--- title: "Security Rules Reference | ShipSafe" description: "200+ documented security rules, organized by category. Covers secrets, injection, XSS, auth, dependencies, and more." doc_version: 2026-09-23 last_updated: 2026-09-23T03:35:06.138Z canonical: https://ship-safe.co/docs/rules --- # Security Rules Reference | ShipSafe ● Security Rules # Every check. Categorized. 208 rules grouped into 16 categories and ranked by severity. Each finding ships with a plain-English reason and the fix. Dedicated rules now span eleven languages — JavaScript, TypeScript, Python, PHP, Ruby, Go, Java, C#, Swift, Kotlin, and Rust — and 23 frameworks, from Next.js, Express, NestJS, Remix, Astro and SvelteKit to FastAPI, Django, Flask, Laravel, Symfony, Rails, Spring Boot, ASP.NET Core, Go web, Supabase, Firebase and Expo. Secret detection runs on any language. Paid scans add an AI review on top, and your report shows the coverage depth (Deep / Standard) for each language it found. All (208)CriticalHighMediumLow ▸ SECRETS · 30 RULES ## Secrets Hardcoded credentials, API keys, and tokens that should be in environment variables. | Rule | Severity | | ----------------------------------------------------------------------- | -------- | | AWS access key IDsecrets/aws-access-key | critical | | AWS secret access keysecrets/aws-secret-key | critical | | Stripe secret keysecrets/stripe-secret-key | critical | | GitHub personal access tokensecrets/github-token | critical | | OpenAI API key (legacy + sk-proj/svcacct/None)secrets/openai-api-key | critical | | Anthropic API key (sk-ant-...)secrets/anthropic-api-key | critical | | Google AI Studio / Gemini API keysecrets/google-ai-key | critical | | xAI / Grok API keysecrets/grok-xai-key | critical | | Groq API key (gsk\_...)secrets/groq-api-key | critical | | Replicate API token (r8\_...)secrets/replicate-token | critical | | Perplexity API key (pplx-...)secrets/perplexity-api-key | high | | Hugging Face access token (hf\_...)secrets/huggingface-token | high | | Together AI API keysecrets/together-api-key | high | | Mistral AI API keysecrets/mistral-api-key | high | | Cohere API keysecrets/cohere-api-key | high | | DeepSeek API keysecrets/deepseek-api-key | high | | ElevenLabs API keysecrets/elevenlabs-api-key | high | | Pinecone vector DB API key (pcsk\_...)secrets/pinecone-api-key | critical | | Weaviate vector DB API keysecrets/weaviate-api-key | high | | VS Code Marketplace publish token (VSCE\_PAT)secrets/vsce-publish-token | critical | | Open VSX publish tokensecrets/ovsx-publish-token | critical | | Supabase service role keysecrets/supabase-service-role | critical | | Private key (RSA, EC, etc.)secrets/private-key | critical | | JWT signing secretsecrets/jwt-secret | critical | | Database connection string with credentialssecrets/database-url | critical | | SendGrid API keysecrets/sendgrid-api-key | critical | | Slack webhook URLsecrets/slack-webhook | critical | | Generic API key patternsecrets/generic-api-key | high | | Hardcoded passwordsecrets/generic-password | high | | Default credentials in codesecrets/default-credentials | critical | ▸ INJECTION · 41 RULES ## Injection SQL injection, command injection, and other code injection vectors. | Rule | Severity | | ---------------------------------------------------------------------------------- | -------- | | SQL query built with string concatenationinjection/sql-string-concat | critical | | User input passed to shell commandinjection/command-injection | critical | | Dynamic code execution with eval()injection/eval-usage | critical | | Unsanitized file path from user inputinjection/path-traversal | high | | Object merge with unvalidated user inputinjection/prototype-pollution | high | | SQL Query Built with String Formatting (Python)injection/python-sql-formatting | critical | | Unsafe YAML Deserialization (Python)injection/python-unsafe-yaml-load | critical | | OS Command Injection (Python)injection/python-command-injection | critical | | Code Execution via eval/exec (Python)injection/python-eval-exec | critical | | Unsafe Deserialization (Python)injection/python-unsafe-deserialization | critical | | Server-Side Request Forgery (Python)injection/python-ssrf | high | | Path Traversal (Python)injection/python-path-traversal | high | | PHP Object Injection via unserialize()injection/php-object-injection | critical | | OS Command Injection (PHP)injection/php-command-injection | critical | | SQL Injection via Interpolated Query (PHP)injection/php-sql-injection | critical | | Unrestricted File Upload (PHP)injection/php-unrestricted-upload | high | | Path Traversal (PHP)injection/php-path-traversal | high | | Server-Side Request Forgery (PHP curl)injection/php-ssrf | high | | SQL Injection via String Interpolation (Ruby/Rails)injection/ruby-sql-injection | critical | | OS Command Injection (Ruby)injection/ruby-command-injection | critical | | Unsafe Deserialization (Ruby)injection/ruby-unsafe-deserialization | critical | | Unsafe Reflection / Code Execution (Ruby)injection/ruby-unsafe-reflection | critical | | Mass Assignment (Ruby/Rails)injection/ruby-mass-assignment | high | | Server-Side Request Forgery (Ruby)injection/ruby-ssrf | high | | OS Command Injection (Go)injection/go-command-injection | critical | | SQL Injection via fmt.Sprintf (Go)injection/go-sql-injection | critical | | SQL Injection via String Concatenation (Java)injection/java-sql-injection | critical | | OS Command Injection (Java)injection/java-command-injection | critical | | Insecure Deserialization (Java)injection/java-insecure-deserialization | critical | | Path Traversal (Java)injection/java-path-traversal | high | | Server-Side Request Forgery (Java)injection/java-ssrf | high | | SQL Injection via Interpolated Raw SQL (C#)injection/csharp-sql-injection | critical | | Insecure Deserialization (C#)injection/csharp-insecure-deserialization | critical | | OS Command Injection (C#)injection/csharp-command-injection | critical | | SQL Injection via format! (Rust)injection/rust-sql-injection | critical | | OS Command Injection (Rust)injection/rust-command-injection | critical | | SQL Injection via String Interpolation (Swift)injection/swift-sql-injection | critical | | OS Command Injection (Swift)injection/swift-command-injection | critical | | SQL Injection via String Template (Kotlin)injection/kotlin-sql-injection | critical | | Path Traversal (Kotlin)injection/kotlin-path-traversal | high | | Insecure Deserialization (Kotlin/Jackson)injection/kotlin-insecure-deserialization | critical | ▸ XSS · 9 RULES ## XSS Cross-site scripting vulnerabilities that allow attackers to inject client-side scripts. | Rule | Severity | | ---------------------------------------------------------------- | -------- | | Setting innerHTML with dynamic contentxss/innerhtml-usage | high | | Using dangerouslySetInnerHTML in Reactxss/dangerously-set-html | high | | Using document.write() with dynamic contentxss/document-write | medium | | Unescaped user input in templatexss/unescaped-output | medium | | Reflected XSS via echo of User Input (PHP)xss/php-reflected-echo | high | | XSS via html\_safe / raw (Ruby/Rails)xss/ruby-html-safe | high | | XSS via template.HTML Bypass (Go)xss/go-template-html-bypass | high | | XSS via Html.Raw / MarkupString (C#)xss/csharp-razor-html-raw | high | | WKWebView Script Injection (Swift)xss/swift-webview-innerhtml | high | ▸ AUTH · 2 RULES ## Auth Authentication weaknesses that could let attackers bypass login or forge sessions. | Rule | Severity | | ----------------------------------------------------------- | -------- | | JWT verified with hardcoded secretauth/hardcoded-jwt-verify | high | | CORS allows all origins (\*)auth/cors-wildcard | high | ▸ AUTHORIZATION · 5 RULES ## Authorization Missing or broken access control checks that could let users access resources they shouldn't. | Rule | Severity | | ----------------------------------------------------------------------- | -------- | | Data access without ownership verificationauthz/missing-ownership-check | high | | Admin check only on frontendauthz/admin-check-frontend-only | critical | | Delete endpoint without authenticationauthz/delete-without-auth | critical | | Role/permission taken from client requestauthz/role-from-client | critical | | Sequential IDs expose data to enumerationauthz/idor-sequential-id | medium | ▸ CRYPTO · 15 RULES ## Crypto Weak or insecure cryptographic implementations. | Rule | Severity | | --------------------------------------------------------------------------- | -------- | | Using MD5 or SHA1 for security purposescrypto/weak-algorithm | high | | Math.random() used for security-sensitive valuescrypto/math-random | high | | Weak Password Hash (PHP md5/sha1)crypto/php-weak-password-hash | high | | JWT Signature Not Verified (Go)crypto/go-jwt-parse-unverified | high | | Weak Password Hash (Go