v0.15 is out: rules that were silently dropped on the shipped engine now run, and scans skip your test and mock files by default. Read more →
RULES CATALOGUE

Every rule earns its place.

Each rule maps to a CWE and ships a vulnerable and a safe example. Filter by language, category, severity, or by how often AI coding tools generate it.

OWASP coverage → AI prevalence = how often Copilot / Cursor / Claude generate the anti-pattern by default

Dataflow analysis. 10 rules run in dataflow (taint) mode · OAuthLint traces untrusted input and sensitive data from source to a dangerous sink, catching multi-line bugs that pattern rules miss. See the proof →

281 rules
RULE SEVERITY CATEGORY AI LANG
better-auth's CSRF / origin protection is explicitly disabled.
 ● HIGH betterauth ● MEDIUM js · ts
The better-auth secret is set to a hard-coded string literal.
 ● HIGH betterauth ● HIGH js · ts
better-auth is configured to issue insecure session cookies.
 ● MEDIUM betterauth ● MEDIUM js · ts
A fully-permissive wildcard appears in better-auth's trustedOrigins.
 ● HIGH betterauth ● MEDIUM js · ts
An auth-looking cookie is being set with a maxAge greater than 30 days.
 ● LOW cookie ● MEDIUM js · ts
A session/auth cookie is being set WITHOUT the HttpOnly flag.
 ● MEDIUM cookie ● HIGH js · ts
A session/auth cookie is being set WITHOUT the SameSite attribute.
 ● LOW cookie ● MEDIUM js · ts
A cookie that looks like a session or auth cookie is being set WITHOUT the Secure flag.
 ● MEDIUM cookie ● HIGH js · ts
A cookie is being set with SameSite=None but WITHOUT Secure.
 ● MEDIUM cookie ● MEDIUM js · ts
CORS is configured to allow the literal origin 'null'.
 ● HIGH cors ● MEDIUM js · ts
CORS is configured to echo the request's Origin back as Access-Control-Allow-Origin.
 ● HIGH cors ● MEDIUM js · ts
CORS is configured with Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true at the same time.
 ● HIGH cors ● HIGH js · ts
A cookie is created with HttpOnly = false, making it readable from client-side JavaScript.
 ● HIGH csharp-cookie ● MEDIUM C#
A cookie is set to SameSite = SameSiteMode.None, which removes the SameSite defense and sends the cookie on cross-site requests.
 ● MEDIUM csharp-cookie ● MEDIUM C#
A cookie policy is set to SecurePolicy = CookieSecurePolicy.None, which lets authentication and session cookies be sent over plain HTTP.
 ● HIGH csharp-cookie ● MEDIUM C#
A CORS policy combines credentialed requests with a wildcard or reflected origin (AllowCredentials() together with AllowAnyOrigin() or SetIsOriginAllowed(...) that returns true for everything).
 ● HIGH csharp-cors ● HIGH C#
A symmetric cipher is configured with CipherMode.ECB.
 ● MEDIUM csharp-crypto ● MEDIUM C#
A security-sensitive value is generated with System.Random or Guid.NewGuid() inside a token/secret/OTP generator.
 ● HIGH csharp-crypto ● HIGH C#
A password is hashed with a fast general-purpose digest (MD5, SHA1, SHA256, SHA512) from System.Security.Cryptography.
 ● HIGH csharp-crypto ● HIGH C#
A redirect target comes straight from user input (a query-string value or a returnUrl-style parameter) and is passed to Redirect(...) without a local-URL check.
 ● MEDIUM csharp-flow ● MEDIUM C#
A JWT signing key is built from a hard-coded string literal (new SymmetricSecurityKey(Encoding.UTF8.GetBytes("..."))).
 ● HIGH csharp-jwt ● HIGH C#
A JWT is decoded with a read-only API that performs NO validation (new JwtSecurityToken(tokenString), handler.ReadJwtToken(...), or new JsonWebToken(tokenString)).
 ● MEDIUM csharp-jwt ● HIGH C#
A JWT setup sets RequireExpirationTime = false on TokenValidationParameters.
 ● MEDIUM csharp-jwt ● MEDIUM C#
A JWT setup sets RequireSignedTokens = false on TokenValidationParameters.
 ● HIGH csharp-jwt ● MEDIUM C#
A custom SignatureValidator on TokenValidationParameters returns a parsed token WITHOUT verifying its signature: it just constructs and returns new JwtSecurityToken(token) / new JsonWebToken(token).
 ● HIGH csharp-jwt ● MEDIUM C#
A JWT bearer setup disables audience validation (ValidateAudience = false) on TokenValidationParameters.
 ● HIGH csharp-jwt ● MEDIUM C#
A JWT bearer setup disables issuer validation (ValidateIssuer = false) on TokenValidationParameters.
 ● HIGH csharp-jwt ● MEDIUM C#
A JWT bearer setup disables lifetime validation (ValidateLifetime = false) on TokenValidationParameters.
 ● HIGH csharp-jwt ● MEDIUM C#
A JWT bearer setup disables signature validation (ValidateIssuerSigningKey = false) on TokenValidationParameters.
 ● HIGH csharp-jwt ● MEDIUM C#
An OAuth/OIDC client secret is assigned from a hard-coded string literal (options.ClientSecret = "...").
