Check catalog

The application drops and recreates database tables when it starts: Sequelize sync({ force: true }) runs DROP TABLE for every model, and TypeORM dropSchema: true drops the schema on each connection. A restart or deploy in production deletes all data. The application drops all tables (SQLAlchemy metadata.drop_all / Flask-SQLAlchemy db.drop_all()) in application code. When this runs on start-up or from a request, a restart or deploy in production deletes all data.

The application alters database tables to match its models every time it starts (Sequelize sync({ alter: true })). Schema changes made this way are not reviewed or versioned and can drop or rewrite columns and data when a model changes; on a large table the ALTER also locks it during a deploy.

TypeORM synchronize: true is set unconditionally, so every application start changes the database schema to match the entities. Renaming or removing a property drops the column and its data in production, without a reviewed migration.

A database query runs inside a loop, once per item (the N+1 query pattern). The number of round trips grows with the data, so code that is fast on a development database becomes slow and holds connections for longer once real tables and lists grow.

One database read is started per item with Promise.all(items.map(...)) (the N+1 query pattern, run concurrently). The page is not slower for short lists, but a long list opens as many queries at once: they queue for the connection pool and add database load proportional to the list size.

A database query runs inside a loop, once per item (the N+1 query pattern). The number of round trips grows with the data, so code that is fast on a development database becomes slow and holds connections for longer once real collections and lists grow.

A database query runs inside a loop, once per iteration (the N+1 query pattern). The number of round trips grows with the data, so code that is fast on a development database becomes slow and holds connections for longer once real tables and lists grow.

A GET endpoint returns the result of a list query that has no row limit. Every request loads and serialises the whole table (or everything matching the filter), so response time, memory use and database load grow without bound as the data grows, and one request can be enough to slow the service down.

A GET endpoint returns the result of a list query that has no row limit. Every request loads and serialises the whole collection (or everything matching the filter), so response time, memory use and database load grow without bound as the data grows, and one request can be enough to slow the service down.

The Vite define option copies an LLM provider API key into the client bundle. Every visitor of the app can read the key and call the provider on your account. An LLM provider API key is used by code that runs in the browser. Anyone who opens the app can read the key from the bundle or the network tab and call the provider on your account.

A model call driven by request input sets no output token limit. Each request can generate up to the model's maximum output, so a user (or a script) can drive cost and latency up with a single prompt.

Text generated by a language model is executed as code or as a shell command. Anyone who can influence the model's input (a chat message, a web page or document it reads) can use prompt injection to make it emit code that then runs with the server's privileges. Text generated by a language model is executed as code, as a shell command or as a template. Anyone who can influence the model's input (a chat message, a web page or document it reads) can use prompt injection to make it emit code that then runs with the server's privileges.

A file path chosen by a language model is used to write or delete files. A prompt-injected response can point it outside the intended directory (../, absolute paths) and overwrite source code, shell profiles or credentials.

Text generated by a language model is inserted into the page as HTML without sanitisation. A prompt-injected response can carry script tags or event handlers (cross-site scripting), or image links that leak the conversation to another site. Text generated by a language model is rendered as HTML without sanitisation. A prompt-injected response can carry script tags or event handlers (cross-site scripting), or image links that leak the conversation to another site.

A query generated by a language model is executed as raw SQL. A prompt-injected request can make the model write any statement the database user is allowed to run: reading other users' rows, changing data or dropping tables.

Request input is interpolated into the system prompt. Text placed in the system role carries the developer's authority, so a user can rewrite the model's instructions (prompt injection) instead of merely asking it a question.

An LLM tool (function calling / MCP tool) passes arguments chosen by the model straight to a shell, to code evaluation or to raw SQL without an allow-list. Prompt injection in any content the agent reads can steer the model into calling the tool with an arbitrary command or query.

defer inside a loop runs only when the surrounding function returns, not at the end of each iteration. Resources such as files or locks pile up until then.

The error is checked but the branch is empty, so the failure is silently ignored.

errors.New(fmt.Sprintf(...)) is a roundabout fmt.Errorf(...) and cannot wrap errors with %w.

Both operands are identical, so the expression is constant. This is almost always a copy-paste mistake.

A variable is assigned to itself. This has no effect and usually indicates a typo.

Catching Throwable or Error also catches OutOfMemoryError, StackOverflowError and other conditions the application cannot recover from.

Empty catch block. The exception is silently discarded, which hides failures and makes bugs hard to diagnose.

printStackTrace() writes to stderr and bypasses the logging framework; it may also leak internals.

A variable is assigned to itself. This has no effect and usually indicates a missing this..

Strings are compared with == / !=, which compares object identity instead of content. The result depends on interning and is usually wrong.

An async callback is passed to forEach. forEach ignores the returned promises, so the surrounding code does not wait for them and their rejections are unhandled.

An async function is used as a Promise executor. Errors thrown after the first await are lost instead of rejecting the promise, and the wrapper is usually unnecessary.

Comparing with NaN is always false (or always true for !=). NaN is not equal to anything, including itself.

A debugger statement was left in the code.

This else-if branch repeats an earlier condition in the same chain, so it can never run.

Empty catch block. The error is silently discarded, which hides failures and makes bugs hard to diagnose.

Both operands are identical, so the expression is constant or redundant. This is almost always a copy-paste mistake.

A variable is assigned to itself. This has no effect and usually indicates a typo.

The catch block only rethrows the caught error, so the try/catch adds nothing.

A debugging dump (var_dump, print_r, var_export, dd, dump) was left in the code.

Empty catch block. The exception is silently discarded, which hides failures and makes bugs hard to diagnose.

The @ operator suppresses every error raised by the expression, hiding failures such as missing files or network errors.

assert (condition, message) asserts a non-empty tuple, which is always true, so the assertion never fails.

A bare except: silently swallows every exception, including KeyboardInterrupt and SystemExit.

except Exception: pass silently discards every error raised in the try block, which hides real failures.

Comparison to None with ==/!= can be overridden by __eq__; use is / is not.

This elif branch repeats an earlier condition in the same chain, so it can never run.

is compares identity, not value. Comparing against a str/int/bytes literal with is depends on interpreter caching and can silently return False.

A mutable default argument is created once and shared between calls, so changes made in one call leak into the next.

A variable is assigned to itself. This has no effect and usually indicates a typo.

A debugger breakpoint (binding.pry, binding.irb, byebug, debugger) was left in the code.

The rescue clause is empty, so the error is silently discarded.

rescue Exception also rescues SignalException, SystemExit and NoMemoryError, so the process can no longer be interrupted or shut down cleanly.

$FN runs synchronously inside a request handler. Node.js serves every request of the process on one thread, so while this call reads or writes a file, waits for a child process or hashes (bcrypt, scrypt and PBKDF2 take tens to hundreds of milliseconds by design), no other request is handled.

$FN hashes a password synchronously. Password checks run on the login and sign-up request path, and bcrypt's cost factor makes each call take tens to hundreds of milliseconds, during which the Node.js process serves no other request.

$CALL blocks inside a coroutine. Async frameworks (FastAPI, Starlette, aiohttp, Django async views) serve every request of a worker on one event loop thread, so while this call waits on the network, a timer or a child process, or hashes a password, no other request on that worker makes progress.

$CLIENT is created inside a request handler. Every request then opens its own database connections (or a whole pool) and pays for the handshake and authentication, and under load the connections pile up until the database refuses new ones.

$CALL opens a new database connection or client inside the route handler $F, so every request pays for a TCP and TLS handshake and authentication, and concurrent requests can exhaust the database's connection limit.

http.Client is created without a Timeout and used in the same function for requests that carry no context deadline, so a slow or unresponsive server blocks the call indefinitely.

$CALL sends the request through http.DefaultClient, which has no timeout. A slow or unresponsive server keeps the goroutine, its connection and everything waiting on the result blocked indefinitely.

HttpClient.newHttpClient() creates a client without a connect timeout, and its requests have no response timeout unless each HttpRequest sets one, so an unresponsive server blocks the caller indefinitely.

new RestTemplate() uses the JDK's default HttpURLConnection settings, which have no connect or read timeout, so a slow or unresponsive upstream blocks the calling thread (and the request it serves) indefinitely.

An axios request is sent without a timeout through the global axios instance, whose default is to wait indefinitely. A slow or unresponsive upstream keeps the request, and whatever is waiting on it, open forever.

axios.create builds an HTTP client without a timeout. axios waits indefinitely by default, so a slow or unresponsive upstream keeps each request, and whatever is waiting on it, open forever.

GuzzleHttp\Client is created without a timeout. Guzzle's default of 0 waits indefinitely, so a slow or unresponsive upstream holds the PHP worker serving this request until the web server kills it.

$CALL is called without a timeout. Requests waits forever by default, so a single slow or unresponsive upstream can hold this worker, and every request queued behind it, indefinitely.

$CALL explicitly disables the client's timeout. httpx and aiohttp time out by default; turning that off lets a single slow or unresponsive upstream hold the request open indefinitely.

