Every check. Categorized.

AWS access key ID

secrets/aws-access-key

AWS secret access key

secrets/aws-secret-key

Stripe secret key

secrets/stripe-secret-key

GitHub personal access token

secrets/github-token

OpenAI API key (legacy + sk-proj/svcacct/None)

secrets/openai-api-key

Anthropic API key (sk-ant-...)

secrets/anthropic-api-key

Google AI Studio / Gemini API key

secrets/google-ai-key

xAI / Grok API key

secrets/grok-xai-key

Groq API key (gsk_...)

secrets/groq-api-key

Replicate API token (r8_...)

secrets/replicate-token

Perplexity API key (pplx-...)

secrets/perplexity-api-key

Hugging Face access token (hf_...)

secrets/huggingface-token

Together AI API key

secrets/together-api-key

Mistral AI API key

secrets/mistral-api-key

Cohere API key

secrets/cohere-api-key

DeepSeek API key

secrets/deepseek-api-key

ElevenLabs API key

secrets/elevenlabs-api-key

Pinecone vector DB API key (pcsk_...)

secrets/pinecone-api-key

Weaviate vector DB API key

secrets/weaviate-api-key

VS Code Marketplace publish token (VSCE_PAT)

secrets/vsce-publish-token

Open VSX publish token

secrets/ovsx-publish-token

Supabase service role key

secrets/supabase-service-role

Private key (RSA, EC, etc.)

secrets/private-key

JWT signing secret

secrets/jwt-secret

Database connection string with credentials

secrets/database-url

SendGrid API key

secrets/sendgrid-api-key

Slack webhook URL

secrets/slack-webhook

Generic API key pattern

secrets/generic-api-key

Hardcoded password

secrets/generic-password

Default credentials in code

secrets/default-credentials

SQL query built with string concatenation

injection/sql-string-concat

User input passed to shell command

injection/command-injection

Dynamic code execution with eval()

injection/eval-usage

Unsanitized file path from user input

injection/path-traversal

Object merge with unvalidated user input

injection/prototype-pollution

SQL Query Built with String Formatting (Python)

injection/python-sql-formatting

Unsafe YAML Deserialization (Python)

injection/python-unsafe-yaml-load

OS Command Injection (Python)

injection/python-command-injection

Code Execution via eval/exec (Python)

injection/python-eval-exec

Unsafe Deserialization (Python)

injection/python-unsafe-deserialization

Server-Side Request Forgery (Python)

injection/python-ssrf

Path Traversal (Python)

injection/python-path-traversal

PHP Object Injection via unserialize()

injection/php-object-injection

OS Command Injection (PHP)

injection/php-command-injection

SQL Injection via Interpolated Query (PHP)

injection/php-sql-injection

Unrestricted File Upload (PHP)

injection/php-unrestricted-upload

Path Traversal (PHP)

injection/php-path-traversal

Server-Side Request Forgery (PHP curl)

injection/php-ssrf

SQL Injection via String Interpolation (Ruby/Rails)

injection/ruby-sql-injection

OS Command Injection (Ruby)

injection/ruby-command-injection

Unsafe Deserialization (Ruby)

injection/ruby-unsafe-deserialization

Unsafe Reflection / Code Execution (Ruby)

injection/ruby-unsafe-reflection

Mass Assignment (Ruby/Rails)

injection/ruby-mass-assignment

Server-Side Request Forgery (Ruby)

injection/ruby-ssrf

OS Command Injection (Go)

injection/go-command-injection

SQL Injection via fmt.Sprintf (Go)

injection/go-sql-injection

SQL Injection via String Concatenation (Java)

injection/java-sql-injection

OS Command Injection (Java)

injection/java-command-injection

Insecure Deserialization (Java)

injection/java-insecure-deserialization

Path Traversal (Java)

injection/java-path-traversal

Server-Side Request Forgery (Java)

injection/java-ssrf

SQL Injection via Interpolated Raw SQL (C#)

injection/csharp-sql-injection

Insecure Deserialization (C#)

injection/csharp-insecure-deserialization

OS Command Injection (C#)

injection/csharp-command-injection

SQL Injection via format! (Rust)

injection/rust-sql-injection

OS Command Injection (Rust)

injection/rust-command-injection

SQL Injection via String Interpolation (Swift)

injection/swift-sql-injection

OS Command Injection (Swift)

injection/swift-command-injection

SQL Injection via String Template (Kotlin)

injection/kotlin-sql-injection

Path Traversal (Kotlin)

injection/kotlin-path-traversal

Insecure Deserialization (Kotlin/Jackson)

injection/kotlin-insecure-deserialization

Setting innerHTML with dynamic content

xss/innerhtml-usage

Using dangerouslySetInnerHTML in React

xss/dangerously-set-html

Using document.write() with dynamic content

xss/document-write

Unescaped user input in template

xss/unescaped-output

Reflected XSS via echo of User Input (PHP)

xss/php-reflected-echo

XSS via html_safe / raw (Ruby/Rails)

xss/ruby-html-safe

XSS via template.HTML Bypass (Go)

