{"source":"catalog","totalChecks":156,"categories":[{"category":"secret-exposure","count":43,"checks":[{"key":"secrets.anthropic-key","lens":"secrets","title":"Anthropic API key exposed","summary":"An Anthropic API key (sk-ant-…) was found in client-visible code.","impact":"The key lets anyone bill Claude API usage to your account and read/abuse your Anthropic access — direct financial exposure.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.aws-key-pair","lens":"secrets","title":"AWS access key + secret pair exposed","summary":"An AWS access key id (AKIA…/ASIA…) was found alongside its 40-character secret access key in client-visible code — a complete, immediately-usable credential.","impact":"Anyone who reads it can authenticate to your AWS account with whatever IAM permissions the key holds — commonly read/write to S3, databases, compute, and more. This is a live, ready-to-use credential, not just an identifier.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.azure-storage-key","lens":"secrets","title":"Azure Storage account key exposed","summary":"An Azure Storage AccountKey= shared key was found in client-visible code.","impact":"The shared key grants full control of the storage account — read, write, and delete on every blob, file, queue, and table it holds.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.db-connection-string","lens":"secrets","title":"Database connection string with embedded credentials exposed","summary":"A database URL containing an inline user:password (Postgres/MySQL/MongoDB/Redis/AMQP) was found in client-visible code.","impact":"The credentials grant direct database access — an attacker can connect and read, alter, or destroy your data, bypassing the application entirely.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.digitalocean-token","lens":"secrets","title":"DigitalOcean token exposed","summary":"A DigitalOcean personal access token (dop_v1_/doo_v1_/dor_v1_) was found in client-visible code.","impact":"The token grants API control of your DigitalOcean account — create/destroy droplets, databases, and DNS, and read account data.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.dockerhub-token","lens":"secrets","title":"Docker Hub access token exposed","summary":"A Docker Hub access token (dckr_pat_…) was found in client-visible code.","impact":"The token lets an attacker push malicious images to your Docker Hub repositories — a supply-chain compromise of anyone pulling them.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.doppler-token","lens":"secrets","title":"Doppler service token exposed","summary":"A Doppler token (dp.pt.… / dp.st.… …) was found in client-visible code.","impact":"Doppler holds your secrets — a leaked service token can read the secret values for a config/project, exposing every credential it manages.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.generic-high-entropy","lens":"secrets","title":"Secret exposed in client code (high-entropy value on a secret-named variable)","summary":"A high-entropy value assigned to a secret-named variable (e.g. SESSION_SECRET, JWT_SIGNING_KEY, api_secret, db_password, client_secret) was found in client-visible code — a credential regardless of provider prefix.","impact":"The value is almost certainly a live secret — a session/JWT signing key, API secret, database password, or client secret. Anyone who reads it can forge sessions or tokens, call privileged APIs, or access the backing service directly.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.github-pat","lens":"secrets","title":"GitHub fine-grained PAT exposed","summary":"A GitHub fine-grained personal access token (github_pat_…) was found in client-visible code.","impact":"The token grants its configured repo/org permissions — potentially read/write to code and settings, enabling source theft or a malicious commit.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.github-token","lens":"secrets","title":"GitHub token exposed","summary":"A GitHub token (ghp_/gho_/ghu_/ghs_/ghr_) was found in client-visible code.","impact":"Depending on scope, the token grants read/write access to your repositories, Actions, and org resources — source-code theft or a supply-chain push.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.gitlab-pat","lens":"secrets","title":"GitLab personal access token exposed","summary":"A GitLab personal access token (glpat-…) was found in client-visible code.","impact":"The token grants its scoped access to your GitLab projects and API — potentially source-code and CI/CD control.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.google-oauth-secret","lens":"secrets","title":"Google OAuth client secret exposed","summary":"A Google OAuth client secret (GOCSPX-…) was found in client-visible code.","impact":"The client secret lets an attacker impersonate your OAuth application, forge token exchanges, and abuse your Google API quota and consent screen.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.groq-key","lens":"secrets","title":"Groq API key exposed","summary":"A Groq API key (gsk_…) was found in client-visible code.","impact":"The key grants API access to your Groq account — others can run inference against your account and quota, at your cost.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.huggingface-token","lens":"secrets","title":"Hugging Face access token exposed","summary":"A Hugging Face access token (hf_…) was found in client-visible code.","impact":"The token grants API access to your Hugging Face account — private models/datasets and, if write-scoped, the ability to alter them.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.linear-key","lens":"secrets","title":"Linear API key exposed","summary":"A Linear API key (lin_api_…) was found in client-visible code.","impact":"The key grants API access to your Linear workspace — reading and modifying issues, projects, and team data.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.mailchimp-key","lens":"secrets","title":"Mailchimp API key exposed","summary":"A Mailchimp API key (<hex>-usN, corroborated by a nearby 'mailchimp' token) was found in client-visible code.","impact":"The key grants API access to your Mailchimp account — audience/subscriber data (PII) and the ability to send campaigns as you.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.mapbox-secret","lens":"secrets","title":"Mapbox secret token exposed","summary":"A Mapbox secret token (sk.…) was found in client-visible code.","impact":"Unlike a public pk. token, a Mapbox secret token can manage your account and tokens — abuse of your account and billing.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.netlify-token","lens":"secrets","title":"Netlify personal access token exposed","summary":"A Netlify personal access token (nfp_…) was found in client-visible code.","impact":"The token grants API control of your Netlify account — deploy or delete sites, read build environment variables (which often hold other secrets), and change DNS.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.newrelic-key","lens":"secrets","title":"New Relic API key exposed","summary":"A New Relic API key (NRAK-…) was found in client-visible code.","impact":"The key grants API access to your New Relic account — reading telemetry and managing configuration, depending on type.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.openai-key","lens":"secrets","title":"OpenAI API key exposed","summary":"An OpenAI API key (sk-…, incl. sk-proj-/sk-svcacct-) was found in client-visible code.","impact":"The key lets anyone bill OpenAI usage to your account and abuse your access — direct financial exposure and quota theft.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.perplexity-key","lens":"secrets","title":"Perplexity API key exposed","summary":"A Perplexity API key (pplx-…) was found in client-visible code.","impact":"The key grants API access to your Perplexity account — others can run queries against your account and quota, at your cost.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.planetscale-token","lens":"secrets","title":"PlanetScale database token exposed","summary":"A PlanetScale password or service token (pscale_pw_… / pscale_tkn_…) was found in client-visible code.","impact":"The token grants direct database access — reading and writing your production data. Treat it as a full database credential.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.private-key","lens":"secrets","title":"Private key exposed (PEM key block)","summary":"A PEM-encoded private key block (RSA/EC/DSA/OpenSSH/encrypted PKCS#8/PGP) was found in client-visible code.","impact":"A leaked private key lets an attacker impersonate your server/service, decrypt intercepted traffic, or sign malicious artifacts as you.