md5/sha1)crypto/go-weak-password-hash | high | | Weak Cryptographic Algorithm (Java)crypto/java-weak-algorithm | high | | JWT Validation Disabled (C#)crypto/csharp-jwt-validation-disabled | high | | Weak Password Hash (C# MD5/SHA1)crypto/csharp-weak-password-hash | high | | JWT Signature Validation Disabled (Rust)crypto/rust-jwt-validation-disabled | high | | TLS Certificate Validation Disabled (Rust)crypto/rust-tls-disabled | high | | Weak Password Hash (Rust)crypto/rust-weak-password-hash | high | | TLS Validation Disabled (Swift)crypto/swift-tls-disabled | high | | Weak Hash (Swift Insecure.MD5/SHA1)crypto/swift-weak-hash | medium | | Trust-All TLS / Hostname Verifier (Kotlin)crypto/kotlin-trust-all-tls | high | | Insecure Random for a Security Value (Python)crypto/python-weak-random | high | ▸ CONFIG · 11 RULES ## Config Configuration files that expose sensitive data or enable debug modes in production. | Rule | Severity | | ------------------------------------------------------------------------------------- | -------- | | .env file committed to version controlconfig/env-file-committed | critical | | Debug mode enabled in production configconfig/debug-mode-enabled | medium | | Insecure NextAuth.js configurationconfig/insecure-nextauth-config | high | | Agent workspace config committed to repoconfig/agent-config-tracked | medium | | TLS Certificate Verification Disabled (Go)config/go-tls-skip-verify | high | | XML External Entity (XXE) (Java)config/java-xxe | high | | Spring Security Misconfiguration (Java)config/java-spring-permit-all | high | | Sensitive Data in UserDefaults (Swift)config/swift-insecure-storage | high | | Cleartext HTTP Request (Swift)config/swift-cleartext-http | medium | | Android WebView JS Bridge on Untrusted Content (Kotlin)config/kotlin-webview-jsbridge | high | | XML External Entity (XXE) (Kotlin)config/kotlin-xxe | high | ▸ PII · 3 RULES ## PII Personally identifiable information leaked through logs, storage, or API responses. | Rule | Severity | | --------------------------------------------------------------- | -------- | | Email addresses logged to consolepii/email-in-logs | medium | | Sensitive data in console.logpii/console-log-sensitive | medium | | Sensitive data stored without encryptionpii/unencrypted-storage | high | ▸ BAAS · 13 RULES ## BaaS Backend-as-a-Service misconfigurations for Supabase, Firebase, and similar platforms. | Rule | Severity | | ----------------------------------------------------------------------------------------------- | -------- | | Supabase service key used on clientbaas/supabase-service-key-client | critical | | Supabase RLS policy bypassedbaas/supabase-rls-bypass | high | | Supabase table without Row Level Securitybaas/supabase-rls-disabled | critical | | Supabase RLS policy allows all rows (USING true)baas/supabase-rls-policy-allows-all | critical | | Postgres anon role granted broad privilegesbaas/supabase-anon-overgrant | high | | Service-role key used in client-reachable routebaas/supabase-service-role-client-reachable | critical | | Supabase RLS trusts a JWT claim it doesn't issuebaas/supabase-rls-policy-jwt-claim-not-verified | high | | Anon key used for server-side mutationsbaas/supabase-anon-key-server-mutation | high | | Supabase storage bucket without access policiesbaas/supabase-storage-no-policy | high | | Direct query to auth.users tablebaas/supabase-auth-users-direct | medium | | Supabase auth with unvalidated redirect URLbaas/supabase-insecure-redirect | high | | Firebase rules allow all reads/writesbaas/firebase-rules-allow-all | critical | | Storage bucket publicly accessiblebaas/storage-bucket-public | high | ▸ LLM / AI · 19 RULES ## LLM / AI Security issues specific to LLM-powered applications and AI integrations. | Rule | Severity | | --------------------------------------------------------------------------------------------------------- | -------- | | System prompt exposed to clientllm/system-prompt-exposed | high | | Unsanitized user input in LLM promptllm/user-input-to-prompt | critical | | AI API key hardcoded in sourcellm/api-key-hardcoded | critical | | AI API key leaks to browser via env prefixllm/api-key-client-env | critical | | LLM output used without validationllm/no-output-validation | medium | | LLM tool call executed without validationllm/tool-call-no-validation | high | | RAG retrieval vulnerable to prompt injectionllm/rag-injection | high | | System prompt