissions.
        • Potential injected malicious code into files referenced by the pipeline configuration file
        • Pull Requests do not execute the pipelines modifications that they include
        • Repository should be associated with an approved CI/CD app
        • Secrets and Credentials at organization level should not widely shared
        • Secrets should be stored explicitly as encrypted GitHub Actions Secrets
        • Secrets used in workflows should not be echoed in the console
        • Signed Container Images
        • Suspicious Pull Request merge invocation
        • Unusual activity at CI/CD environments should be monitored
        • Webhook URL is not allowed
        • Workflows should not use insecure commands
      • CI/ CD Tools
        • Dangerous Workflow
        • Dependency Update Tool
        • Ensure all external dependencies used in the build process are locked
        • Ensure scanners are in place to identify and prevent sensitive data in pipeline files
        • Fuzzing
        • Inadequate Backups of Jenkins Instance
        • Lack of Secure Authentication
        • Lack of Secure Authorization
        • Lack of administrative monitor and logging
        • SAST in use
        • Secure Jenkins version
        • Token Permissions
        • Unsecured Communication
        • Use of Deprecated or Vulnerable Plugins
        • Workflow permissions are not minimal
      • CI/CD Security
        • Malicious script in a CI/CD pipeline.
      • Confusing Names
        • PyPI Confusing Names
      • Container Security
        • 'dnf clean all' missing
        • 'microdnf clean all' missing
        • 'yum clean all | packages' missing
        • 'zypper clean' missing
        • ADD instead of COPY
        • COPY with multiple sources must end destination with /
        • Container runs as root
        • Deprecated MAINTAINER used
        • Exposed port out of range
        • Multiple CMD instructions
        • Multiple ENTRYPOINT instructions
        • No HEALTHCHECK defined
        • RUN package-manager update instruction alone
        • RUN using sudo
        • SSH port exposed
        • WORKDIR path is not absolute
        • WORKDIR should not be mounted on system dirs
        • apk add is missing --no-cache
        • apt-get dist-upgrade used
        • apt-get missing –no-install-recommends
      • Lack Of Version Pinning
        • NPM Lack of Version Pinning
        • NuGet Lack of Version Pinning
        • PyPI Lack of Version Pinning
      • Malicious Image
        • Reverse Shell in Container Image
      • Package Managers
        • Insecure Package Registry webhook
      • Releases
        • Signed Releases
      • SCM
        • Binary artifacts found
        • Code Review
        • Ensure all checks have passed before merging new code
        • Ensure issues deletion is limited to specific users
        • Ensure maximum number of administrators are set for the organization
        • Ensure pipelines are automatically scanned for vulnerabilities
        • Ensure repository creation is limited to specific members
        • Ensure repository deletion is limited to specific users
        • Ensure strict base permissions are set for repositories
        • Ensure the organization is requiring members to use Multi-Factor Authentication (MFA)
        • Ensure two administrators are set for each repository
        • Ensure verification of signed commits for new changes before merging
        • Ineffective GitHub ruleset
        • Insecure Webhook
        • Security Policy
        • Tags are not immutable
        • The Software Bill of Materials (SBOM) is not produced
        • Unprotected branch
        • Vulnerabilities
      • URL Dependency
        • NPM URL Dependency
        • PyPI URL Dependency
      • Use HTTPS With Remote Repositories
        • Maven Use HTTPS with remote repositories
        • NuGet Use HTTPS with remote repositories
        • PyPI Use HTTPS with remote repositories
    • Hardcoded Secrets Spotting
      • API Key
        • Abstract API Key
        • AccuWeather API key
        • Adafruit IO Key
        • Anthropic API key
        • Authress Service Client Access Key
        • PostHog API key
        • PostHog Personal API key
        • Twilio API Key
        • Twilio Account SID
        • Twilio Auth Token
      • API Token
        • Aiven Token
        • Akamai API Token
        • Alchemy API Key
        • Alibaba Cloud Access Key ID
        • Alibaba Cloud Secret Access Key
        • Amazon MWS Token
        • Amazon Web Services Keys ID
        • Amazon Web Services Keys Secret
        • Amazon Web Services Keys Token
        • Artifactory API Key
        • Artifactory Access Token
        • Atlassian API token
        • Auth0 Keys
        • Azure Personal Access Token
        • Azure Service Management Certificate
        • Bitbucket Repository Access Token
        • CircleCI Personal Token
        • CircleCI Project Token
        • Clockwork Key
        • Cloudant Keys
        • Cloudflare Credentials
        • Cloudflare Global API Key
        • Codacy API Token
        • Codacy Project Token
        • Codeclimate key
        • Codecov Token
        • Codecov Token in codecov Command
        • Confluent Keys
        • Contentful Content Delivery API Key
        • Contentful Content Management personal access token
        • Coveralls Config Token
        • Coveralls Token
        • Crates.io Key
        • Customer.io App Keys
        • Customer.io Track Encoded Keys
        • Customer.io Track Keys
        • Databricks Authentication Token
        • Datadog API Credentials
        • Digital Ocean OAuth Client Secret
        • DigitalOcean Spaces Keys
        • DigitalOcean Token
        • Discord Bot Token
        • Discord Oauth2 Keys
        • Docker Swarm Join Token
        • Docker Swarm Unlock Key
        • Dropbox App Credentials
        • Dropbox Key
        • Facebook App Keys
        • Firebase Cloud Messaging API Key
        • Flutterwave API Key
        • Gemfury credentials
        • Gemini API Key
        • GitHub token
        • GitLab Enterprise Personal Access Token
        • GitLab Personal Access Token
        • GitLab Personal Access Token in URL
        • Google API Key
        • Google OAuth2 Keys
        • Grafana Personal Token
        • Grafana Service Account Token
        • Heartland API Key
        • Heroku Platform Key
        • HubSpot API Key
        • Intercom Access Token
        • JSON Web Token
        • Kubernetes JWT
        • Line Messaging OAuth2 Keys
        • Line Token
        • Linkedin OAuth2 Keys
        • Linode Personal Access Token
        • Llama API Key
        • Mailchimp API Key
        • Mailgun Key
        • Midtrans API Key
        • Moneywave API Key
        • Npm Token
        • NuGet API Key
        • Okta Keys
        • Okta Token
        • OpenAI API Key
        • OpenWeatherMap Call Token
        • OpenWeatherMap URL Token
        • PayPal OAuth2 Keys
        • Planetscale API Key
        • Postman API Key
        • Pulumi Access Token
        • Pusher Channels Keys
        • Python Package Index API Token
        • RapidAPI Key
        • Razorpay API Key
        • RubyGems API Key
        • Salesforce Oauth2 Keys
        • Salesforce Refresh Tokens
        • Sendgrid API Key
        • Sentry Token
        • Shopify Generic App Token
        • Shopify Private App Token
        • Shopify Private Key
        • Shopify Private Key V2
        • Slack Access Token
        • Snyk Key
        • SonarQube Token
        • Spotify Keys
        • Square access token
        • Stripe Secret keys
        • Stripe Webhook Secret
        • Telegram Bot Token
        • Tencent Cloud Keys
        • Terraform Cloud Token
        • Travis Personal Token
        • Trello Keys
        • Twitch API Keys
        • Vultr Key
        • WePay API Token
        • Webex App Keys
        • Xygeni.io Token
        • Xygeni.io user / organization token
        • Zendesk Token
        • Zoom API JWT
        • mapbox Token
        • reCAPTCHA Key
      • Access Key
        • Artifactory Identity Token
        • Atlassian OAuth2 Client Secret
        • Azure Storage Access Key
        • Bitbucket OAuth Access Key
        • Cloudant Keys
        • Generic API key / token
        • Google Cloud Service Account Key
        • IBM Cloud Access Key
        • IBM Cloud Object Storage Key
        • Mend API Key
        • Mend User Key
        • Twitter Access Key
        • Veracode API Credentials
        • Zoom API JWT Keys
        • Zoom API Keys
        • Zoom SDK Keys
      • Access Token
        • Splunk Authentication Token
      • Crypto Key
        • Cryptographic Private Key
        • Cryptographic Private Key Putty
      • Data Storage Secret
        • Database Password
        • Database connection data
        • LDAP Credentials
        • MSSQL Credentials
        • MongoDB Password
        • MySQL Credentials Assignment
        • MySQL Credentials CLI
        • ODBC Connection String
        • Password in MongoDB Connection String
        • PostgreSQL Credentials Assignment
        • PostgreSQL Credentials Password file
        • RabbitMQ Address
        • RabbitMQ Password
        • RabbitMQ Password in URL
        • Redis CLI Credentials
        • Redis Credentials Assignment
        • Redis Password in URL
      • Encryption Keys
        • WordPress Security Key
      • Generic Secret
        • Azure Directory Application Secret
        • Base-64 encoded text
        • CLI Secret
        • CLI Secret embedded in a shell script
        • Credential with high entropy
        • Credentials File
        • Credit Card number
        • Discord Webhook
        • Django Secret Key
        • Generic Secret
        • Hubspot Webhook
        • Kubernetes Secret
        • Microsoft Teams Webhook
        • Potential information leak through comments
        • SMTP Assignment
        • SMTP Password
        • SSH Password
        • SSH Password Assignment
        • Slack API/Signing Secret
        • Slack Incoming Webhook URL
        • Twilio Webhook
      • OAuth Secret
        • Square OAuth secret
      • OAuth Token
        • HubSpot OAuth Token
        • NPM OAuth Token
      • Other
        • Cloudflare Credentials
        • HashiCorp Vault Unseal Key
        • Kubernetes User Certificate
      • Password
        • .htpasswd credentials
        • .pypirc credentials
        • Artifactory Encrypted Secret
        • Basic Authentication Credentials
        • Bitbucket Basic Auth
        • Bitbucket Client ID
        • Dockercfg Auth
        • Hardcoded password
        • Jira Basic Auth
        • Password in Maven pom.xml
        • Password in Maven settings.xml
        • Rails Master Key
        • Rails Secret Key Base
        • Snowflake Password
        • Snowflake Password in URI
        • Splunk Admin Password
        • VISA Basic Auth
        • passwd-like credentials
        • pip.conf credential
        • pip.conf proxy credential
      • Password Hash
        • Bcrypt Hash
      • Url
        • Hardcoded URL
    • IaC Flaws
      • AWS
        • ALB listening on HTTP
        • API Gateway has endpoint not private
        • API Gateway has no SSL certificate
        • API Gateway has no X-Ray active
        • AWS AMI Encryption is not enabled
        • AWS AMI is shared with multiple accounts
        • AWS EBS volume is not encrypted
        • AWS ElastiCache Redis cluster with encryption for data at rest is disabled
        • AWS RDS DB cluster encryption is disabled
        • AWS Redshift cluster is not encrypted
        • AWS Redshift cluster is publicly accessible
        • AWS Redshift using default port
        • AWS SQS server side encryption is not enabled
        • An unknown port has been exposed in the EC2 group
        • Auto Scaling group has no ELB group
        • Autoscaling launch configuration has no data in the volumes encrypted
        • Batch job has privileged container
        • CMK is unusable
        • CMK rotation is disabled
        • CloudFormation has no stack policy
        • CloudFormation has the stack retention disabled
        • CloudFormation stack notifications are disabled
        • CloudFormation without template
        • CloudFront distribution without strict security headers policy
        • CloudFront has no configured web application firewall
        • CloudFront logging is disabled
        • CloudTrail has no the SNS topic name configured
        • CloudTrail has the logging disabled
        • CloudTrail is not integrated with CloudWatch
        • CloudTrail log file validation is disabled
        • CloudTrail multi region disabled
        • CloudWatch has no retention period
        • CodeBuild Project encryption is disabled
        • CodeBuild Project is not encrypted
        • Configuration aggregator has no all regions enabled
        • Data stored in Aurora is unencrypted at rest
        • EBS volume is not encrypted
        • EC2 Instance using default VPC
        • EC2 group has HTTP port open to internet
        • EC2 group has SQL analysis services port publicly accessible
        • EC2 group has no restrict access to administration ports
        • EC2 instance has public IP
        • EC2 instance should not have public IP
        • EC2 instance without VPC
        • EC2 security group has unrestricted traffic access
        • EC2 with EBS not optimized
        • ECR image repository has public access
        • ECR image scan on push is disabled
        • ECR image tag is mutable
        • ECS Service admin role is present
        • ECS Service task has network mode different to awsvpc
        • ECS Service without running task
        • ECS Task definition has secrets in the container environment in plain text
        • EFS is not encrypted
        • EFS without tags
        • ELB use weak ciphers
        • ElastiCache using default port
        • ElastiCache without VPC
        • Ensure ALB protocol is HTTPS
        • Ensure AWS EKS cluster security group is not overly permissive to all traffic
        • Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0
        • Ensure AWS IAM password policy does not allow password reuse
        • Ensure AWS IAM policy does not allow assume role permission across all services
        • Ensure AppSync has Field-Level logs enabled
        • Ensure AppSync has Logging enabled
        • Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption
        • Ensure CloudTrail logs are encrypted at rest using KMS CMKs
        • Ensure Code artifact Domain is encrypted by KMS using a customer managed Key (CMK)
        • Ensure DAX encryption at rest is not disabled
        • Ensure DB instance gets all minor upgrades automatically
        • Ensure DMS replication instance is not publicly accessible
        • Ensure DocDB TLS is not disabled
        • Ensure DocumentDB is encrypted at rest
        • Ensure DynamoDB Point-In-Time Recovery (PITR) is enabled
        • Ensure DynamoDB point in time recovery is enabled
        • Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK)
        • Ensure EFS is securely encrypted
        • Ensure Elasticsearch Domain enforces HTTPS
        • Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions
        • Ensure Glue Data Catalog Encryption is enabled
        • Ensure IAM policy documents do not allow * as a statement’s action
        • Ensure IAM role allows only specific services or principals to assume it
        • Ensure KMS key policy does not contain wildcard (*) principal
        • Ensure Kinesis Stream is securely encrypted
        • Ensure Neptune Cluster instance is not publicly available
        • Ensure Neptune logging is enabled
        • Ensure Neptune storage is securely encrypted
        • Ensure Redshift cluster encryption at rest is enabled
        • Ensure Redshift cluster is not publicly accessible
        • Ensure Redshift uses SSL
        • Ensure S3 Bucket ACL doesn’t allow public write
        • Ensure S3 buckets are encrypted with KMS by default
        • Ensure SQS policy does not allow ALL (*) actions
        • Ensure SageMaker Endpoint is encrypted
        • Ensure SageMaker Notebook is encrypted at rest using KMS CMK
        • Ensure all Elasticsearch has node-to-node encryption enabled
        • Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit
        • Ensure all data stored in the Elasticache Replication Group is securely encrypted at transit and has auth token
        • Ensure all data stored in the SNS topic is encrypted
        • Ensure no IAM policies documents allow * as a statement’s actions
        • Ensure no hard-coded secrets exist in EC2 user data
        • Ensure no hard-coded secrets exist in lambda environment
        • Ensure that ALB drops HTTP headers
        • Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager
        • Ensure that Secrets Manager secret is encrypted using KMS CMK
        • Ensure that Timestream database is encrypted with KMS CMK
        • Ensure that Workspace root volumes are encrypted
        • Ensure that Workspace user volumes are encrypted
        • Glue Security Configuration has encryption disabled
        • Glue component has a security configuration associated
        • GuardDuty is not enabled at organization level
        • IAM Assume role policy without ExternalId or MFA
        • IAM Group without users
        • IAM Password is unchangeable in the policy
        • IAM Password policy has no expire
        • IAM Password policy has no reuse prevention
        • IAM Password policy has no the minimum length
        • IAM Password policy without lowercase letter
        • IAM Password policy without number
        • IAM Password policy without uppercase letter
        • IAM database is not enabled
        • IAM policy grants 'AssumeRole' permission to all principals
        • IAM policy grants 'AssumeRole' permission to all services
        • IAM policy has allowed full administrative privileges for all resources
        • IAM policy has granted full permissions to resources
        • IAM policy is attached to user
        • IAM policy with full wildcard administrative privileges
        • KMS Key has a vulnerable policy
        • Kinesis is not encrypted with KMS
        • Lambda function has no tags
        • Lambda function without X-Ray tracing
        • Lambda permission principal contains a wildcard
        • Launch configurations do not have encrypted EBS volumes
        • Load Balancer has deletion protection disabled
        • Load balancer is using insecure TLS policy
        • MSK Cluster encryption at rest or in transit is disabled
        • Public facing ALB not protected by WAF
        • RDS cluster without backup plan
        • RDS has automatic minor upgrades disabled
        • RDS has been defined with public interface
        • RDS has been defined with public subnet
        • RDS has opened a large scope
        • RDS using default port
        • RDS with backup disabled
        • Redis version is not compliant with AWS PCI DSS
        • Remote Desktop Port is open to all internet
        • S3 Bucket ACL allows public read access
        • S3 Bucket CORS is allowed for all origins
        • S3 Bucket SSE disabled
        • S3 Bucket has Read access for all authenticated users
        • S3 Bucket has all actions allowed for any principal
        • S3 Bucket has allowed Delete Action from all principals
        • S3 Bucket has allowed Get Action from all principals
        • S3 Bucket has allowed List Action from all principals
        • S3 Bucket has allowed Put Action from all principals
        • S3 Bucket has allowed access for all principals
        • S3 Bucket has public Read access
        • S3 Bucket logging is not enabled
        • S3 Bucket without versioning
        • S3 Storage is not protected with SSE
        • S3 bucket has block public ACLs disabled
        • SES Policy allow actions for all principals
        • SNS Topic is publicly accessible
        • SQS Policy allow all actions
        • SQS Policy has dangerous access for all principals
        • SQS Queue is exposed
        • SQS without server side encryption
        • The CA certificate for the RDS is outdated
        • The CIDR IP has public interface
        • The CloudFront has a default SSL certificate
        • The CloudFront has an insecure protocol version
        • The connection between CloudFront and the origin server has HTTP allowed
        • The encryption for the EFS is without KMS
        • The log files in CloudTrail are not encrypted with KMS
        • The storage in the RDS is not encrypted
        • User data contains a base64 encoded private key
        • User data shell script is not encoded
        • Verify CloudFront Distribution Viewer Certificate is using TLS v1.2