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-321"},{"key":"secrets.pypi-token","lens":"secrets","title":"PyPI upload token exposed","summary":"A PyPI upload token (pypi-AgEIcHlwaS…) was found in client-visible code.","impact":"The token lets an attacker publish malicious releases of your Python packages — a supply-chain compromise of downstream installers.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.sendgrid-key","lens":"secrets","title":"SendGrid API key exposed","summary":"A SendGrid API key (SG.…) was found in client-visible code.","impact":"The key lets an attacker send email as your domain (phishing/spam from your reputation) and read your email activity.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.shopify-token","lens":"secrets","title":"Shopify access token exposed","summary":"A Shopify access token (shpat_/shpca_/shppa_/shpss_) was found in client-visible code.","impact":"The token grants API access to the connected Shopify store — orders, customer PII, and store configuration, depending on scope.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.slack-token","lens":"secrets","title":"Slack token exposed","summary":"A Slack token (xoxb-/xoxp-/xoxa-/xoxr-/xoxs-/xoxe-/xapp-) was found in client-visible code.","impact":"The token grants API access to your Slack workspace — reading messages/files and posting as the app or user, depending on scope.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.square-token","lens":"secrets","title":"Square access token exposed","summary":"A Square access token (sq0atp-/sq0csp-) was found in client-visible code.","impact":"The token grants API access to your Square account — payments, orders, and customer data, depending on scope.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.stripe-live-secret","lens":"secrets","title":"Stripe live secret key exposed","summary":"A Stripe sk_live_ secret key was found in client-visible code.","impact":"The live secret key can move real money — create charges and refunds, read customer/payment data, and manage your account via the API.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.supabase-secret-key","lens":"secrets","title":"Supabase secret key exposed (sb_secret_)","summary":"A Supabase sb_secret_ secret key was found in client-visible code.","impact":"This is a privileged server key that bypasses Row-Level Security — it grants full read/write access to your database.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.supabase-service-role","lens":"secrets","title":"Supabase service_role key exposed","summary":"A Supabase service_role JWT was found in client-visible code — this key bypasses Row-Level Security.","impact":"Anyone who reads it gets full, RLS-bypassing read/write access to every table in your database — total data compromise.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.aws-access-key","lens":"secrets","title":"AWS access key id exposed","summary":"An AWS access key id (AKIA…/ASIA…) was found in client-visible code, with no secret access key alongside it.","impact":"Paired with its secret, an AWS key grants whatever IAM permissions it holds — often broad access to storage, compute, and data. The key id alone confirms an AWS credential is in play; find and rotate the pair.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.figma-token","lens":"secrets","title":"Figma personal access token exposed","summary":"A Figma personal access token (figd_…) was found in client-visible code.","impact":"The token grants API access to your Figma files and projects — reading (and depending on scope, modifying) design content.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.mailgun-key","lens":"secrets","title":"Mailgun API key exposed","summary":"A Mailgun API key (key-…, corroborated by a nearby 'mailgun' token) was found in client-visible code.","impact":"The key lets an attacker send email through your Mailgun account — phishing/spam that spends your reputation and quota.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.npm-token","lens":"secrets","title":"npm token exposed","summary":"An npm access token (npm_…) was found in client-visible code.","impact":"A publish-scoped npm token lets an attacker push malicious versions of your packages — a supply-chain compromise of everyone who installs them.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.postman-key","lens":"secrets","title":"Postman API key exposed","summary":"A Postman API key (PMAK-…) was found in client-visible code.","impact":"The key grants API access to your Postman account — reading and modifying collections, environments (which often store secrets), and workspaces.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.slack-webhook","lens":"secrets","title":"Slack incoming webhook URL exposed","summary":"A Slack incoming-webhook URL (hooks.slack.com/services/…) was found in client-visible code.","impact":"The URL lets anyone post arbitrary messages into the connected Slack channel — spam or convincing internal phishing.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.stripe-restricted-key","lens":"secrets","title":"Stripe restricted key exposed","summary":"A Stripe rk_live_ restricted key was found in client-visible code.","impact":"A restricted key is scoped, but still grants whatever permissions it was created with against live data — a real, if bounded, exposure.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.stripe-test-secret","lens":"secrets","title":"Stripe test secret key exposed","summary":"A Stripe sk_test_ test-mode secret key was found in client-visible code.","impact":"No real money moves in test mode, but the key exposes test data and API access and signals that secret keys are being shipped to the client — the live key may be next.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.stripe-webhook-secret","lens":"secrets","title":"Stripe webhook signing secret exposed","summary":"A Stripe whsec_ webhook signing secret was found in client-visible code.","impact":"The signing secret lets an attacker forge webhook events your backend will accept as genuine — e.g. faking a successful payment.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.telegram-token","lens":"secrets","title":"Telegram bot token exposed","summary":"A Telegram bot token (<id>:AA…) was found in client-visible code.","impact":"The token grants full control of your Telegram bot — reading its messages and sending as it to every chat it's in.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.twilio-key","lens":"secrets","title":"Twilio API key exposed","summary":"A Twilio API key (SK…, corroborated by a nearby 'twilio' token) was found in client-visible code.","impact":"The key lets an attacker send SMS/voice and read messaging logs on your Twilio account — toll fraud and data exposure.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-798"},{"key":"secrets.google-api-key","lens":"secrets","title":"Google/Firebase API key found","summary":"A Google/Firebase browser API key (AIza…) was found in client-visible code. These are usually public by design and meant to be referrer/app-restricted.","impact":"Not a leak on its own — Google web/Firebase API keys are designed to be public. The risk is only if the key is UNrestricted, letting others spend against your Google Cloud quota or reach unintended APIs.","severity":"info","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-200"}]},{"category":"access-control","count":34,"checks":[{"key":"api.graphql-anon-data","lens":"api","title":"Unauthenticated GraphQL access to sensitive data","summary":"A schema-built query executed anonymously returned records containing sensitive-looking fields — the GraphQL analog of broken access control.","impact":"The API serves private data to unauthenticated callers straight from the client — a direct data breach.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"authz.cross-user-read-byid","lens":"authz","title":"Authenticated user can read another user's object by ID (BOLA / IDOR)","summary":"A logged-in test user could not list a table's rows, yet could fetch another user's specific object directly by its id — object-level authorization is missing (the classic BOLA / IDOR shape, on a table that often exposes no owner column).","impact":"Any authenticated user who knows or guesses an object's id (sequential ids, ids leaked in URLs/emails/other responses) can read another user's record, even though the app never lists those rows to them. When the object carries sensitive data this is a direct horizontal data breach.","severity":"high","status":"live","tier":"deep","owasp":"A01:2025 Broken Access Control","cwe":"CWE-639"},{"key":"authz.cross-user-read-sensitive","lens":"authz","title":"Authenticated user can read another user's sensitive rows","summary":"A logged-in test user that owns no rows in a table could still read another user's rows, and those rows carry sensitive data — access control is not scoped per user.","impact":"Any authenticated account can read other users' private data — horizontal data exposure across accounts (broken object-level authorization). This is the clean, benign-interpretation-free leak.","severity":"high","status":"live","tier":"deep","owasp":"A01:2025 Broken Access Control","cwe":"CWE-639"},{"key":"baas.collection-sensitive-read","lens":"baas","title":"BaaS collection exposes sensitive data to anonymous reads","summary":"A PocketBase/Appwrite collection returned records with sensitive-looking fields to an anonymous list request.","impact":"The collection's access rules allow unauthenticated reads of private data — a direct data breach.