leaks through LLM outputllm/prompt-leak-via-output | medium | | LLM output executed as codellm/output-as-code | critical | | MCP tool used without version pinning (rug-pull risk)llm/mcp-tool-no-pinning | medium | | LangChain RecursiveUrlLoader without SSRF guard (CVE-2026-27795)llm/langchain-recursive-url-loader-unsafe | high | | LangChain loads prompt template from untrusted path (CVE-2026-34070)llm/langchain-load-prompt-from-path | high | | Vercel AI SDK called with raw user inputllm/ai-sdk-input-as-prompt | high | | AI agent run on PR title/body without sanitizingllm/agent-runs-on-unsanitized-pr-content | critical | | LLM call without max\_tokens or cost limitllm/no-max-tokens | medium | | .env or secrets file read into LLM promptllm/env-file-read-into-prompt | critical | | Code writes to .git/hooks (CVE-2026-26268 vector)llm/agent-writes-to-git-hooks | high | | Branch name or repo field passed to shell without sanitizingllm/codex-branch-name-shell-injection | critical | | OpenAI Assistants/Responses API without tool allowlistllm/openai-assistant-tool-no-allowlist | high | ▸ COST & BILLING EXPOSURE · 3 RULES ## Cost & Billing Exposure Findings that put your wallet at risk, not just your data — missing usage caps, unbounded paid-API fan-out, and AI keys wired to the browser. Also see headers/rate-limit-missing-auth-route for signup abuse that runs up account-creation costs. | Rule | Severity | | -------------------------------------------------------------------------------------- | -------- | | Vercel AI SDK call without an output token ceilingcost/ai-sdk-no-token-cap | medium | | Paid API called in a loop over unvalidated request datacost/unbounded-paid-send-loop | high | | AI SDK client configured to run in the browsercost/ai-client-dangerously-allow-browser | critical | ▸ HEADERS · 13 RULES ## Headers Missing or misconfigured HTTP security headers and server-side request issues. | Rule | Severity | | ----------------------------------------------------------------------------- | -------- | | Missing Content Security Policyheaders/missing-csp | medium | | Missing Strict-Transport-Security headerheaders/missing-hsts | medium | | Missing X-Frame-Options headerheaders/missing-x-frame-options | medium | | Server-side request to user-provided URLheaders/ssrf-unvalidated-url | high | | Redirect to unvalidated URLheaders/open-redirect | high | | Missing Referrer-Policy headerheaders/missing-referrer-policy | low | | Missing X-Content-Type-Options headerheaders/missing-x-content-type-options | low | | Missing Permissions-Policy headerheaders/missing-permissions-policy | low | | CORS allows credentials with wildcard originheaders/cors-credentials-wildcard | critical | | Cookie set without Secure/HttpOnly flagsheaders/cookie-missing-secure | high | | Auth route without rate limitingheaders/rate-limit-missing-auth-route | high | | Server request may reach cloud metadata endpointheaders/ssrf-cloud-metadata | critical | | Server request may reach internal IP rangeheaders/ssrf-internal-ip | high | ▸ DEPENDENCIES · 9 RULES ## Dependencies Dependency risks from unpinned versions, typosquatting, and suspicious install scripts. | Rule | Severity | | ----------------------------------------------------------------------------------------- | -------- | | Unpinned dependency versionsdeps/unpinned-versions | medium | | Package name similar to popular packagedeps/typosquatting-risk | medium | | Package runs scripts on installdeps/postinstall-script | high | | Potentially AI-hallucinated package namedeps/slopsquatting-risk | high | | Remote code fetched and executeddeps/eval-fetched-code | critical | | CDN script without Subresource Integritydeps/cdn-no-integrity | medium | | Known-malicious package (Cline 2.3.0, openclaw, postmark-mcp)deps/known-malicious-package | critical | | Likely AI-hallucinated package name (extended list)deps/slopsquatting-risk-extended | high | | No dependency lockfile in projectdeps/no-lockfile | medium | ▸ CLIENT SECURITY · 4 RULES ## Client Security Client-side security patterns — token storage, error exposure, file uploads, and CSRF protection. | Rule | Severity | | ------------------------------------------------------------------------------- | -------- | | Auth token stored in localStorage (XSS risk)client/jwt-in-localstorage | high | | Error stack trace sent to clientclient/error-stack-exposed | medium | | File upload without type or size