      • Ansible
        • CosmosDB has no range ip filter configured
        • Do not create files without permissions control
        • Do not install the latest packages with package managers
        • Do not log passwords
        • Do not use deprecated modules
        • Do not use integers to octal file permissions in YAML
        • Do not use the latest checkout
        • Do not use the same owner and group to transfer files
      • Azure
        • A sensitive port for TCP or UDP protocols is open for the whole network
        • AKS monitoring logging is not enabled
        • Active Directory Administrator is not configured for SQL server
        • Active Directory account has predictable username as 'Admin' or 'Root'
        • App Service is not registered with an Azure Active Directory account
        • Application Gateway WAF has essential rules disabled
        • Azure App Service Web app authentication is Off
        • Azure App Service Web app does not redirect HTTP to HTTPS
        • Azure App Services FTP deployment is AllAllowed
        • Azure Data factory public network access enabled
        • Azure Kubernetes Cluster without RBAC enabled
        • Azure Kubernetes Service has no network policy configured
        • Azure Linux scale uses password authentication
        • Azure MariaDB database server with SSL connection disabled
        • Azure SQL Server threat detection alerts are not enabled for all threat types
        • Azure SQL server audit log retention is too low
        • Azure SQL server auditing is disabled
        • Azure VM data disk is encrypted with the default encryption key instead of ADE/CMK
        • Azure Virtual Network has no a Network Security Group
        • Azure WAF policy disabled or without Detection or Prevention modes
        • Azure application gateway does not have WAF enabled
        • Azure default network access for Storage Account is allowed
        • Azure front door does not have WAF enabled
        • Azure front door does not use WAF in Detection or Prevention modes
        • Azure function app authentication is off
        • Azure key vault is not recoverable
        • Azure linux instance with password authentication
        • CosmosDB without tags
        • Do not allow public access container or its blobs
        • Do not allow the admin user to login to the container registry
        • Do not put the storage account access as public
        • Ensure Azure MariaDB servers dont have public network access
        • Ensure Azure subscriptions with custom roles have minimum permissions
        • Ensure RDP Internet access is restricted
        • Ensure SSH Internet access is restricted
        • Ensure all keys have an expiration date
        • Ensure all secrets have an expiration date
        • Ensure public access level for Blob Containers is set to private
        • Ensure that 'Send Alerts To' is enabled for MSSQL servers
        • Ensure that Azure Defender is set to On Container Registries
        • Ensure that Azure Defender is set to On for App Services.
        • Ensure that Azure Defender is set to On for Kubernetes
        • Ensure that Azure Defender is set to On for Servers
        • Ensure that standard pricing tier is selected
        • Front Door WAF has essential rules disabled
        • Key vault key is not backed by HSM
        • Log profile is not capturing all activities
        • MSSQL servers do not have email service and co-administrators enabled
        • MySQL is not using the latest version of TLS encryption servers
        • No Network Security Group is attached to the Virtual Machine
        • Non SSL Redis Cache port is enabled
        • PostgreSQL checkpoint logging is not enabled
        • PostgreSQL connection throttling is not enabled
        • PostgreSQL connections logging is not enabled
        • PostgreSQL disconnections logging is not enabled
        • PostgreSQL duration logging is not enabled
        • PostgreSQL log retention is not enabled
        • Role definition has enabled custom role creation
        • Role-Based Access Control (RBAC) is disabled for AKS
        • SQL Server is not using the latest version of TLS encryption
        • SQL databases allow ingress from 0.0.0.0/0
        • SQL servers do not enable data security policy
        • SSL is disabled for MySQL
        • SSL is disabled for PostgresSQL
        • Secure transfer required is not enabled
        • Send email notification for high severity alerts is not enabled
        • Send email notification for high severity alerts to admins is not enabled
        • Storage account does not use the latest version of TLS encryption
        • Storage for critical data not encrypted with Customer Managed Key
        • The IP configuration allow a lot of IPs
        • The Key Vault is not soft delete
        • The SQL Server Admin account has predictable username as 'Admin' or 'Root'
        • The active log retention is lower than 365 days
        • The application gateway has no firewall configured
        • The configured minimum TLS version is not the latest version
        • The container register has no locks
        • The firewall rule allowing a lot of hosts to access
        • The firewall rule allowing unrestricted access to Redis
        • The storage account has http traffic allowed
        • The web application has http traffic allowed
        • Trusted Microsoft Services should be enabled for Storage Account access
        • UDP Internet access is not restricted
        • Unencrypted Data Lake Store accounts
        • Unrestricted access to SQL Server
        • Virtual Machine extensions are installed
        • Web App does not use the latest version of TLS encryption
      • Docker
        • Container runs as root
        • Healthcheck instructions have not been added to container image
        • SSH port exposed
        • Unpinned version for base image
      • GCP
        • BigQuery dataset is public accessible
        • Check if the Google compute firewall allows unrestricted RDP access
        • Cloud Storage Anonymous or Publicly Accessible
        • Cloud Storage Bucket should have versioning enabled
        • Cloud storage bucket should have logging enabled
        • Cluster Master Authentication Disabled
        • Compute instances must be launched with Shielded VM enabled
        • Compute instances shouldn’t be accessible from the Internet
        • DNSSEC Using RSASHA1
        • DNSSEC must be enabled for Cloud DNS
        • Defaults Kubernetes Engine Clusters should not be configured to use the default service account
        • GCP SQL Instance should not have insecure Cross DB Ownership Chaining On
        • Google Compute Engine VM instances should not enable serial ports
        • Google Compute Network should not use a firewall rule that allows all ports
        • Google Compute Network should not use a firewall rule that allows port range
        • Google Compute Network should not use default firewall rule
        • Google Compute SSL Policy Weak Chyper Suits is Enabled
        • Google Compute Subnetwork should have Private Google Access enabled
        • Google Firewall should not allow SSH access (port 22) from the Internet (public CIDR block)
        • Google Kubernetes Engine (GKE) Basic Authentication must be disabled
        • Instances must not be configured to use the Default Service Account that has full access to all Cloud APIs
        • Instances must not have IP forwarding enabled
        • KMS encryption keys should be rotated every 90 days or less
        • Kubernetes Clusters must be configured with labels
        • Kubernetes Clusters must be created with Alias IP ranges enabled
        • Kubernetes Clusters must be created with Client Certificate enabled
        • Kubernetes Clusters must be created with Private Clusters enabled
        • Kubernetes Engine Clusters must have Legacy Authorization set to disabled
        • Kubernetes Engine Clusters must have Network Policy enabled
        • Kubernetes Engine Clusters must have Stackdriver Logging enabled
        • Kubernetes Engine Clusters must have Stackdriver Monitoring enabled
        • Management Kubernetes nodes must have auto upgrades set to true
        • Master authorized networks must be enabled in GKE clusters
        • MySQL Instance With Local Infile On
        • PostgreSQL Misconfigured Logging Duration Flag
        • PostgreSQL database 'log_min_messages' flag isn’t set to a valid value
        • PostgreSQL database 'log_temp_files' flag isn’t set to '0'
        • PostgreSQL database instance should have a 'log_checkpoints' flag with its value set to 'on'
        • PostgreSQL database instance should have a 'log_connections' flag with its value set to 'on'
        • SQL DB Instance Publicly Accessible
        • SQL Instance Backup Disabled
        • SQL Instance With SSL Disabled
        • SQL Instance should not have Contained Database Authentication On
        • The node image should be Container-Optimized OS(COS)
        • VM Instance With Full Cloud Access
        • VM Instance should block project-wide SSH keys
        • VM disks for critical VMs must be encrypted with Customer-Supplied Encryption Keys (CSEK) or Customer-Managed Encryption Keys (CMEK)
        • VM instance should have OSLogin enabled
      • Github
        • Ensure GitHub Actions secrets are encrypted
      • Kubernetes
        • API server without certificate / private key
        • Anonymous authentication on Kubelet server is allowed
        • Apiserver allows weak cryptographic ciphers
        • Apiserver does not set TLS key and certificate
        • Authorization mode AlwaysAllow allows all requests
        • Authorization mode does not include node
        • Certificate Authority for apiserver not set
        • Certificate or Key file not set for etcd
        • Certificate or private key not set for peer authentication on etcd
        • Client certificate / key for apiserver not set
        • Container is privileged
        • Container runs with AllowPrivilegeEscalation
        • Controller Manager bound to non loop-back insecure address
        • Controller Manager has profiling active
        • Controller Manager with invalid --root-ca-file argument
        • Controller Manager without RotateKubeletServerCertificate set
        • Controller Manager without individual service account credentials
        • Docker daemon socket exposed to containers
        • Encryption providers are not properly configured
        • Etcd uses self-signed certificates
        • Excessive CertificateSigningRequests approval permission
        • Excessive RoleBindings / ClusterRoleBindings permissions
        • Excessive permissions to escalate roles
        • Excessive wildcard permissions
        • Excessive write permissions over admission webhook
        • Explicit request-timeout not set
        • Garbage collector on pod termination is not active
        • HTTPS not enabled between apiserver and kubelets
        • Highly privileged CAP_SYS_ADMIN granted
        • Host network namespace sharing is allowed
        • Host process ID namespace sharing is allowed
        • IPC namespace sharing is allowed
        • Insecure bind address
        • Insecure bind port
        • Kubelet client certificate rotation is disabled
        • No Certificate Authority file set for etcd
        • No client authentication on etcd service
        • No client certificate for peer authentication in etcd
        • No service account public key file
        • Persistent audit log not enabled
        • Scheduler service bound to loop-back insecure address
        • Service account lookup not set
        • The admission control plugin AlwaysAdmit is set
        • The admission control plugin AlwaysPullImages is not set
        • The admission control plugin NodeRestriction is not set
    • Code Tampering Detection
      • CI/ CD
        • Build File Modification
        • Workflow File Modification
      • Configuration
        • CODEOWNERS File Modification
        • Configuration File Modification
        • Env File Modification
        • Shell Script Modification
      • Custom Critical File
        • Custom Critical File Modification
      • Descriptor
        • Dependency Descriptor File Modification
      • IaC Template
        • IaC File Modification
      • Policy
        • Security Policy File Modification
      • Security Tool Configuration
        • Modification of Security Tool Configuration
    • Code Security - Malware
      • Execution
        • Decoded Code Execution
        • Decrypted Code Execution
        • Downloaded Code Execution
        • Malicious Command Execution
        • Obfuscated Code Execution
        • Silent execution
        • System Registry Code Execution
        • Unusual File Execution
      • File
        • Masquerade File Type
      • Network
        • Suspicious Blockchain Payload
        • Suspicious Request
        • Suspicious URL
      • Package
        • Malicious Installation Scripts
      • Registry
        • System Registry Tampering
      • Sensitive Data
        • Browser Sensitive Data Enumeration
        • Sensitive Data Enumeration
        • Sensitive Data Exfiltration
        • Sensitive File Exfiltration
        • Sensitive File encryption
      • System
        • Bidirectional Characters
        • Clipboard Hijacker
        • Execution Policy Bypass
        • Impair Defenses: Disabled Tools
        • Invisible Characters
        • Obfuscated Code
        • Process Termination
        • Suspicious Scheduled system service
        • Virtualization Sandbox Evasion
    • AI Security
      • LLM01 — Prompt Injection
        • Indirect-injection sink without input guardrail
        • Multimodal input without sanitization
        • Obfuscation-class signature in prompt body
        • Registry prompt pinned to a mutable label
        • Skill / agent instruction surface (semantic-review candidate)
        • System prompt concatenates unbounded user content
        • Tool-invoking agent without input guardrail
      • LLM03 — Supply Chain
        • Skill name typosquatting
    • Code Security - Vulnerabilities
      • C / C++
        • Access Control
          • Null ACL in SetSecurityDescriptorDacl may allow all access
          • Too-permissive umask values
        • Buffer Overflow
          • Direct write into stack buffer may cause stack-based buffer overflow
          • Incorrect use of sizeof() on a malloc’ed pointer type
          • Incorrect use of strncat() may lead to buffer overflow
          • Incorrect use of strncpy/stpncpy/strlcpy with wrong buffer size
          • Missing null termination after strncpy/stpncpy
          • Off-by-one error in buffer size calculation
          • Pointer subtraction between unrelated memory objects
          • Unsafe use of snprintf/vsnprintf return value may cause buffer overflow
          • Unsafe use of strlcpy/strlcat return value may cause buffer overflow
          • Use of insecure gets() function with no bounds checking
          • Use of insecure scanf-family functions prone to buffer overflow
          • Use of insecure sprintf/vsprintf functions prone to buffer overflow
          • Use of insecure unbounded string copy/concatenation functions
        • Command Injection
          • Command injection via exec functions
          • Possible executable path hijacking
        • Cryptography
          • Insecure cipher algorithm
          • Insecure hashing algorithm
          • Usage of insufficient random number generator
          • Use of insecure rand/srand PRNG not suitable for security contexts
          • Use of weak or non-cryptographic hash algorithm in security context
        • Denial Of Service
          • Regular expression with inefficient worst-case complexity (ReDoS)
        • Format String
          • Format string vulnerability from externally controlled format argument
        • Integer Overflow
          • Integer overflow from unsafe use of strlen() in arithmetic
          • Integer overflow or wraparound in arithmetic calculation
          • Integer truncation from casting to a smaller primitive type
          • Meaningless comparison of unsigned variable against negative value
          • Unsafe signed-to-unsigned or unsigned-to-signed integer conversion
        • Memory Management
          • Calling free() on memory not allocated by malloc/calloc/realloc
          • Double free of previously deallocated memory
          • Exposure of memory addresses that may defeat ASLR
          • Function returns the address of a stack-allocated variable
          • Mismatched C++ memory allocation and deallocation functions
          • Mismatched memory allocation and deallocation functions
          • Unchecked return value of malloc/calloc/realloc
          • Use of insecure alloca() with no guarantee of valid memory allocation
          • Use of previously freed memory
          • Use of putenv() with a pointer to a stack variable
        • Miscellaneous
          • Access to attacker-controlled command-line arguments or environment variables
          • Assert used as the only validation for untrusted input
          • Call to a potentially insecure function that should be reviewed
          • Common typo patterns that change application logic
          • High-entropy string assignment that may contain a hardcoded secret
          • Incorrect argument order in memset() call
          • Missing break statement in switch case causing fall-through
          • Missing default case in switch statement
          • Missing return statement in non-void function
          • Overlapping source and destination in sprintf/snprintf
          • Unchecked return value of scanf-family functions
          • Uncontrolled search path element
          • Usage of deprecated function (getlogin)
          • Use of atoi/atol/atof with no error handling or overflow checking
          • Use of obsolete function (getpass)
        • Privilege Management
          • Incorrect order of setuid/setgid calls may allow privilege escalation
          • Return values not checked when attempting to drop privileges
          • Unchecked return value of setuid/seteuid may leave elevated privileges
        • Race Condition
          • Incorrect order of setuid/setgid calls may allow privilege escalation
          • Insecure use of vfork function
          • Time-of-check time-of-use (TOCTOU) race condition in file operations
          • Unchecked return value of setuid/seteuid may leave elevated privileges
          • Use of deprecated signal() API instead of sigaction()
        • Resource Availability
          • Missing error check on read() susceptible to file descriptor exhaustion
        • Temp File
          • Insecure temporary file creation
      • CSharp
        • Access Control
          • .Net access restriction subverted (Reflection)
          • Anonymous LDAP Bind
        • Api
          • Dangerous API
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery ('CSRF')
          • Insufficient Session Expiration
          • JWT Missing Claim Validation
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • Crypto Agility (Hardcoded Algorithm Selection)
          • JWT Signature Verification Bypass
          • PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)
          • PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)
          • Weak Encryption Algorithm
          • Weak Encryption Mode of Operation
          • Weak Hash Algorithm
          • Weak Password Hash
        • Information Leak
          • Hardcoded Credentials
          • Information Exposure Through Error Message
          • Information Exposure Through Query String
          • Insecure Transport
          • Observable Timing Discrepancy
          • Password In Redirect
          • Plaintext Storage In Cookie
          • Trust Boundary Violation
        • Injection
          • Code Injection During Deserialization
          • Cookie Poisoning
          • Cross Site Scripting ('XSS')
          • Dynamic code injection in scripting API
          • HTTP Parameter Pollution
          • HTTP Splitting
          • Improper neutralization of data within XPath expressions ('XPath Injection')
          • Improper neutralization of special elements used in a command ('Command Injection')
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • NoSQL Injection
          • Open Redirect
          • Process Control
          • Regex Injection
          • SQL Injection ('SQLi')
          • Unsafe Reflection
          • XAML Injection
          • XML Entity Injection
          • XML Injection
        • Memory Access
          • Buffer Overflow
        • Misconfiguration
          • ASP.Net Custom Errors Disabled