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"baas.couchdb-admin-party","lens":"baas","title":"CouchDB allows anonymous database enumeration (admin party)","summary":"An anonymous GET /_all_dbs succeeded — the CouchDB server has no admin configured ('admin party'), so every database is world-accessible.","impact":"With no admin, anyone can list, read, and modify every database on the server — a catastrophic, total data compromise.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"baas.couchdb-sensitive-read","lens":"baas","title":"CouchDB database exposes sensitive data to anonymous reads","summary":"An anonymous read of a CouchDB database returned documents with sensitive-looking fields.","impact":"The database is readable without authentication — a direct breach of whatever private data it holds.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"baas.elasticsearch-open-cluster","lens":"baas","title":"Elasticsearch/OpenSearch cluster allows anonymous index enumeration","summary":"An anonymous GET /_cat/indices succeeded — the cluster is unauthenticated, so all indices are world-accessible.","impact":"An open cluster lets anyone enumerate indices and read (or delete) all documents — the classic mass-data-exposure class.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"baas.elasticsearch-sensitive-read","lens":"baas","title":"Elasticsearch index exposes sensitive data to anonymous queries","summary":"An anonymous _search of an index returned documents with sensitive-looking fields.","impact":"The index is queryable without authentication — a direct breach of the private data it contains.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"baas.graphql-anon-data","lens":"baas","title":"GraphQL backend exposes sensitive data to anonymous queries","summary":"An anonymous (or public-API-key) GraphQL query returned records containing sensitive-looking fields.","impact":"The backend serves private data to unauthenticated callers — a direct data breach reachable straight from the client.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"efficacy.anon-read-sensitive","lens":"efficacy","title":"Anonymous read exposes sensitive data","summary":"An anonymous SELECT returned rows containing sensitive columns or sensitive values (PII, credentials, financial data).","impact":"Anyone can read private user data without authenticating — a direct data breach and a likely privacy/regulatory violation.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-200","compliance":{"soc2":["CC6.1"]}},{"key":"efficacy.anon-write","lens":"efficacy","title":"Anonymous writes accepted (RLS does not block unauthenticated writes)","summary":"An anonymous INSERT was accepted by the table's row-level-security policies.","impact":"Anyone on the internet can create or tamper with rows in this table — data integrity and, depending on the table, downstream trust are broken.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284","compliance":{"soc2":["CC6.1","CC6.3"]}},{"key":"firebase.firestore-open","lens":"firebase","title":"Firestore collection is world-readable (open security rules)","summary":"An anonymous read of a Firestore collection returned document data — the collection's `allow read` rule lets unauthenticated clients through.","impact":"Anyone can read the collection's documents (and, if writes are open, alter them) — a direct breach of the private data it holds.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"firebase.rtdb-open","lens":"firebase","title":"Firebase Realtime Database is world-readable (open security rules)","summary":"An anonymous read of the Realtime Database root succeeded — the database's .read rule allows unauthenticated access.","impact":"Anyone can read (and, if .write is equally open, modify) the entire database — a full breach of all user data it stores.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"firebase.storage-open","lens":"firebase","title":"Firebase Storage bucket lists objects to anonymous users (open security rules)","summary":"An anonymous list of the default Firebase Storage bucket returned object metadata — the Storage rules allow unauthenticated read/list.","impact":"Anyone can enumerate and download the bucket's files — a data breach if any object is private (uploads, documents, user media).","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"storage.bucket-listable-private","lens":"storage","title":"Cloud bucket is world-listable and holds private-looking files","summary":"An S3/GCS/Azure bucket allows anonymous listing, and the sampled object names match private-data patterns (backups, invoices, KYC, .env, …).","impact":"Anyone can enumerate and download the bucket's objects — a direct data breach of whatever private files it holds.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"storage.supabase-listable-private","lens":"storage","title":"Supabase Storage bucket is world-listable and holds private-looking files","summary":"A Supabase Storage bucket returns objects to an anonymous list request, and the sampled names match private-data patterns.","impact":"A broken storage.objects RLS policy lets anyone enumerate and reach the bucket's private files — a data breach.","severity":"high","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"api.unauth-sensitive-data","lens":"api","title":"Likely unauthenticated access to sensitive data","summary":"An anonymous GET of an API route returned sensitive-looking (PII-shaped) fields — the endpoint appears to serve private data without authentication.","impact":"If the endpoint is not meant to be public, anyone can read the sensitive data it returns — a broken-access-control breach. Labeled 'likely' because intent can be ambiguous.","severity":"medium","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"authz.cross-user-read-broad","lens":"authz","title":"Owner-less table readable across users (no per-user scoping — confirm intended)","summary":"A table with no per-user ownership column returned a row readable by more than one user, so it has no per-user access scoping — and the rows carry sensitive data. Indistinguishable by structure alone from an intended public/shared table.","impact":"If the table is meant to be per-user-private, any authenticated user can read others' sensitive rows — a horizontal data leak. If it is genuinely public/shared reference data this is expected. Held at medium pending confirmation because, without an owner column, a leak and a public table can't be told apart from the data.","severity":"medium","status":"live","tier":"deep","owasp":"A01:2025 Broken Access Control","cwe":"CWE-639"},{"key":"authz.cross-user-read-public","lens":"authz","title":"Authenticated user can read another user's rows (no sensitive columns — confirm intended)","summary":"A logged-in test user that owns no rows in a table could read another user's rows, but no sensitive columns were detected — possibly a public feed by design.","impact":"If the table is meant to be per-user-private this is a horizontal leak; if it is a public feed it is expected. The absence of sensitive columns keeps this at medium pending confirmation.","severity":"medium","status":"live","tier":"deep","owasp":"A01:2025 Broken Access Control","cwe":"CWE-639"},{"key":"authz.cross-user-read-shared","lens":"authz","title":"Authenticated user can read other users' rows in a shared-looking table (confirm intended)","summary":"A logged-in test user owns rows in a table AND can read rows owned by others — structurally identical to a legitimate shared/co-membership/public-profile table, so it cannot be confirmed a leak by data alone.","impact":"If the table is genuinely shared (team roster, chat participants, public profiles) this is expected; if it is meant to be per-user-private it is a horizontal leak. Held at medium (the shared-table false-positive guard).","severity":"medium","status":"live","tier":"deep","owasp":"A01:2025 Broken Access Control","cwe":"CWE-639"},{"key":"authz.cross-user-write","lens":"authz","title":"Authenticated user can write another user's row (writes not owner-scoped — confirm intended)","summary":"A value-neutral update by a logged-in test user succeeded against another user's row — the write (UPDATE) policy is not scoped per owner.","impact":"If the table is meant to be writable by non-owners (shared/collaborative/assignment) this is