Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Directly reading the Kubernetes ServiceAccount token from '/var/run/secrets/kubernetes.io/serviceaccount/token' can expose cluster credentials if the token is transmitted in outbound requests. Use a scoped token with a restricted audience instead.
Publish access check queries disabled publish access without also verifying invisible publish access, allowing unlisted/invisible content to be enumerated.
File paths received from MCP tool arguments are resolved with filepath.Abs and used without sensitive path validation or boundary checks. This allows prompt-injection or untrusted inputs to exfiltrate sensitive local files.
Sensitive credentials or authentication requests are transmitted to a caller-supplied server URL without validating that HTTPS is enforced and the target host is on an allowlist of configured servers.
Pandoc is invoked with a TeX/LaTeX PDF engine without explicitly disabling shell escape via '--pdf-engine-opt=-no-shell-escape'. Untrusted input containing TeX commands or LaTeX macros could execute arbitrary commands or read sensitive local files during PDF compilation.
Plaintext action argument inherits sensitivity from source attribute instead of enforcing `sensitive?: true`, risking cleartext exposure in logs, inspect dumps, and error reports.
HTTP redirect handler modifies request headers during redirects but does not check for or reject HTTPS-to-HTTP scheme downgrades, potentially exposing sensitive headers over plaintext HTTP.
Exposing pprof debug routes directly on a router without authentication or conditional checks may allow unauthorized actors to access sensitive profiling data such as process command-line arguments, environment variables, or memory dumps.
`SubmoduleConfigParser` is instantiated without `merge_includes=False`. This allows untrusted `.gitmodules` files to execute `[include]` directives and read arbitrary local files on the system.
Raw API token or secret is embedded directly into a dictionary passed to template rendering instead of using an opaque handle or hashed identifier.
Record dictionary is filtered by privacy status but returned verbatim without stripping sensitive operator-side or internal fields. Ensure only public allowlisted fields are returned.
Incomplete bundle state reset fails to clear galaxy and cluster mappings, leading to cross-bundle state leakage when parser instances are reused.
Object-scoped change feed accesses `change_set` directly without permission filtering for the requesting user, potentially leaking change metadata from restricted projects.
Search results from hierarchical query are mapped and returned without verifying per-note credential access or branch visibility, allowing unauthorized information disclosure.
Attribute '$NAME' is marked as sensitive (`sensitive? true`) but also made public (`public? true`), potentially exposing confidential credentials via public API routes or serialization.
REST controller verifies access permissions on the parent container rather than the specific topic item, potentially bypassing item-level access controls.
Validating only a file extension with a regular expression before reading from the filesystem does not prevent path traversal. Verify that the path does not escape the base directory using path.relative() or path containment checks.
JWT claim 'sub' is assigned a constant or static variable instead of the account user identifier during token generation inside an account loop. This causes all generated tokens to share the same subject identity.
Returning raw application objects in API route handlers can expose sensitive credentials such as API tokens, private keys, or client secrets. Ensure sensitive fields are redacted before returning the object in response payloads.
Directly returning an EMAIL_NOT_AVAILABLE error during registration when an email already exists enables account enumeration.
Sandboxed Twig template execution only sanitizes the 'config' facade with buildSandboxConfig() instead of filtering all configuration arrays via buildSandboxVars(). Twig sandbox policies do not restrict plain array key lookups, exposing sensitive configuration data.
API response sanitization unsets password fields but omits unsetting pass_indatabase_crypted, which may leak password verifiers to unauthorized API consumers.
Plugin configuration option for credential field '$NAME' is missing 'sensitive: True', potentially exposing secrets in API responses.
When stripping user info from a PSR-7 URI (e.g. for Referer headers), the URI fragment is not stripped using withFragment(''). This can leak sensitive data contained in URI fragments (such as access tokens or state values) to redirect targets.