          • ASP.Net Unsafe Authentication Forms
          • ASP.Net Unsafe Cookies Configuration
          • Cross-site scripting protection disabled
          • Debug Features Enabled
          • Insecure SSL
          • Request Validation Disabled
          • SameSite None Without Secure
          • Too-broad CORS Policy
          • Unsafe Cookie
          • User Controlled Primary Key
          • ViewState MAC Disabled
        • Path Resolution
          • Dangerous File Upload
          • Path Traversal
          • Zip Slip
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
          • Insufficient Key Size
          • Non Random IV With CBC Mode
        • Privilege
          • P/Invoke declarations should not be safe critical
        • Resource Management
          • Connection String Parameter Pollution
          • Regular expression Denial of Service ('ReDoS')
        • Risky Values
          • Dangerous Hostname Check
        • UI
          • Clickjacking Protection Weakened
      • Go
        • Access Control
          • Anonymous LDAP Bind
          • Insecure File Permissions
          • Socket Binding To All Interfaces
        • Api
          • Avoid Native Calls
          • Dangerous API
          • Insecure Temporary File
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery (CSRF)
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • Crypto Agility (Hardcoded Algorithm Selection)
          • JWT Signature Verification Bypass
          • PQC Hybrid (Bare Post-Quantum Algorithm Without a Classical Partner)
          • PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)
          • PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)
          • Use of a broken or risky cryptographic algorithm
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak cryptographic initialization vector
          • Weak Hash Algorithm
          • Weak Password Hash
        • Entry Points
          • Profiling Endpoint Exposed
        • Information Leak
          • Hardcoded Credentials
          • Information Exposure Through Debug Log
          • Information Exposure Through Error Message
          • Information Exposure Through External Request
          • Information Exposure Through Query String
          • Insecure Authentication
          • Insecure Transport
          • JSONP Hijacking
          • Observable Timing Discrepancy
          • Password In Redirect
          • Plaintext Storage In Cookie
          • Plaintext Storage Of Password
          • Serializable Class Containing Sensitive Data
          • Server Insecure Transport
          • Trust Boundary Violation
        • Injection
          • Code Injection
          • Cookie Poisoning
          • Format String Injection
          • HTTP Parameter Pollution
          • HTTP Splitting
          • Improper neutralization of data within XPath expressions ('XPath Injection')
          • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
          • JSON Injection
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • NoSQL Injection
          • OS Command Injection
          • Regex Injection
          • Resource Injection
          • SQL Injection
          • Server-side Template Injection
          • Sleep Injection
          • URL Redirection to Untrusted Site ('Open Redirect')
          • Unsafe Reflection
          • XML Injection
        • Misconfiguration
          • Insecure SSL
          • Insecure SSL Version
          • Missing SSH host key verification
          • SameSite None Without Secure
          • Too Broad Cors Policy
          • Unsafe Cookie
          • Unsafe Session Configuration
          • User Controlled Primary Key
        • Other
          • Execution After Redirect ('EAR')
        • Path Resolution
          • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
          • Zip Slip
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
          • Insufficient Key Size
        • Resource Management
          • Connection String Parameter Pollution
          • DoS Decompression Bomb
          • Slowloris Attack
        • Risky Values
          • Error unhandled
          • Integer Overflow or Wraparound
      • Html
        • Access Control
          • Hidden Sensitive Fields
          • Insecure Iframe Configuration
          • Missing Frame Ancestors Protection
          • Missing Resource Integrity
          • Missing Tabnabbing Protection
          • Unsafe Content Security Policy
        • Authentication
          • Forms Without CSRF Protection
        • Information Leak
          • Autocomplete Enabled for Sensitive Fields
          • Insecure Authentication via HTTP GET
          • Insecure Meta Tags
          • Insecure Resource
          • Unmasked Password Fields
        • Injection
          • Inline JavaScript Event Handler
          • Input Fields Without Validation Attributes
          • JavaScript Protocol Urls
      • Java
        • Access Control
          • Android Missing Receiver Permission
          • Android Sticky Broadcast
          • Android Unrestricted Broadcast
          • Android Webview JavaScript Enabled
          • Android Webview JavaScript Interface Annotation
          • Android World Writeable Readable File Permission
          • Anonymous LDAP Bind
          • Database Access Control
          • Implicitly Exported Android Component
          • Intent Forwarding
          • Privilege Escalation Vulnerability
          • Too Broad App Permissions
        • Api
          • Avoid Direct Database Connection
          • Avoid Explicit Socket
          • Avoid Explicit Thread Management
          • Avoid JVM Exit
          • Avoid Native Calls
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery ('CSRF')
          • Insufficient Session Expiration
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • Crypto Agility (Hardcoded Algorithm Selection)
          • JWT Signature Verification Bypass
          • PQC Hybrid (Bare Post-Quantum Algorithm Without a Classical Partner)
          • PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)
          • PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak cryptographic initialization vector
          • Weak Encryption Algorithm
          • Weak Hash Algorithm
          • Weak Password Hash
        • Entry Points
          • Android Debugging Enabled
          • Android Webview Debugging Enabled
          • Avoid Leftover Debug Code
        • Exception Management
          • Unhandled SSL Exception
        • Information Leak
          • Android Application Backup Allowed
          • Android Screenshot Allowed
          • Android Sensitive Keyboard Cache
          • Android Webview Content Access Enabled
          • Android Webview File Access Enabled
          • Hardcoded Credentials
          • Information Exposure Through Debug Log
          • Information Exposure Through Error Message
          • Information Exposure Through External Request
          • Information Exposure Through Query String
          • Insecure Authentication
          • Insecure Transport
          • Observable Timing Discrepancy
          • Password In Redirect
          • Plaintext Storage In Cookie
          • Plaintext Storage Of Password
          • SMS Monitoring
          • Serializable Class Containing Sensitive Data
          • Trust Boundary Violation
        • Injection
          • Android Fragment Injection
          • Android URI Permission Manipulation
          • Code Injection
          • Code Injection During Deserialization
          • Cookie Poisoning
          • Cross Site History Manipulation ('XSHM')
          • Cross Site Scripting ('XSS')
          • External Control Of Configuration Setting
          • Format String Injection
          • HTTP Parameter Pollution
          • HTTP Splitting
          • Improper Validation Of Array Index
          • JSON Injection
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • NoSQL Injection
          • OS Command Injection
          • Open Redirect
          • Process Control
          • Reflected File Download
          • Regex Injection
          • Resource Injection
          • SQL Injection ('SQLi')
          • Same Origin Method Execution ('SOME')
          • Security Check In Overridable Method
          • Sleep Injection
          • Third-Party Package Context Code Execution
          • Unchecked Input In Loop Condition
          • Unsafe Reflection
          • View Manipulation
          • XML Entity Injection
          • XML Injection
          • XPath Injection
        • Misconfiguration
          • Cross-site scripting protection disabled
          • Insecure SSL
          • Insecure Transport Configuration
          • Missing Certificate Pinning
          • SameSite None Without Secure
          • Spring Security Debug Enabled
          • Spring XSS Protection Disabled
          • Too Broad Cors Policy
          • Unprotected Storage of Credentials
          • Unrestricted Request Mapping
          • Unsafe Cookie
          • User Controlled Primary Key
          • Web.xml security misconfigurations
        • Other
          • Dangerous API
          • Execution After Redirect ('EAR')
        • Path Resolution
          • Input Path Not Canonicalized
          • Input Path Not Normalized
          • Path Traversal
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
          • Insufficient Key Size
          • Non Random IV With CBC Mode
        • Resource Management
          • Connection String Parameter Pollution
          • Potential Infinite Loop
          • Regular expression Denial of Service ('ReDoS')
        • Risky Values
          • Avoid Non Serializable Objects Stored
          • Dangerous Hostname Check
        • Synchronization
          • Race Condition Format
          • Race Condition Matcher
          • Race Condition Servlet
          • Static Database Connection
      • JavaScript / TypeScript
        • Authentication
          • Cross Site Request Forgery (CSRF)
          • Improper Certificate Validation
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • Crypto Agility (Hardcoded Algorithm Selection)
          • Insufficient Cryptographic Key Length
          • JWT Signature Verification Bypass
          • PQC Hybrid (Bare Post-Quantum Algorithm Without a Classical Partner)
          • PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)
          • PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)
          • Use of a broken or risky cryptographic algorithm
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak password hashing
          • Weak Hash Algorithm
        • Information Leak
          • Hardcoded Credentials
          • Information Exposure Through Error Message
          • Information Exposure Through Query String
          • Insecure Transport
          • Plaintext Storage In Cookie
          • Sensitive data in HTML5 Web Storage
          • Server Insecure Transport
          • Too Broad Message Posting
        • Injection
          • Angular Cross Site Scripting
          • Client-side Template Injection
          • Code Injection
          • Code injection during object deserialization
          • Code injection with javascript: URL in JSX
          • Cookie Poisoning
          • HTML escape disabled in Vue component
          • Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
          • Improper neutralization of XML entities ('Xml Entity Injection')
          • Improper neutralization of data within XPath expressions ('XPath Injection')
          • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
          • NoSQL Injection
          • OS Command Injection
          • Regex Injection
          • Resource Injection
          • SQL Injection
          • Server-side Template Injection
          • URL Redirection to Untrusted Site ('Open Redirect')
          • Unsafe JQuery Plugin
        • Misconfiguration
          • CORS Policy is too broad
          • Cross-site scripting protection disabled
          • HTTP Strict Transport Security (HSTS) not set
          • Insecure SSL
          • Prevent MIME Sniffing
          • SameSite None Without Secure
          • Strict Contextual Escaping (SCE) disabled
          • Unsafe Cookie
          • X-Powered-By header must be disabled
        • Path Resolution
          • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
          • Zip Slip
        • Predictability
          • Hardcoded Cryptographic Key
          • Insecure Randomness
        • Resource Management
          • Allocation Of Resources Without Limits
          • Potential loop with unreachable exit condition ('Infinite Loop')
          • Regular Expression DoS
        • Risky Values
          • Do not use eval()
          • React dangerouslySetInnerHTML should not be used
          • ReactDOM.findDOMNode() should not be used
          • SolidJS innerHTML should not be used without sanitization
        • UI
          • No clickjacking protection configured
      • Kotlin
        • Access Control
          • Android Missing Receiver Permission
          • Android Sticky Broadcast
          • Android Unrestricted Broadcast
          • Android Webview JavaScript Enabled
          • Android Webview JavaScript Interface Annotation
          • Android World Writeable Readable File Permission
          • Anonymous LDAP Bind
          • Implicitly Exported Android Component
          • Intent Forwarding
          • Privilege Escalation Vulnerability
          • Too Broad App Permissions
        • Api
          • Avoid Native Calls
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery ('CSRF')
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • Crypto Agility (Hardcoded Algorithm Selection)
          • JWT Signature Verification Bypass
          • PQC Hybrid (Bare Post-Quantum Algorithm Without a Classical Partner)
          • PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)
          • PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak cryptographic initialization vector
          • Weak Encryption Algorithm
          • Weak Hash Algorithm
          • Weak Password Hash
        • Entry Points
          • Android Debugging Enabled
          • Android Webview Debugging Enabled
        • Exception Management
          • Unhandled SSL Exception
        • Information Leak
          • Android Application Backup Allowed
          • Android Screenshot Allowed
          • Android Sensitive Keyboard Cache
          • Android Webview Content Access Enabled
          • Android Webview File Access Enabled
          • Hardcoded Credentials
          • Information Exposure Through Debug Log
          • Information Exposure Through Error Message
          • Information Exposure Through External Request
          • Information Exposure Through Query String
          • Insecure Authentication
          • Insecure Transport
          • Observable Timing Discrepancy
          • Password In Redirect
          • Plaintext Storage In Cookie
          • Plaintext Storage Of Password
          • SMS Monitoring
          • Serializable Class Containing Sensitive Data
          • Trust Boundary Violation
        • Injection
          • Android Fragment Injection
          • Android URI Permission Manipulation
          • Code Injection
          • Code Injection During Deserialization
          • Cookie Poisoning
          • Cross Site Scripting ('XSS')
          • Format String Injection
          • HTTP Parameter Pollution
          • HTTP Splitting
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • NoSQL Injection
          • OS Command Injection
          • Open Redirect
          • Process Control
          • Reflected File Download
          • Regex Injection
          • Resource Injection
          • SQL Injection ('SQLi')
          • Same Origin Method Execution ('SOME')
          • Sleep Injection
          • Third-Party Package Context Code Execution
          • Unsafe Reflection
          • View Manipulation
          • XML Entity Injection
          • XPath Injection
        • Misconfiguration
          • Cross-site scripting protection disabled
          • Insecure SSL
          • Insecure Transport Configuration
          • Missing Certificate Pinning
          • SameSite None Without Secure
          • Spring XSS Protection Disabled
          • Too Broad Cors Policy
          • Unprotected Storage of Credentials
          • Unrestricted Request Mapping
          • Unsafe Cookie
          • User Controlled Primary Key
        • Other
          • Dangerous API
        • Path Resolution
          • Path Traversal
          • Zip Slip
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
          • Insufficient Key Size
        • Resource Management
          • Connection String Parameter Pollution
          • Regular expression Denial of Service ('ReDoS')
      • Objective-C
        • Auth
          • Biometric authentication should be hardware and keychain backed.
        • Code
          • The App may contain banned API(s). These API(s) are insecure and must not be used.
        • Cryptography
          • SHA1 is a weak hash known to have hash collisions.
          • The App uses ECB mode in Cryptographic encryption algorithm.
          • Weak Hash algorithm used.
        • Network
          • App allows self signed or invalid SSL certificates. App is vulnerable to MITM attacks.
          • UIWebView in App ignore SSL errors and accept any SSL Certificate.
        • Platform
          • User input in "loadHTMLString" will result in JavaScript Injection.
        • Storage
          • Hardcoded sensitive information.
          • The App logs information. Sensitive information should never be logged.
          • The file has no special protections associated with it.
      • Php
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery (CSRF)
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • Crypto Agility (Hardcoded Algorithm Selection)
          • PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)
          • PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)
          • Use of a broken or risky cryptographic algorithm
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak cryptographic initialization vector
          • Weak Hash Algorithm
          • Weak Password Hash
        • Information Leak
          • Hardcoded Credentials
          • Information Exposure Through Debug Log
          • Information Exposure Through Error Message
          • Information Exposure Through Query String
          • Insecure Transport
          • Password In Redirect
          • Trust Boundary Violation
          • Twig No Use Debug
        • Injection
          • Code Injection
          • Code injection during object deserialization
          • External Variable Modification
          • Format String Injection
          • HTTP Parameter Pollution
          • Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
          • Improper neutralization of XML entities ('Xml Entity Injection')
          • Improper neutralization of data within XPath expressions ('XPath Injection')
          • Improper neutralization of external input used within a CSV or Excel formula ('Formula Injection')
          • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • Mail Content Injection
          • Mail Header Manipulation
          • NoSQL Injection
          • OS Command Injection
          • Regex Injection
          • Resource Injection
          • SQL Injection
          • Sleep Injection
          • URL Redirection to Untrusted Site ('Open Redirect')
        • Misconfiguration
          • CakePHP Unsafe Configuration
          • CakePHP Unsafe Session Configuration
          • CodeIgniter Unsafe Session Configuration
          • Laravel Unsafe Session Configuration
          • SameSite None Without Secure
          • Too Broad Cors Policy
          • Twig XSS protection disabled
          • Unsafe Configuration
          • Unsafe Cookie
          • Unsafe Session Configuration
          • User Controlled Primary Key
          • Zend/ Laminas Unsafe Session Configuration
        • Other
          • Execution After Redirect ('EAR')
        • Path Resolution
          • Dangerous File Upload
          • Improper Control of filename for include / require statement ('Include File Injection')
          • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
        • Resource Management
          • Connection String Parameter Pollution
          • Regular Expression DoS
        • Risky Values
          • Do not use $_REQUEST
          • Do not use eval()
          • Symfony No Use Default Secret
      • Python
        • Access Control
          • Anonymous LDAP Bind
          • Django Missing Permissions Check
          • Insecure File Permissions