expected; otherwise an authenticated user can modify others' data — a horizontal-privilege-escalation write. Held at medium: the value-neutral test proves the policy is not owner-scoped, not an exploited takeover.","severity":"medium","status":"live","tier":"deep","owasp":"A01:2025 Broken Access Control","cwe":"CWE-639"},{"key":"efficacy.anon-write-intake","lens":"efficacy","title":"Anonymous writes accepted on an intake table (confirm intended)","summary":"An anonymous INSERT was accepted on a table that looks like an intake/submission form (contact, waitlist, feedback, signup).","impact":"Public inserts may be by design here, but without validation and rate-limiting the table is open to spam, forged submissions, and storage abuse.","severity":"medium","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284","compliance":{"soc2":["CC6.1"]}},{"key":"storage.bucket-listable-ambiguous","lens":"storage","title":"Cloud bucket allows anonymous listing (contents not obviously public)","summary":"An S3/GCS/Azure bucket allows anonymous listing; the objects are not recognizable public assets, so exposure is possible but unconfirmed.","impact":"Anonymous listing reveals every object name and lets anyone download them — a problem if any file is not meant to be public.","severity":"medium","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"storage.supabase-bucket-list-readable","lens":"storage","title":"Supabase Storage bucket list is anonymously readable","summary":"An anonymous GET /storage/v1/bucket returns the project's bucket names — the storage bucket metadata is world-readable.","impact":"Exposing the bucket inventory hands an attacker the exact names to target for object-listing and download attempts.","severity":"medium","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"storage.supabase-listable-ambiguous","lens":"storage","title":"Supabase Storage bucket allows anonymous listing (contents not obviously public)","summary":"A Supabase Storage bucket is anonymously listable; the objects are not recognizable public assets, so exposure is possible but unconfirmed.","impact":"Anonymous listing exposes the object inventory and allows retrieval — a problem for any file not meant to be public.","severity":"medium","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"baas.graphql-introspection","lens":"baas","title":"GraphQL introspection is enabled","summary":"The backend's GraphQL endpoint answers an introspection query, exposing the full schema (types, fields, operations).","impact":"Introspection isn't a breach by itself, but it hands an attacker a complete map of your data model and mutations to target — a strong recon aid.","severity":"low","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-200"},{"key":"baas.collection-anon-readable","lens":"baas","title":"BaaS collection is anonymously readable (no sensitive columns)","summary":"A PocketBase/Appwrite collection returned records to an anonymous request, but no sensitive field patterns were seen — likely public-by-design.","impact":"Low risk if the collection is meant to be public, but open anonymous reads are worth confirming as intentional.","severity":"info","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"baas.couchdb-anon-readable","lens":"baas","title":"CouchDB database is anonymously readable (no sensitive columns)","summary":"An anonymous read of a CouchDB database returned documents, but no sensitive field patterns — likely public-by-design.","impact":"Low risk if the database is meant to be public, but anonymous read access is worth confirming as intended.","severity":"info","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"baas.elasticsearch-anon-readable","lens":"baas","title":"Elasticsearch index is anonymously queryable (no sensitive fields)","summary":"An anonymous _search of an index returned documents, but no sensitive field patterns — likely a public search index.","impact":"Low risk if the index is a genuine public search corpus, but anonymous query access is worth confirming as intended.","severity":"info","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"efficacy.anon-read-public","lens":"efficacy","title":"Table is anon-readable but holds no sensitive columns","summary":"An anonymous SELECT returned rows, but no sensitive column or value patterns were detected — likely intentionally public.","impact":"Not treated as a vulnerability. Recorded so the anon-readable surface is visible without crying wolf.","severity":"info","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control"},{"key":"efficacy.rpc-surface","lens":"efficacy","title":"Supabase RPC (stored-procedure) surface referenced by the app","summary":"The app's code calls Supabase RPC functions. A function defined SECURITY DEFINER runs with the definer's privileges and bypasses row-level security — an anon-callable one would be an RLS-bypass vector. This is presence-only: we detect the calls in the bundle but do NOT invoke the functions, so anon-callability and SECURITY DEFINER are unconfirmed.","impact":"Advisory, not a confirmed vulnerability — it may be benign (the functions can be authenticated-only or SECURITY INVOKER). Surfaced so the RPC surface is auditable, because a SECURITY DEFINER function reachable by the anon role would silently bypass RLS.","severity":"info","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284","compliance":{"soc2":["CC6.1"]}},{"key":"storage.bucket-listable-public","lens":"storage","title":"Cloud bucket allows anonymous listing (public assets)","summary":"An S3/GCS/Azure bucket allows anonymous listing and its objects look like public CDN assets (images, css, js).","impact":"Low risk if the bucket is genuinely a public asset store, but open listing still exposes the full inventory of files and their naming.","severity":"info","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"storage.r2-public-bucket","lens":"storage","title":"Cloudflare R2 public bucket in use","summary":"A public r2.dev URL is referenced — an R2 bucket exposed through Cloudflare's public-by-design dev endpoint.","impact":"r2.dev serves objects publicly by design (no listing), so this is informational — the risk is only if private files were placed in a public R2 bucket.","severity":"info","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"storage.supabase-listable-public","lens":"storage","title":"Supabase Storage bucket allows anonymous listing (public assets)","summary":"A Supabase Storage bucket is anonymously listable and its objects look like public assets.","impact":"Low risk if the bucket is a genuine public asset store, but open listing still exposes the full object inventory.","severity":"info","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"}]},{"category":"exposed-artifact","count":28,"checks":[{"key":"exposure.actuator-env","lens":"exposure","title":"Spring Boot actuator /env exposes configuration","summary":"The Spring Boot actuator /env endpoint is public and dumps the app's property sources.","impact":"The /env dump exposes environment variables, configuration, and often credentials — a direct information-disclosure and pivot vector.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-215"},{"key":"exposure.actuator-heapdump","lens":"exposure","title":"Spring Boot actuator heap dump downloadable","summary":"The Spring Boot actuator /heapdump endpoint is public, serving a full JVM heap dump.","impact":"A heap dump contains in-memory secrets, session tokens, and live request/response data — a severe disclosure that often yields credentials.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-215"},{"key":"exposure.aws-credentials","lens":"exposure","title":"AWS credentials file publicly served","summary":"An ~/.aws/credentials INI file exposing aws_access_key_id / aws_secret_access_key is downloadable.","impact":"The keys grant whatever IAM permissions the profile holds — often broad access to storage, compute, and data across your AWS account.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-798"},{"key":"exposure.backup-archive","lens":"exposure","title":"Backup archive publicly served","summary":"A ZIP archive (backup.zip / www.zip / public_html.zip) — confirmed by its archive magic bytes — is downloadable.","impact":"A public backup archive typically contains the full site source, config, and often a database dump — a comprehensive breach in one file.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.credentials-file","lens":"exposure","title":"Plaintext credentials file publicly served","summary":"A plaintext credentials file (~/.netrc or ~/.pgpass) is downloadable and returns real credential lines, not HTML.","impact":"These files hold plaintext logins — FTP/HTTP credentials (.netrc) or database host:port:db:user:password (.pgpass) — that an attacker can use directly.