 ● HIGH csharp-oauth ● HIGH C#
An OpenID Connect handler turns PKCE off (UsePkce = false).
 ● HIGH csharp-oauth ● MEDIUM C#
An OIDC/JWT bearer handler disables HTTPS for its metadata and token exchange (RequireHttpsMetadata = false).
 ● HIGH csharp-oauth ● MEDIUM C#
TLS server-certificate validation is turned off: the handler accepts any certificate via DangerousAcceptAnyServerCertificateValidator or a callback that always returns true.
 ● HIGH csharp-tls ● HIGH C#
The middleware pipeline calls UseAuthorization() BEFORE UseAuthentication().
 ● HIGH csharp-web ● MEDIUM C#
An authentication/authorization middleware does nothing but call next().
 ● HIGH express ● MEDIUM js · ts
An Express session cookie is explicitly configured as insecure.
 ● MEDIUM express ● MEDIUM js · ts
cookie-parser is initialised with a hard-coded string secret (cookieParser('some-secret')).
 ● HIGH express ● MEDIUM js · ts
A Helmet security header is explicitly turned off.
 ● MEDIUM express ● MEDIUM js · ts
A static file handler is configured with dotfiles: 'allow', which serves dotfiles from the mounted directory.
 ● HIGH express ● LOW js · ts
Express is configured to trust EVERY proxy (app.set('trust proxy', true) or the equivalent app.enable('trust proxy')).
 ● MEDIUM express ● MEDIUM js · ts
@fastify/cookie, @fastify/session, or @fastify/secure-session is registered with a hard-coded secret string literal.
 ● HIGH fastify ● HIGH js · ts
@fastify/cors is registered with a wildcard/reflected origin (origin: '*' or origin: true) together with credentials: true.
 ● HIGH fastify ● MEDIUM js · ts
@fastify/jwt is registered with a hard-coded secret string literal.
 ● HIGH fastify ● HIGH js · ts
Fastify is created with trustProxy: true, which trusts EVERY proxy.
 ● MEDIUM fastify ● MEDIUM js · ts
HTTP Basic credentials flow into a logging call (console.* or logger.*).
 ● HIGH flow ● MEDIUM js · ts
A secret credential is placed in a URL query string.
 ● HIGH flow ● HIGH js · ts
Math.random() produces a value whose name marks it as security-sensitive.
 ● HIGH flow ● HIGH js · ts
A /login, /signin, /auth, or /reset-password POST handler is registered without any rate-limit middleware in scope.
 ● LOW flow ● HIGH js · ts
An OAuth/OIDC credential from the request flows into a logging call.
 ● HIGH flow ● MEDIUM js · ts
Untrusted request input flows into a redirect destination.
 ● HIGH flow ● HIGH js · ts
A password validation schema is enforcing a minimum length of less than 8 characters.
 ● MEDIUM flow ● MEDIUM js · ts
A user-supplied password is being persisted WITHOUT being hashed first.
 ● HIGH flow ● MEDIUM js · ts
A secret-shaped value is passed to a logging call.
 ● MEDIUM flow ● HIGH js · ts
A server-side secret read from process.env flows into an HTTP response body.
 ● HIGH flow ● HIGH js · ts
auth.flow.ssrf DATAFLOW
Untrusted request input flows into the URL of an outbound HTTP request.
 ● HIGH flow ● HIGH js · ts
A secret-shaped value (password, token, secret, apiKey, csrf, hmac) is being compared with === / !== / string1 == string2.
 ● MEDIUM flow ● MEDIUM js · ts
A bcrypt cost factor below 10 was used.
 ● MEDIUM flow ● MEDIUM js · ts
A password is being hashed with a fast, general-purpose hash (MD5/SHA-1/SHA-256/SHA-512 via crypto.createHash).
 ● HIGH flow ● HIGH js · ts
A Gin auth/session cookie is written with secure or httpOnly set to a literal false.
 ● HIGH go-cookie ● HIGH go
A session/auth http.Cookie is created with a security attribute explicitly disabled (Secure: false or HttpOnly: false).
 ● HIGH go-cookie ● HIGH go
CORS is configured to allow every origin with the wildcard *.
 ● HIGH go-cors ● HIGH go
An Echo CORS middleware is configured to allow every origin with the wildcard "*".
 ● HIGH go-cors ● HIGH go
A Fiber CORS middleware is configured with the wildcard origin "*".
 ● HIGH go-cors ● HIGH go
bcrypt.GenerateFromPassword is called with a cost factor below 10.
 ● MEDIUM go-crypto ● MEDIUM go
A broken or deprecated block/stream cipher is used to protect data.
 ● HIGH go-crypto ● MEDIUM go
A password is being hashed with a fast, general-purpose digest from the Go standard library (MD5, SHA-1, SHA-256, SHA-512).
 ● HIGH go-crypto ● HIGH go
An OAuth/OIDC credential from the HTTP request flows into a logging call.
 ● HIGH go-flow ● MEDIUM go
Untrusted request data flows into an HTTP redirect destination.
 ● HIGH go-flow ● HIGH go
A server-side secret read from the environment flows into an HTTP response body, leaking it to the client.
 ● HIGH go-flow ● HIGH go
Untrusted request data flows into the URL of an outbound HTTP request.