xss/go-template-html-bypass

XSS via Html.Raw / MarkupString (C#)

xss/csharp-razor-html-raw

WKWebView Script Injection (Swift)

xss/swift-webview-innerhtml

JWT verified with hardcoded secret

auth/hardcoded-jwt-verify

CORS allows all origins (*)

auth/cors-wildcard

Data access without ownership verification

authz/missing-ownership-check

Admin check only on frontend

authz/admin-check-frontend-only

Delete endpoint without authentication

authz/delete-without-auth

Role/permission taken from client request

authz/role-from-client

Sequential IDs expose data to enumeration

authz/idor-sequential-id

Using MD5 or SHA1 for security purposes

crypto/weak-algorithm

Math.random() used for security-sensitive values

crypto/math-random

Weak Password Hash (PHP md5/sha1)

crypto/php-weak-password-hash

JWT Signature Not Verified (Go)

crypto/go-jwt-parse-unverified

Weak Password Hash (Go md5/sha1)

crypto/go-weak-password-hash

Weak Cryptographic Algorithm (Java)

crypto/java-weak-algorithm

JWT Validation Disabled (C#)

crypto/csharp-jwt-validation-disabled

Weak Password Hash (C# MD5/SHA1)

crypto/csharp-weak-password-hash

JWT Signature Validation Disabled (Rust)

crypto/rust-jwt-validation-disabled

TLS Certificate Validation Disabled (Rust)

crypto/rust-tls-disabled

Weak Password Hash (Rust)

crypto/rust-weak-password-hash

TLS Validation Disabled (Swift)

crypto/swift-tls-disabled

Weak Hash (Swift Insecure.MD5/SHA1)

crypto/swift-weak-hash

Trust-All TLS / Hostname Verifier (Kotlin)

crypto/kotlin-trust-all-tls

Insecure Random for a Security Value (Python)

crypto/python-weak-random

.env file committed to version control

config/env-file-committed

Debug mode enabled in production config

config/debug-mode-enabled

Insecure NextAuth.js configuration

config/insecure-nextauth-config

Agent workspace config committed to repo

config/agent-config-tracked

TLS Certificate Verification Disabled (Go)

config/go-tls-skip-verify

XML External Entity (XXE) (Java)

config/java-xxe

Spring Security Misconfiguration (Java)

config/java-spring-permit-all

Sensitive Data in UserDefaults (Swift)

config/swift-insecure-storage

Cleartext HTTP Request (Swift)

config/swift-cleartext-http

Android WebView JS Bridge on Untrusted Content (Kotlin)

config/kotlin-webview-jsbridge

XML External Entity (XXE) (Kotlin)

config/kotlin-xxe

Email addresses logged to console

pii/email-in-logs

Sensitive data in console.log

pii/console-log-sensitive

Sensitive data stored without encryption

pii/unencrypted-storage

Supabase service key used on client

baas/supabase-service-key-client

Supabase RLS policy bypassed

baas/supabase-rls-bypass

Supabase table without Row Level Security

baas/supabase-rls-disabled

Supabase RLS policy allows all rows (USING true)

baas/supabase-rls-policy-allows-all

Postgres anon role granted broad privileges

baas/supabase-anon-overgrant

Service-role key used in client-reachable route

baas/supabase-service-role-client-reachable

Supabase RLS trusts a JWT claim it doesn't issue

baas/supabase-rls-policy-jwt-claim-not-verified

Anon key used for server-side mutations

baas/supabase-anon-key-server-mutation

Supabase storage bucket without access policies

baas/supabase-storage-no-policy

Direct query to auth.users table

baas/supabase-auth-users-direct

Supabase auth with unvalidated redirect URL

baas/supabase-insecure-redirect

Firebase rules allow all reads/writes

baas/firebase-rules-allow-all

Storage bucket publicly accessible

baas/storage-bucket-public

System prompt exposed to client

llm/system-prompt-exposed

Unsanitized user input in LLM prompt

llm/user-input-to-prompt

AI API key hardcoded in source

llm/api-key-hardcoded

AI API key leaks to browser via env prefix

llm/api-key-client-env

LLM output used without validation

llm/no-output-validation

LLM tool call executed without validation

llm/tool-call-no-validation

RAG retrieval vulnerable to prompt injection

llm/rag-injection

System prompt leaks through LLM output

llm/prompt-leak-via-output

LLM output executed as code

llm/output-as-code

MCP tool used without version pinning (rug-pull risk)

llm/mcp-tool-no-pinning

LangChain RecursiveUrlLoader without SSRF guard (CVE-2026-27795)

llm/langchain-recursive-url-loader-unsafe

LangChain loads prompt template from untrusted path (CVE-2026-34070)

llm/langchain-load-prompt-from-path

Vercel AI SDK called with raw user input

llm/ai-sdk-input-as-prompt

AI agent run on PR title/body without sanitizing

llm/agent-runs-on-unsanitized-pr-content

LLM call without max_tokens or cost limit

llm/no-max-tokens

.env or secrets file read into LLM prompt

llm/env-file-read-into-prompt

Code writes to .git/hooks (CVE-2026-26268 vector)

