{"rule_id": "iac-docker-curl-pipe-shell", "description": "Downloaded script piped directly into a shell interpreter.", "severity": "high", "file": "examples/sample-app/Dockerfile", "line": 2, "secret": "curl -fsSL https://get.example.com/install.sh | bash", "line_excerpt": "RUN curl -fsSL https://get.example.com/install.sh | bash # remote script piped to shell (CWE-494)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "Remote Script Piped to Shell", "cwe": "CWE-494", "owasp": "A08:2021 Software and Data Integrity Failures", "remediation": "Pin and checksum-verify the artifact before execution.", "secure_code": "RUN curl -fsSLo i.sh https://x/i.sh && echo \" i.sh\" | sha256sum -c && sh i.sh\n", "vulnerable_code": "RUN curl -fsSL https://get.example.com/install.sh | bash # remote script piped to shell (CWE-494)", "technical_impact": "A compromised or MITM'd endpoint runs arbitrary code at build time.", "business_impact": "Supply-chain compromise of the built image.", "secret_sha256": "45596d51cebc0fc7ea396ecfaf06e2b14768d119b4e042eec751f8eab1ea3806", "secret_redacted": "curl -fsSL https://get.example.com/install.sh | bash"} {"rule_id": "env-named-credential-assignment", "description": "Credential-named env/config variable assigned a value (.env / shell / dotenv style)", "severity": "medium", "file": "examples/sample-app/.env", "line": 4, "secret": "s3cr3tCl13ntV4lu", "line_excerpt": "AM_CLIENT_SECRET=s3cr3tCl13ntV4lu", "entropy": 3.45, "verified": null, "source": "sast", "commit": null, "rule_category": null, "name": null, "cwe": null, "owasp": null, "remediation": null, "secure_code": null, "vulnerable_code": null, "technical_impact": null, "business_impact": null, "secret_sha256": "08797118b38b4a2e7308a917024d3518978ae19a138225b9325388d878982cdd", "secret_redacted": "s3cr********V4lu"} {"rule_id": "env-named-credential-assignment", "description": "Credential-named env/config variable assigned a value (.env / shell / dotenv style)", "severity": "medium", "file": "examples/sample-app/.env", "line": 5, "secret": "0Iael9zksjdhfg8273hdksjf", "line_excerpt": "SESSION_SECRET=0Iael9zksjdhfg8273hdksjf", "entropy": 4.08, "verified": null, "source": "sast", "commit": null, "rule_category": null, "name": null, "cwe": null, "owasp": null, "remediation": null, "secure_code": null, "vulnerable_code": null, "technical_impact": null, "business_impact": null, "secret_sha256": "44a4075b389d84511dde87e3975af86b5570c8736f88a3ebda142b5bab7432a6", "secret_redacted": "0Iae****************ksjf"} {"rule_id": "env-named-credential-assignment", "description": "Credential-named env/config variable assigned a value (.env / shell / dotenv style)", "severity": "medium", "file": "examples/sample-app/.env", "line": 6, "secret": "Sup3rP@ssw0rdDB", "line_excerpt": "DATABASE_PASSWORD=Sup3rP@ssw0rdDB", "entropy": 3.64, "verified": null, "source": "sast", "commit": null, "rule_category": null, "name": null, "cwe": null, "owasp": null, "remediation": null, "secure_code": null, "vulnerable_code": null, "technical_impact": null, "business_impact": null, "secret_sha256": "1e5283363899ef426b9f2f31768e5a37fd5d88981bff83ecfc7dca531924eadf", "secret_redacted": "Sup3*******rdDB"} {"rule_id": "env-named-credential-assignment", "description": "Credential-named env/config variable assigned a value (.env / shell / dotenv style)", "severity": "medium", "file": "examples/sample-app/.env", "line": 7, "secret": "aGVsbG9lbmNyeXB0aW9ua2V5MTIz", "line_excerpt": "ENCRYPTION_KEY=aGVsbG9lbmNyeXB0aW9ua2V5MTIz", "entropy": 4.35, "verified": null, "source": "sast", "commit": null, "rule_category": null, "name": null, "cwe": null, "owasp": null, "remediation": null, "secure_code": null, "vulnerable_code": null, "technical_impact": null, "business_impact": null, "secret_sha256": "c79fbb6e4033e06d7859a9853e58e1a49e3a759f561e6bff02c1b462a3404571", "secret_redacted": "aGVs********************MTIz"} {"rule_id": "basic-auth-credential", "description": "HTTP Basic auth credential assigned in code/config (basic_auth = \"...