Leaderboard

A URL object is instantiated to validate the path, but the host is not verified. Attackers can supply protocol-relative paths (e.g., `//evil.com`) which resolve against the current base URL and pass protocol-only checks. If the unvalidated path is then used for navigation, it results in an Open Redirect.

Detected a TypeORM query using an unscoped OR condition to fetch potentially private or sensitive records globally. In TypeORM, an array in `where` is interpreted as an OR condition. Providing an object restricted only to the type (e.g., `{ type: 'personal' }`) or using a `.where().orWhere()` chain lacking explicit `AND` constraints fails tenant separation,

Reconstructing a relative URL directly from `URL.pathname` without sanitizing leading slashes can lead to Open Redirect vulnerabilities. When parsing user input with a dummy base, inputs like `/.//evil.com` normalize to a pathname of `//evil.com`. If this is used in a navigation or redirect, it is treated as a protocol-relative URL to an external domain. Col

Direct assignment of joined array content to innerHTML or outerHTML bypasses HTML encoding and can lead to Cross-Site Scripting (XSS). If the array contains untrusted or user-controlled input, such as unescaped component slots, an attacker can execute arbitrary scripts via implicitly closed tags. Use textContent instead to safely encode the data as plain tex

An incomplete blocklist of unsafe modules for pickle deserialization was found. The blocklist misses stdlib modules such as `uuid`, `pkgutil`, `imaplib`, or insufficiently blocks `cProfile` and `profile`. Attackers can exploit these unblocked functions to bypass the scanner and achieve arbitrary code execution.

A function return value is compared directly against an expected value without first verifying for negative error codes. This may lead to unexpected execution of error-handling cleanup paths, potentially triggering double-frees when unhandled error codes mimic unexpected data bytes.

A session was retrieved by ID and restored/bound without checking ownership. This logic allows a session hijacking attack if an attacker supplies a victim's session ID. Verify that the session owner matches the currently authenticated user before performing the binding.

The code relies on blocklisting specific HTML tags or attributes (such as `[onerror]` or `[href^=javascript]`) to sanitize untrusted input. This approach is inherently incomplete and easily bypassed by attackers using different executable constructs (e.g., `srcdoc`, `formaction`, data URIs). To properly sanitize HTML, use a well-tested library like DOMPurify