 ● HIGH go-flow ● HIGH go
A security-sensitive value is being generated with the math/rand package.
 ● HIGH go-flow ● HIGH go
The Echo JWT middleware (labstack/echo-jwt) is configured with a hardcoded string-literal SigningKey.
 ● HIGH go-jwt ● HIGH go
The Fiber JWT middleware (gofiber/contrib/jwt) is configured with a hardcoded string-literal signing key (SigningKey: jwtware.SigningKey{Key: []byte("...")}).
 ● HIGH go-jwt ● HIGH go
A JWT HMAC signing/verification key is hardcoded as a string literal in a call to golang-jwt.
 ● HIGH go-jwt ● HIGH go
A JWT is created or accepted with the none algorithm, which produces an unsigned token.
 ● HIGH go-jwt ● HIGH go
A JWT is decoded with ParseUnverified, which parses the token WITHOUT checking its signature.
 ● HIGH go-jwt ● HIGH go
A JWT parser turns off registered-claims validation with jwt.WithoutClaimsValidation().
 ● MEDIUM go-jwt ● MEDIUM go
A JWT Keyfunc returns the verification key without checking token.Method, enabling algorithm confusion.
 ● HIGH go-jwt ● HIGH go
Untrusted request input flows into the verification key returned by a golang-jwt Keyfunc (or into the WithValidMethods allowlist).
 ● HIGH go-jwt ● LOW go
An oauth2.Config is built with a hardcoded string-literal ClientSecret.
 ● HIGH go-oauth ● MEDIUM go
An OAuth/OIDC endpoint is being contacted over cleartext http://.
 ● HIGH go-oauth ● MEDIUM go
OAuth token request uses the Resource Owner Password Credentials grant (grant_type=password).
 ● HIGH go-oauth ● MEDIUM go
OAuth authorization request is built with a hardcoded, constant state value.
 ● MEDIUM go-oauth ● MEDIUM go
A gorilla/sessions or securecookie store is initialized with a hardcoded string-literal key.
 ● HIGH go-session ● HIGH go
A tls.Config sets InsecureSkipVerify: true, disabling TLS certificate verification.
 ● HIGH go-tls ● HIGH go
A tls.Config is created with MinVersion pinned to an obsolete protocol: SSL 3.0, TLS 1.0, or TLS 1.1.
 ● HIGH go-tls ● MEDIUM go
A session/auth cookie is set with Hono's setCookie(c, name, value, ...) helper WITHOUT the Secure flag, or with secure/httpOnly explicitly disabled.
 ● MEDIUM hono ● MEDIUM js · ts
Hono's cors() middleware is given an origin function that reflects the caller's origin straight back (origin: (origin) => origin) together with credentials: true.
 ● HIGH hono ● MEDIUM js · ts
Hono's jwt() middleware from hono/jwt is configured with a hard-coded secret string literal.
 ● HIGH hono ● HIGH js · ts
A secret-like key (client_secret, token, password, api_key, ...) is assigned a hard-coded literal in this CI workflow instead of being read from the secret store.
 ● MEDIUM iac ● HIGH YAML
This AWS IAM trust policy federates GitHub Actions OIDC (token.actions.githubusercontent.com) with an aud condition but sets no sub condition at all, so ANY GitHub repository, owned by anyone, can assume this role.
 ● HIGH iac ● MEDIUM JSON
This AWS IAM trust policy federates GitHub Actions OIDC (token.actions.githubusercontent.com) but pins the sub claim to a wildcard pattern, so any repository, branch, or pull request matching the glob can assume this role.
 ● HIGH iac ● HIGH JSON
A secret-like attribute (client_secret, token, password, api_key, private_key, ...) is assigned a hard-coded string literal in Terraform.
 ● MEDIUM iac ● HIGH Terraform
This Terraform resource provisions an OAuth client with the implicit grant enabled (grant_types or allowed_oauth_flows contains "implicit").
 ● HIGH iac ● MEDIUM Terraform
This Terraform resource registers an OAuth redirect/callback URL that is either plaintext http:// (not on localhost) or uses a wildcard host.
 ● HIGH iac ● MEDIUM Terraform
A servlet Cookie is created with a security attribute explicitly disabled.
 ● HIGH java-cookie ● HIGH java
CORS is configured to allow every origin with the wildcard *.
 ● HIGH java-cors ● HIGH java
CORS is configured to allow any origin together with credentials.
 ● HIGH java-cors ● MEDIUM java
A JCA Cipher is being created in ECB mode (or with a bare algorithm alias that defaults to ECB).
 ● HIGH java-crypto ● MEDIUM java
A security-sensitive value (token, secret, key, password, nonce, OTP, or salt) is generated with a non-cryptographic PRNG.
 ● HIGH java-crypto ● HIGH java
Spring stores passwords with no hashing.
 ● HIGH java-crypto ● HIGH java
A broken hash algorithm (MD5 or SHA-1) is being instantiated via JCA MessageDigest.getInstance(...).
 ● MEDIUM java-crypto ● MEDIUM java
A password is being hashed with a fast, general-purpose digest from the JCA MessageDigest (MD5, SHA-1, SHA-256, SHA-512).