$CALL is called without a timeout. It then falls back to the global socket default, which is no timeout at all unless the process sets one, so an unresponsive server blocks the caller indefinitely.

axios.defaults.timeout is set (vetkit internal marker, never reported).

The Android app explicitly enables android:allowBackup. App data, including tokens stored in SharedPreferences or databases, can be extracted with adb backup or cloud backup.

The Android app allows cleartext HTTP traffic for all domains (android:usesCleartextTraffic="true"). Data and session tokens can be read or modified on the network.

The Android manifest hard-codes android:debuggable="true". Release builds become debuggable, so anyone with the device can attach a debugger, read app data and run code in the app's process.

An exported Android content provider has no read/write permission. Any installed app can query or modify the data it serves (and use path traversal tricks if it serves files).

An exported Android broadcast receiver has no android:permission. Any installed app can send it intents, including forged system-like broadcasts.

An exported Android service has no android:permission. Any installed app can start or bind to it and invoke its functionality.

The Android app declares android:sharedUserId. Apps sharing a user ID share data and permissions, so a weakness in one of them exposes the other; the attribute is deprecated.

The Android manifest sets android:testOnly="true", a flag meant only for test builds that should not be part of a shipped configuration.

A custom Android permission uses the normal or dangerous protection level (or none, which means normal). Any app can obtain it, so it does not protect the components that require it.

The Android network security config permits cleartext HTTP for every domain (<base-config cleartextTrafficPermitted="true">).

The Android network security config trusts user-installed CA certificates outside debug-overrides. Anyone who can get a user to install a certificate can intercept the app's TLS traffic.

Apache explicitly enables the HTTP TRACE method (TraceEnable on), which echoes request headers (including cookies) back to the client.

Apache directory listing is enabled (Options Indexes). Files in the directory that are not linked anywhere, such as backups or configuration files, can be listed and downloaded.

Apache enables an obsolete SSL/TLS protocol version (SSLv2, SSLv3, TLSv1 or TLSv1.1) in SSLProtocol. These versions are deprecated by RFC 8996.

Apache enables a broken cipher suite (RC4, DES/3DES, NULL, EXPORT, LOW, MD5 or anonymous key exchange) in SSLCipherSuite.

An ASP.NET Core settings file that is not Development-only enables DetailedErrors. Blazor and the host then send exception details to the browser.

ASP.NET custom errors are switched off (<customErrors mode="Off">). Remote users see full exception details and stack traces.

ASP.NET compiles the application in debug mode (<compilation debug="true">). Debug builds disable optimisations and request timeouts and can expose detailed error information.

IIS directory browsing is enabled (<directoryBrowse enabled="true">). Unlinked files in the site directory can be listed and downloaded.

ASP.NET tracing is enabled for remote clients (<trace enabled="true" localOnly="false">). trace.axd then shows request details, headers, cookies and session state to anyone.

ASP.NET request validation is disabled for the whole application (validateRequest="false"). Script and markup in request input is no longer rejected before it reaches pages.

ASP.NET ViewState MAC validation is disabled (enableViewStateMac="false"). Attackers can tamper with ViewState and, through deserialization, execute code on the server.

A command line built from program arguments, environment variables or received data is run through the shell (command injection).

AES is used in ECB mode; equal plaintext blocks produce equal ciphertext blocks, which leaks data patterns.

A key, token, salt or nonce is generated with rand() / random() or RAND_pseudo_bytes, which are not cryptographically secure.

DES, 3DES, RC4, RC2 or Blowfish is used; these ciphers are broken or have a 64-bit block size.

A password or secret is hashed with MD5 / SHA-1, which can be brute-forced quickly.

A signature or certificate is created or verified over an MD5 / SHA-1 digest, which is not collision resistant.

A printf-family function receives a non-constant string as its format and no further arguments; %n / %s in that string read or write arbitrary memory.

The same pointer is passed to free() a second time without being reassigned in between (double free).

gets() reads a line without any length limit; every call can overflow the destination buffer.

A command-line argument or environment variable is copied into a buffer with strcpy / strcat / sprintf, which does not check the destination size.

A function returns the address of one of its own stack variables; the memory is invalid as soon as the function returns.

A scanf-family call reads a string with %s or %[ and no field width, so long input overflows the buffer.

strcpy / strcat / sprintf("%s") copies a non-constant string without a destination size, a common source of buffer overflows.

A pointer is dereferenced after it was passed to free() and before it is reassigned (use after free).

A file or directory is made writable by every local user (mode with the other-write bit set).

chroot() is called without a following chdir("/"); the current directory stays outside the jail, so it can be escaped.

The result of setuid / setgid / setgroups is ignored; if the call fails the program keeps running with elevated privileges.

A file is checked with access() and then opened by name; the file can be swapped (e.g. for a symlink) between the check and the use.

mktemp / tmpnam / tempnam only return a name; another process can create that file before it is opened (insecure temporary file).

libcurl peer or host verification is switched off, so the TLS connection can be intercepted (man-in-the-middle).

A TLS client context is set to SSL_VERIFY_NONE, so the server certificate is not checked (man-in-the-middle).

The Capacitor config allows cleartext HTTP on Android (server.cleartext: true), an option intended for live-reload development.

A Compose service adds a kernel capability that allows escaping the container (ALL, SYS_ADMIN, SYS_MODULE, SYS_PTRACE, SYS_RAWIO, DAC_READ_SEARCH or BPF).

A Compose service mounts the Docker daemon socket. Whoever controls this container can drive the Docker API and start a privileged container, which is equivalent to root on the host (a read-only mount does not prevent this).

A Compose service shares the host's PID, IPC or user namespace. The container can see and signal host processes or read host shared memory, which removes an important isolation layer.

A Compose service uses the host network stack (network_mode: host). Every port it opens is exposed directly on the host interfaces and it can reach services bound to the host's loopback address.

A Compose service runs a privileged container. privileged: true gives the container every kernel capability and access to all host devices, so a compromise of that service is a compromise of the host.

A Compose service explicitly runs its process as root (user: root / user: "0"). A process escape or a writable mount then acts with root privileges.

A Compose service mounts a sensitive host directory (/, /etc, /root, /proc, /sys, /dev, /boot, /var/lib/docker…) writable into the container. Writing there lets the container change host configuration or credentials.

A Compose service disables its seccomp, AppArmor or SELinux confinement (unconfined / label:disable). The container can then use system calls and resources that the default profile blocks to protect the host kernel.

A Compose service publishes a database or cache port on all host interfaces. Anyone who can reach the machine can talk to the data store directly; this is fine on a developer laptop but dangerous on a server.

The Cordova network allow-list permits requests to any origin (<access origin="*">). Code injected into the web view can send data anywhere and load scripts from any host.

The Cordova app lets its web view navigate to any URL (<allow-navigation href="*">). A malicious page loaded in the app gets access to the native plugin bridge.

A System.Linq.Dynamic expression string is built from request input. Dynamic LINQ parses and compiles the string, so an attacker can change the query or, on older library versions, invoke arbitrary methods.

A shell (cmd.exe /c, powershell -Command, sh -c) is started with a command line built from non-constant values. Shell metacharacters in any of those values run arbitrary commands.

Request input is used as the executable or the argument string of a new process. An attacker can run other programs or inject extra arguments (OS command injection).

A cookie is explicitly made readable from JavaScript (HttpOnly = false). Any XSS on the site can then steal it.

A cookie is explicitly allowed to be sent over plain HTTP (Secure = false or CookieSecurePolicy.None). Network attackers can read or inject it.

The CORS policy accepts every origin while allowing credentials. Any website can make authenticated cross-origin requests and read the responses.

A block cipher is used in ECB mode. Identical plaintext blocks produce identical ciphertext blocks, which leaks the structure of the data.

A symmetric encryption key is a constant in source code. Anyone who can read the code or the compiled assembly can decrypt the data.

System.Random is used to generate a token, password, OTP, salt or key. Its output is predictable, so an attacker can guess the generated secret.

An encryption IV is a constant or all-zero array. Reusing the same IV with the same key makes CBC/CTR/GCM ciphertext predictable or, for GCM/CTR, lets an attacker recover plaintext.

A broken or legacy block cipher (DES, 3DES or RC2) is used. Its small key or block size makes the ciphertext practical to brute-force or attack.

MD5 or SHA-1 is used. Both are broken for collision resistance and must not protect integrity, signatures or passwords.

A password is hashed with a single fast hash (MD5, SHA-1 or SHA-2). Fast unsalted hashes are cracked offline at billions of guesses per second.

PBKDF2 (Rfc2898DeriveBytes) is used with fewer than 100,000 iterations (the two-argument constructors default to 1,000 iterations of SHA-1). Derived keys and password hashes are cheap to brute-force.

An RSA or DSA key smaller than 2048 bits is generated. Such keys are below current minimums and within reach of well-funded factoring attacks.