          • Socket Binding To All Interfaces
        • Api
          • Insecure Temporary File
        • Authentication
          • Cookies In Security Decision
          • Cross Site Request Forgery (CSRF)
          • JWT Missing Claim Validation
        • Channel
          • Server Side Request Forgery ('SSRF')
        • Cryptography
          • Crypto Agility (Hardcoded Algorithm Selection)
          • JWT Signature Verification Bypass
          • PQC Hybrid (Bare Post-Quantum Algorithm Without a Classical Partner)
          • PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)
          • PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)
          • Use of a broken or risky cryptographic algorithm
          • Use of a broken or risky cryptographic mode of operation
          • Use of a weak cryptographic initialization vector
          • Weak Hash Algorithm
          • Weak Password Hash
        • Information Leak
          • Hardcoded Credentials
          • Information Exposure Through Debug Log
          • Information Exposure Through Error Message
          • Information Exposure Through External Request
          • Information Exposure Through Query String
          • Insecure Authentication
          • Insecure Transport
          • Observable Timing Discrepancy
          • Password In Redirect
          • Plaintext Storage In Cookie
          • Server Insecure Transport
          • Trust Boundary Violation
        • Injection
          • Code Injection
          • Code injection during object deserialization
          • Cookie Poisoning
          • HTTP Parameter Pollution
          • HTTP Splitting
          • Improper neutralization of XML entities ('Xml Entity Injection')
          • Improper neutralization of data within XPath expressions ('XPath Injection')
          • Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')
          • JSON Injection
          • LDAP Injection
          • Log Forging
          • Mail Command Injection
          • NoSQL Injection
          • OS Command Injection
          • Regex Injection
          • Resource Injection
          • SQL Injection
          • Server-side Template Injection
          • Sleep Injection
          • URL Redirection to Untrusted Site ('Open Redirect')
          • Unsafe Cookie
          • Unsafe Reflection
        • Misconfiguration
          • Django Unsafe Configuration
          • Django Unsafe Session Configuration
          • Django XSS Protection Disabled
          • Flask Unsafe Configuration
          • Flask XSS Protection Disabled
          • Improper Request Certificate Verification
          • Insecure Parser
          • Insecure SSL Version
          • Jinja XSS Protection Disabled
          • Mako XSS Protection Disabled
          • Missing Resource Integrity Check
          • Missing SSH Host Key Verification
          • SameSite None Without Secure
          • Template XSS Protection Disabled
          • Too Broad Cors Policy
          • Unsafe Cookie
          • Unsafe Logging Configuration
          • User Controlled Primary Key
        • Other
          • Execution After Redirect ('EAR')
        • Path Resolution
          • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
          • Zip Slip
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Insecure Randomness
          • Insufficient Key Size
        • Resource Management
          • Connection String Parameter Pollution
          • External Request DoS
          • Regular Expression DoS
        • Risky Values
          • Django Password Requirements Not Enforced
          • Do not use assert
          • Do not use compile()
          • Do not use eval()
      • Ruby
        • Attribute Restriction
          • Attribute Restriction
        • Authentication
          • Authentication
        • Basic Auth
          • Basic Auth
        • Command Injection
          • Command Injection
        • Cross-Site Request Forgery
          • Cross-Site Request Forgery: Missing protect_from_forgery
          • Cross-Site Request Forgery: Skipping CSRF or authentication checks by default
          • Cross-Site Request Forgery: Versions with CSRF token forgery vulnerability
        • Cross-Site Scripting
          • Cross-Site Scripting: HTML escaping is disabled for JSON output
          • Cross-Site Scripting: I18n XSS (CVE-2013-4491)
          • Cross-Site Scripting: Missing JSON encoding (CVE-2015-3226)
          • Cross-Site Scripting: Number helpers XSS vulnerabilities in certain versions
          • Cross-Site Scripting: Rails versions with SafeBuffer bug
          • Cross-Site Scripting: Strip_tags vulnerabilities
          • Cross-Site Scripting: Unescaped output in views
          • Cross-Site Scripting: Unsafe uses of select() helper
          • Cross-Site Scripting: Unsafe uses of select_tag() in some versions of Rails 3.x
          • Cross-Site Scripting: Unsanitized href Values
          • Cross-Site Scripting: Versions before 2.3.14 which have a vulnerable escape method
          • Cross-Site Scripting: Versions which do not escape single quotes (CVE-2012-3464)
          • Cross-Site Scripting: Versions with vulnerable sanitize and sanitize_css
          • Cross-Site Scripting: Vunerable uses of sanitize (CVE-2022-32209)
          • Cross-Site Scripting: XSS in Render Calls
          • Cross-Site Scripting: XSS in calls to content_tag
          • Cross-Site Scripting: XSS in link_to in versions before 3.0
          • Cross-Site Scripting: XSS vulnerability in translate helper
          • Cross-Site Scripting: simple_format XSS (CVE-2013-6416)
        • Dangerous Eval
          • Dangerous Eval
        • Dangerous Send
          • Dangerous Send
        • Default Routes
          • Default Routes: Filter Skipping (Rails 3.0-3.0.9)
          • Default Routes: General Warning
        • Denial Of Service
          • Denial of Service: Digest authentication DoS vulnerability
          • Denial of Service: Header DoS (CVE-2013-6414)
          • Denial of Service: Mime type denial of service (CVE-2016-0751)
          • Denial of Service: Route DoS (CVE-2015-7581)
          • Denial of Service: Searches regexes including user input
          • Denial of Service: Symbol DoS
          • Denial of Service: Versions with ActiveRecord symbol denial of service
          • Denial of Service: XML denial of service (CVE-2015-3227)
          • Denial of Service: render :text DoS (CVE-2014-0082)
        • Directory Traversal
          • Directory Traversal
        • Divide By Zero
          • Divide by Zero
        • Dynamic Render Path
          • Dynamic Render Path
        • File Access
          • File Access: Possible file access using user input
          • File Access: Versions with JRuby XML parsing backend
          • File Access: Versions with file existence disclosure vulnerability
        • Format Validation
          • Format Validation
        • HTTP Verb Confusion
          • HTTP Verb Confusion
        • Information Disclosure
          • Information Disclosure
        • Mail Link
          • Mail Link
        • Mass Assignment
          • Mass Assignment: Dangerous attr_accessible Attributes
          • Mass Assignment: General Mass Assignment
          • Mass Assignment: Mass assignment using without_protection
          • Mass Assignment: Potentially dangerous attributes allowed via permit
          • Mass Assignment: Strong params bypass in CVE-2014-3514
        • Missing Authorization
          • Missing Authorization
        • Missing Encryption
          • Missing Encryption
        • Nested Attributes
          • Nested Attributes: Nested attributes vulnerability (CVE-2015-7577)
          • Nested Attributes: Nested attributes vulnerability in Rails 2.3.9 and 3.0.0
        • Path Traversal
          • Path Traversal: CVE-2018-3760
          • Path Traversal: Unexpected Pathname behavior
        • Redirect
          • Redirect
        • Remote Code Execution
          • Remote Code Execution: JSON parsing vulnerabilities CVE-2013-0333 and CVE-2013-0269
          • Remote Code Execution: Render that might be vulnerable to CVE-2016-0752
          • Remote Code Execution: Unsafe deserialization of objects
          • Remote Code Execution: Unsafe reflection
          • Remote Code Execution: Unsafe reflection to access methods
          • Remote Code Execution: Use of Marshal for cookie serialization
          • Remote Code Execution: Uses of serialize in versions vulnerable to CVE-2013-0277
          • Remote Code Execution: YAML parsing vulnerabilities (CVE-2013-0156)
        • Response Splitting
          • Response Splitting
        • Reverse Tabnabbing
          • Reverse Tabnabbing
        • SQL Injection
          • SQL Injection: General SQL Injection
          • SQL Injection: Quote_table_name vulnerability in versions before 2.3.14
          • SQL Injection: Several SQL CVEs
          • SQL Injection: Unsafe find_by_* Usage
        • SSL Verification Bypass
          • SSL Verification Bypass
        • Security
          • EOLRails
          • EOLRuby
          • Send File
        • Session Manipulation
          • Session Manipulation
        • Session Setting
          • Session Setting
        • Template Injection
          • Template Injection
        • Timing Attack
          • Timing Attack
        • Unscoped Find
          • Unscoped Find
        • Weak Cryptography
          • Weak Cryptography
        • Weak Hash
          • Weak Hash
      • Rust
        • Command Injection
          • Command injection via user-controlled input
        • Cryptography
          • Use of non-cryptographic random number generator in security context
          • Use of weak or non-cryptographic hash algorithm in security context
        • Tls
          • TLS/SSL certificate verification disabled
        • Unsafe Code
          • Unsafe block usage requires manual audit
        • Untrusted Input
          • Untrusted input used in security decision
      • Scala
        • Cookie
          • Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
          • Information Exposure Through Persistent Cookies
          • Sensitive Cookie Without 'HttpOnly' Flag
          • Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
          • Trust Boundary Violation
        • Cors
          • Permissive Cross-domain Policy with Untrusted Domains
        • Cryptography
          • Improper Certificate Validation
          • Inadequate Encryption Strength
          • Inadequate encryption strength
          • Incorrect Behavior Order
          • Missing Support for Integrity Check
          • Use of RSA Algorithm without OAEP
          • Use of a Broken or Risky Cryptographic Algorithm
        • Endpoint
          • Cleartext transmission of sensitive information
          • Improper Certificate Validation
          • URL Redirection to Untrusted Site ('Open Redirect')
          • Use of less trusted source
        • File
          • Improper limitation of a pathname to a restricted directory ('Path Traversal')
        • Form
          • Improper validation of unsafe equivalence in input
        • Inject
          • Expression injection (OGNL)
          • External Control of System or Configuration Setting
          • Files or Directories Accessible to External Parties
          • Improper Control of Generation of Code ('Code Injection')
          • Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
          • Improper Neutralization of CRLF Sequences ('CRLF Injection')
          • Improper Neutralization of Special Elements in Data Query Logic
          • Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
          • Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
          • Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
          • Improper limitation of a pathname to a restricted directory ('Path Traversal')
        • Ldap
          • Improperly implemented security check for standard
        • Password
          • Use of Hard-coded Password
        • Perm
          • Incorrect Permission Assignment for Critical Resource
          • Insecure inherited permissions
        • Script
          • Improper Control of Generation of Code ('Code Injection')
        • Smtp
          • Improper Neutralization of Special Elements used in a Command
          • Improper Validation of Certificate with Host Mismatch
        • Ssrf
          • Server-Side Request Forgery (SSRF)
        • Strings
          • Collapse of data into unsafe value
          • Improper Handling of Unicode Encoding
          • Incorrect Type Conversion or Cast
          • Use of Externally-Controlled Format String
        • Templateinjection
          • Improper Control of Generation of Code ('Code Injection')
        • Unsafe
          • Exposure of sensitive system information to an unauthorized control sphere
          • External Control of System or Configuration Setting
          • Information Exposure Through an Error Message
        • Xml
          • Deserialization of Untrusted Data
          • Weak authentication
          • XML injection (aka Blind XPath injection)
        • Xpathi
          • Improper Restriction of XML External Entity Reference ('XXE')
        • Xss
          • Improper Neutralization of Input During Web Page Generation
          • Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
        • Xxe
          • Improper Restriction of XML External Entity Reference ('XXE')
      • Swift
        • Api
          • Avoid Native Calls
          • Insecure Temporary File
        • Authentication
          • Weak Biometric Access Control Flags
          • Weak Biometric Authentication
          • Weak Keychain ACL (Device Passcode)
        • Cryptography
          • Crypto Agility (Hardcoded Algorithm Selection)
          • JWT Signature Verification Bypass
          • PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)
          • PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)
          • Weak Encryption Algorithm
          • Weak Encryption Mode of Operation
          • Weak Hash Algorithm
          • Weak Password Hash
        • Incorrect Validation
          • Improper input validation using regular expressions without anchors
          • Unsafe HTML filtering using regular expressions
        • Information Leak
          • ATS Allows Arbitrary Loads For Media
          • ATS Allows Arbitrary Loads In Web Content
          • ATS Exception Insecure HTTP Loads
          • ATS Exception Low TLS Version
          • ATS Exception No Forward Secrecy
          • Cleartext Transmission of Sensitive Information
          • Cleartext storage of sensitive information in an application preference store
          • File Sharing Enabled
          • General Pasteboard Access
          • Hardcoded Credentials
          • Insecure Transport
          • Sensitive Information Logging
          • Unprotected File Storage
          • Weak Keychain Accessibility
        • Injection
          • Code Injection During Deserialization
          • Command Injection
          • Cookie Poisoning
          • Cross Site Scripting ('XSS')
          • Externally Controlled Format String
          • HTTP Response Splitting
          • JavaScript injection in a web view
          • NoSQL Injection
          • Open Redirect
          • Predicate Injection
          • Regex Injection
          • SQL Injection ('SQLi')
          • Server-Side Request Forgery (SSRF)
          • Unsafe Reflection
          • WebView loaded without restricting base URL
        • Memory Management
          • Untrusted Pointer Dereference
        • Misconfiguration
          • Deprecated UIWebView Usage
          • Entitlement App Sandbox Disabled
          • Entitlement Get-Task-Allow in Release
          • Entitlement Hardened Runtime Exception
          • Entitlement Keychain Access Groups Wildcard
          • Insecure SSL
          • Missing Dangerous Permission
          • SameSite None Without Secure
          • Unsafe Cookie
          • XML External Entity (XXE)
        • Path Resolution
          • Path Traversal
        • Predictability
          • Hardcoded Cryptographic Key
          • Hardcoded Cryptographic Salt
          • Inadequate Padding
          • Insecure Randomness
          • Insufficient Key Size
          • Non Random IV with CBC Mode
        • Resource Management
          • Connection String Parameter Pollution
          • Regular expression Denial of Service ('ReDoS')
        • Risky Values
          • Dangerous Hostname Check
    • DAST Detectors
      • Access Control
        • Access Control Issue - Improper Authentication
        • Access Control Issue - Improper Authorization
        • Bypassing 403
        • CORS Header
        • Cross-Domain JavaScript Source File Inclusion
        • Cross-Domain Misconfiguration
        • Fetch Metadata Request Headers
        • Insecure HTTP Method
        • Insufficient Site Isolation Against Spectre Vulnerability
        • Permissions Policy Header Not Set
      • Authentication
        • Authentication Request Identified
        • JWT Scan Rule
        • Possible Username Enumeration
        • Use of SAML
        • Username Hash Found
        • Weak Authentication Method
      • Buffer Overflow
        • Buffer Overflow
      • CRLF Injection
        • CRLF Injection
      • Clickjacking
        • Anti-clickjacking Header
      • Code Injection
        • Server Side Code Injection
      • Cross-Site Request Forgery
        • Absence of Anti-CSRF Tokens
        • Anti-CSRF Tokens Check
        • Cross Site Request Forgery
      • Cross-Site Scripting
        • Cross Site Scripting (DOM Based)
        • Cross Site Scripting (Persistent)
        • Cross Site Scripting (Persistent) - Prime
        • Cross Site Scripting (Persistent) - Spider
        • Cross Site Scripting (Reflected)
        • Cross-site Scripting
        • Dangerous JS Functions
        • Out of Band XSS
        • User Controllable HTML Element Attribute (Potential XSS)
        • User Controllable JavaScript Event (XSS)
        • Web Browser XSS Protection Not Enabled
      • File Inclusion
        • File Upload
        • Remote File Inclusion
      • Fingerprinting
        • Client-Side Data Flow
        • GraphQL
        • Modern Web Application
        • Retrieved from Cache
        • Tech Detection Passive Scanner
        • User Agent Fuzzer
        • Verification Request Identified
        • ZAP is Out of Date
      • Information Disclosure
        • .env Information Leak
        • .htaccess Information Leak
        • Application Error Disclosure
        • Backup File Disclosure
        • Base64 Disclosure
        • Cloud Metadata Potentially Exposed
        • Directory Browsing
        • ELMAH Information Leak
        • HTTP Server Response Header
        • Hash Disclosure - MD4 / MD5
        • Hidden File Found
        • Image Exposes Location or Privacy Data
        • In Page Banner Information Leak
        • Information Disclosure - Debug Error Messages
        • Information Disclosure - Sensitive Information in HTTP Referrer Header
        • Information Disclosure - Sensitive Information in URL
        • Information Disclosure - Suspicious Comments
        • PII Disclosure
        • Private IP Disclosure
        • Proxy Disclosure
        • Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
        • Source Code Disclosure - /WEB-INF Folder
        • Source Code Disclosure - CVE-2012-1823
        • Source Code Disclosure - File Inclusion
        • Source Code Disclosure - Git
        • Source Code Disclosure - PHP
        • Source Code Disclosure - SVN
        • Spring Actuator Information Leak
        • Timestamp Disclosure - Unix
        • Trace.axd Information Leak
        • WSDL File Detection
        • X-AspNet-Version Response Header
        • X-Backend-Server Header Information Leak
        • X-ChromeLogger-Data (XCOLD) Header Information Leak
        • X-Debug-Token Information Leak
      • Injection
        • Advanced SQL Injection
        • Exponential Entity Expansion (Billion Laughs Attack)
        • Expression Language Injection
        • Format String Error
        • Generic Padding Oracle
        • HTTP Parameter Override
        • HTTP Parameter Pollution
        • Integer Overflow Error
        • LDAP Injection
        • NoSQL Injection - MongoDB
        • NoSQL Injection - MongoDB (Time Based)
        • Parameter Tampering
        • SOAP Action Spoofing
        • SOAP XML Injection
        • SQL Injection
        • SQL Injection - Hypersonic SQL (Time Based)
        • SQL Injection - MsSQL (Time Based)
        • SQL Injection - MySQL (Time Based)
        • SQL Injection - Oracle (Time Based)
        • SQL Injection - PostgreSQL (Time Based)
        • SQL Injection - SQLite (Time Based)
        • XPath Injection