 ● HIGH java-crypto ● HIGH java
Untrusted request input flows into the URL of an outbound HTTP request.
 ● HIGH java-flow ● HIGH java
A JWT signing key is hard-coded as a string literal (CWE-798).
 ● HIGH java-jwt ● HIGH java
This JWT is verified for signature but its intended-recipient claims are never asserted: the Auth0 JWT.require(alg)...build() verifier pins no withIssuer(...)/withAudience(...), or the jjwt parser sets a signature key but pins no requireIssuer(...)/requireAudience(...).
 ● MEDIUM java-jwt ● MEDIUM java
A JWT is created or verified with the none algorithm, which means there is no signature at all.
 ● HIGH java-jwt ● MEDIUM java
This JWT is created or parsed without a signature, so its contents are neither authenticated nor tamper-proof (CWE-347).
 ● HIGH java-jwt ● MEDIUM java
Untrusted request input flows into the JWT verification key.
 ● HIGH java-jwt ● LOW java
An OAuth 2.0 client secret is hard-coded as a string literal in a Spring Security ClientRegistration builder (.clientSecret("...")).
 ● MEDIUM java-oauth ● MEDIUM java
An OAuth/OIDC endpoint is being contacted over cleartext http://.
 ● HIGH java-oauth ● MEDIUM java
OAuth token request uses the Resource Owner Password Credentials grant (grant_type=password).
 ● HIGH java-oauth ● MEDIUM java
OAuth authorization request sends a hardcoded, constant state value.
 ● MEDIUM java-oauth ● MEDIUM java
Spring Security session fixation protection is disabled via sessionFixation().none().
 ● HIGH java-session ● MEDIUM java
TLS hostname verification is disabled.
 ● HIGH java-tls ● HIGH java
Spring Security CSRF protection is disabled.
 ● HIGH java-web ● HIGH java
Spring Security's X-Frame-Options header is disabled.
 ● MEDIUM java-web ● MEDIUM java
Spring Security authorizes every request without authentication via anyRequest().permitAll().
 ● HIGH java-web ● HIGH java
Spring Security grants permitAll() to a sensitive management path.
 ● MEDIUM java-web ● MEDIUM java
Spring excludes all paths from the security filter chain.
 ● HIGH java-web ● MEDIUM java
Spring permits every request via a catch-all matcher.
 ● HIGH java-web ● HIGH java
JWTs are being verified with the none algorithm in the allowed list.
 ● HIGH jwt ● HIGH js · ts
A JWT is being verified with HS256 (a symmetric algorithm) but the key looks like an RSA / EC public key in PEM format.
 ● HIGH jwt ● MEDIUM js · ts
jwt.decode() from jsonwebtoken only parses the token.
 ● MEDIUM jwt ● HIGH js · ts
ignoreExpiration: true in a jsonwebtoken verify() call disables the exp claim check.
 ● MEDIUM jwt ● HIGH js · ts
A JWT-looking value (header eyJ…) appears in a URL query string or fragment.
 ● HIGH jwt ● MEDIUM js · ts
A JWT is verified with jose jwtVerify(...) but no audience option is passed, so the aud claim is never checked.
 ● MEDIUM jwt ● MEDIUM js · ts
A JWT is verified with jose jwtVerify(...) but no issuer option is passed, so the iss claim is never checked.
 ● MEDIUM jwt ● MEDIUM js · ts
A JWT (or other auth token) is being written to localStorage.
 ● MEDIUM jwt ● HIGH js · ts
jwt.verify(...) is called without an explicit algorithms allowlist.
 ● MEDIUM jwt ● HIGH js · ts
JWT is being verified without checking the aud (audience) claim.
 ● MEDIUM jwt ● MEDIUM js · ts
JWT is signed without any expiresIn / exp claim, OR a token is verified without an maxAge check.
 ● MEDIUM jwt ● HIGH js · ts
JWT is being verified without checking the iss (issuer) claim.
 ● LOW jwt ● LOW js · ts
Untrusted request input flows into the verification key or the algorithms allowlist of jwt.verify(...).
 ● HIGH jwt ● LOW js · ts
JWT signing or verification uses a hard-coded secret.
 ● HIGH jwt ● HIGH js · ts
An authentication / OAuth endpoint is called over cleartext http://.
 ● MEDIUM kotlin-android ● MEDIUM Kotlin
An OAuth client secret / API key / password is assigned from a hard-coded string literal.
 ● HIGH kotlin-android ● HIGH Kotlin
An AppAuth AuthorizationRequest.Builder explicitly disables PKCE with .setCodeVerifier(null).
 ● MEDIUM kotlin-android ● LOW Kotlin
An auth token / secret is written to plain SharedPreferences (prefs.edit().putString("auth_token", ...)).
 ● HIGH kotlin-android ● HIGH Kotlin
An OAuth authorization URL is loaded inside an in-app WebView (webView.loadUrl("...authorize?client_id=...")).
 ● MEDIUM kotlin-android ● HIGH Kotlin
A WebViewClient.onReceivedSslError(...) handler calls handler.proceed(), telling the WebView to ignore a TLS certificate error and load the page anyway.
 ● HIGH kotlin-android ● MEDIUM Kotlin
A Ktor session cookie is configured without cookie.secure = true, so the browser will send it over plain HTTP as well as HTTPS.