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.docker-config","lens":"exposure","title":"Docker registry credentials publicly served","summary":"A Docker CLI config (~/.docker/config.json) with an `auths` block is served publicly.","impact":"The `auths` block holds base64-encoded registry username:password pairs — an attacker can pull (and often push) your private container images.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.env-file","lens":"exposure","title":"Environment file (.env) publicly served","summary":"A .env-style environment file (any variant — .env, .env.production, .env.bak, …) is downloadable and returns real KEY=value lines, not an HTML page.","impact":"Environment files typically hold the app's most privileged secrets — database URLs, API keys, signing secrets — so this is often a direct path to full compromise. Any keys inside are reported separately.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.kube-config","lens":"exposure","title":"Kubernetes kubeconfig publicly served","summary":"A kubeconfig (~/.kube/config) with cluster credentials is served publicly.","impact":"A kubeconfig grants API access to the cluster — client certificates/keys or a bearer token that an attacker can use to read secrets, deploy workloads, or take over the cluster.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.private-key-file","lens":"exposure","title":"Private key file publicly served","summary":"A PEM private key (e.g. .ssh/id_rsa, id_rsa) is downloadable.","impact":"A leaked private key lets an attacker authenticate as the server/user, decrypt intercepted traffic, or sign artifacts as you.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-798"},{"key":"exposure.rails-db-config","lens":"exposure","title":"Rails database.yml with credentials publicly served","summary":"A Rails config/database.yml (or /database.yml) is served publicly and contains a literal database password.","impact":"The file exposes the database adapter, host, and a plaintext password — direct database access, bypassing the application.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.service-account-key","lens":"exposure","title":"Cloud service-account key file publicly served","summary":"A GCP/Firebase service-account or OAuth credential file (serviceAccount.json, firebase-adminsdk.json, credentials.json) with a private_key is downloadable.","impact":"A service-account key grants programmatic access to the whole cloud project and — for Firebase admin — bypasses all Security Rules. This is a full-project compromise.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-798"},{"key":"exposure.sftp-credentials","lens":"exposure","title":"Deploy (SFTP) credentials publicly served","summary":"A VS Code SFTP deploy config (.vscode/sftp.json) exposing a host plus a password or private-key path is downloadable.","impact":"The file gives an attacker the deploy server's address and login material — enough to connect and modify the live site.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-798"},{"key":"exposure.sql-dump","lens":"exposure","title":"SQL database dump publicly served","summary":"A SQL dump (backup.sql / dump.sql / database.sql) with CREATE TABLE / INSERT statements is downloadable.","impact":"A public database dump is a full data breach — all rows, including user PII and any credentials stored in the database, can be downloaded.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.terraform-state","lens":"exposure","title":"Terraform state publicly served","summary":"A Terraform state file (terraform.tfstate) is downloadable.","impact":"Terraform state routinely stores provider credentials and resource secrets in plaintext — a direct route to your cloud infrastructure.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.wp-config-backup","lens":"exposure","title":"WordPress config backup leaks DB credentials","summary":"A wp-config.php backup (wp-config.php.bak/~/.save/.old) is served as raw source, exposing DB_PASSWORD and auth salts.","impact":"The backup reveals database credentials and WordPress secret keys — enough to access the database directly and forge authentication.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.actuator-index","lens":"exposure","title":"Spring Boot actuator endpoints exposed","summary":"The Spring Boot actuator index is public, listing management endpoints (env, beans, mappings, …).","impact":"The endpoint list reveals internal application detail and points an attacker at higher-value actuator endpoints to probe next.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-215"},{"key":"exposure.docker-compose","lens":"exposure","title":"docker-compose file publicly served","summary":"A docker-compose.yml/.yaml is served publicly, exposing service environment variables and topology.","impact":"Compose files leak inline environment variables (often secrets), image names, and service wiring an attacker can use to map and target your stack.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.dotnet-appsettings","lens":"exposure","title":".NET appsettings.json with secrets exposed","summary":"A .NET appsettings.json carrying ConnectionStrings or other secrets is served publicly.","impact":"Connection strings and secrets in appsettings hand an attacker direct database/service credentials.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.git-exposed","lens":"exposure","title":"Git repository metadata exposed (.git)","summary":"Git internals (.git/config, .git/HEAD, or .git/logs/HEAD) are served publicly.","impact":"An exposed .git directory is often fully downloadable, letting an attacker reconstruct your complete source code, commit history, author details, and any secrets ever committed.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-527"},{"key":"exposure.laravel-log","lens":"exposure","title":"Laravel log file publicly served","summary":"The Laravel application log (storage/logs/laravel.log) is served publicly.","impact":"Application logs leak stack traces, file paths, query fragments, and occasionally secrets — useful reconnaissance for an attacker.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-532"},{"key":"exposure.npmrc-token","lens":"exposure","title":".npmrc auth token publicly served","summary":"An .npmrc (or similar registry config) containing a _authToken / _auth / _password is downloadable.","impact":"A registry auth token can let an attacker read private packages and, if publish-scoped, push malicious versions — a supply-chain risk.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.phpinfo","lens":"exposure","title":"phpinfo() output publicly served","summary":"A phpinfo() page is publicly reachable (e.g. /phpinfo.php).","impact":"phpinfo() discloses the PHP version, loaded modules, full configuration, absolute filesystem paths, and server environment variables — the latter can include database URLs and API keys — giving an attacker a detailed map for a targeted attack.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-200"},{"key":"exposure.sensitive-config","lens":"exposure","title":"Config file with sensitive keys exposed","summary":"A JSON config file (e.g. config.json) served publicly contains sensitive-looking keys (api_key, secret, password, token).","impact":"A config file with credential-shaped fields exposes secrets or internal wiring an attacker can use directly or to pivot. Any recognizable keys are reported separately.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-538"},{"key":"exposure.server-status","lens":"exposure","title":"Apache server-status publicly served","summary":"The Apache mod_status page (/server-status) is publicly reachable.","impact":"server-status streams live request URLs, client IPs, virtual-host names, and server internals — an attacker can monitor real traffic and enumerate endpoints and users.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-200"},{"key":"exposure.wp-debug-log","lens":"exposure","title":"WordPress debug.log publicly served","summary":"The WordPress /wp-content/debug.log is served publicly, exposing PHP errors and stack traces.","impact":"Debug logs leak file paths, plugin internals, SQL errors, and sometimes secrets — reconnaissance that guides deeper attacks.