Anti-forgery token validation is explicitly disabled for an MVC/Razor endpoint. If the endpoint changes state for a cookie-authenticated user, only the cookie's SameSite setting still stands between it and cross-site request forgery (CSRF).

Data is deserialized with BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter or ObjectStateFormatter. These formatters instantiate attacker-chosen types and lead to remote code execution on untrusted input; Microsoft states they cannot be made safe.

An XmlSerializer / DataContractSerializer is created for a type whose name is resolved at runtime from a non-constant string. If the name comes from the payload or the request, an attacker chooses which type is instantiated (unsafe deserialization).

JavaScriptSerializer is created with SimpleTypeResolver, which lets the JSON choose the .NET type to instantiate. Untrusted input leads to remote code execution.

Json.NET TypeNameHandling is enabled without a SerializationBinder. The JSON can then name the .NET type to create, which allows remote code execution through known gadget types when the input is untrusted.

The developer exception page is enabled without an IsDevelopment() check. In production it exposes stack traces, source snippets and configuration details.

A JWT signing key is created from a string literal in source code. Anyone with access to the code (or a decompiled binary) can mint valid tokens.

JWT/OpenID Connect authentication allows its metadata and signing keys to be fetched over plain HTTP (RequireHttpsMetadata = false) outside a development-only branch.

JWT issuer or audience validation is disabled. Tokens issued for another application or by another tenant of the same identity provider will be accepted.

JWT lifetime validation is disabled (ValidateLifetime = false or RequireExpirationTime = false). Expired or never-expiring tokens are accepted, so a leaked token stays valid forever.

JWT validation accepts tokens without a verified signature (RequireSignedTokens = false or a SignatureValidator that returns the token unchecked). Anyone can forge a token.

Request input is placed into an LDAP search filter without escaping. Characters such as *, ( and ) let an attacker rewrite the filter (LDAP injection).

A redirect target is taken from request input without checking that it is a local URL. An attacker can send users to a phishing site from a link on this domain (open redirect).

A file system path is built from request input (or an uploaded file's client-supplied name). Sequences such as ../ or an absolute path let an attacker read, overwrite or delete files outside the intended directory.

An archive entry's FullName is used to build an extraction path without checking that the result stays inside the target directory (zip slip). A crafted archive can overwrite arbitrary files.

A regular expression pattern is built from request input and evaluated without a match timeout. A crafted pattern can backtrack catastrophically and exhaust CPU (ReDoS), or change what the expression matches.

A SQL statement embeds a value inside quotes through string interpolation, concatenation or string.Format before it is executed. Any quote in the value breaks out of the literal, which is SQL injection.

Request input flows into the text of a SQL command (ADO.NET, EF raw SQL or Dapper). An attacker can change the structure of the query, which is SQL injection.

An outbound HTTP request is sent to a URL built from request input. An attacker can make the server call internal services or cloud metadata endpoints (server-side request forgery).

TLS server certificate validation is disabled with a callback that always returns true (or DangerousAcceptAnyServerCertificateValidator). Any machine-in-the-middle can impersonate the server.

SSL 3.0, TLS 1.0 or TLS 1.1 is explicitly enabled. These protocol versions are deprecated (RFC 8996) and vulnerable to downgrade and padding-oracle attacks.

A type name or assembly is loaded from request input. An attacker can instantiate arbitrary types (deserialization-style gadgets) or load attacker-supplied code.

An XPath expression is built from request input or by splicing a value into a quoted literal. An attacker can change the query and read or bypass checks on other parts of the XML document (XPath injection).

ASP.NET request validation is disabled with [ValidateInput(false)]. Markup in form and query values reaches the action unfiltered, so every output path must encode it correctly.

Request input is written to the response as raw HTML (Html.Raw, HtmlString, MarkupString, Response.Write or text/html content) without encoding. This is cross-site scripting.

DTD processing is explicitly enabled for an XML reader. Parsing untrusted XML with DTDs enabled allows entity-expansion denial of service and, together with a resolver, XML external entity (XXE) attacks.

An XmlUrlResolver is attached to an XML parser. With DTD processing on (the default for XmlDocument on .NET Framework before 4.5.2), external entities can read local files or make network requests (XXE).

XSLT embedded scripts or the document() function are enabled. A malicious stylesheet can then run code or read arbitrary files and URLs.

Elasticsearch security is turned off (xpack.security.enabled: false). The cluster accepts requests without authentication or TLS, so anyone who can reach it can read, change or delete all indices.

The Expo app config enables cleartext HTTP on Android (usesCleartextTraffic: true), so the release app may talk to servers over unencrypted connections.

The Expo app config disables App Transport Security on iOS (NSAllowsArbitraryLoads: true in infoPlist), so the app may load content over plain HTTP.

A Firebase Realtime Database rule sets .read to true at the database root. Anyone with the public database URL can download the entire database.

A Firebase Realtime Database rule sets .write to true. Anyone with the public database URL can write, overwrite or delete this part of the database.

A Firestore / Cloud Storage security rule gives every signed-in user write access to all data under a recursive wildcard match (if request.auth != null). With anonymous or open sign-up, anyone can read and overwrite other users' data.

A Firestore / Cloud Storage rule lets anyone read everything under a recursive wildcard match ({document=**} / {allPaths=**}) without a condition.

A Firestore / Cloud Storage security rule allows writes without any condition (if true or no condition). Anyone on the internet can create, modify or delete this data with the public Firebase config.

A Firestore / Cloud Storage security rule only checks the current date (request.time < timestamp.date(...)), the console's "test mode". Until that date anyone can read and write the data; after it, the app stops working.

The program to execute is chosen by request input, letting a client run arbitrary commands.

A shell (sh -c / bash -c) executes a dynamically built command string (command injection).

A cookie is created with HttpOnly explicitly off, so page scripts (and any XSS payload) can read it.

A cookie is created with the Secure flag explicitly off, so browsers also send it over plain HTTP.

CORS allows every origin together with credentials. Any website can then make authenticated requests on behalf of a signed-in user and read the responses.

A block cipher encrypts data block by block in a loop (ECB mode). Equal plaintext blocks produce equal ciphertext blocks, which leaks the structure of the data.

A cipher, MAC or session-cookie key is a string literal compiled into the program.

math/rand is used to produce a security-sensitive value; it is predictable.

A cipher is initialised with a constant or all-zero IV / nonce. Reusing an IV under one key reveals plaintext relationships and, for GCM and CTR, breaks confidentiality and authenticity.

DES, 3DES or RC4 is used for encryption; these ciphers are broken or have a 64-bit block size.

A password hash is computed with a work factor below the accepted minimum (bcrypt cost under 10 or PBKDF2 under 10000 iterations).

A password or secret is hashed with MD5/SHA-1.

An RSA key shorter than 2048 bits is generated; such keys can be factored with modest resources.

A signature is created or verified over an MD5 / SHA-1 digest, which is not collision resistant.

net/http/pprof is blank-imported, which registers the /debug/pprof handlers on http.DefaultServeMux. If that mux is served publicly, anyone can dump goroutines, heap contents and CPU profiles.

An HTTP server is started without read timeouts, so slow clients can hold connections open indefinitely (Slowloris denial of service).

A number parsed from a string as a full-width integer is converted to a narrower type without a range check. Out-of-range input silently wraps around, which can bypass size or bounds checks.

A JWT is signed with a hard-coded key.

The JWT "none" algorithm is used, producing or accepting tokens without a signature.

A JWT is decoded with ParseUnverified, which skips signature validation.

Redirect target comes from request input (open redirect).

An archive entry name is joined into the extraction path without checking that the result stays inside the destination (Zip Slip). An entry named ../../x is written outside the target directory.

A filesystem path is built from request input without confining it to a base directory (path traversal). ../ segments let a client read or overwrite files outside the intended folder.

A file or directory is made writable by every local user (mode with the other-write bit set).

Request input is placed into the SQL text of an ORM query fragment instead of being bound as a parameter (SQL injection). Affected methods include Where, Order, Group, Joins and Having.

SQL query text is built with fmt.Sprintf or string concatenation, enabling SQL injection.

The SSH client accepts any host key, so the connection can be intercepted (man-in-the-middle).

An outbound HTTP request URL is taken from request input (server-side request forgery).

A file with a fixed name is created in the shared temp directory. Another local user can pre-create it or plant a symlink there to hijack or corrupt the write.

Request input is parsed as template source (server-side template injection). A client can read any field and call any exported method of the data passed to Execute.

tls.Config sets InsecureSkipVerify, disabling certificate validation.

The TLS cipher suite list enables RC4, 3DES, NULL or export-grade suites.

tls.Config allows SSL 3.0 / TLS 1.0 / TLS 1.1, protocol versions with known attacks (POODLE, BEAST).

Request input is written into an HTML response without escaping (reflected cross-site scripting).

Request input is converted to template.HTML, bypassing html/template escaping (cross-site scripting).

Request input is cast to a trusted html/template type, which switches off contextual escaping for it (cross-site scripting). Affected types are template.JS, URL, HTMLAttr, CSS, JSStr and Srcset.