 ● MEDIUM kotlin-cookie ● MEDIUM Kotlin
A Ktor CORS configuration combines anyHost() with allowCredentials = true.
 ● HIGH kotlin-cors ● HIGH Kotlin
A JWT signer or verifier is built with Algorithm.none(), the unsecured algorithm that produces (and accepts) tokens with no signature.
 ● HIGH kotlin-jwt ● MEDIUM Kotlin
A JWT is decoded but its signature is never verified.
 ● MEDIUM kotlin-jwt ● HIGH Kotlin
This JWT verifier checks the signature but never asserts the token's intended recipient: the Auth0 JWT.require(alg)...build() chain pins no .withIssuer(...) and no .withAudience(...).
 ● MEDIUM kotlin-jwt ● MEDIUM Kotlin
A JWT signing key is built from a hard-coded string literal (Algorithm.HMAC256("...")).
 ● HIGH kotlin-secret ● HIGH Kotlin
This MCP StreamableHTTPServerTransport is created without DNS-rebinding protection (CWE-346).
 ● HIGH mcp ● HIGH js · ts
This MCP server enforces bearer auth via requireBearerAuth(...) but passes no resourceMetadataUrl.
 ● MEDIUM mcp ● HIGH js · ts
This MCP StreamableHTTPServerTransport derives its session id from a predictable source: Date.now(), Math.random(), or an incrementing counter (CWE-330).
 ● MEDIUM mcp ● MEDIUM js · ts
An MCP server forwards the INCOMING caller token to an upstream API (token pass-through).
 ● HIGH mcp ● HIGH js · ts
An argument of an MCP tool handler (server.registerTool / server.tool) flows into an outbound HTTP request without validation, a server-side request forgery (SSRF, CWE-918).
 ● HIGH mcp ● HIGH js · ts
This MCP transport is mounted on an Express route with NO auth middleware.
 ● HIGH mcp ● HIGH js · ts
NestJS app.enableCors() is configured with a wildcard/reflected origin (origin: '*' or origin: true) together with credentials: true.
 ● HIGH nestjs ● MEDIUM js · ts
A NestJS guard's canActivate returns a constant true.
 ● HIGH nestjs ● MEDIUM js · ts
A NestJS JwtModule is configured with a hard-coded secret (or secretOrPrivateKey) string literal.
 ● HIGH nestjs ● HIGH js · ts
The NextAuth/Auth.js authorized callback returns true unconditionally.
 ● HIGH nextauth ● HIGH js · ts
A NextAuth/Auth.js custom cookie is configured as insecure.
 ● MEDIUM nextauth ● MEDIUM js · ts
The NextAuth/Auth.js config hard-codes debug: true.
 ● MEDIUM nextauth ● MEDIUM js · ts
The NextAuth/Auth.js secret is set to a hard-coded string literal.
 ● HIGH nextauth ● HIGH js · ts
The NextAuth/Auth.js redirect callback returns the incoming url without validating it against baseUrl.
 ● HIGH nextauth ● HIGH js · ts
The NextAuth/Auth.js session callback copies an OAuth token onto the session object.
 ● MEDIUM nextauth ● MEDIUM js · ts
An OAuth access_token (or refresh_token / id_token) is placed in a URL query string.
 ● MEDIUM oauth ● MEDIUM js · ts
OAuth scope request includes an over-broad scope such as admin, full_access, *, or repo (entire GitHub access).
 ● LOW oauth ● HIGH js · ts
An OAuth client_secret (or similarly sensitive credential) is being assigned a hard-coded string literal.
 ● HIGH oauth ● HIGH js · ts
OAuth implicit flow is deprecated by the OAuth 2.0 Security BCP (RFC 9700) and the OAuth 2.1 draft.
 ● HIGH oauth ● MEDIUM js · ts
An OAuth/OIDC endpoint is being contacted over cleartext http://.
 ● HIGH oauth ● MEDIUM js · ts
An OAuth token-lifetime field is set to a literal value longer than 24 hours.
 ● MEDIUM oauth ● MEDIUM js · ts
OIDC authorization request (scope contains openid) is being built WITHOUT a nonce parameter.
 ● MEDIUM oauth ● MEDIUM js · ts
OAuth authorization request from a public client omits the PKCE code_challenge parameter.
 ● MEDIUM oauth ● HIGH js · ts
OAuth 2.0 authorization request is being built WITHOUT a state parameter.
 ● HIGH oauth ● HIGH js · ts
OAuth callback handler reads state from the request but never compares it to a stored value.
 ● MEDIUM oauth ● HIGH js · ts
The OAuth callback handler redirects to a URL taken straight from the request without validating it.
 ● HIGH oauth ● HIGH js · ts
PKCE is configured with code_challenge_method=plain.
 ● MEDIUM oauth ● MEDIUM js · ts
OAuth token request uses the Resource Owner Password Credentials grant (grant_type=password).
 ● HIGH oauth ● MEDIUM js · ts
OAuth authorization request sends a hardcoded, constant state value.
 ● MEDIUM oauth ● MEDIUM js · ts
An OAuth/OIDC token is written to localStorage / sessionStorage, readable by any script on the origin.