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-532"},{"key":"exposure.ds-store","lens":"exposure","title":".DS_Store index exposed","summary":"A macOS .DS_Store file is served publicly; it discloses the names of other files in the directory.","impact":"Low on its own, but it reveals hidden/adjacent file and directory names that guide an attacker toward more sensitive targets.","severity":"low","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-527"},{"key":"exposure.wp-users-enum","lens":"exposure","title":"WordPress usernames enumerable via REST API","summary":"The WordPress /wp-json/wp/v2/users endpoint returns the site's usernames.","impact":"Enumerable usernames remove a factor from credential attacks — an attacker now only needs passwords, and can target specific accounts.","severity":"low","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-200"},{"key":"exposure.wp-xmlrpc","lens":"exposure","title":"WordPress XML-RPC enabled","summary":"The WordPress /xmlrpc.php endpoint is enabled and responding.","impact":"XML-RPC enables brute-force amplification (system.multicall bundles many password guesses per request) and can be abused as a pingback DDoS relay.","severity":"low","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-307"}]},{"category":"certificate","count":7,"checks":[{"key":"tls.cert-expired","lens":"tls","title":"TLS certificate has expired","summary":"The certificate the site serves for HTTPS is past its expiry date.","impact":"Every browser shows a full-page security warning and blocks the site — visitors cannot reach it, and the padlock/trust signal is gone.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-298"},{"key":"tls.cert-not-yet-valid","lens":"tls","title":"TLS certificate is not yet valid","summary":"The served certificate's start (not-before) date is in the future, so it isn't valid yet.","impact":"Clients reject the certificate and show a security warning until its start date — often a sign of a misconfigured deploy or a wrong server clock.","severity":"high","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-298"},{"key":"tls.cert-expiring-soon","lens":"tls","title":"TLS certificate is expiring soon","summary":"The served certificate is valid now but expires within the next 30 days.","impact":"If renewal is missed the certificate will lapse and browsers will block the site — a self-inflicted outage.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-298"},{"key":"tls.cert-hostname-mismatch","lens":"tls","title":"TLS certificate does not match the hostname","summary":"The served certificate's subject/SAN names do not cover the hostname being visited.","impact":"Browsers show a name-mismatch warning and block the site. (If the host is fronted by a CDN/proxy that terminates TLS elsewhere this can be benign — confirm which edge serves the name.)","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-297"},{"key":"tls.cert-self-signed","lens":"tls","title":"TLS certificate is self-signed / not from a trusted CA","summary":"The certificate is self-issued (issuer equals subject), so it does not chain to a publicly trusted certificate authority.","impact":"Public clients do not trust it and show a security warning, and users are trained to click through warnings — which also masks real man-in-the-middle attacks.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-295"},{"key":"tls.cert-weak-key","lens":"tls","title":"TLS certificate uses a weak (short) RSA key","summary":"The served certificate's RSA public key is smaller than the 2048-bit minimum.","impact":"Sub-2048-bit RSA keys are considered factorable at scale and fail NIST and CA/Browser Forum baselines; a served short key usually means an internal or long-outdated certificate.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-326"},{"key":"tls.cert-weak-signature","lens":"tls","title":"TLS certificate uses a weak signature algorithm","summary":"The served leaf certificate is signed with a collision-broken hash (SHA-1, MD5, or MD2).","impact":"Collision attacks against SHA-1/MD5 make it feasible to forge a certificate a client would accept; modern browsers already reject SHA-1-signed leaf certificates, so this also breaks compatibility. A served weak-signed leaf usually means an internal or long-outdated certificate authority.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-328"}]},{"category":"email-authentication","count":7,"checks":[{"key":"email.dmarc-missing","lens":"email","title":"No DMARC record — spoofed mail is not rejected","summary":"The domain publishes no DMARC (_dmarc, v=DMARC1) policy, so mailbox providers have no instruction to quarantine or reject failing mail.","impact":"Even with SPF/DKIM configured, without DMARC there is no enforcement policy — spoofed mail that fails those checks can still be delivered.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-290"},{"key":"email.dmarc-subdomain-unprotected","lens":"email","title":"DMARC does not protect this subdomain","summary":"This subdomain has no DMARC record of its own, and the organizational domain's policy does not enforce on subdomains (sp=none, or no sp= tag with p=none) — so mail spoofing this subdomain is not rejected.","impact":"Attackers can spoof mail from this subdomain even though the apex may look protected — subdomains are a common phishing vector precisely because their DMARC coverage is overlooked.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-290"},{"key":"email.dmarc-weak","lens":"email","title":"DMARC policy not enforced (p=none)","summary":"The DMARC record uses p=none (monitor-only) or omits the required p= tag, so failing mail is still delivered.","impact":"p=none reports abuse but does not stop it — mail failing SPF/DKIM is still delivered, so spoofing of your domain is not actually prevented.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-290"},{"key":"email.spf-missing","lens":"email","title":"No SPF record — sender spoofing is unrestricted","summary":"The domain publishes no SPF (v=spf1) TXT record, so receivers have no authorized-sender policy to check.","impact":"Anyone can send mail with a forged From: address at this domain and it will not fail SPF — enabling phishing and business-email-compromise that appears to come from you.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-290"},{"key":"email.spf-multiple","lens":"email","title":"Multiple SPF records — policy is undefined","summary":"The domain publishes more than one v=spf1 record; per RFC 7208 this is a permerror and SPF may be ignored entirely.","impact":"With SPF evaluation undefined, receivers may skip the check — leaving spoofed mail unfiltered as if no policy existed.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-290"},{"key":"email.spf-neutral","lens":"email","title":"SPF is neutral (?all) — no enforcement","summary":"The SPF record ends in \"?all\" (neutral): it expresses no pass/fail policy.","impact":"Spoofed mail is neither authorized nor rejected, so SPF provides no protection against forgery of your domain.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-290"},{"key":"email.spf-permissive","lens":"email","title":"SPF authorizes any sender (+all)","summary":"The SPF record ends in \"+all\", which explicitly authorizes every host on the internet to send as this domain.","impact":"\"+all\" is equivalent to publishing no policy — any server can send mail that passes SPF for your domain.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-290"}]},{"category":"cross-origin","count":6,"checks":[{"key":"config.cors-null-credentials","lens":"config","title":"CORS allows the `null` origin with credentials","summary":"The server returns Access-Control-Allow-Origin: null together with Access-Control-Allow-Credentials: true.","impact":"The null origin is attacker-reachable — a sandboxed iframe, a data:/file: document, or certain redirects all send Origin: null — so any of those contexts can make credentialed cross-origin requests and read the victim's authenticated responses.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-942"},{"key":"config.cors-reflect-credentials","lens":"config","title":"CORS reflects arbitrary origins with credentials","summary":"The server echoes any request Origin back in Access-Control-Allow-Origin together with Access-Control-Allow-Credentials: true.","impact":"Any website a victim visits can make credentialed cross-origin requests and read the responses — effectively reading the victim's authenticated data.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-942"},{"key":"config.cors-wildcard-credentials","lens":"config","title":"CORS allows any origin with credentials","summary":"Access-Control-Allow-Origin: * is sent together with Access-Control-Allow-Credentials: true.","impact":"Browsers reject this combination, but its presence signals a misconfigured CORS layer; a fix that swaps `*` for origin-reflection would become directly exploitable.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-942"},{"key":"config.cors-null-open","lens":"config","title":"CORS allows the `null` origin (no credentials)","summary":"The server returns Access-Control-Allow-Origin: null, but without credentials.","impact":"Low-risk without credentials, but the null origin is attacker-reachable (sandboxed iframe / data: document), so any endpoint that starts trusting Origin would be exposed.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-942"},{"key":"config.cors-reflect-open","lens":"config","title":"CORS reflects arbitrary origins (no credentials)","summary":"The server echoes any request Origin back in Access-Control-Allow-Origin, but without credentials.","impact":"Low-risk on its own (equivalent to `*`), but any endpoint that later starts relying on Origin for trust would be exposed.