An HTML page is rendered with text/template, which performs no escaping (cross-site scripting).

Grafana anonymous access is enabled with the Admin or Editor role. Anyone who can reach Grafana can change dashboards and data sources and query every connected database.

Grafana's admin password is set to the well-known default admin. Unless it is changed on first login, anyone can sign in as administrator.

App Transport Security is disabled for all connections (NSAllowsArbitraryLoads = true). The app may load content over plain HTTP or weak TLS, exposing data to network attackers.

App Transport Security is disabled for web views or media content. With NSAllowsArbitraryLoadsInWebContent / NSAllowsArbitraryLoadsForMedia that content may be loaded over plain HTTP.

An App Transport Security domain exception allows plain HTTP (NSExceptionAllowsInsecureHTTPLoads = true) for that host.

An App Transport Security exception lowers the minimum TLS version to 1.0 or 1.1 for a host. These versions are deprecated (RFC 8996) and weaken the connection.

A non-debug entitlements file grants get-task-allow. Builds signed with it let other processes attach a debugger and read or modify the app's memory.

A WebView explicitly enables access to the local file system.

A WebView proceeds past TLS certificate errors (onReceivedSslError calls proceed()).

A JavaScript bridge is added to a WebView with JavaScript enabled; any page it loads can call the exposed Java methods.

A WebView lets file:// pages read other files or any origin (setAllowUniversalAccessFromFileURLs/setAllowFileAccessFromFileURLs).

A file, database or SharedPreferences is created world-readable or world-writable.

Request data is evaluated as an expression (SpEL/OGNL/MVEL/JEXL/EL), which allows remote code execution.

Request data is executed as a script (ScriptEngine/Groovy), which allows remote code execution.

The program or the argument list of a started process comes from request data (command injection).

An OS command is executed from a dynamically built string or through a shell (command injection).

A cookie explicitly disables its Secure or HttpOnly flag.

A block cipher is used in ECB mode (explicitly or as the "AES" default), which leaks plaintext patterns.

A cryptographic key is hard-coded in the source code.

A security-sensitive value (token, password, session id, nonce, salt) is generated with a predictable random number generator.

SecureRandom is seeded with a constant value, which can make its output predictable.

RSA encryption uses PKCS#1 v1.5 or no padding instead of OAEP.

A constant initialization vector/nonce is used for encryption.

A broken or weak cipher (DES, 3DES, RC2, RC4, Blowfish) is used.

MD5/SHA-1 is cryptographically broken; do not use it for signatures, integrity or passwords.

A password is hashed with a fast general-purpose digest (MD5/SHA family) instead of a password hashing function.

A password-based key derivation uses fewer than 10,000 iterations.

An RSA/DSA/DH key pair is generated with fewer than 2048 bits.

Jackson polymorphic typing accepts arbitrary class names from JSON input (unsafe deserialization).

Kryo class registration is disabled, so serialized input can instantiate arbitrary classes.

Java native deserialization (ObjectInputStream/XMLDecoder) of untrusted data can lead to remote code execution.

Request data is loaded with a default SnakeYAML constructor, which instantiates arbitrary classes in SnakeYAML 1.x.

XStream deserializes XML without a type allow-list, which can lead to remote code execution.

A JNDI lookup name comes from request data (JNDI injection, can load remote classes).

A JWT is signed or verified with a hard-coded secret.

A JWT is parsed with jjwt's generic parse(), which in jjwt < 0.12 also accepts unsigned tokens.

A JWT is accepted without signature verification (unsigned/none algorithm tokens).

An LDAP search filter is built from request data (LDAP injection).

A redirect target is built from request data (open redirect).

A file system path is built from request data, allowing path traversal (../) outside the intended directory.

An archive entry name is used as an output path without checking that it stays inside the target directory (zip slip).

CORS allows any origin together with credentials, so any website can make authenticated requests and read the responses.

Spring Security CSRF protection is disabled.

The X-Frame-Options header is disabled, so pages can be framed by other sites (clickjacking).

Passwords are stored in plain text or with a fast, unsalted digest (NoOp/MD5/SHA password encoder).

Spring Security permits every request that is not matched by an earlier rule (anyRequest().permitAll()).

SQL/JPQL query text is built with string concatenation or String.format (SQL injection).

An outbound HTTP request is sent to a URL taken from request data (server-side request forgery).

A Spring MVC view name is built from request data, which can lead to template expression injection.

Request data is used as template source code (server-side template injection).

A TrustManager or HostnameVerifier accepts every certificate/host, disabling TLS validation.

A deprecated SSL/TLS protocol version (SSLv3, TLS 1.0 or TLS 1.1) is requested.

An XPath expression is built from request data (XPath injection).

Request data is written to the HTTP response without HTML encoding (cross-site scripting).

An XML parser is created and used without disabling DTDs/external entities (XXE).

Dynamic code evaluation with a non-literal argument. If any part of the value is attacker-controlled this is arbitrary code execution.

Request input decides which module or script is loaded or compiled (require/import/vm.Script). An attacker can load arbitrary files as code.

child_process.exec/execSync runs its argument through a shell. Building the command from dynamic values allows shell command injection.

spawn/execFile invoked with shell: true and a non-literal command. The command is interpreted by a shell, which enables command injection.

CORS reflects any request Origin while allowing credentials. Any website can make authenticated requests as the visiting user and read the responses.

bcrypt is used with a cost factor below 10. Stolen password hashes are then much cheaper to crack.

The deprecated crypto.createCipher/createDecipher API is used. It derives the key from a password with a single MD5 round and no salt, reuses the same IV for every message and is removed in Node.js 22.

A block cipher is used in ECB mode. ECB encrypts identical plaintext blocks to identical ciphertext blocks and leaks the structure of the data.

An encryption or HMAC key is a constant in the source code. Anyone with access to the code (or a leaked build) can decrypt the data or forge MACs.

Math.random() is used to generate a security-sensitive value (token, password, nonce...). It is predictable and not suitable for secrets.

PBKDF2 runs with fewer than 10,000 iterations. Offline brute-forcing of the derived keys or password hashes is cheap.

createCipheriv is called with a constant IV (literal, zero-filled or fixed buffer). Reusing an IV makes ciphertexts linkable and, with CTR/GCM modes, lets attackers recover plaintext and forge messages.

An HMAC/signature is compared with ===/!==. Ordinary string comparison returns early at the first differing byte, which can leak the expected value through response timing.

A broken or legacy cipher (DES, 3DES, RC2, RC4, Blowfish ...) is used. These ciphers have small keys or blocks and practical attacks.

MD5/SHA-1 is cryptographically broken; do not use it for signatures, integrity or secrets.

A password or secret is hashed with a fast, broken digest (MD5/SHA-1). Such hashes are trivially brute-forced.

An RSA/DSA key pair is generated with a modulus shorter than 2048 bits. This is below current minimum key-size recommendations.

The framework's built-in CSRF / origin check is explicitly disabled or opened to every origin. Other sites can then submit state-changing requests on behalf of logged-in users.

A deserializer that revives functions with eval (serialize-to-js, funcster or cryo) is used. Deserializing attacker-controlled input with it is remote code execution.

node-serialize unserialize executes functions embedded in the payload (remote code execution).

YAML is loaded with js-yaml's DEFAULT_FULL_SCHEMA. That schema constructs !!js/function values, so loading untrusted YAML executes attacker-supplied JavaScript.

An Electron window disables context isolation. Web content can then tamper with the preload script's globals and reach privileged APIs.

An Electron window enables Node.js integration for its web content. Any XSS or loaded remote content then gets full access to the operating system.

shell.openExternal is called with a URL that is not checked first. Web content can make the app open file: or custom-protocol URLs, which can execute programs on the user's machine.

The Electron renderer sandbox is disabled. This weakens the boundary between web content and the operating system.

An Electron window disables web security (same-origin policy) or allows insecure content on HTTPS pages.

GraphQL introspection or a GraphQL IDE is enabled unconditionally. This exposes the full API schema in production.

A helmet security header (CSP, frame options, HSTS or nosniff) is explicitly disabled. This removes a browser-side defence against XSS, clickjacking or protocol downgrade.

An error stack trace is sent to the client. Stack traces reveal file paths, library versions and internal logic that help attackers.

The authenticated user is taken from jwt.decode(), which does not verify the token signature. Anyone can craft a token with arbitrary claims and impersonate any user.

JWT signed or verified with a hard-coded secret. Anyone with access to the source can forge tokens.

JWT verification is configured with ignoreExpiration: true, so expired (e.g. revoked or stolen) tokens are accepted forever.

JWT verification accepts the none algorithm, which disables signature checking.

Request input is spliced into an LDAP search filter. Characters such as *, ( and ) let an attacker rewrite the filter, for example to bypass a login check.

The whole request body is written into a database model. Clients can set any field they like, including privileged ones such as role, isAdmin, ownerId or balance (mass assignment).