 ● MEDIUM oauth ● HIGH js · ts
OAuth redirect_uri allow-list contains a wildcard, an http:// URL, or localhost.
 ● HIGH oauth ● MEDIUM js · ts
A passport-jwt strategy is configured with ignoreExpiration: true.
 ● MEDIUM passport ● MEDIUM js · ts
An authentication-related cookie is set without the Secure and/or HttpOnly flags (or with SameSite=None).
 ● MEDIUM php-cookie ● HIGH PHP
A Laravel session config hard-codes an insecure cookie flag: 'secure' => false, 'http_only' => false, or 'same_site' => 'none'.
 ● MEDIUM php-cookie ● MEDIUM PHP
This endpoint sends Access-Control-Allow-Credentials: true together with an Access-Control-Allow-Origin that is either the wildcard * or the request's own Origin reflected back unchecked.
 ● MEDIUM php-cors ● MEDIUM PHP
A Laravel Socialite OAuth flow calls ->stateless(), which disables the state parameter that ties the redirect to the user's session.
 ● MEDIUM php-flow ● MEDIUM PHP
A JWT payload is read by hand (json_decode(base64_decode($parts[1])) on the second dot-segment of a token) without ever verifying the signature.
 ● HIGH php-jwt ● HIGH PHP
A JWT is configured with an unsecured / none signer, e.g. Configuration::forUnsecuredSigner() or new Signer\None() (lcobucci/jwt), or the 'none' algorithm passed to JWT::encode() / new Key(...) (firebase/php-jwt).
 ● HIGH php-jwt ● MEDIUM PHP
A JWT signing key is a hard-coded string literal, passed to JWT::encode() / new Key() (firebase/php-jwt) or InMemory::plainText() / InMemory::base64Encoded() (lcobucci/jwt).
 ● HIGH php-secret ● HIGH PHP
A PHP session hardening flag is turned off at runtime with ini_set(): session.cookie_httponly, session.cookie_secure, or session.use_only_cookies set to 0 / '0' / false.
 ● MEDIUM php-session ● MEDIUM PHP
A session/auth cookie is issued with a security attribute explicitly disabled.
 ● HIGH py-cookie ● HIGH python
Flask-CORS allows any origin while credentials are enabled.
 ● HIGH py-cors ● MEDIUM python
FastAPI CORS allows any origin with credentials.
 ● HIGH py-cors ● HIGH python
A symmetric cipher is configured in ECB mode.
 ● MEDIUM py-crypto ● MEDIUM python
passlib configured with a weak or plaintext password scheme.
 ● HIGH py-crypto ● MEDIUM python
django-cors-headers is configured to allow every origin, disabling cross-origin access control.
 ● MEDIUM py-django ● MEDIUM python
DRF disables authentication globally with an empty DEFAULT_AUTHENTICATION_CLASSES list.
 ● HIGH py-drf ● MEDIUM python
DRF makes every endpoint public because DEFAULT_PERMISSION_CLASSES is set to AllowAny.
 ● HIGH py-drf ● HIGH python
A DRF view disables authentication with an empty authentication_classes list.
 ● HIGH py-drf ● MEDIUM python
A FastAPI security dependency (Security(...), an API-key scheme such as APIKeyHeader/APIKeyQuery/APIKeyCookie, or an OAuth2 bearer scheme) injects a credential that is then compared against a hard-coded string literal.
 ● HIGH py-fastapi ● MEDIUM python
A FastAPI HTTP Basic auth dependency compares the request's username or password against a hard-coded string literal.
 ● HIGH py-fastapi ● HIGH python
Starlette's SessionMiddleware is configured with a hard-coded secret_key string literal.
 ● HIGH py-fastapi ● HIGH python
Starlette's TrustedHostMiddleware is added but configured to trust every Host header (allowed_hosts=["*"], or a list that contains "*").
 ● MEDIUM py-fastapi ● MEDIUM python
A Flask cookie security flag is disabled through app.config, weakening session and remember-me cookie protection.
 ● HIGH py-flask ● MEDIUM python
A Django view disables CSRF protection.
 ● MEDIUM py-flow ● HIGH python
Debug mode is hard-coded to True.
 ● MEDIUM py-flow ● HIGH python
A security-sensitive value is being generated with the random module.
 ● HIGH py-flow ● HIGH python
An OAuth/OIDC credential from the request flows into a logging call.
 ● HIGH py-flow ● MEDIUM python
Untrusted request data flows into a Flask redirect(...) without validation, an open redirect (CWE-601).
 ● HIGH py-flow ● HIGH python
A requests call disables TLS certificate verification with verify=False.
 ● HIGH py-flow ● HIGH python
A server-side secret read from the environment flows into an HTTP response sent back to the client, leaking it (CWE-200).
 ● HIGH py-flow ● HIGH python
Untrusted request data flows into an outbound HTTP request without validation, a Server-Side Request Forgery (SSRF, CWE-918).
 ● HIGH py-flow ● HIGH python
A password is being hashed with a fast, general-purpose digest from hashlib (MD5, SHA-1, SHA-256, SHA-512).
 ● HIGH py-flow ● HIGH python
A JWT is decoded or signed with the none algorithm.
 ● HIGH py-jwt ● HIGH python
A JWT is decoded with an algorithms allowlist that mixes an HMAC algorithm with an asymmetric one.