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-942"},{"key":"config.cors-wildcard-open","lens":"config","title":"CORS allows any origin (no credentials)","summary":"Access-Control-Allow-Origin: * without credentials — common and low-risk for public data.","impact":"Fine for genuinely public resources; a concern only if a private endpoint sits behind the same wildcard policy.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-942"}]},{"category":"supply-chain","count":6,"checks":[{"key":"cms.wp-core-outdated","lens":"cms","title":"WordPress core is significantly outdated","summary":"The detected WordPress core version is on a branch several releases behind the current line, so it is missing the accumulated security fixes WordPress backports to maintained branches.","impact":"An outdated core accumulates publicly-known, mass-exploited vulnerabilities (SQL injection, privilege escalation, RCE across releases). Labeled 'likely' because the version is inferred from the page — but a core this far behind is a high-value target for automated attacks.","severity":"medium","status":"live","tier":"standard","owasp":"A03:2025 Software Supply Chain Failures","cwe":"CWE-1104"},{"key":"cms.wp-plugin-vuln","lens":"cms","title":"WordPress plugin with a known vulnerability","summary":"A WordPress plugin was detected at a version below the patch for a known CVE (the version is inferred from the plugin's asset URL).","impact":"Known plugin CVEs are widely exploited on WordPress sites — depending on the flaw this can mean stored XSS, SQL injection, auth bypass, or remote code execution. Labeled 'likely' because the version is inferred, not confirmed.","severity":"medium","status":"live","tier":"standard","owasp":"A03:2025 Software Supply Chain Failures","cwe":"CWE-1035"},{"key":"libs.known-vulnerable","lens":"libs","title":"Outdated JavaScript library with known vulnerabilities","summary":"A client-side JavaScript library is loaded at a version below the fix for one or more known CVEs (the version is observed in a script URL or the library's own version banner).","impact":"Known library CVEs (typically DOM XSS, prototype pollution, or ReDoS) can be exploitable if the affected feature is reachable with untrusted input. Kept at medium on a passive signal — presence is certain, but reachability of the vulnerable code path is not.","severity":"medium","status":"live","tier":"standard","owasp":"A03:2025 Software Supply Chain Failures","cwe":"CWE-1104"},{"key":"cms.wp-plugin-unconfirmed","lens":"cms","title":"WordPress plugin present — version could not be confirmed","summary":"A WordPress plugin with a known CVE history was detected, but its version could not be read from the page assets — so vulnerability can't be confirmed or ruled out.","impact":"Only a pointer, not a confirmed finding: if the installed version is below the patch it is exploitable; if it's current it's fine. Worth confirming because this plugin has a known vulnerable range.","severity":"low","status":"live","tier":"standard","owasp":"A03:2025 Software Supply Chain Failures","cwe":"CWE-1035"},{"key":"sri.missing","lens":"sri","title":"Third-party subresource loaded without Subresource Integrity","summary":"A cross-origin (third-party) subresource — a <script>, stylesheet, or module/preload — is loaded without a Subresource Integrity (SRI) hash, so the browser can't verify the file wasn't tampered with before running or applying it.","impact":"If the third-party host or its CDN is compromised — or the response is altered in transit — attacker-controlled code (or CSS that can exfiltrate/deface) runs in your site's origin with access to the DOM, cookies, and any in-page secrets. An SRI hash pins the exact file the browser will accept and rejects anything else. Kept at low: it's a defense-in-depth gap, not an active vulnerability on its own.","severity":"low","status":"live","tier":"standard","owasp":"A08:2025 Software or Data Integrity Failures","cwe":"CWE-353"},{"key":"sri.not-enforced","lens":"sri","title":"Subresource Integrity present but not enforced (missing crossorigin)","summary":"A cross-origin subresource carries an `integrity` hash but no `crossorigin` attribute. On a cross-origin resource the browser fetches in no-cors mode and gets an opaque response it cannot read, so the SRI hash is silently NOT enforced — the pin does not take effect.","impact":"The developer intended to pin the file, but the check does nothing: the resource is typically blocked outright (a broken page), or in some paths loads unverified — either way the integrity guarantee they think they have is absent. A one-attribute misconfiguration that defeats the protection it looks like it provides.","severity":"low","status":"live","tier":"standard","owasp":"A08:2025 Software or Data Integrity Failures","cwe":"CWE-353"}]},{"category":"info-disclosure","count":5,"checks":[{"key":"api.graphql-introspection","lens":"api","title":"GraphQL introspection is enabled","summary":"The API's GraphQL endpoint answers an introspection query, exposing the full schema (queries, mutations, types).","impact":"Introspection isn't a breach by itself, but it hands an attacker a complete map of the API's operations and data model to target.","severity":"low","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-200"},{"key":"api.openapi-exposed","lens":"api","title":"API specification is publicly exposed","summary":"An OpenAPI/Swagger specification is served publicly, documenting every route and parameter of the API.","impact":"Often intentional, but a public spec hands an attacker the full API map — routes, parameters, and auth requirements — to probe.","severity":"low","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-200"},{"key":"sourcemap.exposed","lens":"sourcemap","title":"Source map exposes original application source","summary":"A JavaScript bundle references a publicly-served .map file whose sourcesContent reconstructs the original, un-minified source (comments, internal logic, endpoints).","impact":"The recovered source hands an attacker your client-side logic, internal API endpoints, and any secrets or comments the minifier had obscured — a strong reconnaissance boost, and occasionally a direct secret leak.","severity":"low","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-540"},{"key":"config.banner-server-version","lens":"config","title":"Server banner discloses version","summary":"The Server response header includes a version number.","impact":"Version disclosure narrows an attacker's search to CVEs affecting that exact release.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-200"},{"key":"config.banner-x-powered-by","lens":"config","title":"Framework disclosed via X-Powered-By","summary":"The X-Powered-By response header advertises the server framework (and sometimes its version).","impact":"Not exploitable on its own, but it hands an attacker precise version/framework intel for targeting known CVEs.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-200"}]},{"category":"authentication","count":4,"checks":[{"key":"auth.cognito-unauth-identity-pool","lens":"auth","title":"Cognito identity pool grants AWS credentials to anonymous clients","summary":"An AWS Cognito identity pool allows unauthenticated access, so an anonymous request obtains temporary AWS credentials with no sign-in.","impact":"The blast radius equals the unauthenticated IAM role's permissions. If that guest role can read/write S3, DynamoDB, or invoke other AWS APIs, anyone on the internet inherits that access. Even a tightly-scoped role is worth confirming, since the pool id is public in the app.","severity":"medium","status":"live","tier":"standard","owasp":"A01:2025 Broken Access Control","cwe":"CWE-284"},{"key":"auth.wildcard-oauth-domain","lens":"auth","title":"Firebase authorized domains include a wildcard","summary":"The Firebase project's authorizedDomains list contains a wildcard entry, widening the OAuth redirect surface.","impact":"An over-broad authorized-domain allow-list increases the chance an OAuth redirect/callback can be pointed at an attacker-controlled host, aiding token/credential theft.","severity":"low","status":"live","tier":"standard","owasp":"A07:2025 Authentication Failures","cwe":"CWE-601"},{"key":"auth.clerk-open-signup","lens":"auth","title":"Clerk open registration is enabled","summary":"The Clerk environment config (readable from the public Frontend API with the publishable key) shows sign-up mode is \"public\" — anyone can self-register.","impact":"Open registration is often intentional, but where authorization checks only 'is the request signed in' (not per-user ownership), self-signup turns 'authenticated' into 'anyone' — a fresh account reaches data meant for real users.","severity":"info","status":"live","tier":"standard","owasp":"A07:2025 Authentication Failures","cwe":"CWE-284"},{"key":"auth.open-registration","lens":"auth","title":"Firebase open registration is enabled","summary":"The Firebase project config (readable with the public web API key) shows email/password sign-up is open to anyone.","impact":"Open registration is often intentional, but combined with weak Firestore/RTDB rules it lets an attacker create an account and reach any data that is protected only by `request.auth != null` — turning 'authenticated' into 'anyone'.","severity":"info","status":"live","tier":"standard","owasp":"A07:2025 Authentication Failures","cwe":"CWE-284"}]},{"category":"cipher","count":4,"checks":[{"key":"tls.cipher-broken","lens":"tls","title":"Broken cipher suites accepted","summary":"The server negotiated a genuinely broken cipher (RC4, EXPORT, or NULL) from a weak-only ClientHello.","impact":"These ciphers are cryptographically broken — traffic protected by them can be decrypted or was never encrypted at all (NULL), undermining confidentiality.