        • XSLT Injection
      • OS Command Injection
        • Remote OS Command Injection
        • Remote OS Command Injection (Time Based)
      • Path Traversal
        • Path Traversal
      • Redirect
        • Big Redirect Detected (Potential Sensitive Information Leak)
        • External Redirect
        • Off-site Redirect
      • Remote Code Execution
        • Java Serialization Object
        • Log4Shell
        • Remote Code Execution (React2Shell)
        • Remote Code Execution - CVE-2012-1823
        • Remote Code Execution - Shell Shock
        • Spring4Shell
        • Text4shell (CVE-2022-42889)
      • Security Misconfiguration
        • Apache Range Header DoS (CVE-2011-3192)
        • CSP
        • Charset Mismatch
        • Content Cacheability
        • Content Security Policy (CSP) Header Not Set
        • Content-Type Header Missing
        • HTTP Only Site
        • HTTP to HTTPS Insecure Transition in Form Post
        • HTTPS Content Available via HTTP
        • HTTPS to HTTP Insecure Transition in Form Post
        • Heartbleed OpenSSL Vulnerability
        • Heartbleed OpenSSL Vulnerability (Indicative)
        • Httpoxy - Proxy Header Misuse
        • Insecure Component
        • Re-examine Cache-control Directives
        • Relative Path Confusion
        • Reverse Tabnabbing
        • Script Served From Malicious Domain (polyfill)
        • Secure Pages Include Mixed Content
        • Strict-Transport-Security Header
        • Sub Resource Integrity Attribute Missing
        • User Controllable Charset
        • Vulnerable JS Library
        • Web Cache Deception
        • X-Content-Type-Options Header Missing
      • Server-Side Include Injection
        • Server Side Include
      • Server-Side Request Forgery
        • Server Side Request Forgery
      • Server-Side Template Injection
        • Server Side Template Injection
        • Server Side Template Injection (Blind)
      • Session Fixation
        • Session Fixation
      • Session Management
        • Cookie No HttpOnly Flag
        • Cookie Poisoning
        • Cookie Slack Detector
        • Cookie Without Secure Flag
        • Cookie without SameSite Attribute
        • GET for POST
        • Insecure JSF ViewState
        • Loosely Scoped Cookie
        • Session ID in URL Rewrite
        • Session Management Response Identified
        • Viewstate
      • XML External Entity
        • XML External Entity Attack
    • API Security Detectors
      • API1:2023 - Broken Object Level Authorization
        • Broken Object Level Authorization (BOLA / IDOR)
      • API2:2023 - Broken Authentication
        • JWT Misconfiguration
        • Sensitive Parameter on Unauthenticated Endpoint
        • Unauthenticated Endpoint
      • API3:2023 - Broken Object Property Level Authorization
        • Excessive Data Exposure (C#)
        • Excessive Data Exposure (Go)
        • Excessive Data Exposure (Java)
        • Excessive Data Exposure (JavaScript / TypeScript)
        • Excessive Data Exposure (PHP)
        • Excessive Data Exposure (Python)
        • Mass Assignment
        • PII Leak in Response (C#)
        • PII Leak in Response (Go)
        • PII Leak in Response (Java)
        • PII Leak in Response (JavaScript / TypeScript)
        • PII Leak in Response (PHP)
        • PII Leak in Response (Python)
      • API4:2023 - Unrestricted Resource Consumption
        • Rate-Limit Absence
      • API5:2023 - Broken Function Level Authorization
        • Broken Function Level Authorization (BFLA)
      • API7:2023 - Server Side Request Forgery
        • SSRF (Server-Side Request Forgery)
      • API8:2023 - Security Misconfiguration
        • CORS Misconfiguration
      • API9:2023 - Improper Inventory Management
        • Zombie Endpoint / Orphan API Spec
    • Unusual Activity Detection
      • Anomalous plugin installed
      • Auditing Configuration Modification
      • Anomalous fork
      • Anomalous Pull Request
      • Branch protection disabled
      • Commit anomalous
      • Commit bypassed branch protection
      • Compliance Framework Removed
      • Compliance Framework Updated
      • CI Token Scope Modified
      • DAST Profile Modified
      • Environment Unprotected
      • Failed login attempts
      • Commit force pushed
      • Feature Flag Updated
      • Member received Admin permissions
      • Organization deleted
      • Organization renamed
      • Organization Publicized
      • IP Restrictions Updated
      • Potential Script Injection Attack
      • Organization MFA requirement disabled
      • Manually Triggered Housekeeping
      • Pull Request merged without passing the status checks
      • Project Default Branch Updated
      • Repository archived
      • Repository deleted
      • Repository publicized
      • Repository Renamed
      • Repository unarchived
      • Stale Pull Request merged
      • Tag force pushed
      • Status Check Modification
      • Team received Admin permissions
      • Unsigned commit
      • Unusual Login
      • Unusual long time build job
  • Compliance Assessment Standards
    • CIS Software Supply Chain Security benchmark
      • 1.1.1 Ensure any changes to code are tracked in a version control platform
      • 1.1.10 Ensure open branches are up-to-date before merge
      • 1.1.11 Ensure all open comments are resolved before allowing code change merging
      • 1.1.12 Ensure verification of signed commits for new changes before merging
      • 1.1.13 Ensure linear history is required
      • 1.1.14 Ensure branch protection rules are enforced for administrators
      • 1.1.15 Ensure pushing or merging of new code is restricted to specific individuals or teams
      • 1.1.16 Ensure force push code to branches is denied
      • 1.1.17 Ensure protected branch deletions are denied
      • 1.1.3 Ensure any change to code receives approval of a minimum strongly authenticated users
      • 1.1.4 Ensure previous approvals are dismissed when updates are introduced to a code change proposal
      • 1.1.5 Ensure there are restrictions on who can dismiss code change reviews
      • 1.1.6 Ensure code owners are set for extra sensitive code or configuration
      • 1.1.8 Ensure inactive branches are periodically reviewed and removed
      • 1.1.9 Ensure all checks have passed before merging new code
      • 1.2.1 Ensure all public repositories contain a SECURITY.md file
      • 1.2.2 Ensure repository creation is limited to specific members
      • 1.2.3 Ensure repository deletion is limited to specific users
      • 1.2.4 Ensure issue deletion is limited to specific users
      • 1.3.1 Ensure inactive users are reviewed and removed periodically
      • 1.3.3 Ensure maximum number of administrators are set for the organization
      • 1.3.5 Ensure the organization is requiring members to use Multi-Factor Authentication (MFA)
      • 1.3.7 Ensure two administrators are set for each repository
      • 1.3.8 Ensure strict base permissions are set for repositories
      • 1.3.9 Ensure an organization’s identity is confirmed with a "Verified" badge
      • 2.3.1 Ensure all build steps are defined as code
      • 2.3.5 Ensure access to build process triggering is minimized
      • 2.3.7 Ensure pipelines are automatically scanned for vulnerabilities
      • 2.3.8 Ensure scanners are in place to identify and prevent sensitive data in pipeline files
      • 2.4.2 Ensure all external dependencies used in the build process are locked
      • 2.4.6 Ensure pipeline steps sign the Software Bill of Materials (SBOM) produced
      • 3.1.7 Ensure dependencies are pinned to a specific, verified version
      • 3.2.2 Ensure packages are automatically scanned for known vulnerabilities
      • 3.2.3 Ensure packages are automatically scanned for license implications
      • 4.2.3 Ensure user access to the package registry utilizes Multi-Factor Authentication (MFA)
      • 4.2.5 Ensure anonymous access to artifacts is revoked
      • 4.3.4 Ensure webhooks of the package registry are secured
    • OWASP Software Component Verification Standard
      • OWASP SCVS Unknown Components
    • OpenSSF FLOSS
      • Basic project website content
    • OpenSSF Scorecard
      • Branch protection
      • CI Tests: Does the project run tests in CI?
      • Code Review
      • Contributors
      • Dangerous Workflow
      • Dependency Update Tool
      • Fuzzing
      • License Declaration
      • Maintained
      • No Binary Artifacts
      • OpenSSF Best Practices badge
      • Packaging
      • Pinned Dependencies
      • SAST in use
      • Security Policy
      • Signed Releases
      • Token Permissions
      • Vulnerabilities
      • Webhooks
    • ESF Securing the Software Supply Chain DEV
      • Are all of your builds continuously built and tested?
      • Are code check-ins gated by code collaborators and source control to prevent anyone from accidentally or intentionally submitting unreviewed code changes?
      • Do you ensure only required modules are included in the product?
      • Do you have and adhere to responsible disclosure requirements for all externally identified vulnerabilities?
      • Do you have and use security tools for Software Composition Analysis?
      • Do you perform binary composition analysis of the final package?
      • Do you perform input fuzzing as part of a regular process for your component or product’s inputs?
      • Do you perform nightly builds with automated regression and security test to quickly detect problems with recent builds?
      • Do you track all third-party components you use directly and all internal components in a secure and persistent repository?
      • Do you use the toolchain to automatically gather information that informs security decision-making?
      • Does the project use a static code analysis tool?
      • Does the project use tools to help update its dependencies?
      • Does the team require code reviews for all code and build scripts / configuration changes?
      • Does your release confirmation that binaries are digitally signed?
      • Does your release include an SBOM?
      • The project should not have generated executable (binary) artifacts in the source repository.
    • Code Quality
      • CSharp
        • Best Practice
          • Control Statement Braces
          • Do Not Declare Static Members On Generic Types
          • Do Not Expose Generic Lists
          • Implement Standard Exception Ctors
          • Inclusive Class
          • Inclusive Comments
          • Inclusive Function
          • Inclusive Variable
        • Code Smell
          • Abstract Types No Constructors
          • Avoid Goto
          • Avoid Uninstantiated Internal
          • Boolean Compare With Literal
          • Catch Variable Reassigned
          • Commented Out Code
          • Cyclic Namespace Dependencies
          • Duplicate Imports
          • Field Name Matches Class
          • Logger Constant Template
          • Nested If
          • Nested Ternary
          • No Empty Finalizer
          • Redundant Modifiers
          • Static Class
          • URI Parameters Not Strings
          • URI Return String
          • Unnecessary Default Constructor
          • Unused Local Variable
          • Unused Method Parameter
          • Unused Private Field
          • Unused Private Method
          • Use Params For Variable Args
        • Complexity
          • Cyclomatic Complexity
          • Max Params
        • Dead Code
          • Unreachable Code
        • Efficiency
          • AsSpan Instead Of Range
          • Avoid Unnecessary String Creation
          • Avoid Unsealed Attributes
          • Method Could Be Static
          • String Concat In Loop
        • Naming Convention
          • Identifiers No Incorrect Suffix
          • Identifiers No Type Names
          • Interface First Letter
          • Naming Class
          • Naming Long Class Name
          • Naming Method
          • Naming Namespace
          • Naming Placeholder Identifier
          • Naming Single Char Var
        • Reliability
          • Access To Modified Closure
          • Assignment In Conditional
          • Async Task Not Void
          • Base Equals Reference
          • Bitwise Enum No Flags
          • Boolean Return Null
          • Compare Value To Itself
          • Comparison Nan
          • Condition Always True
          • Covariant Array Conversion
          • Dispose Before Scope
          • Do Not Call Overridable In Ctor
          • Do Not Hide Base Class Methods
          • Do Not Lock This
          • Do Not Raise Reserved Exception Types
          • Dropped Exception
          • Duplicate Branches
          • Empty Catch Block
          • Empty Finally Block
          • Empty Function Body
          • Empty Try Block
          • Equals HashCode Override
          • Equals Signature Correct
          • Equals Unrelated Types
          • Exception In Dispose
          • Exception In Equals
          • Exception In GetHashCode
          • Exception Must Be Thrown
          • Finalizer No Exception
          • Float Equality
          • Implement IDisposable
          • Member Initializer Ignored
          • Multiple OrderBy
          • No Catch Generic Exception
          • No Double Operators
          • No Duplicate Case
          • Non Readonly In GetHashCode
          • Normalize Strings
          • Override Equals On Overloading
          • Parameter Shadows Property
          • Platform Compatibility
          • Possible Loss Of Fraction
          • Possible Unintended Reference Compare
          • Preserve Stack Trace
          • Reference Equals Value Type
          • Return From Finally
          • Return Value Ignored
          • Same Conditional
          • Same Implementation Conditional
          • Same Method Field Names
          • Same Subexpression
          • Self Assignment
          • Specify Culture
          • Specify IFormatProvider
          • SpinLock Readonly
          • String Comparison
          • String Format Problems
          • Suspicious Type Conversion
          • Ternary Equal Branches
          • ThreadStatic Instance Field
          • Unassigned Readonly Field
          • Unconditional Recursion
          • Unused Import
          • Use Ordinal String Comparison
          • Wrong Lock Usage
      • Go
        • Best Practice
          • Context TODO
          • Drop Blank Identifier
          • Inclusive Comments
          • Inclusive Functions
          • Inclusive Types
          • Inclusive Variables
          • Omit Redundant Control Flow
          • Print In Production Code
          • Regexp Raw String
          • Signal Trapped
          • Simplify Error Construction
          • Unexported Return Type
          • Unnecessary fmt.Sprint
          • Unnecessary fmt.Sprintf For A String
          • Use HTTP Status Constants
          • Use copy
          • Use fmt.Fprintf
          • Use strings.Contains For Presence Tests
          • Use strings.ReplaceAll
          • Use strings.TrimPrefix
          • Use time.Since
        • Code Smell
          • Address Of Dereference
          • Avoid Bare Return
          • Avoid Dot Imports
          • Boolean Compare With Literal
          • Commented Out Code
          • Convert If To Switch
          • De Morgan Law
          • Deprecated Api
          • Duplicate Build Constraint
          • Duplicate Imports
          • Elaborate Sleep
          • First Const Only Typed
          • Ineffective Sort
          • Io Writestring Byte Slice
          • Lift Break Into Loop Condition
          • Merge Conditional Assignment
          • Merge Variable Declaration
          • Mixed Receivers
          • Modify Parameter
          • Negative Zero Constant
          • Nested If
          • No-Op Bitwise Operation
          • No-Op Rounding Of Converted Integer
          • Non Canonical Header Key
          • Omit Default Slice Index
          • Omit Nil Check In Type Assertion
          • Omit Redundant Nil Check
          • Overwritten Argument
          • Print Byte Slice As String
          • Range Over String
          • Redundant Canonical Header Key
          • Redundant Nil Check
          • Redundant Single-Argument Append
          • Redundant Type In Declaration
          • Simplify Boolean Expression
          • Simplify Boolean Return
          • Simplify Make
          • Simplify Make Slice
          • Simplify Math Pow
          • Simplify Type Assertion Cases
          • Single Case Select
          • Superfluous Else
          • Switch Default First Or Last
          • Type Assertion To Self Type
          • Unnecessary Delete Guard
          • Unnecessary Map Access Guard
          • Unread Value
          • Untyped Switch To Tagged
          • Unused Function Parameter
          • Use Bytes Buffer String
          • Use Sort Helper
          • Use time.Until
          • Yoda Conditions
        • Complexity
          • Cyclomatic Complexity
          • Max Params
        • Dead Code
          • Unreachable Code
        • Documentation
          • Doc Comment Starts With Name
          • Missing Package Comment
        • Efficiency
          • Empty For Spin
          • Inefficient String Comparison
          • Map Index Byte Slice
          • Regexp Match in Loop
          • String Concatenation in Loop
          • Sync Pool Non Pointer
          • Use bytes.Equal Instead Of bytes.Compare
        • Naming Convention
          • Boolean Getter Naming
          • Consistent Receiver Name
          • Context First Argument
          • Duration Variable Naming
          • Error Result Position
          • Error String Format
          • Error Variable Naming
          • Get Return
          • Identifier Style
          • Long Type Name
          • Package Naming Convention
          • Placeholder Identifier Name
          • Receiver Naming
          • Single-Character Variable Name
        • Reliability
          • Address Compared To Nil
          • Assignment To Receiver
          • Atomic Assignment
          • Avoid Call To Gc
          • Avoid Empty Critical Sections
          • Bad Context Key
          • Benchmark Assigns b.N
          • Binary Unsupported Type
          • Bytes Equal On Netip
          • Cannot Marshal Channel or Function
          • Compare Identical
          • Compare time.Time with Equal
          • Context Cancelable
          • Control Characters In String
          • Cutset Duplicates
          • Defer Lock
          • Defer in Loop
          • Defer/Go with Panic/Recover
          • Deferred Close Before Error
          • Deferred Returned Function Not Called
          • Delete System Directory
          • Division By Zero
          • Do Not Compare NaN
          • Empty Function Body
          • Empty If Body
          • Errors As Non Pointer
          • Errors Direct Comparison
          • Exceeded Shift
          • Failnow Goroutine
          • Field Assignment Never Observed
          • Finalizer References Object
          • Import Name Collision
          • Impossible GOOS Or GOARCH Comparison
          • Impossible Len Or Cap Check
          • Impossible Type Assertion
          • Ineffective Bounded Random
          • Ineffectual Compiler Directive
          • Integer Literal Division Truncating To Zero
          • Integer To String
          • Interface Nil Comparison
          • Invalid Exec Command
          • Invalid Printf
          • Invalid Struct Tag
          • Invalid strconv Argument
          • Locks Passed By Value
          • Loop Var Capture
          • Modulo By One
          • Net Listen Bad Address
          • Nil Context
          • Nil Map Assignment
          • No Public Fields Marshal
          • No Unmodified Loop
          • Non Pointer Unmarshal
          • Nonstandard Method Signature
          • Octal-Looking File Mode
          • Overlapping Encoder Slices
          • Potential Resource Leak
          • Printf Dynamic Format
          • Redefine Builtin Id
          • Regexp FindAll With Zero Count
          • Repeated If Conditions
          • Return Value Ignored
          • Seek Whence Argument Order
          • Self Assignment
          • Shadowing Variable
          • Signal Notify Unbuffered
          • Single Iteration Loop
          • Sort Slice Non Slice
          • Strings Replace Zero
          • TestMain Without os.Exit
          • Time Parse Format
          • Time Tick Leak
          • Type Assertion Else Wrong Value
          • Type Assertion On Errors
          • Uintptr To Unsafe Pointer
          • Unconditional Recursion
          • Unobserved Append
          • Unreachable Type Switch
          • Unsigned Negative Comparison
          • Url Query Modification Lost
          • Valid Regular Expression
