Supported frameworks
DevShield detects the stacks in a project and runs the rules that apply to them. This page is the
map from stack to rules; each ID links to its own page.
How a stack is detected
| Stack |
Signals |
| Laravel |
artisan file, laravel/framework in composer.json |
| Node.js, Express, React, Next.js |
package.json and the matching dependency |
| NestJS |
@nestjs/core in package.json |
| Django |
django in requirements, pyproject or Pipfile, or a Django manage.py |
| FastAPI, Flask |
the package in the dependencies, or an import in a Python file |
| Spring Boot |
spring-boot in pom.xml, or the Spring Boot plugin or starters in Gradle |
| ASP.NET Core |
a .csproj using Microsoft.NET.Sdk.Web or Microsoft.AspNetCore packages |
| Terraform |
.tf files |
| CloudFormation |
YAML or JSON templates that declare AWS:: resources |
| Docker, GitHub Actions |
Dockerfile or compose files, workflow files |
Detected stacks are listed at the top of every report. Build output is skipped: target/ next to a
pom.xml or Gradle build, obj/ and bin/ next to a .csproj, .terraform/, and virtual
environments. A folder that only shares one of those names is still scanned. Development-profile
files (application-dev.properties, settings/dev.py) are skipped by the debug-style checks; set
scan_dev_files: true in devshield.yml to check them too.
Rules by stack
A rule that applies to several stacks is listed under each of them.
Laravel
| Rule |
Severity |
Title |
| PERF001 |
low |
Laravel optimization caches not built on deploy |
| SH009 |
medium |
Laravel CORS allows every origin |
| SH010 |
high |
Sensitive file in Laravel public directory |
| SH104 |
medium |
Laravel session cookie not hardened |
| SH105 |
medium |
No rate limiting on Laravel auth routes |
Node.js
| Rule |
Severity |
Title |
| SH002 |
medium |
Permissive CORS configuration |
| SH008 |
high |
Dynamic code execution |
| SH102 |
medium |
Unsafe JWT usage |
Express
| Rule |
Severity |
Title |
| SH003 |
medium |
Security headers not configured |
| SH004 |
low |
X-Powered-By header exposes Express |
| SH101 |
medium |
Insecure session cookie settings |
| SH103 |
medium |
No rate limiting on authentication routes |
NestJS
| Rule |
Severity |
Title |
| SH003 |
medium |
Security headers not configured |
| SH109 |
medium |
NestJS request validation not enabled |
React
| Rule |
Severity |
Title |
| PERF201 |
low |
Production source maps enabled |
| PERF202 |
medium |
Large frontend bundle or heavy import |
| PERF203 |
low |
Unoptimized images |
| SH005 |
medium |
dangerouslySetInnerHTML without sanitizer |
| SH006 |
high |
Secret exposed to the browser |
Next.js
| Rule |
Severity |
Title |
| PERF201 |
low |
Production source maps enabled |
| PERF202 |
medium |
Large frontend bundle or heavy import |
| PERF203 |
low |
Unoptimized images |
| SH005 |
medium |
dangerouslySetInnerHTML without sanitizer |
| SH006 |
high |
Secret exposed to the browser |
| SH007 |
medium |
Next.js Content-Security-Policy not configured |
Django
| Rule |
Severity |
Title |
| SH014 |
medium |
Django accepts any Host header |
| SH015 |
medium |
Django does not enforce HTTPS |
| SH016 |
medium |
Permissive CORS in a Python, Java or .NET API |
| SH019 |
high |
Unsafe code execution or deserialization in Python |
| SH020 |
high |
SQL query built from string formatting |
| SH106 |
medium |
Session cookies not hardened |
| SH107 |
medium |
CSRF protection disabled |
| SH206 |
high |
Hard-coded framework secret key |
| SH208 |
high |
Database password written in Django settings |
FastAPI
| Rule |
Severity |
Title |
| SH016 |
medium |
Permissive CORS in a Python, Java or .NET API |
| SH017 |
low |
API documentation exposed |
| SH019 |
high |
Unsafe code execution or deserialization in Python |
| SH020 |
high |
SQL query built from string formatting |
| SH106 |
medium |
Session cookies not hardened |
| SH107 |
medium |
CSRF protection disabled |
| SH206 |
high |
Hard-coded framework secret key |
Flask
| Rule |
Severity |
Title |
| SH016 |
medium |
Permissive CORS in a Python, Java or .NET API |