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-327"},{"key":"tls.cipher-weak-negotiated","lens":"tls","title":"Weak cipher negotiated when strong suites were offered","summary":"Even when offered strong suites, the server chose a weak (non-AEAD) cipher.","impact":"The server's cipher preference favours a weaker algorithm, so ordinary clients get weaker-than-necessary encryption for their traffic.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-327"},{"key":"tls.cipher-3des","lens":"tls","title":"Legacy 3DES cipher accepted","summary":"The server accepts the legacy 3DES (Triple-DES) cipher suite.","impact":"3DES is deprecated (Sweet32 birthday attack against 64-bit block ciphers) though not outright broken; it is common on default edges, so this is a hardening/compliance item.","severity":"low","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-327"},{"key":"tls.no-forward-secrecy","lens":"tls","title":"No forward secrecy (static-RSA key exchange)","summary":"The server negotiated a static-RSA key-exchange cipher even though modern ECDHE suites were offered, so sessions have no forward secrecy.","impact":"Without forward secrecy, a single future compromise of the server's private key lets an attacker who recorded past traffic decrypt all of it retroactively. ECDHE/DHE and TLS 1.3 avoid this by using ephemeral keys.","severity":"low","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-327"}]},{"category":"session-cookies","count":3,"checks":[{"key":"config.cookie-missing-httponly","lens":"config","title":"Session cookie missing HttpOnly","summary":"A session-looking cookie is readable by JavaScript because it lacks the HttpOnly attribute.","impact":"Any cross-site-scripting flaw can read the session cookie and exfiltrate it, escalating XSS to full account takeover.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-1004"},{"key":"config.cookie-missing-secure","lens":"config","title":"Session cookie missing Secure","summary":"A session-looking cookie is set without the Secure attribute on an HTTPS site.","impact":"The cookie can be transmitted over plain HTTP and intercepted by an on-path attacker, hijacking the session.","severity":"medium","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-614"},{"key":"config.cookie-missing-samesite","lens":"config","title":"Session cookie missing SameSite","summary":"A session-looking cookie has no SameSite attribute.","impact":"Increases cross-site-request-forgery exposure: the cookie is sent on cross-site requests unless another CSRF defense is present.","severity":"low","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-1275"}]},{"category":"ai-surface","count":2,"checks":[{"key":"ai.mcp-agent-config","lens":"ai","title":"Client-visible MCP / AI-agent configuration","summary":"AI-agent / Model Context Protocol wiring is reachable from the client (an mcpServers block, MCP SDK, or an MCP server reference).","impact":"If an agent with tool access reads user-controlled data (rows, documents, messages), malicious stored values can steer it into unintended actions — data-plane (indirect) prompt injection. This is presence-only detection, not a confirmed exploit.","severity":"medium","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-829"},{"key":"ai.llm-surface","lens":"ai","title":"AI / LLM surface present","summary":"A client-visible AI/LLM integration was detected — an LLM provider host called from the browser and/or an agent framework in the bundle.","impact":"Informational: a browser-side LLM call risks exposing the provider API key and turns model output into an untrusted-input (output-handling / XSS) surface. Presence only.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-200"}]},{"category":"content-security","count":2,"checks":[{"key":"config.csp-weak","lens":"config","title":"Content-Security-Policy present but weak","summary":"A CSP exists but its script policy allows unsafe-inline, unsafe-eval, or a wildcard source.","impact":"These directives largely defeat CSP's core purpose — blocking injected script — so an XSS flaw executes despite the policy.","severity":"low","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-693"},{"key":"config.hardening-headers-absent","lens":"config","title":"Standard hardening headers absent","summary":"One or more defense-in-depth response headers (HSTS, CSP, X-Content-Type-Options, frame protection, Referrer-Policy) are missing.","impact":"Absence is not directly exploitable, but each missing header removes a layer that would blunt XSS, clickjacking, MIME-sniffing, or referrer leakage.","severity":"info","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-693"}]},{"category":"dns","count":1,"checks":[{"key":"takeover.dangling-dns","lens":"takeover","title":"Possible subdomain takeover (dangling DNS record)","summary":"A DNS record (via CNAME) points at a hosting service resource (S3 bucket, GitHub Pages site, Heroku app, …) that is unclaimed — the service returned its distinctive 'unregistered' response.","impact":"An attacker who registers that unclaimed name on the service can serve arbitrary content on your subdomain — enabling convincing phishing, cookie/session theft (same registrable domain), and content spoofing under your brand.","severity":"high","status":"live","tier":"standard","owasp":"A02:2025 Security Misconfiguration","cwe":"CWE-350"}]},{"category":"error-disclosure","count":1,"checks":[{"key":"errpage.disclosure","lens":"errpage","title":"Server error / debug page exposed","summary":"The site served a framework debug or stack-trace page instead of a generic error — leaking its framework and version, server file paths, and often source snippets, SQL, or configuration.","impact":"A stack trace / debug page hands an attacker a map of your stack: framework and version, absolute server paths, source snippets, query fragments, and sometimes credentials or environment values — a strong foothold for a targeted attack. It usually means production is running with debug mode on.","severity":"medium","status":"live","tier":"standard","owasp":"A10:2025 Mishandling of Exceptional Conditions","cwe":"CWE-209"}]},{"category":"injection","count":1,"checks":[{"key":"xss.reflected-dom","lens":"xss","title":"Reflected cross-site scripting (XSS) — injected script executed in the browser","summary":"A value taken from the URL was reflected into the page and ran as JavaScript in the visitor's browser — proven by executing a benign marker payload, not merely by reflecting it.","impact":"An attacker who gets a victim to open a crafted link can run arbitrary JavaScript in your site's origin as that visitor: read or steal session tokens and cookies, act as the user, alter anything the page can, and phish convincingly from your own domain. Because execution was proven (not just reflection), this is directly exploitable.","severity":"high","status":"live","tier":"deep","owasp":"A05:2025 Injection","cwe":"CWE-79"}]},{"category":"protocol","count":1,"checks":[{"key":"tls.protocol-deprecated","lens":"tls","title":"Deprecated TLS 1.0 / 1.1 still accepted","summary":"The server still completes handshakes over TLS 1.0 and/or 1.1, which are formally deprecated.","impact":"Deprecated protocols carry known weaknesses and fail PCI-DSS and modern browser baselines; on their own they are a hygiene/compliance issue rather than a live exploit (many CDN edges still allow them by default).","severity":"low","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-327"}]},{"category":"transport-security","count":1,"checks":[{"key":"config.hsts-weak","lens":"config","title":"HSTS max-age is very short or zero","summary":"Strict-Transport-Security is set but with a max-age under a day (or 0).","impact":"A short window leaves users exposed to SSL-stripping downgrade attacks outside it; max-age=0 actively clears any prior HSTS pin.","severity":"low","status":"live","tier":"standard","owasp":"A04:2025 Cryptographic Failures","cwe":"CWE-319"}]}]}