          • Verify Short Sleep
          • Waitgroup Add In Goroutine
          • Wrong Errors Is
      • Html
        • Best Practice
          • Inclusive Comments
          • Require Canonical Link
          • Require Meta Description
        • Code Smell
          • Avoid Inline Styles
          • Avoid Long Inline Scripts
          • Avoid Media Autoplay
          • Avoid Redundant ARIA Roles
          • Commented Out Code
          • Double-Quoted Attribute Values
          • Lowercase Attribute Names
          • Separate Content From Behavior
          • Write Tag Names In Lowercase
        • Complexity
          • Excessively Nested Divs
        • Efficiency
          • Declare Stylesheets In Head
          • Defer Render-Blocking Head Scripts
          • Prefer Link Over CSS Import
        • Reliability
          • Alt Attribute Required
          • Associate Labels With Inputs
          • Avoid Meta Refresh
          • Avoid Positive Tabindex
          • Charset Should Be UTF-8
          • Declare Character Encoding
          • Empty Heading
          • Escape Special Characters
          • Form Validation Disabled
          • Image Height and Width Required
          • Incomplete Anchor
          • Multimedia Fallback
          • No Duplicate Attributes
          • No Special Characters In Tag Names
          • Non-Boolean Attribute Without Value
          • Obsolete Attributes
          • Obsolete Elements
          • Require A Doctype Declaration
          • Require A Main Landmark
          • Require An H1 Heading
          • Require Document Title
          • Require Form Action
          • Require Frame Title
          • Require Viewport Meta
          • Source Attribute Required
          • Specify Button Type Attribute
          • Specify Lang Attribute
          • Unique Id
          • Use The HTML5 Doctype
          • Value Attribute Required
          • Viewport Disables Zoom
          • Void Element With Closing Tag
      • Java
        • Best Practice
          • Avoid Enumeration For Loop Control
          • Avoid Legacy Date/Time API
          • Control Statement Braces
          • Equals Without Instanceof
          • Loose Coupling
          • Prefer constructor injection over @Autowired fields
          • Redundant String.substring(0)
          • Return Empty Array Instead of Null
          • Spring controller method without request-mapping annotation
          • Use @RepositoryRestResource instead of custom CRUD controllers
          • Use @RestController instead of @Controller + @ResponseBody
          • Use @SpringBootApplication instead of @Configuration + @EnableAutoConfiguration + @ComponentScan
          • Use Arrays.asList Instead of Manual Loop Copy
          • Use Locale For Case Conversion
        • Code Smell
          • Abstract Class Constructors Should Not Be Public
          • Array Brackets Should Follow the Type
          • Assign Already Assigned Value
          • Avoid Creating Empty ZIP or JAR Files
          • Avoid Multiple Control Variables in For Loops
          • Avoid ThreadGroup
          • Avoid Wildcard (Star) Imports
          • Avoid the Default (Unnamed) Package
          • Boolean Comparison With Literal
          • Commented-Out Code
          • Confused Inheritance
          • Constant-Only Interface
          • Constraint Layout Tools Attribute Has No Effect
          • Dangling Else
          • Duplicate Branches
          • Duplicate Imports
          • Duplicate String Literals
          • Empty Static Initializer
          • Empty String Concatenation for Type Conversion
          • Empty Switch Statement
          • Entity Class Must Not Import J2EE Web APIs
          • Field Name Matches Class Name
          • Final Parameter on Abstract Method
          • For Loop Without Init/Update Should Be While
          • Hardcoded SD Card Path
          • Identifiers Should Not Contain Dollar Sign
          • If-Else instanceof Chain
          • Interface Redundant Modifiers
          • Layout Attribute Set to Platform Default
          • Local Variable Shadows Field
          • Main Method Reserved
          • Method Named Like Its Enclosing Class
          • No Chained Assignment
          • No Import From Same Package
          • Non-Short-Circuit Operator
          • One Public Top-Level Type per File
          • One Variable per Declaration
          • Parameter Shadows Field
          • Parent Class References Child Class
          • Prefer Implementing Runnable Over Extending Thread
          • Protected Member in Final Class
          • Raw Color
          • Raw Dimension
          • Redundant Field Initializer
          • Redundant Type Cast
          • Redundant extends Object
          • Redundant final on Private Method
          • Redundant final on Static Method
          • Redundant java.lang Import
          • Redundant toString on String
          • Redundant toString() on StringBuilder in Concatenation
          • Runtime totalMemory/freeMemory In Code
          • Simplify Boolean Return
          • Simplify Boolean Test Assertions
          • Simplify Equals Test Assertions
          • Simplify Null Test Assertions
          • Simplify Operator Test Assertions
          • Static Fields Should Be Final
          • StringBuilder or StringBuffer As Class Field
          • Switch Default Not Last
          • Switch Fallthrough Without Comment
          • System.out / System.err In Application Code
          • Ternary Expression With Negated Condition
          • Thread.dumpStack() In Production
          • Unnecessary Default Constructor
          • Unused Import
          • Unused Local Variable
          • Unused Method Parameter
          • Unused Private Field
          • Unused Private Method
          • Useless Control Flow (Identical If/Else Branches)
          • Useless Method Override
          • Utility Class Should Have Private Constructor
          • While Literal Boolean Simplify
        • Complexity
          • Cyclomatic Complexity
          • Excessive Fan-Out
        • Dead Code
          • Unreachable Code
        • Documentation
          • Javadoc Content
          • Missing Javadoc
        • Efficiency
          • Avoid AbsoluteLayout
          • Avoid Calling Thread.destroy()
          • Avoid FileStream
          • Avoid List.contains In Loop
          • Avoid Multidimensional Arrays and Nested Lists
          • Avoid String Instantiation
          • Avoid the Deprecated Boolean Constructor
          • Boxed Number Constructor Is Inefficient
          • Boxed Type toString() Instead Of Static toString()
          • Collection Associations Should Not Use Eager Fetching
          • Deep Layout Hierarchy
          • Inefficient Empty String Test
          • Inner Class Should Be Static
          • KeySet Iterator
          • Math Method on Compile-Time Constant
          • No SELECT * In SQL Queries
          • No Throwable.printStackTrace()
          • Pattern.compile In Loop
          • Prefer PreparedStatement Over Statement
          • PrepareStatement In Loop
          • Private Method Could Be Static
          • Recyclable Android Resource Not Recycled
          • Repeated Cast of Same Object
          • Replace Hashtable With Map
          • Replace Vector With List
          • Single-Character String Concatenation in Loop
          • String Comparison for Single Character
          • String Concatenation in Loop
          • String.indexOf() With Single-Character String
          • StringBuffer/StringBuilder for Constant Value
          • StringBuilder.append() With Single-Character String
          • Synchronized Block In Loop
          • Thread.sleep() In Loop (Busy-Wait)
          • Try/Catch Block In Loop
          • Unnecessary Math Call On Constants
          • Unnecessary Object Allocation for getClass()
          • Use Enhanced For Loop
          • Use SparseArray Instead of Map with Integer Keys
          • Use System.arraycopy() Instead of Loop
          • Use ViewHolder Pattern in Adapters
          • Use charAt() for single-character prefix/suffix test
        • Naming Convention
          • Class Naming Convention
          • Exception Naming Convention
          • Inclusive Class Definition
          • Inclusive Function Definition
          • Inclusive Variable Assignment
          • Interface Fields Uppercase
          • Layout File Name Not in snake_case
          • Long Class Name
          • Method Naming Convention
          • Methods Named 'is…​' Should Return Boolean
          • Package Case
          • Package Naming Standard
          • Reserved Package Prefix
          • Reserved Words in Identifiers
          • Single-Character Variable Name
          • Static Final Fields Should Be UPPER_SNAKE_CASE
          • Wrong Layout Name
          • Wrong View Id Format
        • Reliability
          • @Column Invalid on Association Fields
          • @Entity with @AllArgsConstructor Missing @NoArgsConstructor
          • @Entity with @Builder Missing Required Constructors
          • @SequenceGenerator with Empty Sequence Name
          • @Transactional Catch Block Without Rollback
          • AdapterView Must Not Declare Inline Children
          • Ambiguous String-Plus-Number Concatenation
          • Android Super Lifecycle
          • Android android:onClick Must Reference an Existing Method
          • Array toString
          • Assignment in Conditional Expression
          • Assignment with Self-Increment
          • AttributeConverter Missing @Converter Annotation
          • Avoid Assignment In Loop Condition
          • Avoid Calling Thread.interrupted()
          • Avoid Comparing a Value With Itself
          • Avoid Comparisons Against Byte.MAX_VALUE / Byte.MIN_VALUE
          • Avoid Comparisons Against Character.MAX_VALUE / Character.MIN_VALUE
          • Avoid Comparisons Against Double.MAX_VALUE / Double.MIN_VALUE
          • Avoid Comparisons Against Float.MAX_VALUE / Float.MIN_VALUE
          • Avoid Comparisons Against Integer.MAX_VALUE / Integer.MIN_VALUE
          • Avoid Comparisons Against Long.MAX_VALUE / Long.MIN_VALUE
          • Avoid Comparisons Against Short.MAX_VALUE / Short.MIN_VALUE
          • Avoid Internal JDK sun.* and com.sun.* Packages
          • Avoid Literal "." In Regex String Methods
          • Avoid MessageDigest Field
          • Avoid Overloading Clone
          • Avoid Reassigning Parameters
          • Avoid Runtime.runFinalization()
          • Avoid SingleThreadModel
          • Avoid auto-scan annotations in the default package
          • Avoid by-name constructor injection without @Qualifier
          • Avoid classpath wildcard in Spring resource paths
          • Avoid nextDouble() to Generate Random Integer
          • Bad Regular Expression Syntax
          • Bad Shift Amount
          • Boolean Method Returns Null
          • Case Conversion Chained With equals()
          • Catch Variable Reassigned
          • Catching OutOfMemoryError
          • Check indexOf Against Zero
          • Class Comparison via getName()
          • Class With All Private Constructors Should Be Final
          • Clone Must Be Public
          • Clone Standard Signature
          • Clone Uses Constructor Instead of super.clone()
          • Clone Without Super.clone
          • Collection Add to Self
          • Comparable Without equals() Override
          • Comparison With NaN Using == or !=
          • Complete FragmentTransaction with commit()
          • Composite Element Must Implement equals() and hashCode()
          • Condition.await() Must Be Called Inside a While Loop
          • Constructor Calls Overridable Method
          • Constructor More Visible Than Class
          • Cyclic Package Dependencies
          • Deprecated Thread Methods (stop, suspend, resume)
          • Do Not Call Abstract Methods in Constructors
          • Do Not Call Thread.run() Directly
          • Do Not Call a Recycled Android Resource
          • Do Not Call finalize() Explicitly
          • Do Not Catch IllegalMonitorStateException
          • Do Not Catch NullPointerException
          • Do Not Catch java.lang.Error
          • Do Not Catch java.lang.Exception
          • Do Not Catch java.lang.Throwable
          • Do Not Invoke the Garbage Collector Explicitly
          • Do Not Replace Persistent Collection in Setter
          • Do Not Throw NullPointerException
          • Do Not Throw Raw java.lang.Exception
          • Do Not Throw java.lang.Error
          • Do Not Throw java.lang.Throwable
          • Do Not Use instanceof to Dispatch Exceptions in Catch Blocks
          • Do Not Use synchronized on a Lock Object
          • Double-Checked Locking Without Volatile
          • Dropped Exception
          • Duplicate android:id in Layout
          • Duplicate android:id in Menu File
          • Embeddable Must Implement equals() and hashCode()
          • Empty Catch Block
          • Empty Finally Block
          • Empty If Body
          • Empty Loop Body
          • Empty Synchronized Block
          • Empty Try Block
          • Entity Class Must Declare an Identifier
          • Entity Class Must Have an Accessible No-Argument Constructor
          • Entity Class Must Not Be Final
          • Entity equals()/hashCode() References @Id Field
          • Entity with Multiple @Id Fields Must Declare @IdClass
          • Equals Called With Null
          • Equals Without HashCode
          • Equals on Unrelated Types
          • Erroneous Layout Attribute for Parent Type
          • Exception Created But Not Thrown
          • Externalizable class missing public no-arg constructor
          • Float or Double Loop Counter
          • Floating-Point Equality Comparison
          • HQL/JPQL Cartesian Product Without JOIN
          • Hardcoded File Separator
          • HashCode Without Equals
          • Hibernate Date Property Explicit Temporal
          • Hibernate Entity Equals Policy
          • Hibernate Explicit Inheritance Strategy
          • Hibernate Problematic Flush Mode
          • Hibernate Static Inner
          • Identifier Field Should Use a Nullable Wrapper Type
          • Identifier Setter Should Be Private
          • Implement Cloneable When Overriding Clone
          • Incorrect hashCode() Spelling
          • Incorrect toString() Spelling
          • Infinite Recursive Loop
          • Instanceof Before Cast
          • Iteration Over Non-Concurrent Collection Without Synchronization
          • Iterator next() in hasNext()
          • Iterator.next() Must Throw NoSuchElementException
          • JPA Manytomany Cascade Remove
          • JPA Onetoone Lazy Misleading
          • JUnit 5 Obsolete Assertions
          • JUnit Assertequals On Array
          • JUnit Malformed Declaration
          • JUnit Mixed Versions
          • JUnit Parameterized No Data
          • Lazy Initialization of Static Field Without Synchronization
          • Literals First In Comparison
          • Long Literal With Lowercase Suffix
          • Loop Control Variable Reassigned in Body
          • Matching View Id
          • Missing Switch Default
          • Missing explicit base package in @ComponentScan
          • Missing serialVersionUID
          • Modulus One Always Equals Zero
          • Multiple @EnableAutoConfiguration annotations
          • Multiple Entities Mapped to the Same Table
          • Narrowing Primitive Cast
          • Nested Scrolling Containers
          • No Thread.start() In Constructor
          • Non-Serializable Field in Serializable Class
          • Non-Standard equals() Signature
          • Object Equality Use Equals
          • Object.wait() Must Be Called Inside a While Loop
          • Odd Check Fails for Negative Numbers
          • Persistent Collection Field Must Be Interface Type
          • Persistent Collection Fields Must Not Be Arrays
          • Preserve Stack Trace
          • Problematic while(true) Loop
          • Random Instance Used Only Once
          • Redundant Math.ceil/floor/round on Integer Argument
          • Reserved Future Keyword Identifier
          • Return Empty Enumeration Instead of Null
          • Return Empty Iterator Instead of Null
          • Return From Finally Block
          • Return Value Ignored
          • Returning MIN_VALUE From compareTo()
          • Runtime Trace Method Calls Removed
          • ScrollView Child Must Not Use match_parent
          • ScrollView Must Have Exactly One Child
          • Self-assignment
          • Spring AOP Unsupported Pointcut
          • Spring Batch step without explicit commit interval
          • Spring Boot Invalid Setup
          • Spring Boot main class in deep sub-package
          • Spring Data JDBC Mapped Key Column
          • Spring Data Modifying Missing
          • Spring Data Page Without Pageable
          • Spring Invalid Configuration Properties
          • Spring Non Void Initbinder
          • Spring Pathvariable Mismatch
          • Spring Security Self-Invocation
          • Static Field Write from Instance Method
          • String Equality Use Equals
          • Style Element with android:id Crashes AAPT
          • Subclass of Error or Throwable
          • Suspicious Import of android.R
          • Switch Case Must Terminate
          • Switch Default Missing Break
          • Switch Statement Should Have Default Branch
          • Synchronization On String Literal
          • Synchronized Method Acquires Second Lock
          • Thread Subclass Must Override run()
          • Thread.sleep() or Object.wait() on Android UI Thread
          • Throw From Finally Block
          • Transient Fields in Serializable
          • URL equals/hashCode Triggers DNS Lookup
          • Uninitialized Field Read in Constructor
          • Unreleased Android WakeLock
          • Unreleased Lock
          • Use Bind Parameters in Hibernate Queries
          • Use Integer Index Variable in Loops
          • Use Integer Version Instead of Timestamp for Optimistic Locking
          • Volatile Increment Is Not Atomic
          • Volatile on Array Field
          • Wrong Constraint Layout
          • Wrong View Cast in findViewById
          • equals() Always Returns a Constant
          • java.net.URL Should Not Be Used as Map Key or Set Element
          • readObject must not be synchronized
          • readResolve() must return Object
          • serialVersionUID must be private static final long
          • wait()/notify()/notifyAll() Outside Synchronized Context
      • JavaScript / TypeScript
        • Best Practice
          • Abstract Class Constructor Should Be Protected
          • Banned TypeScript Types
          • Exported Function Missing Return Type
          • Nested Ternary Expression
          • No alert / confirm / prompt
          • No console.* (Outside the Allow List)
          • Non-Portable Method Call
          • Prefer Rest Parameters Over arguments
          • Prefer Spread Over apply()
          • Prefer const
          • Switch Statement Should Have a Default Case
        • Code Smell
          • Allocation Result Ignored
          • Always Use Braces Around Control-Flow Bodies
          • Angular: Avoid forwardRef
          • Angular: Lifecycle Method Without implements
          • Async Function Without Own Await
          • Avoid TypeScript namespace Declarations
          • Ban TypeScript Suppression Comments
          • Browser Sniffing via Navigator
          • Comma Operator Outside Conventional Contexts
          • Commented-out Code
          • Confusing +/- Sequence
          • Debugger Statement In Source
          • Duplicate Function/Class Declaration
          • Duplicate Imports
          • Duplicate Type in Union or Intersection
          • Else After Always-Exiting If
          • Empty Function Body
          • Empty interface Declaration
          • Lone Block Statement
          • No Catch-Parameter Reassignment
          • No Explicit any Type
          • No Parameter Reassign
          • No Useless Return
          • Pointless Arithmetic
          • Redundant Boolean Ternary
          • Redundant TypeScript Type Arguments
          • Redundant if/else Returning Booleans
          • Unnecessary Default Constructor
          • Unnecessary .bind() On A Function That Does Not Use this
          • Unused Function/Method Parameter
          • Unused Local Variable
          • Use Dot Notation
          • Use let or const Instead of var
          • Useless Backslash Escape
          • Useless Catch (Re-throws Only)
          • var Redeclaration
        • Complexity
          • Cyclomatic Complexity
          • Deeply Nested Callbacks
          • Deeply Nested if
          • Too Many Function Parameters
        • Dead Code
          • Unreachable Code