A MongoDB query filter takes a value straight from the parsed request body or query string. JSON bodies and nested query strings can carry operator objects such as {"$ne": null}, which turns an equality check into an attacker-chosen condition (e.g. login bypass).

A MongoDB $where clause is built from a dynamic string. $where executes JavaScript on the database server, so any spliced-in value is server-side code injection.

The browser navigates to a URL taken from the query string or fragment. Attackers can send links that redirect users to phishing pages or run javascript: URLs.

Redirect target comes from request input. Attackers can craft links that redirect victims to malicious sites.

A file path is built from an archive entry name while extracting. Entries named ../../somewhere are written outside the target directory (zip slip).

multer disk storage saves uploads under the client-supplied file.originalname. A name such as ../../app/server.js writes outside the upload directory and can overwrite application files.

The view name passed to res.render comes from request input. An attacker can render arbitrary template files from disk, which can disclose files or lead to code execution.

A filesystem path is derived from request input, which can allow reading or writing arbitrary files.

A window message event handler uses event.data without checking event.origin (or event.source). Any page that can open or frame this one can send it messages.

A request value is used as the first key of a nested property assignment (obj[key][prop] = value). A key of __proto__ or constructor modifies Object.prototype for the whole process (prototype pollution).

A regular expression is compiled from request input. Attackers can submit catastrophic patterns that block the Node.js event loop (ReDoS) or match more than intended.

A session or authentication cookie is created with httpOnly: false. Any cross-site scripting bug can then read the cookie and hijack the session.

The session cookie is configured with secure: false. Browsers then also send it over plain HTTP, where it can be intercepted.

The session or cookie signing secret is a string literal in the source code. Anyone who can read the code can forge signed cookies or session data.

Request input reaches the text of a raw SQL query or SQL fragment. An attacker can change the query and read or modify arbitrary data.

SQL query built with string concatenation or template interpolation. Untrusted values in the query text lead to SQL injection.

An outbound HTTP request URL is built from request input. This allows server-side request forgery against internal services and cloud metadata endpoints.

The whole request object is passed as template locals to res.render. Template engines read special keys from locals (layout, settings, view options), so request fields can switch layouts, include arbitrary files or reach engine options that execute code.

Request input is compiled as a template (EJS, Pug, Handlebars, Nunjucks, lodash.template ...). Server-side template injection lets an attacker run code on the server.

TLS hostname verification is disabled with a no-op checkServerIdentity. Any valid certificate for any domain is accepted, so the connection can be intercepted.

TLS certificate verification is disabled. Connections can be intercepted by a man-in-the-middle.

TLS is configured to allow SSLv3, TLS 1.0 or TLS 1.1. These deprecated protocol versions are vulnerable to known downgrade and decryption attacks.

A host, origin or e-mail domain is validated with endsWith() against a bare domain name. An attacker-registered domain such as evilexample.com also passes the check.

Request input is spliced into an XPath expression. An attacker can change the query to read other parts of the XML document.

Angular's sanitizer is bypassed (bypassSecurityTrust*) for a dynamic value. If any part of the value is user-controlled this is cross-site scripting.

dangerouslySetInnerHTML / innerHTML receives a non-literal value. Unsanitised HTML leads to cross-site scripting.

Data from the page URL, referrer or window.name is inserted as HTML through jQuery or another HTML-parsing API (DOM-based cross-site scripting).

Request input is concatenated into an HTML response body without escaping (reflected cross-site scripting).

XML is parsed with libxmljs and noent: true, which expands external entities. A crafted document can read local files or make the server issue requests (XXE).

The Jupyter server allows cross-origin requests from any website (allow_origin = '*'). A malicious page can then drive the kernel API in the user's browser.

The Jupyter server is configured with an empty token and no password. Anyone who can reach it gets an unauthenticated notebook, i.e. arbitrary code execution as the server user.

A WebView explicitly enables access to the local file system.

A WebView proceeds past TLS certificate errors (onReceivedSslError calls proceed()).

A JavaScript bridge is added to a WebView with JavaScript enabled; any page it loads can call the exposed methods.

A WebView lets file:// pages read other files or any origin (allowUniversalAccessFromFileURLs/allowFileAccessFromFileURLs).

A file, database or SharedPreferences is created world-readable or world-writable.

An OS command is executed from a dynamically built string or through a shell (command injection).

A block cipher is used in ECB mode (explicitly or as the "AES" default), which leaks plaintext patterns.

A cryptographic key is hard-coded in the source code.

A security-sensitive value (token, password, session id, nonce, salt) is generated with a predictable random number generator.

A constant initialization vector/nonce is used for encryption.

A broken or weak cipher (DES, 3DES, RC2, RC4, Blowfish) is used.

MD5/SHA-1 is cryptographically broken; do not use it for signatures, integrity or passwords.

Java native deserialization (ObjectInputStream/XMLDecoder) of untrusted data can lead to remote code execution.

A JWT is signed or verified with a hard-coded secret.

A JWT is accepted without signature verification (unsigned/none algorithm tokens).

A redirect target is built from request data (open redirect).

A file system path is built from request data, allowing path traversal (../) outside the intended directory.

Spring Security CSRF protection is disabled.

Passwords are stored in plain text or with a fast, unsalted digest (NoOp/MD5/SHA password encoder).

SQL query text is built with a string template or concatenation (SQL injection).

An outbound HTTP request is sent to a URL taken from request data (server-side request forgery).

A TrustManager or HostnameVerifier accepts every certificate/host, disabling TLS validation.

A deprecated SSL/TLS protocol version (SSLv3, TLS 1.0 or TLS 1.1) is requested.

Request data is sent back as an HTML response without encoding (cross-site scripting).

An entitlements file weakens the hardened runtime against code injection (disable-library-validation or allow-dyld-environment-variables). Other code can be loaded into the process and inherit its privileges and TCC permissions.

An entitlements file allows unsigned executable memory or disables executable page protection, which makes memory-corruption exploits easier.

An entitlements file explicitly disables the App Sandbox (com.apple.security.app-sandbox). A compromised app then has the user's full file and network access.

MongoDB listens on all interfaces (bindIp: 0.0.0.0 / bindIpAll: true) but access control is not enabled (security.authorization). Anyone who can reach the port can read and modify every database.

MySQL/MariaDB enables local_infile. A malicious or compromised client/server pair can use LOAD DATA LOCAL to read files from the other side.

MySQL/MariaDB is configured with skip-grant-tables. The privilege system is disabled and every connection gets full access to all databases without a password.

nginx alias with a trailing slash is used in a prefix location without a trailing slash. A request such as /static../secret escapes the aliased directory and reads files from its parent ("off-by-slash" path traversal).

nginx reflects the request's Origin header into Access-Control-Allow-Origin while also allowing credentials. Any website can then make authenticated cross-origin requests and read the responses.

nginx writes the decoded request path ($uri / $document_uri) into a redirect or response header. A request containing an encoded line break (%0d%0a) can inject headers into the response (HTTP response splitting).

nginx directory listing is enabled (autoindex on). Every file in the served directory, including backups, dumps or configuration files that were never linked, can be discovered and downloaded.

nginx proxy_pass uses the request's Host header ($host / $http_host) as the upstream. In a default or wildcard server block the client chooses where the server connects (SSRF / open proxy).

nginx proxy_pass takes its upstream host from a request header, query argument or cookie. Any client can make the server send requests to arbitrary internal or external hosts (SSRF / open proxy).

nginx enables an obsolete SSL/TLS protocol version (SSLv2, SSLv3, TLSv1 or TLSv1.1). These versions have known cryptographic weaknesses and are deprecated by RFC 8996.

nginx enables a broken cipher suite (RC4, DES/3DES, NULL, EXPORT, LOW, MD5 or anonymous key exchange) in ssl_ciphers. Clients that negotiate it get no real confidentiality or authenticity.

The API description defines an API key passed in the query string. Keys in URLs end up in server, proxy and browser logs and in Referer headers.

The API description lists a plain-HTTP server URL for a non-local host. Clients generated from it send credentials and data unencrypted.

The OpenSearch security plugin is disabled (plugins.security.disabled: true). The cluster accepts requests without authentication or TLS.

A hash, HMAC or password digest is compared with loose == / !=. PHP type juggling treats '0e…' digests as equal numbers, allowing authentication bypass.

strcmp() on request input is checked with == 0 / !strcmp(). On PHP < 8 an array input makes strcmp() return NULL, which loosely equals 0 and bypasses the check.

A class to instantiate or a method to call is chosen by request input (unsafe reflection). Attackers can reach classes and methods that were never meant to be exposed.

A function to call is chosen by request input (code injection). Attackers can invoke any function such as system() or passthru().

PHP code is evaluated from a non-literal value (code injection).

An OS command is built from request input (command injection). An attacker can append shell metacharacters to run arbitrary commands on the server.

Request input reaches the additional_parameters argument of mail(), which is passed to the sendmail command line (argument injection; can write files or execute code).

display_errors is switched on at runtime. Error messages shown to visitors disclose paths, queries and configuration details.