 ● HIGH py-jwt ● MEDIUM python
A JWT signing/verification key is hardcoded as a string literal in the call to PyJWT.
 ● HIGH py-jwt ● HIGH python
A JWT is decoded with a verification key but WITHOUT an explicit algorithms allowlist.
 ● MEDIUM py-jwt ● HIGH python
A JWT is decoded with options={"verify_exp": False}, which turns off PyJWT's exp (expiration) check.
 ● MEDIUM py-jwt ● HIGH python
A JWT is decoded with signature verification disabled.
 ● HIGH py-jwt ● HIGH python
PyJWT jwt.decode(...) verifies the signature (an algorithms list is given) but passes no audience, so the aud claim is not checked.
 ● MEDIUM py-jwt ● MEDIUM python
Untrusted request input flows into the verification key or the algorithms allowlist of jwt.decode(...) (PyJWT / python-jose).
 ● HIGH py-jwt ● LOW python
PyJWT decode disables audience or issuer checks.
 ● MEDIUM py-jwt ● MEDIUM python
This FastMCP server binds to 0.0.0.0 and serves a network transport (streamable-http / SSE) without DNS-rebinding protection (CWE-346).
 ● MEDIUM py-mcp ● MEDIUM python
This MCP server enables auth via AuthSettings(...) but never sets resource_server_url.
 ● MEDIUM py-mcp ● HIGH python
This MCP server declares a resource_server_url but does not set validate_token_resource=True on AuthSettings.
 ● HIGH py-mcp ● HIGH python
An MCP server forwards the INCOMING caller token to an upstream API (token pass-through).
 ● HIGH py-mcp ● HIGH python
An argument of an MCP tool handler (@mcp.tool()) flows into an outbound HTTP request without validation, a server-side request forgery (SSRF, CWE-918).
 ● HIGH py-mcp ● HIGH python
This MCP server is exposed over a NETWORK transport (streamable-http / SSE) but was constructed with no authentication: no auth= and no token_verifier=.
 ● HIGH py-mcp ● HIGH python
An OAuth client secret is passed as a string literal to the OAuth client.
 ● HIGH py-oauth ● HIGH python
An OAuth/OIDC endpoint is being contacted over cleartext http://.
 ● HIGH py-oauth ● MEDIUM python
OAUTHLIB_INSECURE_TRANSPORT is set, disabling oauthlib's HTTPS requirement for OAuth flows.
 ● HIGH py-oauth ● HIGH python
OAuth token request uses the Resource Owner Password Credentials grant (grant_type=password).
 ● HIGH py-oauth ● MEDIUM python
OAuth authorization request sends a hardcoded, constant state value.
 ● MEDIUM py-oauth ● MEDIUM python
An OAuth client fetches or refreshes a token with TLS certificate verification disabled (verify=False).
 ● HIGH py-oauth ● MEDIUM python
The Django SECRET_KEY is set to a hard-coded string literal in settings.
 ● HIGH py-secret ● HIGH python
The Flask SECRET_KEY (used to sign session cookies and CSRF tokens) is set to a hard-coded string literal.
 ● HIGH py-secret ● HIGH python
The Rails cookie session store is configured with secure: false or httponly: false.
 ● MEDIUM ruby-cookie ● MEDIUM Ruby
A rack-cors allow block combines origins '*' with credentials: true.
 ● MEDIUM ruby-cors ● HIGH Ruby
A JWT is encoded or decoded with the none algorithm, which produces (and accepts) unsigned tokens.
 ● HIGH ruby-jwt ● MEDIUM Ruby
JWT.decode is called with its third positional argument set to false, which disables signature verification entirely.
 ● HIGH ruby-jwt ● HIGH Ruby
JWT.decode is called with verification enabled (true) but no algorithm: / algorithms: option, so the library trusts whatever alg the token header names.
 ● MEDIUM ruby-jwt ● HIGH Ruby
A Doorkeeper (OAuth provider) initializer weakens a core protection: force_ssl_in_redirect_uri false allows plaintext http:// redirect URIs (authorization codes/tokens travel in cleartext and are open to interception/redirect tampering, CWE-601); allow_blank_redirect_uri true accepts clients with no registered redirect URI; and an unconditional skip_authorization do true end auto-approves EVERY client with no user consent.
 ● MEDIUM ruby-oauth ● MEDIUM Ruby
OmniAuth is configured to accept GET requests on the request phase (allowed_request_methods includes :get, or silence_get_warning is set to true).
 ● MEDIUM ruby-oauth ● MEDIUM Ruby
An OmniAuth provider is configured with provider_ignores_state: true, which disables verification of the OAuth state parameter on the callback.
 ● HIGH ruby-oauth ● MEDIUM Ruby
The HMAC key passed to JWT.encode / JWT.decode is a hard-coded string literal.
 ● HIGH ruby-secret ● HIGH Ruby
A Rails secret_key_base / secret_key is assigned a hard-coded string literal.
 ● HIGH ruby-secret ● MEDIUM Ruby
A Rails controller disables CSRF protection with skip_before_action :verify_authenticity_token.
 ● MEDIUM ruby-session ● HIGH Ruby
A session/auth cookie is built with a security attribute explicitly disabled (secure(false) or http_only(false)).