        • Efficiency
          • Angular *ngFor Missing trackBy
          • Function Declared In Loop
          • Object Instantiation Inside Loop
        • Naming Convention
          • Angular @Component Naming
          • Angular @Directive Naming
          • Angular @Injectable Class Name
          • Angular @NgModule Class Name
          • Angular @Pipe Naming
          • Class Naming
          • Function / Method Naming
          • Inclusive Class Name
          • Inclusive Function Name
          • Inclusive Variable Name
        • Reliability
          • Angular Service Missing @Injectable
          • Array Method Callback Must Return a Value
          • Assignment To Imported Binding
          • Assignment in Condition
          • Assignment in Return Statement
          • Async Function as Promise Executor
          • Avoid document.all
          • Avoid process.exit
          • Avoid with Statement
          • Calling a Non-Callable Global
          • Compare Against Negative Zero
          • Compare Value To Itself
          • Consistent Return
          • Cyclic Module Dependencies
          • Derived Constructor Without super()
          • Division or Modulo by Zero
          • Duplicate Class Member
          • Duplicate Else-If Conditions
          • Duplicate Function Argument
          • Duplicate Property Name in Object Literal
          • Duplicate Switch Case
          • Duplicate if Condition
          • Empty Destructuring Pattern
          • Empty Loop Body
          • Empty if / else / catch / finally
          • Equality Between Unrelated-Type Literals
          • Extending Built-in Prototypes
          • For Loop Update Direction Mismatch
          • For-Loop Variable Not Used in Condition or Update
          • Getter Must Return a Value
          • If/Else With Identical Branches
          • Invalid Constructor Usage
          • Loop Body Never Iterates
          • Missing await on Async Call
          • Missing key Prop In React List
          • New Wrapper Constructor
          • No Class Reassignment
          • No Constant Condition
          • No Function Reassignment
          • No Sparse Arrays
          • No const Reassignment
          • Numeric Literal Loses Precision
          • Overwriting Built-In Globals
          • Promise Result Ignored
          • Promise.reject Without an Error
          • React Hook Called Conditionally
          • React: Hook Called Conditionally
          • Read-Modify-Write Across await
          • Redundant await
          • Return Value from Constructor
          • Returning a Value from a Promise Executor
          • Returning a Value from a Setter
          • Same Key in Destructuring or Object Literal
          • Strict Equality (===) Required
          • Suspicious =+ / =- Assignment
          • Switch Case Falls Through Without Comment
          • Ternary With Identical Branches
          • Test NaN Equality
          • Throw a Literal Value
          • Typeof Compared to Invalid String
          • Unguarded for…​in
          • Unmodified Loop Condition
          • Unsafe Continuation After Optional Chain
          • Unsafe Control Flow Inside Finally
          • Unsafe Negation Before in / instanceof
          • Unsafe any Assignment
          • Unsound Type Guard Check
          • Unused Expression Statement
          • Use Before Define
          • Use of arguments.caller / arguments.callee
          • Vue v-for Missing :key
          • Vue v-if Combined With v-for
          • Vue: data Must Be A Function
          • parseInt Without Radix
          • this/super Used Before super() in Derived Constructor
          • typeof Compared Against Non-Standard String
      • Kotlin
        • Best Practice
          • Alert Dialog Usage
          • Android Invalid Import
          • Data Class Immutable
          • Inject Dispatcher
          • No Catch Error
          • No Catch Generic Exception
          • No Catch NPE
          • No Throw NPE
          • No Throw Throwable
          • Preserve Stack Trace
          • Println In Production
          • Use Check Or Error
          • Use Require
          • Var Could Be Val
        • Code Smell
          • Abstract To Concrete
          • Android SD Card Path
          • Avoid Star Import
          • Boolean Compare With Literal
          • Boolean Return Null
          • Can Be Non-nullable
          • Class Naming
          • Collapsible If Statements
          • Complex Condition
          • Constraint Layout Tools Attribute Has No Effect
          • Data Class Functions
          • Deprecated Block Tag
          • Double Mutability Collection
          • Duplicate String Literals
          • Empty Default Constructor
          • Empty Function Body
          • Empty Init Block
          • Empty Kotlin File
          • Empty When Branch
          • Enum Entry Naming
          • Equals Signature Correct
          • Explicit GC Call
          • Expression Body
          • ForEach On Range
          • Function Naming
          • Function Returning Constant
          • Generic Array Of Primitives
          • Instanceof Check Exception
          • Iterator HasNext Calls Next
          • Layout Attribute Set to Platform Default
          • May Be Const
          • Named Arguments
          • Nested If
          • Nested Scope Functions
          • No Empty Class Bodies
          • No Unit Return
          • Object Literal Lambda
          • Package Naming
          • Parens Before Trailing Lambda
          • Print Stack Trace
          • Raw Color
          • Raw Dimension
          • Redundant Suspend
          • Redundant Visibility Modifier
          • Rethrow Caught Exception
          • Return Count
          • Spread Operator
          • Throwing Same Exception
          • Unconditional Jump In Loop
          • Unnecessary Apply
          • Unnecessary Let
          • Unnecessary Not Null Assertion
          • Unnecessary Safe Call
          • Unnecessary Temporary Instantiation
          • Unpaired Equals / HashCode
          • Unsafe Cast
          • Unused Function Parameter
          • Unused Import
          • Unused Local Variable
          • Unused Private Class
          • Unused Private Function
          • Unused Private Property
          • Use Data Class
          • Utility Class Should Be Object
        • Complexity
          • Cyclomatic Complexity
        • Dead Code
          • Unreachable Code
        • Efficiency
          • Android Missing Recycle
          • Android Sparse Arrays
          • Android View Holder
          • Avoid AbsoluteLayout
          • Could Be Sequence
          • Deep Layout Hierarchy
          • String Concatenation In Loop
        • Naming Convention
          • Boolean Property Naming
          • Field Name Matches Class
          • Layout File Name Not in snake_case
          • Matching Declaration Name
          • Naming Long Class Name
          • Naming Single Char Var
          • Placeholder Identifier
          • Wrong Layout Name
          • Wrong View Id Format
        • Reliability
          • AdapterView Must Not Declare Inline Children
          • Android Recycle Call
          • Android Super Lifecycle
          • Android Suspicious Import
          • Android Transaction Commit
          • Android Wait Sleep Activity
          • Android WakeLock
          • Android Weak Reference In Inner Class
          • Android android:onClick Must Reference an Existing Function
          • Augmented Assign On Read-only Collection
          • Avoid Referential Equality
          • BigDecimal Equals
          • Cast Nullable To NonNullable
          • Cast To Nullable Type
          • Collection Add To Self
          • Compare Value To Itself
          • Deferred Result Unused
          • Delegate To Var
          • Dropped Exception
          • Duplicate android:id in Layout
          • Duplicate android:id in Menu File
          • Empty Catch Block
          • Empty Do While
          • Empty Else Block
          • Empty Finally Block
          • Empty For Block
          • Empty If Body
          • Empty Try Block
          • Empty When Block
          • Empty While Block
          • Equals Always Returns
          • Equals Incompatible Types
          • Equals Null Call
          • Erroneous Layout Attribute for Parent Type
          • Exception As Object
          • Exception Raised Unexpected
          • Exit Outside Main
          • Float Equality Comparison
          • Global Coroutine Usage
          • Has Platform Type
          • Implicit Default Locale
          • Invalid Package Declaration
          • Invalid Range
          • Lateinit Usage
          • Local Shadows Property
          • Map Not-Null Assertion
          • Matching View Id
          • Nested Scrolling Containers
          • Not Implemented Declaration
          • Null Check On Mutable Property
          • Nullable To String
          • Parameter Shadows Property
          • Private Data Class Copy
          • Recursive Property Accessor
          • Return From Finally
          • Return Value Ignored
          • Run Blocking In Coroutine
          • Run Blocking In Suspend
          • ScrollView Child Must Not Use match_parent
          • ScrollView Must Have Exactly One Child
          • Sleep Instead Of Delay
          • String Referential Equality
          • Style Element with android:id Crashes AAPT
          • Suspend Coroutine No Cancel
          • Suspend Fun Flow Return
          • Suspend Fun Swallowed Cancellation
          • Thread Run Called Directly
          • Thread Subclass Must Override Run
          • Throwable Not Thrown
          • Throwing Exception From Finally
          • Throwing Exceptions Without Message
          • Unreachable Catch
          • Unused Flow
          • Wrong Constraint Layout
          • Wrong View Cast in findViewById
          • forEach Unused Value
          • hashCode on Array
          • toString on Array
      • Php
        • Best Practice
          • Missing Switch Default
        • Code Smell
          • Avoid Global Variables
          • Avoid Reassigning Parameters
          • Boolean Compare With Literal
          • Class File Include
          • Closing Tag In Php Only File
          • Commented Out Code
          • Control Statement Braces
          • Cyclic Namespace Dependencies
          • Deprecated Class
          • Deprecated Constant
          • Deprecated Function
          • Deprecated Method
          • Deprecated Property
          • Duplicate Imports
          • Empty Function Body
          • Explicit Method Visibility
          • Field Name Matches Class
          • For Loop Over Array
          • Inclusive Class
          • Inclusive Function
          • Inclusive Variable
          • Method Could Be Static
          • Missing Param Type
          • Missing Property Type
          • Missing Return Type
          • Nested Ternary
          • Parenthesised Include
          • Public Method Only Actions
          • Redundant Cast
          • Return Without Parens
          • Same Method Field Names
          • Short Open Tag
          • Single Line Comments
          • Unnecessary Default Constructor
          • Unused Closure Parameter
          • Unused Import
          • Unused Local Variable
          • Unused Parameter
          • Unused Private Field
          • Unused Private Method
          • Uppercase Keyword
          • Variable As String
          • Variable Substitution
        • Complexity
          • Cyclomatic Complexity
          • Max Params
          • Nested If
        • Dead Code
          • Unreachable Code
        • Efficiency
          • Avoid Unnecessary Replacements Loops
          • Concatenation In Echo
          • Counter Functions In Loops
          • No Flush In Loop
          • Smart Substring Matching
          • Sql Queries In Loop
          • String Concat In Loop
        • Naming Convention
          • Naming Class
          • Naming Constant
          • Naming Long Class Name
          • Naming Method
          • Naming Placeholder Identifier
          • Naming Single Char Var
          • Naming Suffix Conventions
          • Psr4 Class Naming
        • Reliability
          • Abstract Instantiation
          • Assign Null In Function Call
          • Avoid Exit Die
          • Avoid Logical Operators
          • Avoid Ref Multidim Array
          • Avoid This In Static
          • Bad Null Guard
          • Boolean Return Null
          • Call Time Pass By Reference
          • Catch Variable Reassigned
          • Circular Reference
          • Compare Value To Itself
          • Condition Always True
          • Condition Similar Block
          • Do Not Use Error Suppression
          • Dropped Exception
          • Duplicate Array Key
          • Duplicate Class
          • Empty Catch Block
          • Empty Finally Block
          • Empty Loop Body
          • Empty Try Block
          • Exception Extension
          • Exception Must Be Thrown
          • Function Arguments Uniqueness
          • Method Signature Mismatch
          • No Catch Generic Exception
          • No Deprecated Functions
          • No Double Operators
          • No Fallthrough
          • No Side Effect
          • No Update Loop Vars
          • Numerically Indexed Arrays
          • Optional Params At End
          • Parameter Shadows Property
          • Posix Regex
          • Preserve Stack Trace
          • Redirect After Post
          • Return From Finally
          • Return In Constructor
          • Return Value Ignored
          • Self Assignment
          • Set For Attributes Get
          • Throwing Exception
          • Too Many Params In Call
          • Uncaught Throw Global
          • Unset Loop References
          • Use Strict Comparisons
          • Variable Initialization
      • Python
        • Best Practice
          • Boolean Comparison With Literal
          • Compare to None with is
          • Inclusive Comments
          • Inclusive Function Name
          • Inclusive Variable Name
          • Instance Attribute Outside init
          • Method Could Be Static
          • No for i in range(len(x))
          • Use dict.items() to Iterate
          • Use zip() to Iterate Parallel Lists
        • Code Smell
          • Avoid Calling Magic Methods
          • Avoid Wildcard (Star) Imports
          • Catch Variable Reassigned
          • Commented-out Code
          • Cyclic Package Dependencies
          • Duplicate Imports
          • Empty Sequences Are Falsy
          • Nested Ternary
          • No print()
          • Unnecessary pass Statement
        • Complexity
          • Cyclomatic Complexity
          • Max Parameters
          • Nested If
        • Dead Code
          • Unreachable Code
          • Unused Import
          • Unused Local Variable
          • Unused Method Parameter
          • Unused Private Field
          • Unused Private Method
        • Efficiency
          • Avoid Unnecessary Materialization
          • Improve List Extension
          • Initialise Containers With Literals
          • Lazy Logger Formatting
          • Pandas: Avoid inplace=True
        • Naming Convention
          • Naming Class
          • Naming Conventions
          • Naming Method
          • cls as First Argument
          • self as First Argument
        • Reliability
          • Avoid Duplicate Dict Keys
          • Collection Modified While Iterating
          • Consistent Return
          • Context Manager Defines Both enter and exit
          • Default Mutable Arguments
          • Deprecated Module Import
          • Django Duplicate Blocks
          • Django Endblock Mismatch
          • Django Mismatched Tags
          • Django Misplaced Extends
          • Do Not Catch Exception
          • Empty Except Block
          • Exception Must Inherit a Base
          • First Argument Reassigned
          • Hardcoded Absolute Path
          • Incompatible new and init
          • Invalid Escape Sequence
          • Invalid open() Mode
          • Missing Await on Coroutine
          • No datetime.today() / datetime.now() / date.today()
          • Open Files Using with
          • Return Value from init
          • Same Method And Attribute Name
          • Self Assignment
          • Shadowing Built-in Names
          • Statement With No Effect
          • Static Method No Self
          • Subclass init Calls Parent
          • Suspicious Boolean Coroutine
          • Tuple Item Assignment
          • Unsafe Control Flow Inside Finally
          • Use isinstance for Type Checks
          • Void Function Return Value Used
          • Wrong except Clause Order
          • Wrong super() Arguments
          • init Cannot Be a Generator
      • Swift
        • Best Practice
          • Avoid Locks
          • Block Based KVO
          • Nested Ternary
          • Print In Production
          • Utility Type Should Be Enum
        • Code Smell
          • Async Without Await
          • Boolean Return Nil
          • Commented Out Code
          • Compiler Protocol Init
          • Discouraged Optional Boolean
          • Empty Blocks
          • Empty Enum Arguments
          • Empty Parameters
          • For Where
          • Functions Should Not Return Constants
          • Guard Let Shorthand
          • IBOutlet Private
          • If Let Shorthand
          • Implicit Getter
          • Implicitly-Unwrapped Optional
          • Legacy CGGeometry Functions
          • Legacy Constant
          • Legacy Constructor
          • Legacy Hashing
          • Legacy Random
          • Private Action
          • Private Over Fileprivate
          • Redundant @objc Attribute
          • Redundant Discardable Let
          • Redundant Nil Coalescing
          • Redundant Optional Initialization
          • Redundant String Enum Raw Value
          • Same Class Field Names
          • Same Condition
          • Shorthand Operator
          • Static Over Final Class
          • Syntactic Sugar for Collection Types
          • Trailing Semicolon
          • Unneeded Break
          • Unneeded Override
          • Unused Closure Parameter
          • Unused Function Parameter
          • Unused Optional Binding
          • Usage Description Placeholder
          • Vars Should Be Constants
          • Void Function In Ternary
          • Void Return
        • Complexity
          • Cyclomatic Complexity
          • Max Params
          • Nested Callbacks
          • Nested If
        • Dead Code
          • Unreachable Code
          • Unused Declaration
          • Unused Import
          • Unused Local Variable
          • Unused Private Function
        • Documentation
          • Missing Docs
        • Efficiency
          • Avoid Comparing Count To Zero
          • Avoid Max Location Accuracy
          • Cache Date Formatters
          • Contains Over Filter
          • Contains Over First
          • First Predicate
          • FlatMap Over Map Reduce
          • Is Disjoint
          • Last Where
          • Minimize Bluetooth Interaction
          • No Object Instantiation In Loops
          • PBXProj Release Debug Optimization
          • Reduce Into
          • Sorted First / Last
          • Stop Scanning On Found
          • String Concat In Loop
        • Naming Convention
          • Inclusive Language
          • Long Type Name
          • Method Naming Convention
          • Placeholder Identifier
          • Single-Character Identifier
          • Type Naming Convention
        • Reliability
          • Array Subscript Zero
          • Avoid Dangerous Try
          • Class Delegate Protocol
          • Dead Stores
          • Duplicate Conditions
          • Duplicate Enum Cases
          • Duplicate Imports
          • Duplicated Dictionary Key
          • Empty Catch Block
          • Float Equality
          • Forced Type Conversion
          • Forced Unwrapped
          • Hardcoded Absolute Path
          • IBInspectable Typing
          • Identical Operands
          • Local Vars With Global Name
          • No Fallthrough Only
          • Notification Center Detachment
          • Orphaned Doc Comment
          • Overridden Super Call
          • PBXProj Unsigned Release
          • Parameter Shadows Property
          • Return Value Ignored
          • Same Method Field Names
          • Storyboard Custom Class Exists
          • Storyboard IBOutlet / IBAction Exists
          • Storyboard Identifier Exists
          • Storyboard References Banned UIWebView
          • Unconditional Jump
          • Unused Control Flow Label
          • Unused Setter Value
          • Weak Delegate References
          • Weak Self In Closure
          • XCTFail Message
  • XyDocs
  • Unusual Activity Detection

