Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
JWT audience ('aud') claim validation is enforced only when the configured audience list is non-empty. When the list is empty the 'aud' claim options keep presence-only semantics, so a correctly signed assertion minted for another service (different audience) is accepted and can be exchanged for an access token across a trust boundary (RFC 7523 section 3). F
Auth dependency $FUNC fails open: when the configured credential ($KEY) is unset, the guard `if not $KEY: return` ends the check without rejecting the request or restricting it to loopback clients. On any network-reachable deployment the whole protected API surface is then served unauthenticated. Fail closed instead: raise when the credential is not configur
nsenter is invoked with an argv that enters a target process's mount namespace (--target <pid> --mount ...) and runs "/bin/sh -lc", but the argv contains no --root flag. nsenter only switches namespaces: without --root the spawned shell keeps the caller's root directory (the host's), so every absolute path in the payload resolves against the host filesystem
TeX shell escape (\write18) is enabled for this engine run: either the engine constructor turns it on by default, or the command list executed via subprocess carries a shell-escape flag. Compiling document-derived (untrusted) TeX this way also runs without the TeX sandbox flags (--untrusted --only-cached), so \openin, \openout, \XeTeXpicfile and \XeTeXpdffil
SSH/SFTP host-key verification is disabled by default: the host-key-check opt-out flag (e.g. no_host_key_check) is initialised to a permissive value (True) in the hook constructor, as an instance attribute, or whenever the connection extra is absent, so any connection that does not explicitly opt in accepts any server host key (e.g. paramiko.AutoAddPolicy).
A sensitive variable is assigned a hardcoded default fallback value. Generate a random value or require it to be configured to prevent authentication bypass or credential exposure.
The URL scheme defaults to unencrypted HTTP when the security flag is absent or falsy. Default to HTTPS instead to prevent transmitting sensitive data or credentials over plaintext HTTP.
Defaulting the host binding address to '::' binds the server to all network interfaces, potentially exposing sensitive or unauthenticated endpoints to external network clients. Default to '127.0.0.1' or 'localhost' instead.
The plugin signature verification policy defaults or falls back to WARN instead of ENFORCE. This allows unsigned or unverifiable third-party plugins to be loaded and executed without cryptographic verification.
Insecure default configuration (CWE-1188): a code-runner / sandbox selection variable is assigned an unsandboxed execution mode ("$VALUE"). Untrusted, user-authored workflow code (Python/JavaScript code nodes) will run in a plain interpreter subprocess (venv / python3 / node) with access to the process environment, the filesystem, subprocess spawning and the
Insecure default exec configuration includes tailwindcss in execution whitelist.
Insecure classpath resource discovery for serialization filter configuration in fat JAR environments.
ClassLoader.getResources() used to discover Helidon serialization filter configurations may fail to aggregate metadata in single-jar or shaded packaging environments. Use MetadataDiscovery instead.
Standard ClassLoader.getResources lookup for serialization filter metadata may fail in single-jar or modular deployments.
Deserialization filter configuration files are loaded directly via ClassLoader.getResources(), which may fail to aggregate configuration across single/fat JAR packaging layouts, leading to unenforced filters.
Authentication middleware fails open: when the signing credential ($SECRET) is empty the request is passed straight to next($CTX) without any authentication, so a deployment that leaves the credential unconfigured (a common default) exposes every protected endpoint. Fail closed instead (return an HTTP error when the credential is missing), provision the cred
Server bind address $HOST is a wildcard address (all network interfaces) and the surrounding configuration carries no non-empty credential, so the service is reachable by any unauthenticated network peer (insecure default, e.g. agent APIs exposing GET /agents and POST /chat). Default to a loopback bind (127.0.0.1 / localhost / ::1), or fail closed by requiri
Network isolation for containerized workloads is configured from a fail-open default. Either a CLI security flag is registered with a literal `false` default, a JSON request field is typed as plain `bool` (so an omitted field deserializes to the Go zero value `false` and silently disables the control), or a raw request bool is passed straight into the networ
$SECRET is initialized from environment variable $ENV with a hard-coded string-literal fallback, so the effective signing/secret material is publicly recoverable from source control, container images and documentation; anyone who can read the repository can use that value to forge whatever the secret protects (e.g. sign HS256 tokens with an attacker-chosen s
Sandbox entry point fails open: when the strong isolation backend reports itself unavailable, untrusted code is silently handed to a weaker fallback sandbox constructed inside the availability guard (e.g. a subprocess-based backend) with no kernel filesystem allowlist or network denial, while status metadata may still claim the strong sandbox was used. Fail
A hardcoded string literal is used as the fallback value for secret/key material: either as the default of a secret-named environment variable or passed directly where a signing/encryption key is expected. In an open-source deployment this fallback value is public knowledge, so any instance where the environment variable is unset signs session cookies and JW
$FUNC silently reports success (bare `return` / `return True`) when $SECRET is unset or empty. The missing secret disables the only authentication control, so every endpoint guarded by $FUNC is reachable unauthenticated whenever the secret is not configured (fail-open authentication). Fail closed instead: raise an error (e.g. HTTP 401 Unauthorized) when $SEC
$FUNC() is a fail-open SSRF guard: it returns before validating the URL whenever the opt-in hardening flag is disabled, so the private/internal address checks (localhost, RFC1918, link-local, cloud metadata) never run in the default configuration. Server-side fetches protected only by this guard can be pointed at loopback, private-network or cloud-metadata e
Security capability flag $OPT is defaulted to `true` via `unwrap_or(true)`, so an omitted field (e.g. a model-supplied tool argument, API payload, or unset config key) silently grants the capability (shell execution, auto-approval, elevated trust) instead of requiring explicit opt-in. This fail-open default decouples what a requester/approver sees from the p