 ● HIGH rust-cookie ● HIGH rust
A wide-open CORS policy is configured.
 ● HIGH rust-cors ● MEDIUM rust
bcrypt::hash (or bcrypt::hash_with_result) is called with a cost factor below 10.
 ● MEDIUM rust-crypto ● MEDIUM rust
A broken or deprecated cipher from the RustCrypto ecosystem is used to protect data.
 ● HIGH rust-crypto ● MEDIUM rust
A password is hashed with a fast, general-purpose digest unsuitable for password storage.
 ● HIGH rust-crypto ● HIGH rust
Untrusted request input flows into the URL of an outbound HTTP request.
 ● HIGH rust-flow ● HIGH rust
A secret-shaped value (password, token, secret, apikey, hmac, signature, mac, digest) is being compared with == / !=.
 ● MEDIUM rust-flow ● MEDIUM rust
A jsonwebtoken Validation accepts both HMAC and asymmetric algorithms, enabling algorithm confusion.
 ● HIGH rust-jwt ● MEDIUM rust
Validation::insecure_disable_signature_validation() turns off JWT signature verification.
 ● HIGH rust-jwt ● MEDIUM rust
A JWT HMAC signing/verification key is hardcoded as a literal.
 ● HIGH rust-jwt ● HIGH rust
JWT audience (aud) validation is disabled by setting validate_aud: false on the jsonwebtoken Validation.
 ● MEDIUM rust-jwt ● MEDIUM rust
JWT expiration validation is turned off by setting validate_exp: false on the jsonwebtoken Validation.
 ● HIGH rust-jwt ● MEDIUM rust
A JWT is decoded with a jsonwebtoken Validation that never sets the expected issuer.
 ● MEDIUM rust-jwt ● MEDIUM rust
An OAuth client_secret is hardcoded as a string literal and passed to the oauth2 crate's ClientSecret::new(...).
 ● HIGH rust-oauth ● HIGH rust
An OAuth/OIDC endpoint is being contacted over cleartext http://.
 ● HIGH rust-oauth ● MEDIUM rust
OAuth token request uses the Resource Owner Password Credentials grant (grant_type=password).
 ● HIGH rust-oauth ● MEDIUM rust
OAuth authorization request is built with a hardcoded, constant state value (CsrfToken::new("literal")).
 ● MEDIUM rust-oauth ● MEDIUM rust
A reqwest client is built with danger_accept_invalid_certs(true), which turns off TLS certificate validation.
 ● HIGH rust-tls ● HIGH rust
A reqwest client is built with danger_accept_invalid_hostnames(true), which turns off TLS hostname verification.
 ● HIGH rust-tls ● HIGH rust
A hard-coded credential matching a well-known provider's key format was found in the source.
 ● HIGH secret ● HIGH js · ts
A secret is being read from an environment variable whose name carries a client-public prefix.
 ● HIGH secret ● HIGH js · ts
An express-session / cookie-session secret is a hard-coded string literal.
 ● HIGH session ● HIGH js · ts
A session token / id appears in a URL query string.
 ● HIGH session ● MEDIUM js · ts
The user is marked as logged in without first regenerating the session id.
 ● MEDIUM session ● MEDIUM js · ts
A Vapor CORSMiddleware.Configuration combines allowedOrigin: .all (the * wildcard) with allowCredentials: true.
 ● MEDIUM swift-cors ● MEDIUM Swift
An ASWebAuthenticationSession explicitly sets prefersEphemeralWebBrowserSession = false.
 ● MEDIUM swift-flow ● MEDIUM Swift
An OAuth / OpenID authorization URL is loaded inside a WKWebView.
 ● MEDIUM swift-flow ● MEDIUM Swift
A JWTKit HMAC signing key is registered from a hard-coded string literal (add(hmac: "...", ...)).
 ● HIGH swift-jwt ● MEDIUM Swift
A Keychain item is created with kSecAttrAccessibleAlways (or kSecAttrAccessibleAlwaysThisDeviceOnly).
 ● MEDIUM swift-keychain ● MEDIUM Swift
A secret, API key, token, or password is assigned from a hard-coded string literal.
 ● HIGH swift-secret ● HIGH Swift
A token, secret, or credential is bound to @AppStorage.
 ● MEDIUM swift-storage ● HIGH Swift
A token, secret, or credential is written to UserDefaults.
 ● HIGH swift-storage ● HIGH Swift
TLS certificate validation is disabled for this connection.
 ● HIGH tls ● HIGH js · ts
An exported activity registers a BROWSABLE intent-filter for a custom-scheme OAuth redirect (android:scheme="com.example.app" with an oauth/callback/ redirect host).
 ● MEDIUM xml-android ● MEDIUM XML
A credential (client secret, API key, password, bearer token) is hard-coded as a value in res/values/strings.xml.
 ● HIGH xml-android ● HIGH XML
The manifest sets android:usesCleartextTraffic="true" on <application>, re-enabling plaintext HTTP for the entire app.
 ● HIGH xml-android ● HIGH XML
A network-security-config permits cleartext traffic (cleartextTrafficPermitted="true") in a <base-config> or in a <domain-config> that is not restricted to a loopback dev host.
 ● MEDIUM xml-android ● MEDIUM XML