Supported Unusual Activity detectors

The detectors for Unusual Activities listed below are classified by the target resource.

Organization

  • Auditing configuration modified

  • CICD token scope modified

  • CICD token unprotected

  • Compliance framework deleted

  • Compliance framework modified

  • DAST profile modified

  • Environment unprotected

  • Feature flag updated

  • IP restrictions updated

  • Manually triggered housekeeping

  • Organization MFA requirement disabled

  • Organization deleted

  • Organization publicized

  • Organization renamed

Repository

  • Anomalous fork

  • Anomalous Pull Request

  • Commit force pushed

  • Member received Admin permissions

  • Pull Request merged without passing the status checks

  • Repository archived

  • Repository deleted

  • Repository publicized

  • Repository renamed

  • Repository unarchived

  • Potential Script Injection Attack

  • Stale Pull Request merged

  • Tag force pushed

  • Team received Admin permissions

Branch

  • Commit anomalous

  • Commit bypassed branch protection

  • Branch protection disabled

  • Default branch updated

  • Status check requirements modified

  • Unsigned commit

Jenkins Login

  • Failed login attempts

  • Unusual Login

Jenkins Plugin

  • Anomalous plugin installed

Jenkins Project

  • Unusual long time build job

© 2026 Xygeni. All rights reserved