llm/agent-writes-to-git-hooks

Branch name or repo field passed to shell without sanitizing

llm/codex-branch-name-shell-injection

OpenAI Assistants/Responses API without tool allowlist

llm/openai-assistant-tool-no-allowlist

Vercel AI SDK call without an output token ceiling

cost/ai-sdk-no-token-cap

Paid API called in a loop over unvalidated request data

cost/unbounded-paid-send-loop

AI SDK client configured to run in the browser

cost/ai-client-dangerously-allow-browser

Missing Content Security Policy

headers/missing-csp

Missing Strict-Transport-Security header

headers/missing-hsts

Missing X-Frame-Options header

headers/missing-x-frame-options

Server-side request to user-provided URL

headers/ssrf-unvalidated-url

Redirect to unvalidated URL

headers/open-redirect

Missing Referrer-Policy header

headers/missing-referrer-policy

Missing X-Content-Type-Options header

headers/missing-x-content-type-options

Missing Permissions-Policy header

headers/missing-permissions-policy

CORS allows credentials with wildcard origin

headers/cors-credentials-wildcard

Cookie set without Secure/HttpOnly flags

headers/cookie-missing-secure

Auth route without rate limiting

headers/rate-limit-missing-auth-route

Server request may reach cloud metadata endpoint

headers/ssrf-cloud-metadata

Server request may reach internal IP range

headers/ssrf-internal-ip

Unpinned dependency versions

deps/unpinned-versions

Package name similar to popular package

deps/typosquatting-risk

Package runs scripts on install

deps/postinstall-script

Potentially AI-hallucinated package name

deps/slopsquatting-risk

Remote code fetched and executed

deps/eval-fetched-code

CDN script without Subresource Integrity

deps/cdn-no-integrity

Known-malicious package (Cline 2.3.0, openclaw, postmark-mcp)

deps/known-malicious-package

Likely AI-hallucinated package name (extended list)

deps/slopsquatting-risk-extended

No dependency lockfile in project

deps/no-lockfile

Auth token stored in localStorage (XSS risk)

client/jwt-in-localstorage

Error stack trace sent to client

client/error-stack-exposed

File upload without type or size validation

client/file-upload-no-validation

State-changing endpoint without CSRF protection

client/missing-csrf-state-change

AI agent config file contains invisible Unicode

ai-agent/invisible-unicode-in-config

MCP server runs an arbitrary shell command

ai-agent/mcp-stdio-shell-command

MCP server points to a public HTTP URL

ai-agent/mcp-public-http-endpoint

Cursor Auto-Run / YOLO mode enabled

ai-agent/cursor-auto-run-enabled

Agent tool allowlist disabled or empty

ai-agent/agent-allowlist-disabled

Agent configured to auto-approve all tool calls

ai-agent/auto-approve-tools

CI agent reads PR title or body without sanitizing

ai-agent/ci-agent-untrusted-pr-input

CI agent triggers on pull_request from forks

ai-agent/ci-agent-pull-request-fork

PR title or body interpolated into shell step

ai-agent/github-action-injection-from-pr

Agent config path suggests workspace file was committed

ai-agent/agent-config-not-gitignored

GitHub Action uses pull_request_target + checks out PR code

ai-agent/pwn-request-checkout

Workflow grants write-all permissions to AI agent job

ai-agent/workflow-write-all-permissions

JSON schema loaded from untrusted remote URL

ai-agent/jetbrains-junie-json-schema-remote

.cursor/rules/*.mdc files present — review recommended

ai-agent/cursor-mdc-rules-directory-presence

Mass assignment — ::create/fill with request()->all()

injection/laravel-mass-assignment

SQL injection — request input concatenated into whereRaw/selectRaw

injection/laravel-raw-sql-concat

OS command injection — shell_exec / proc_open on request input

injection/laravel-os-command-request

PHP object injection — unserialize on request input

deserialization/laravel-unserialize-request

Template injection — Blade::render on a user string (SSTI)

injection/laravel-blade-render-request

Hardcoded APP_KEY committed in source

secrets/laravel-hardcoded-app-key

Auth middleware stripped with withoutMiddleware()

auth/laravel-without-middleware-auth

Gate::before closure returns true — authorization bypass

auth/laravel-gate-always-true

Blade unescaped output — {!! $var !!}

xss/laravel-blade-unescaped

Reflected XSS — response()->make with unescaped request input

xss/laravel-response-make-reflected

Path traversal — getClientOriginalName() used to build a storage path

file/laravel-store-user-filename

TLS verification disabled — Http::withoutVerifying()

ssrf/laravel-http-without-verifying

CORS allows any origin with credentials

misconfig/laravel-cors-credentials-wildcard

Insecure randomness — mt_rand / rand used for a token or OTP

crypto/laravel-insecure-random-token

CSRF protection disabled by wildcard exclusion

config/laravel-csrf-disabled

APP_DEBUG=true — stack traces exposed in production

config/laravel-debug-enabled

Debug statement left in code — dd() / dump() / var_dump

misconfig/laravel-debug-statement-left