A cookie or the session cookie is configured with the Secure or HttpOnly flag explicitly disabled. It may travel over plain HTTP or be read by injected JavaScript.

The request's Origin is reflected into Access-Control-Allow-Origin while credentials are allowed. Any website can then read authenticated responses.

crypt() is called with a hard-coded salt. Every password then shares the same salt (and legacy DES/MD5 salts are trivially cracked).

A token, password, salt or nonce is generated with a non-cryptographic random source (rand / mt_rand / uniqid / lcg_value / microtime), so it can be predicted.

The mcrypt extension is used for encryption. It is unmaintained, was removed in PHP 7.2 and makes weak modes and padding easy to misuse.

openssl_encrypt() is called with a constant initialization vector. Reusing an IV with the same key leaks plaintext relationships (and breaks GCM/CTR completely).

openssl_encrypt/decrypt uses a broken cipher or ECB mode (DES, 3DES, RC2, RC4, Blowfish, *-ECB). ECB leaks plaintext patterns and the others are breakable.

A password is hashed with md5()/sha1().

CSRF verification is disabled for every route (wildcard exception in VerifyCsrfToken / validateCsrfTokens). Any site can submit state-changing requests as a logged-in user.

A route opts out of Laravel CSRF verification with withoutMiddleware(). This is only safe for endpoints authenticated by something other than the session cookie (e.g. signed webhooks).

A file-metadata function receives a path fully controlled by request input. On PHP < 8 a phar:// path triggers deserialization of the archive metadata (object injection).

unserialize() is called on request input, enabling PHP object injection. Gadget chains in loaded classes can lead to remote code execution.

A file is included based on request input (local/remote file inclusion).

An uploaded file is stored under a name or extension chosen by the client. Without an extension allow-list this allows uploading executable .php files or overwriting files.

phpinfo() output is generated by application code. It exposes the full PHP configuration, server paths and environment variables (often including secrets).

PHP allow_url_include is enabled. Any include/require of an attacker-influenced path turns into remote code execution by loading code from a URL.

PHP display_errors is enabled. Error messages with file paths, queries and stack details are printed into HTTP responses.

PHP enable_dl is enabled, which lets scripts load arbitrary native extensions at runtime with dl() and bypass other restrictions.

PHP expose_php is enabled, so every response advertises the exact PHP version in the X-Powered-By header.

PHP session cookies are explicitly made readable by JavaScript (session.cookie_httponly off). Any XSS can then steal the session identifier.

Request input is built into an LDAP search filter without ldap_escape() (LDAP injection). Attackers can alter the filter to bypass authentication or enumerate the directory.

extract() imports request input as local variables. Attackers can overwrite any variable in scope, such as authorization flags or file paths.

Request input is mass-assigned with forceFill()/forceCreate(), which bypasses $fillable and $guarded. Attackers can set any column, such as is_admin or user_id.

The whole request payload ($request->all()) is mass-assigned to an Eloquent model. Only the model's $fillable / $guarded lists stop attackers from setting extra attributes.

A Laravel model disables mass-assignment protection ($guarded = [] or Model::unguard()). Any attribute passed to create()/update()/fill() is then writable.

parse_str() is called without a result array, so query-string keys become local variables (variable overwrite; removed in PHP 8).

A variable name is taken from request input ($$name). Attackers can overwrite any variable in scope, emulating register_globals.

A redirect target is taken from request input (open redirect). Attackers can craft links on your domain that forward victims to a phishing site.

A file path (or URL) used to read, write or delete a file comes from request input (path traversal). Attackers can use ../ sequences or absolute paths to reach other files.

The session id is set from request input (session fixation). An attacker can plant a known session id and take over the session after the victim logs in.

Request input is built into a Doctrine DQL/SQL string (SQL injection). Doctrine only protects values passed as parameters.

Request input reaches a raw Laravel query fragment (DB::raw, whereRaw, orderByRaw …), bypassing query-builder bindings (SQL injection).

Request input is concatenated or interpolated into a SQL query (SQL injection). An attacker can read or modify arbitrary database rows.

Request input is built into the format string of $wpdb->prepare() (SQL injection). prepare() only escapes the values passed as separate arguments.

Request input is built into a $wpdb query string without $wpdb->prepare() placeholders (SQL injection).

An outbound HTTP request is sent to a URL taken from request input (server-side request forgery). Attackers can reach internal services and cloud metadata endpoints.

Request input is compiled as a template (server-side template injection). Template code can call PHP functions and lead to remote code execution.

cURL TLS verification is disabled.

TLS certificate verification is disabled for an HTTP client or stream context, enabling man-in-the-middle attacks.

Request input is built into an XPath expression (XPath injection). Attackers can change the query to read other nodes or bypass checks.

A Blade template prints request input with the unescaped {!! !!} syntax (reflected XSS). Blade only escapes output written with {{ }}.

Request input is echoed without HTML escaping (reflected XSS).

XML is parsed with external entity loading or entity substitution enabled (XXE). Untrusted XML can then read local files or trigger requests to internal hosts.

pg_hba.conf allows passwordless trust authentication for TCP connections from non-loopback addresses. Anyone who can reach PostgreSQL can log in as the listed users (often any user).

An authorization check is written as an assert statement. Python removes asserts when run with -O, which silently disables the check.

A cleartext FTP or Telnet connection is opened; credentials and data travel unencrypted.

A cloud SDK client is created with a literal secret access key. Committed cloud keys grant account access to anyone who obtains the code.

eval()/exec() called with a non-literal argument. Attacker-influenced input leads to arbitrary code execution.

A module name taken from request input is imported dynamically. Attackers can load arbitrary installed modules.

An attribute name taken from request input is looked up with getattr() and called. Attackers can invoke any method of the object.

An XML-RPC server registers an instance with allow_dotted_names=True. Remote callers can traverse attributes and reach module globals, which can lead to code execution.

A non-literal command is passed to an API that always runs it through /bin/sh (subprocess.getoutput, asyncio.create_subprocess_shell). This allows OS command injection.

A shell command is built from a non-literal value (os.system / subprocess with shell=True). This allows OS command injection.

A remote shell command for SSH exec_command() is built with string interpolation. Values containing shell metacharacters run arbitrary commands on the remote host.

The session or CSRF cookie is explicitly configured without the Secure flag, so it is also sent over plain HTTP.

The session cookie is configured without HttpOnly. Any XSS can then read the session cookie and hijack the account.

CORS allows any origin together with credentials. The middleware then echoes the caller's Origin, so every website can read authenticated responses.

A broken or obsolete cipher (DES, 3DES, RC4, RC2, Blowfish, CAST, IDEA, SEED) is used.

A block cipher is used in ECB mode, which leaks patterns of the plaintext (identical blocks encrypt identically).

A password is hashed with a single fast SHA-2/SHA-3/BLAKE2 digest. Fast hashes let attackers test billions of guesses per second.

An encryption key is a literal in source code. Anyone with the code (or a leaked copy) can decrypt or forge the protected data.

The random module is used to generate a security-sensitive value. It is predictable.

A cipher is initialised with a constant IV/nonce. Reusing an IV/nonce with the same key breaks confidentiality (and integrity for GCM/CTR).

An HMAC digest is compared with == / !=. The comparison time leaks how many leading bytes match, allowing signatures to be forged byte by byte.

MD5/SHA-1 is cryptographically broken; do not use it for signatures, integrity or secrets.

A password or secret is hashed with a fast, broken digest (MD5/SHA-1).

An RSA/DSA key shorter than 2048 bits is generated; such keys are within reach of factoring attacks.

A file is loaded with a pickle-based loader (joblib.load, pandas.read_pickle, torch.load). Loading an untrusted file runs arbitrary code.

A loader is explicitly told to accept pickled objects (weights_only=False, allow_pickle=True, safe_mode=False). A malicious file executes code when loaded.

Deserializing data with pickle/marshal/shelve or yaml.load without a safe loader can execute arbitrary code if the input is untrusted.

A Django settings module allows every Host header (ALLOWED_HOSTS contains "*"). Forged Host headers then poison password-reset links and caches.

A view that relies on the logged-in user or session is marked @csrf_exempt. Other sites can make the victim's browser perform this action (CSRF).

A Django settings module sets DEBUG = True unconditionally. Deployed with it, error pages leak source code, settings and environment details.

A Django settings module sets AUTH_PASSWORD_VALIDATORS to an empty list, so any password (including "1") is accepted.

A Django settings module hard-codes SECRET_KEY. Anyone with the source can forge sessions, password-reset tokens and signed data.

The preferred Django password hasher (first entry of PASSWORD_HASHERS) is a fast, broken digest such as MD5 or SHA-1. Leaked hashes are cracked quickly.

Django REST framework's default permission class is AllowAny. Every API view without its own permission_classes is public.

A file or directory is made world-writable (chmod / umask). Any local user can then modify it.

