Rule catalog

Hardcoded private key block

Any file · secret-private-key

Hardcoded aWS access key ID

Any file · secret-aws-access-key

Hardcoded aWS secret access key

Any file · secret-aws-secret-key

Hardcoded gitHub token

Any file · secret-github-token

Hardcoded gitLab personal access token

Any file · secret-gitlab-token

Hardcoded slack token

Any file · secret-slack-token

Hardcoded slack incoming webhook

Any file · secret-slack-webhook

Hardcoded stripe live secret key

Any file · secret-stripe-live-key

Hardcoded google API key

Any file · secret-google-api-key

Hardcoded anthropic API key

Any file · secret-anthropic-api-key

Hardcoded openAI API key

Any file · secret-openai-api-key

Hardcoded npm access token

Any file · secret-npm-token

Hardcoded sendGrid API key

Any file · secret-sendgrid-key

Hardcoded credentials embedded in connection URL

Any file · secret-credentials-in-url

Hardcoded jSON Web Token

Any file · secret-jwt

Hardcoded hardcoded secret assignment

Any file · secret-generic-secret

Missing Strict-Transport-Security header

vercel.json · vercel-strict-transport-security

Missing Content-Security-Policy header

vercel.json · vercel-content-security-policy

Missing X-Frame-Options header

vercel.json · vercel-x-frame-options

Missing X-Content-Type-Options header

vercel.json · vercel-x-content-type-options

Missing Referrer-Policy header

vercel.json · vercel-referrer-policy

Missing Permissions-Policy header

vercel.json · vercel-permissions-policy

Permissive Content-Security-Policy

vercel.json · vercel-weak-csp

HSTS max-age shorter than 180 days

vercel.json · vercel-short-hsts

Wildcard CORS origin

vercel.json · vercel-cors-wildcard

X-Powered-By discloses the stack

vercel.json · vercel-x-powered-by

Dependency below known-safe version

package.json · pkg-vuln*

Known compromised release (hijacked maintainer)

package.json · pkg-compromised*

Known malicious or typosquat package

package.json · pkg-malicious*

Dependency downloaded over plain HTTP

package.json · pkg-insecure-source*

Dependency installed from git/URL

package.json · pkg-non-registry*

Unbounded version range

package.json · pkg-unbounded-range*

Install hook downloads or evaluates code

package.json · pkg-suspicious*

Dev tool shipped in production dependencies

package.json · pkg-devtool-in-deps*

No audit script

package.json · pkg-missing-audit-script

Container runs as root

Dockerfile · docker-root-user

Unpinned base image

Dockerfile · docker-latest-tag

Secret baked into image via ENV

Dockerfile · docker-secret-env*

Secret recorded in image history via ARG

Dockerfile · docker-secret-arg*

ADD from URL without checksum

Dockerfile · docker-add-remote*

Remote script piped into a shell

Dockerfile · docker-curl-pipe-shell*

World-writable permissions

Dockerfile · docker-chmod-777*

sudo used in build

Dockerfile · docker-sudo*

SSH port exposed

Dockerfile · docker-expose-ssh

COPY . copies the whole build context

Dockerfile · docker-copy-all

No HEALTHCHECK

Dockerfile · docker-no-healthcheck

.env files not ignored

.gitignore · gitignore-missing-env

Private key files not ignored

.gitignore · gitignore-missing-keys

Negation re-includes an env file

.gitignore · gitignore-env-negated

Credential files not ignored

.gitignore · gitignore-missing-sensitive

node_modules not ignored

.gitignore · gitignore-missing-node-modules

Server secret behind a public prefix

.env · env-client-exposed*

Default or weak credential

.env · env-weak-credential*

Signing secret shorter than 32 characters

.env · env-short-signing-secret*

Debug mode enabled

.env · env-debug*

TLS certificate verification disabled

.env · env-tls-verification-disabled

TLS disabled for a connection

.env · env-db-ssl-disabled*

Plain-HTTP endpoint

.env · env-plain-http*

Wildcard CORS origin

.env · env-cors-wildcard*

Privileged container

docker-compose.yml · compose-privileged*

Docker socket mounted

docker-compose.yml · compose-docker-socket*

Sensitive host path mounted

docker-compose.yml · compose-sensitive-mount*

Host namespace shared

docker-compose.yml · compose-host*

Seccomp/AppArmor/SELinux disabled

docker-compose.yml · compose-unconfined*

Dangerous Linux capability added

docker-compose.yml · compose-cap*

Database port published on all interfaces

docker-compose.yml · compose-public-datastore*

Default database password

docker-compose.yml · compose-weak-password*

Unpinned service image

docker-compose.yml · compose-unpinned-image*

Deprecated TLS protocol enabled

nginx.conf · nginx-weak-tls*

Weak cipher suites allowed

nginx.conf · nginx-weak-ciphers*

Alias off-by-slash path traversal

nginx.conf · nginx-alias-traversal*

Directory listing enabled

nginx.conf · nginx-autoindex

HTTP not redirected to HTTPS

nginx.conf · nginx-no-https-redirect

Plain HTTP only

nginx.conf · nginx-no-https

Wildcard CORS origin

nginx.conf · nginx-cors-wildcard*

Missing security headers

nginx.conf · nginx-missing-security-headers

nginx version advertised

nginx.conf · nginx-server-tokens