Security rules

A server-only environment variable is read in a file that ships to the browser, so the value is bundled into client JavaScript.

antipattern/server-secret-in-clientCWE-200

exec()/execSync() runs a string through a shell, so interpolated values can run arbitrary commands.

injection/commandOWASP A03:2021 · CWE-78

subprocess with shell=True (or os.system) runs an interpolated string through a shell.

injection/command-pythonOWASP A03:2021 · CWE-78

execute() receives an f-string or %-formatted query instead of parameters.

injection/sql-python-formatOWASP A03:2021 · CWE-89

A query is assembled by interpolating values into SQL text, so any tainted value can change the query.

injection/sql-string-buildingOWASP A03:2021 · CWE-89

Detects a Anthropic API key committed in source. Anyone with repository access can use it.

secrets/anthropic-keyCWE-798

Detects a AWS access key ID committed in source. Anyone with repository access can use it.

secrets/aws-access-keyCWE-798

Detects a AWS secret access key committed in source. Anyone with repository access can use it.

secrets/aws-secret-keyCWE-798

Detects a Database URL with embedded password committed in source. Anyone with repository access can use it.

secrets/database-url-passwordCWE-798

Detects a GitHub fine-grained token committed in source. Anyone with repository access can use it.

secrets/github-fine-grained-patCWE-798

Detects a GitHub token committed in source. Anyone with repository access can use it.

secrets/github-tokenCWE-798

Detects a OpenAI API key committed in source. Anyone with repository access can use it.

secrets/openai-keyCWE-798

Detects a OpenAI API key committed in source. Anyone with repository access can use it.

secrets/openai-project-keyCWE-798

Detects a Private key committed in source. Anyone with repository access can use it.

secrets/private-keyCWE-798

A secret-looking value uses a NEXT_PUBLIC_/VITE_ style prefix, so the bundler ships it to every visitor.

secrets/public-env-secretCWE-200

Detects a Stripe secret key committed in source. Anyone with repository access can use it.

secrets/stripe-secret-keyCWE-798

Detects a Supabase service_role key committed in source. Anyone with repository access can use it.

secrets/supabase-service-roleCWE-798

A database read filters by a client-controlled id instead of the authenticated user, so one user can read another user's rows.

antipattern/bolaOWASP API1:2023

eval() executes whatever string it is given, turning any tainted value into code execution.

antipattern/evalCWE-95

The JWT check accepts unsigned or expired tokens.

antipattern/jwt-weak-verificationOWASP A07:2021 · CWE-347

A POST/PUT/PATCH/DELETE route handler with no authentication check anywhere in the file.

antipattern/missing-auth-mutating-routeOWASP API2:2023 · API5:2023

new Function() compiles a string into code, with the same risk as eval().

antipattern/new-functionCWE-95

Passwords appear to be stored or compared in plain text.

antipattern/password-plain-compareOWASP A02:2021 · CWE-256

Certificate validation is turned off, so any network attacker can impersonate the server (MITM).

antipattern/tls-verification-disabledCWE-295

A Supabase .or()/.filter() string is built from input, which can widen the filter to other rows.

injection/postgrest-filterOWASP A03:2021 · CWE-89

A high-entropy value is assigned to a name like key/token/secret/password, which looks like a live credential.

secrets/generic-credentialCWE-798

Detects a Google API key committed in source. Anyone with repository access can use it.

secrets/google-api-keyCWE-798

Detects a npm access token committed in source. Anyone with repository access can use it.

secrets/npm-tokenCWE-798

Detects a Resend API key committed in source. Anyone with repository access can use it.

secrets/resend-keyCWE-798

Detects a SendGrid API key committed in source. Anyone with repository access can use it.

secrets/sendgrid-keyCWE-798

Detects a Slack token committed in source. Anyone with repository access can use it.

secrets/slack-tokenCWE-798

Detects a Stripe webhook secret committed in source. Anyone with repository access can use it.