Flask-WTF CSRF protection is disabled (WTF_CSRF_ENABLED = False) outside of test configuration.

The Flask/Werkzeug debugger is enabled. In production it exposes an interactive console (remote code execution).

The JWT verification algorithm is taken from the token's own unverified header. Attackers choose the algorithm (algorithm confusion, "none").

JWT expiry verification is disabled (verify_exp = False); stolen tokens stay valid forever.

A JWT or framework signing secret is hard-coded in source. Anyone with the code can forge tokens/sessions.

JWT signature verification is disabled; forged tokens will be accepted.

An LDAP search filter is built with string interpolation and no escaping. Characters such as * ( ) in the value alter the filter (LDAP injection, authentication bypass).

A MongoDB $where JavaScript expression is built with string interpolation. Injected values run as server-side JavaScript.

JSON request data is placed into a MongoDB query filter without type checks. Objects such as {"$ne": null} change the query logic (operator injection).

Redirect target comes from request input (open redirect).

A filesystem path built from request input is opened, served or modified. Sequences such as ../ let attackers read or overwrite arbitrary files.

A tar archive is extracted with extractall() without a safety filter. Crafted member names or links (../, absolute paths) can write files outside the target directory.

A regular expression is compiled from request input. Crafted patterns cause catastrophic backtracking (ReDoS) or match more than intended.

A raw SQL fragment for the Django ORM (RawSQL, QuerySet.extra) is built with string interpolation. Untrusted values in it lead to SQL injection.

SQL executed from a string built with %, .format(), f-strings or concatenation. This is vulnerable to SQL injection.

Paramiko is told to accept unknown SSH host keys (AutoAddPolicy / WarningPolicy). The first connection can be intercepted by a man-in-the-middle.

An outbound HTTP request URL is taken from request input (server-side request forgery).

Request input is compiled as template source (render_template_string / Template). Template injection lets attackers run code on the server.

tempfile.mktemp() is race-prone; another process can create the file first.

TLS certificate verification is disabled, enabling man-in-the-middle attacks.

An obsolete SSL/TLS protocol version (SSLv2, SSLv3, TLS 1.0 or TLS 1.1) is selected or allowed.

Request input is embedded into an XPath expression. Quotes in the value change the query (XPath injection).

format_html() receives a string that was already interpolated, so the inserted values are not escaped (XSS).

A Jinja2 environment is created with autoescape=False. If it renders HTML, every variable is inserted unescaped (XSS).

A non-literal value is marked as safe HTML, bypassing template auto-escaping (XSS).

Request input is written into an HTML response without escaping. This is reflected cross-site scripting.

An XML parser is configured to resolve external entities or fetch DTDs. Untrusted XML can then read local files or reach internal hosts (XXE).

Redis listens on all network interfaces but no password or ACL is configured. Anyone who can reach the port can read and change all data and, through CONFIG/MODULE commands, often run code on the host.

Redis protected mode is off while no bind address or password is configured. Any network client can run commands without authenticating.

http_basic_authenticate_with uses a hard-coded password literal. Anyone with source access knows it and it cannot be rotated without a deploy.

A class is looked up from request input (constantize / const_get). Attackers can instantiate or call arbitrary classes, a known path to remote code execution.

A method name taken from request input is invoked with send / public_send / try. Attackers can call any method on the object, such as destroy, update_columns or exit.

Ruby code is evaluated from request input (code injection). An attacker can run arbitrary code in the application process.

A shell command is built from request input (command injection). An attacker can append shell metacharacters to run arbitrary commands.

Kernel#open / IO.read receives request input. A value starting with "|" runs a shell command, and any other value reads an arbitrary file.

A cookie or the session store is configured with secure / httponly explicitly disabled. The cookie may travel over plain HTTP or be read by injected JavaScript.

A token, password, salt or nonce is generated with a non-cryptographic random source (rand / Random / Array#sample / shuffle), so it can be predicted.

A cipher is given a constant initialization vector. Reusing an IV with the same key leaks plaintext relationships (and breaks GCM/CTR completely).

A broken cipher or ECB mode is used (DES, 3DES, RC2, RC4, Blowfish, *-ECB). ECB leaks plaintext patterns and the others are breakable.

A password is hashed with MD5/SHA-1, which is trivially brute-forced.

protect_from_forgery uses with: :null_session, so requests with a bad token run with an empty session instead of failing. Cookie-based authentication outside the session stays usable.

CSRF protection is skipped for a browser-facing controller (or disabled in configuration). Any site can submit state-changing requests on behalf of a logged-in user.

JSON / Oj parsing is configured to create Ruby objects from the document (create_additions or Oj object mode). Untrusted JSON can then instantiate arbitrary classes.

Request data is deserialized with Marshal / YAML.unsafe_load / Oj object mode / JSON.load, which can instantiate arbitrary objects and lead to remote code execution.

Request data is parsed with YAML.load / Psych.load. Before Psych 4 (Ruby < 3.1) this instantiates arbitrary Ruby objects and can lead to remote code execution.

JWT.decode is called with signature verification disabled or the "none" algorithm, so anyone can forge tokens.

Strong-parameter filtering is disabled (permit! / permit_all_parameters). Every attribute in the request, such as admin or role, becomes mass-assignable.

A model is created or updated from a raw params hash without permit. Rails 4+ rejects this at runtime, but in Sinatra / Grape or with permit_all_parameters it is mass assignment.

A redirect target is taken from request params (open redirect). Attackers can craft links on your domain that forward victims to a phishing site.

A file path used to read, write, send or delete a file comes from request input (path traversal). Attackers can use ../ sequences or absolute paths to reach other files.

render file: receives request input, so any file on the server can be rendered (path traversal / local file disclosure).

The template or partial to render is chosen by request input. Attackers can render templates that were never meant to be reachable (and on old Rails, arbitrary files).

secret_key_base / secret_token is set to a string literal in code. Anyone with the source can forge signed cookies and sessions and decrypt encrypted ones.

config.consider_all_requests_local is true in the production environment, so every visitor gets full exception pages with source, parameters and environment details.

config.force_ssl is explicitly false in the production environment, so HTTPS, HSTS and secure cookies are not enforced by Rails.

A regular expression is compiled from request input. Attackers can supply a catastrophic pattern (ReDoS) or alter the match logic.

Request input is validated with a regex anchored by ^ / $, which match at line breaks in Ruby. A value with an embedded newline passes the check (use \A and \z).

A format validation opts into multiline: true, allowing ^ / $ anchors that match at line breaks. Values with an embedded newline can pass the validation.

Request input is wrapped in Arel.sql / SqlLiteral, which marks it as trusted raw SQL (SQL injection).

Request input is built into an ActiveRecord / SQL query string (SQL injection). An attacker can read or modify arbitrary database rows.

Request input is used as a raw ORDER BY / pluck expression (SQL injection). Rails 6.1+ rejects most non-column strings, older versions execute them verbatim.

Request input is built into a raw Sequel SQL string or literal (SQL injection). Sequel only escapes values passed as placeholders or in dataset filters.

An outbound HTTP request is sent to a URL taken from request input (server-side request forgery). Attackers can reach internal services and cloud metadata endpoints.

Request input is compiled as a template (ERB.new / render inline: / Haml / Slim). Template code runs Ruby, so this is server-side template injection leading to code execution.

TLS certificate verification is disabled for an HTTP client (verify: false / verify_ssl: false / ssl_verify_peer: false), enabling man-in-the-middle attacks.

TLS peer verification is disabled (OpenSSL::SSL::VERIFY_NONE).

An ERB template prints request data without escaping (<%== / raw / html_safe), allowing reflected XSS.

A non-literal string is marked html_safe / passed to raw, bypassing escaping (XSS).

link_to uses a request parameter as the link target. Rails does not block javascript: URLs in href, so the parameter can inject script (XSS).

XML is parsed with entity substitution or external DTD loading enabled (NOENT / DTDLOAD). Untrusted XML can then read local files or reach internal hosts (XXE).

A shell (sh -c / cmd /C) executes a dynamically built command string (command injection).

A cookie is created with HttpOnly explicitly off, so page scripts (and any XSS payload) can read it.

A cookie is created with the Secure flag explicitly off, so browsers also send it over plain HTTP.

CORS accepts any origin together with credentials. Any website can then make authenticated requests on behalf of a signed-in user and read the responses.

A block cipher is used in ECB mode; equal plaintext blocks produce equal ciphertext blocks, which leaks data patterns.

An encryption key is a byte-string literal compiled into the program.

A security-sensitive value is generated with a non-cryptographic or fixed-seed random number generator.

An encryption nonce / IV is a constant. Reusing a nonce under the same key breaks the confidentiality and integrity of AES-GCM and ChaCha20-Poly1305 and makes CBC/CTR output predictable.

DES, 3DES, RC4 or Blowfish is used for encryption; these ciphers are broken or have a 64-bit block size.

A password or secret is hashed with MD5 / SHA-1, which can be brute-forced quickly.