validationclient/file-upload-no-validation | high | | State-changing endpoint without CSRF protectionclient/missing-csrf-state-change | medium | ▸ AI AGENT CONFIG · 14 RULES ## AI Agent Config IDE, agent, and CI misconfig that turns prompt injection into RCE. Covers MCP servers, .cursorrules, .github/workflows, Cursor Auto-Run, and the Pwn Request family. | Rule | Severity | | --------------------------------------------------------------------------------------------------- | -------- | | AI agent config file contains invisible Unicodeai-agent/invisible-unicode-in-config | critical | | MCP server runs an arbitrary shell commandai-agent/mcp-stdio-shell-command | critical | | MCP server points to a public HTTP URLai-agent/mcp-public-http-endpoint | high | | Cursor Auto-Run / YOLO mode enabledai-agent/cursor-auto-run-enabled | high | | Agent tool allowlist disabled or emptyai-agent/agent-allowlist-disabled | high | | Agent configured to auto-approve all tool callsai-agent/auto-approve-tools | high | | CI agent reads PR title or body without sanitizingai-agent/ci-agent-untrusted-pr-input | critical | | CI agent triggers on pull\_request from forksai-agent/ci-agent-pull-request-fork | high | | PR title or body interpolated into shell stepai-agent/github-action-injection-from-pr | critical | | Agent config path suggests workspace file was committedai-agent/agent-config-not-gitignored | low | | GitHub Action uses pull\_request\_target + checks out PR codeai-agent/pwn-request-checkout | critical | | Workflow grants write-all permissions to AI agent jobai-agent/workflow-write-all-permissions | high | | JSON schema loaded from untrusted remote URLai-agent/jetbrains-junie-json-schema-remote | medium | | .cursor/rules/\*.mdc files present — review recommendedai-agent/cursor-mdc-rules-directory-presence | low | ▸ LARAVEL (PHP FRAMEWORK) · 17 RULES ## Laravel (PHP framework) 59 dedicated rules for Laravel — our deepest framework coverage. Catches the footguns that raw-PHP rules miss because Laravel abstracts them: Eloquent, Blade, middleware, Artisan, storage, and config. A sample of the 59 below. | Rule | Severity | | ----------------------------------------------------------------------------------------------------- | -------- | | Mass assignment — ::create/fill with request()->all()injection/laravel-mass-assignment | critical | | SQL injection — request input concatenated into whereRaw/selectRawinjection/laravel-raw-sql-concat | critical | | OS command injection — shell\_exec / proc\_open on request inputinjection/laravel-os-command-request | critical | | PHP object injection — unserialize on request inputdeserialization/laravel-unserialize-request | critical | | Template injection — Blade::render on a user string (SSTI)injection/laravel-blade-render-request | critical | | Hardcoded APP\_KEY committed in sourcesecrets/laravel-hardcoded-app-key | critical | | Auth middleware stripped with withoutMiddleware()auth/laravel-without-middleware-auth | high | | Gate::before closure returns true — authorization bypassauth/laravel-gate-always-true | high | | Blade unescaped output — {!! $var !!}xss/laravel-blade-unescaped | high | | Reflected XSS — response()->make with unescaped request inputxss/laravel-response-make-reflected | high | | Path traversal — getClientOriginalName() used to build a storage pathfile/laravel-store-user-filename | high | | TLS verification disabled — Http::withoutVerifying()ssrf/laravel-http-without-verifying | high | | CORS allows any origin with credentialsmisconfig/laravel-cors-credentials-wildcard | high | | Insecure randomness — mt\_rand / rand used for a token or OTPcrypto/laravel-insecure-random-token | high | | CSRF protection disabled by wildcard exclusionconfig/laravel-csrf-disabled | high | | APP\_DEBUG=true — stack traces exposed in productionconfig/laravel-debug-enabled | medium | | Debug statement left in code — dd() / dump() / var\_dumpmisconfig/laravel-debug-statement-left | medium | ### False positive? Suppress any rule by ID. It won't block CI or clutter your reports. npx @ship-safe/cli ignore {rule-id} \-r "reason" See [Configuration](https://ship-safe.co/docs/configuration) for details on .shipsafeignore. [← PreviousConfiguration](https://ship-safe.co/docs/configuration)[Next →GitHub Actions](https://ship-safe.co/docs/github-actions) ## Sitemap Every page of this site, in markdown: [https://ship-safe.co/sitemap.md](https://ship-safe.co/sitemap.md)