| DOC001 |
medium |
documentation |
README missing or nearly empty |
|
| DOC002 |
low |
documentation |
No license |
|
| DOC003 |
info |
documentation |
CONTRIBUTING or CHANGELOG missing |
|
| DX001 |
medium |
developer_experience |
No automated tests detected |
|
| DX002 |
low |
developer_experience |
No CI workflow |
yes |
| DX003 |
medium |
developer_experience |
Workflow token permissions too broad |
yes |
| DX004 |
critical |
security |
pull_request_target checks out untrusted code |
|
| DX005 |
medium |
security |
Action not pinned to a commit SHA |
|
| DX006 |
low |
developer_experience |
CI installs dependencies without caching |
|
| DX007 |
low |
developer_experience |
Inconsistent version numbers |
|
| DX008 |
low |
developer_experience |
.gitignore missing or incomplete |
|
| DX009 |
low |
developer_experience |
Large file committed |
|
| DX010 |
high |
security |
Secret printed in workflow logs |
|
| DX011 |
high |
security |
Untrusted input interpolated into a shell step |
|
| PERF001 |
low |
performance |
Laravel optimization caches not built on deploy |
|
| PERF101 |
medium |
docker |
Base image not pinned to a version |
|
| PERF102 |
medium |
docker |
Container runs as root |
yes |
| PERF103 |
low |
docker |
No .dockerignore |
yes |
| PERF104 |
low |
docker |
Build tools left in the final image |
|
| PERF105 |
low |
docker |
ADD used instead of COPY |
|
| PERF106 |
low |
docker |
Package install leaves caches or extras |
|
| PERF107 |
low |
docker |
Dependency install after copying the whole project |
|
| PERF108 |
info |
docker |
No HEALTHCHECK |
|
| PERF201 |
low |
frontend |
Production source maps enabled |
|
| PERF202 |
medium |
frontend |
Large frontend bundle or heavy import |
|
| PERF203 |
low |
frontend |
Unoptimized images |
|
| PERF301 |
medium |
dependencies |
Lockfile missing or out of sync |
|
| PERF302 |
low |
dependencies |
Duplicate or overlapping dependencies |
|
| PERF303 |
low |
dependencies |
Development tool in production dependencies |
|
| PERF304 |
medium |
dependencies |
Unpinned dependency version |
|
| SH001 |
high |
security |
Debug mode enabled |
yes |
| SH002 |
medium |
security |
Permissive CORS configuration |
|
| SH003 |
medium |
security |
Security headers not configured |
|
| SH004 |
low |
security |
X-Powered-By header exposes Express |
|
| SH005 |
medium |
security |
dangerouslySetInnerHTML without sanitizer |
|
| SH006 |
high |
secrets |
Secret exposed to the browser |
|
| SH007 |
medium |
security |
Next.js Content-Security-Policy not configured |
|
| SH008 |
high |
security |
Dynamic code execution |
|
| SH009 |
medium |
security |
Laravel CORS allows every origin |
|
| SH010 |
high |
security |
Sensitive file in Laravel public directory |
|
| SH011 |
high |
security |
Risky docker-compose service configuration |
|
| SH012 |
high |
security |
Secret baked into Dockerfile |
|
| SH013 |
medium |
security |
Dangerous file permissions |
|
| SH014 |
medium |
security |
Django accepts any Host header |
|
| SH015 |
medium |
security |
Django does not enforce HTTPS |
|
| SH016 |
medium |
security |
Permissive CORS in a Python, Java or .NET API |
|
| SH017 |
low |
security |
API documentation exposed |
|
| SH018 |
high |
security |
Spring Boot management or debug endpoints exposed |
|
| SH019 |
high |
security |
Unsafe code execution or deserialization in Python |
|
| SH020 |
high |
security |
SQL query built from string formatting |
|
| SH101 |
medium |
authentication |
Insecure session cookie settings |
|
| SH102 |
medium |
authentication |
Unsafe JWT usage |
|
| SH103 |
medium |
authentication |
No rate limiting on authentication routes |
|
| SH104 |
medium |
authentication |
Laravel session cookie not hardened |
|
| SH105 |
medium |
authentication |
No rate limiting on Laravel auth routes |
|
| SH106 |
medium |
authentication |
Session cookies not hardened |
|
| SH107 |
medium |
authentication |
CSRF protection disabled |
|
| SH108 |
high |
authentication |
Spring Security allows every request |
|
| SH109 |
medium |
authentication |
NestJS request validation not enabled |
|
| SH201 |
high |
secrets |
Hard-coded secret |
|
| SH202 |
high |
secrets |
.env file committed or not ignored |
yes |
| SH203 |
critical |
secrets |
Private key or keystore file in project |
|
| SH204 |
high |
secrets |
Secret in git history |
|
| SH205 |
high |
secrets |
Weak or empty application secret |
|
| SH206 |
high |
secrets |
Hard-coded framework secret key |
|
| SH207 |
high |
secrets |
Credential written in an application config file |
|
| SH208 |
high |
secrets |
Database password written in Django settings |
|
| SH301 |
low |
configuration |
.env.example missing or incomplete |
yes |
| SH302 |
medium |
configuration |
Required environment variable missing |
|
| SH303 |
medium |
configuration |
Hibernate changes the database schema at startup |
|
| SH401 |
high |
security |
S3 bucket is publicly accessible |
|
| SH402 |
high |
security |
IAM policy grants wildcard permissions |
|
| SH403 |
high |
security |
Security group open to the internet |
|
| SH404 |
medium |
security |
Storage encryption at rest not enabled |
|
| SH405 |
high |
security |
Database reachable from the internet |
|