An RSA key shorter than 2048 bits is generated; such keys can be factored with modest resources.

A JWT signing / verification secret is a string literal compiled into the program.

JWT signature validation is disabled, so forged tokens are accepted.

Bytes read from a file, socket or stream are turned into a str with from_utf8_unchecked. Invalid UTF-8 from outside the program makes this undefined behaviour.

std::mem::uninitialized is used; producing an uninitialized value of almost any type is undefined behaviour.

Redirect target comes from request input (open redirect).

A filesystem path is built from request input without confining it to a base directory (path traversal). ../ segments let a client read or overwrite files outside the intended folder.

A file or directory is made writable by every local user (mode with the other-write bit set).

SQL text is built with format! and passed to a query API, so interpolated values can change the query (SQL injection).

An outbound HTTP request URL is taken from request input (server-side request forgery).

A rustls ServerCertVerifier accepts every server certificate without checking it (man-in-the-middle).

TLS certificate or hostname validation is switched off, so the connection can be intercepted (man-in-the-middle).

A Serverless Framework IAM statement allows every action on every resource (Action: '*', Resource: '*'). Any code-execution bug in a function becomes full control of the AWS account.

A bucket declared in serverless.yml uses a public canned ACL (PublicRead / PublicReadWrite). Every object, including later uploads, becomes readable (or writable) by anyone.

A password is passed to mysql/mysqldump/mysqladmin/mariadb or sshpass as a command-line argument. Command lines are visible to other local users (ps, /proc) and end up in logs.

The script pipes a password from a variable into sudo -S. The sudo password is stored or passed around in clear text so the script can escalate without a human.

docker run starts a container with host-level access (--privileged, the Docker socket, the host PID namespace or the SYS_ADMIN/ALL capability). A compromise of that container is a compromise of the host.

eval runs a string built from the script's or function's arguments ($1, $@, $*). Any shell metacharacters in an argument are executed as commands.

The script switches off a host security control (SELinux enforcement, ufw or firewalld). Services on the machine lose mandatory access control or network filtering.

A sh -c / bash -c command string interpolates the script's arguments inside double quotes. The inner shell re-parses the argument, so metacharacters in it run as commands.

The script sets a umask that leaves new files writable by every user (e.g. umask 000). Everything it creates afterwards is world-writable.

chmod makes files world-writable (e.g. 777, 666, o+w). Any local user or compromised service can then modify them, including scripts and configuration that run with higher privileges.

rm -r deletes $DIR/ or $DIR/* without a ${DIR:?} guard or set -u. If the variable is ever empty or unset, the command deletes the contents of the filesystem root.

The script sources (executes) a file whose path comes from its arguments (source "$1" / . "$1"). Whoever controls the argument controls the code that runs.

SSH host key verification is turned off (StrictHostKeyChecking=no or UserKnownHostsFile=/dev/null). The connection can be intercepted by anyone on the network path (man-in-the-middle).

The script writes a sudoers rule that grants passwordless root access to every command (NOPASSWD: ALL). Code execution as that user then means root.

mktemp -u only prints a name without creating the file, so another process can create it first (race condition).

The script writes to a fixed file name in /tmp. Another local user can pre-create it or a symlink with that name and make the script overwrite or disclose arbitrary files.

Spring Boot exposes every Actuator endpoint over HTTP (management.endpoints.web.exposure.include=*). Endpoints such as /actuator/env and /actuator/heapdump leak configuration secrets and in-memory credentials.

Spring Boot exposes every Actuator endpoint over HTTP (management.endpoints.web.exposure.include: "*"). Endpoints such as /actuator/env and /actuator/heapdump leak secrets.

Spring Boot 1.x Actuator security is switched off (management.security.enabled=false or endpoints.sensitive=false). Sensitive endpoints such as /env, /heapdump and /trace become reachable without authentication.

Spring Boot exposes a sensitive Actuator endpoint (env, heapdump, jolokia, shutdown, gateway, logfile or httpexchanges) over HTTP. These endpoints reveal secrets or allow remote control of the application.

Spring Boot exposes a sensitive Actuator endpoint (env, heapdump, jolokia, shutdown, gateway, logfile or httpexchanges) over HTTP. These endpoints reveal secrets or allow remote control of the application.

Spring Boot always includes stack traces in error responses (server.error.include-stacktrace=always). Every client sees internal classes, library versions and sometimes data.

Spring Boot always includes stack traces in error responses (include-stacktrace: always). Every client sees internal classes, library versions and sometimes data.

The H2 web console accepts connections from other hosts (spring.h2.console.settings.web-allow-others=true). The console can run arbitrary SQL and Java code, so anyone who reaches it can take over the server.

The H2 web console accepts connections from other hosts (web-allow-others: true). The console can run arbitrary SQL and Java code, so anyone who reaches it can take over the server.

sshd explicitly enables password authentication, which exposes the server to password guessing and credential stuffing.

sshd allows logins to accounts with empty passwords (PermitEmptyPasswords yes). Any such account can be accessed remotely without credentials.

sshd allows direct root logins with a password or key (PermitRootLogin yes). Attackers can brute-force or reuse credentials directly against the most privileged account.

A sudoers rule grants passwordless root access to every command (NOPASSWD: ALL). Anyone who gets code execution as that user or group immediately becomes root.

A shell is started with -c and a command line built from interpolation or concatenation. Shell metacharacters in the interpolated value run arbitrary commands.

Vapor's CORS middleware reflects any request Origin (.originBased) while allowing credentials. Any website can make authenticated cross-origin requests and read the responses.

A block cipher is used in ECB mode. Identical plaintext blocks produce identical ciphertext blocks, which leaks the structure of the data.

A symmetric encryption or MAC key is a string literal in source code. Anyone with the app binary can extract it and decrypt or forge the protected data.

A token, password, OTP, salt or key is generated with the C library rand()/random()/drand48(), which are predictable (and often seeded with the time).

An IV or nonce is a constant (string literal or all-zero array). Reusing it with the same key makes CBC ciphertext predictable and breaks GCM/ChaCha confidentiality and integrity.

A broken or legacy cipher (DES, 3DES, RC2, RC4 or Blowfish) is used. Small keys or 64-bit blocks make the ciphertext practical to attack.

MD5 or SHA-1 is used (CommonCrypto or CryptoKit's Insecure namespace). Both are broken for collision resistance and must not protect integrity, signatures or passwords.

NSKeyedUnarchiver is used without secure coding (unarchiveObject / unarchiveTopLevelObjectWithData / requiresSecureCoding = false). A crafted archive can instantiate unexpected classes (object injection).

An NSPredicate format string is built with interpolation instead of %@ arguments. A crafted value can change the predicate (for example to match every Core Data record).

A Vapor redirect target is taken from request input. An attacker can send users to a phishing site from a link on this domain (open redirect).

A SQL statement embeds a value inside quotes through string interpolation or concatenation before it is executed (SQLite C API, FMDB, GRDB or SQLite.swift). Any quote in the value breaks out of the literal, which is SQL injection.

A SQLKit/Fluent raw SQL string interpolates a value with \(raw:) or builds .sql(raw:) from interpolation. Raw interpolation is copied into the statement unescaped (SQL injection).

A Vapor outbound HTTP request is sent to a URL taken from request input. An attacker can make the server call internal services or cloud metadata endpoints (server-side request forgery).

A file is written with Data Protection explicitly disabled (.noFileProtection / FileProtectionType.none). Its contents stay readable while the device is locked and from unencrypted backups.

A Keychain item uses kSecAttrAccessibleAlways(ThisDeviceOnly), so it is readable while the device is locked and is not protected by the passcode-derived key (deprecated by Apple).

A password, token, API key or similar secret is stored in UserDefaults / @AppStorage, which is a plain-text plist inside the app container and included in device backups.

Alamofire server trust evaluation is disabled for a host (DisabledTrustEvaluator / .disableEvaluation). TLS connections to it accept any certificate.

TLS trust evaluation is configured without host name validation (validateHost: false or a basic X.509 policy). A valid certificate for any other domain is accepted for this server.

An authentication challenge is answered with URLCredential(trust:) for the server's trust object without evaluating it (SecTrustEvaluateWithError) or pinning it. Any certificate, including an attacker's, is accepted.

A WKWebView preference enables allowFileAccessFromFileURLs through KVC. JavaScript in a file:// page can read other local files.

HTML built with string interpolation is loaded into a web view with a non-nil base URL. Markup in the interpolated value executes with that origin's privileges (XSS).

Web view JavaScript may open windows without user interaction (javaScriptCanOpenWindowsAutomatically = true), which helps pop-up phishing and click-jacking.

JavaScript evaluated in a web view is built with string interpolation. A quote or script fragment in the interpolated value runs as code in the page (script injection).

UIWebView is used. It is deprecated, cannot disable JavaScript or isolate content, and App Store submissions that reference it are rejected.

A WKWebView is configured with allowUniversalAccessFromFileURLs through KVC. A file:// page can then read any local file and send it to any origin.