| SH019 |
high |
Unsafe code execution or deserialization in Python |
| SH020 |
high |
SQL query built from string formatting |
| SH106 |
medium |
Session cookies not hardened |
| SH107 |
medium |
CSRF protection disabled |
| SH206 |
high |
Hard-coded framework secret key |
Spring Boot
| Rule |
Severity |
Title |
| SH016 |
medium |
Permissive CORS in a Python, Java or .NET API |
| SH018 |
high |
Spring Boot management or debug endpoints exposed |
| SH020 |
high |
SQL query built from string formatting |
| SH106 |
medium |
Session cookies not hardened |
| SH107 |
medium |
CSRF protection disabled |
| SH108 |
high |
Spring Security allows every request |
| SH207 |
high |
Credential written in an application config file |
| SH303 |
medium |
Hibernate changes the database schema at startup |
ASP.NET Core
| Rule |
Severity |
Title |
| SH016 |
medium |
Permissive CORS in a Python, Java or .NET API |
| SH017 |
low |
API documentation exposed |
| SH020 |
high |
SQL query built from string formatting |
| SH106 |
medium |
Session cookies not hardened |
| SH107 |
medium |
CSRF protection disabled |
| SH207 |
high |
Credential written in an application config file |
| Rule |
Severity |
Title |
| SH401 |
high |
S3 bucket is publicly accessible |
| SH402 |
high |
IAM policy grants wildcard permissions |
| SH403 |
high |
Security group open to the internet |
| SH404 |
medium |
Storage encryption at rest not enabled |
| SH405 |
high |
Database reachable from the internet |
| Rule |
Severity |
Title |
| SH401 |
high |
S3 bucket is publicly accessible |
| SH402 |
high |
IAM policy grants wildcard permissions |
| SH403 |
high |
Security group open to the internet |
| SH404 |
medium |
Storage encryption at rest not enabled |
| SH405 |
high |
Database reachable from the internet |
Docker
| Rule |
Severity |
Title |
| PERF101 |
medium |
Base image not pinned to a version |
| PERF102 |
medium |
Container runs as root |
| PERF103 |
low |
No .dockerignore |
| PERF104 |
low |
Build tools left in the final image |
| PERF105 |
low |
ADD used instead of COPY |
| PERF106 |
low |
Package install leaves caches or extras |
| PERF107 |
low |
Dependency install after copying the whole project |
| PERF108 |
info |
No HEALTHCHECK |
| SH011 |
high |
Risky docker-compose service configuration |
| SH012 |
high |
Secret baked into Dockerfile |
GitHub Actions
| Rule |
Severity |
Title |
| DX003 |
medium |
Workflow token permissions too broad |
| DX004 |
critical |
pull_request_target checks out untrusted code |
| DX005 |
medium |
Action not pinned to a commit SHA |
| DX006 |
low |
CI installs dependencies without caching |
| DX010 |
high |
Secret printed in workflow logs |
| DX011 |
high |
Untrusted input interpolated into a shell step |
Every project
| Rule |
Severity |
Title |
| DOC001 |
medium |
README missing or nearly empty |
| DOC002 |
low |
No license |
| DOC003 |
info |
CONTRIBUTING or CHANGELOG missing |
| DX001 |
medium |
No automated tests detected |
| DX002 |
low |
No CI workflow |
| DX007 |
low |
Inconsistent version numbers |
| DX008 |
low |
.gitignore missing or incomplete |
| DX009 |
low |
Large file committed |
| PERF301 |
medium |
Lockfile missing or out of sync |
| PERF302 |
low |
Duplicate or overlapping dependencies |
| PERF303 |
low |
Development tool in production dependencies |
| PERF304 |
medium |
Unpinned dependency version |
| SH001 |
high |
Debug mode enabled |
| SH013 |
medium |
Dangerous file permissions |
| SH201 |
high |
Hard-coded secret |
| SH202 |
high |
.env file committed or not ignored |
| SH203 |
critical |
Private key or keystore file in project |
| SH204 |
high |
Secret in git history |
| SH205 |
high |
Weak or empty application secret |
| SH301 |
low |
.env.example missing or incomplete |
| SH302 |
medium |
Required environment variable missing |
Adding a stack
Each new stack needs a detector in devshield/core/detect.py, a rule pack under
devshield/rules/, fixtures in tests/fixtures/ (one insecure, one clean) and documentation.
Third parties can ship rules for other stacks as plugins.