secrets/stripe-webhook-secretCWE-798

Detects a Twilio API key committed in source. Anyone with repository access can use it.

secrets/twilio-keyCWE-798

The API accepts cross-origin requests from any website.

antipattern/cors-wildcard-credentialsOWASP A05:2021 · CWE-942

React renders the HTML verbatim, so any user-supplied markup becomes script in the page.

antipattern/dangerously-set-inner-htmlOWASP A03:2021 · CWE-79

Debug mode exposes stack traces and, for Flask/Werkzeug, an interactive console.

antipattern/debug-enabledOWASP A05:2021

Assigning untrusted values to innerHTML/outerHTML is a DOM XSS sink.

antipattern/inner-htmlCWE-79

Math.random() is predictable and must not generate tokens, codes or passwords.

antipattern/insecure-randomnessCWE-338

Detects a Slack webhook URL committed in source. Anyone with repository access can use it.

secrets/slack-webhookCWE-798

Tokens in localStorage are readable by any script on the page, so a single XSS steals the session.

antipattern/token-in-localstorageCWE-922

MD5/SHA-1 are broken for security use (passwords, signatures, integrity).

antipattern/weak-hashCWE-328

A migration turns RLS off again on an exposed table.

rls/disabledOWASP API1:2023 · CWE-284

A table in an API-exposed schema is never given `enable row level security` in any migration.

rls/table-without-rlsOWASP API1:2023 · CWE-284

A policy uses `using (true)`, so RLS doesn't restrict the rows the API role can reach.

rls/permissive-policyOWASP API1:2023 · CWE-284

user_metadata is user-editable, so a policy that reads it can be bypassed by the user.

rls/user-metadataCWE-807

The function runs as its owner and resolves names through the caller's search_path, which can be hijacked.

rls/security-definer-search-pathCWE-426

An unauthenticated client can list databases, so anyone who reaches the port can read or wipe them.

db/mongo-no-authOWASP A07:2021 · CWE-306

An account can authenticate with no password.

db/mysql-empty-passwordOWASP A07:2021 · CWE-521

root/admin accepts connections from any address.

db/mysql-remote-rootCWE-250

A live table in an exposed schema has RLS off; severity depends on what the anon/authenticated roles are granted.

db/rls-disabledOWASP API1:2023 · CWE-284

The app or audit user holds root/dbOwner-style roles instead of readWrite on its own database.

db/mongo-overprivileged-userOWASP A01:2021 · CWE-250

FILE/SUPER/SHUTDOWN/PROCESS on *.* turns one SQL injection into server compromise.

db/mysql-dangerous-privilegeOWASP A01:2021 · CWE-250

A live policy uses `true` for its USING/WITH CHECK expression.

db/rls-permissive-policyOWASP API1:2023 · CWE-284

A live policy reads user-editable JWT metadata to decide access.

db/rls-user-metadataCWE-807

A view runs with its owner's rights, so readers see rows their own policies would hide.

db/security-definer-viewCWE-284

require_secure_transport is OFF, so clients can send credentials in clear text.

db/mysql-insecure-transportOWASP A02:2021 · CWE-319

local_infile lets a malicious server read files from connecting clients.

db/mysql-local-infileCWE-73

A live function runs as its owner without `set search_path = ''`.

db/security-definer-search-pathCWE-426

Without a $jsonSchema validator, injected operator objects and wrong types can be stored.

db/mongo-no-validatorOWASP A03:2021 · CWE-20

Updates and deletes can hit unintended duplicate rows, and replication needs a key.

db/mysql-no-primary-key

A wildcard host widens the blast radius of a leaked password.

db/mysql-wildcard-hostCWE-1188

auth.uid()/auth.jwt() called directly in a policy runs once per row; wrapping it in a sub-select makes it an init-plan.

db/rls-initplan

Joins and cascading deletes scan the whole table, which is also a cheap denial-of-service lever.

db/unindexed-foreign-key

RLS denies everything until a policy allows it, which is safe but usually means the feature is broken.

db/rls-no-policies