\")", "severity": "medium", "file": "examples/sample-app/.env", "line": 8, "secret": "eAxbYmFzaWM6Y3JlZHM=", "line_excerpt": "basic_auth = \"eAxbYmFzaWM6Y3JlZHM=\"", "entropy": 4.12, "verified": null, "source": "sast", "commit": null, "rule_category": null, "name": null, "cwe": null, "owasp": null, "remediation": null, "secure_code": null, "vulnerable_code": null, "technical_impact": null, "business_impact": null, "secret_sha256": "da9b783e107b96c6ed1ad2b0c08c8dafd9c40c9efb19ea9539a1ff2f717b5df2", "secret_redacted": "eAxb************ZHM="} {"rule_id": "dotnet-debug-enabled", "description": " ships verbose errors, disables optimizations, and lengthens request timeouts.", "severity": "medium", "file": "examples/sample-app/web.config", "line": 3, "secret": " ", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "ASP.NET Debug Compilation Enabled in Production", "cwe": "CWE-489", "owasp": "A05:2021 Security Misconfiguration", "remediation": "Set debug=\"false\" for production deployments and enable on the server.", "secure_code": "\n", "vulnerable_code": " ", "technical_impact": "Detailed exception pages leak source paths, versions, and stack traces, and the app is more DoS-prone.", "business_impact": "Reconnaissance data handed to attackers and degraded availability under load.", "secret_sha256": "312394a0e0e615e4d8187ba2b6083a99ccc822ed29342a13e932f6b89fd63527", "secret_redacted": " returns full stack traces and framework banners to remote clients.", "severity": "medium", "file": "examples/sample-app/web.config", "line": 4, "secret": " ", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "ASP.NET customErrors Off (Stack Trace Disclosure)", "cwe": "CWE-209", "owasp": "A05:2021 Security Misconfiguration", "remediation": "Use mode=\"RemoteOnly\" (or On) with a generic defaultRedirect error page in production.", "secure_code": "\n", "vulnerable_code": " ", "technical_impact": "Yellow-screen-of-death pages expose method names, file paths, connection strings, and exact patch levels.", "business_impact": "Internal architecture and occasionally credentials are disclosed to anonymous internet users.", "secret_sha256": "8d0302e1b0e2fd7ecf1829c9ffa9ff92ff3f51c3c718bddab83f915fe444abe2", "secret_redacted": " ", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "ASP.NET Request Validation Disabled", "cwe": "CWE-20", "owasp": "A03:2021 Injection", "remediation": "Leave request validation enabled (default) and HTML-encode output; scope any exception to a single field.", "secure_code": "\n\n", "vulnerable_code": " ", "technical_impact": "The framework no longer rejects markup in query/form input, re-opening reflected and stored XSS sinks.", "business_impact": "Session theft and account takeover through cross-site scripting on any page that echoes user input.", "secret_sha256": "76288b5c8fa8907414d117ece17c26fb855e674f6eed64c934875abedb8102ad", "secret_redacted": "validateRequest=\"false\""} {"rule_id": "kotlin-command-injection-exec", "description": "Request/intent input reaches Runtime.exec or ProcessBuilder, often via string interpolation.", "severity": "critical", "file": "examples/sample-app/src/Main.kt", "line": 2, "secret": "Runtime.getRuntime().exec(", "line_excerpt": "Runtime.getRuntime().exec(\"sh -c \" + intent.getStringExtra(\"cmd\")) // cmd injection (CWE-78)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "Kotlin OS Command Injection", "cwe": "CWE-78", "owasp": "A03:2021 Injection", "remediation": "Pass a fixed argv list with validated arguments; never build a shell string from input.", "secure_code": "ProcessBuilder(listOf(\"convert\", validated(file), \"out.png\")).start()\n", "vulnerable_code": "Runtime.getRuntime().exec(\"sh -c \" + intent.getStringExtra(\"cmd\")) // cmd injection (CWE-78)", "technical_impact": "Arbitrary OS command execution in the server or app process.", "business_impact": "Server takeover (Ktor) or device compromise (Android) via a single tainted value.", "secret_sha256": "1e9b75e7ec12ce5449118d7db8aaa772af69dfaa97b7d2393fa3252538311ce5", "secret_redacted": "Runtime.getRuntime().exec("} {"rule_id": "kotlin-android-webview-javascript-interface", "description": "addJavascriptInterface exposes native methods to page JavaScript, risking RCE from loaded content.", "severity": "high", "file": "examples/sample-app/src/Main.kt", "line": 3, "secret": ".addJavascriptInterface(", "line_excerpt": "webView.addJavascriptInterface(JsBridge(), \"android\") // Android JS bridge (CWE-749)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "Android WebView addJavascriptInterface Exposure", "cwe": "CWE-749", "owasp": "A05:2021 Security Misconfiguration", "remediation": "Avoid the bridge; if required, gate methods with @JavascriptInterface and load only trusted content.", "secure_code": "// prefer WebMessageListener with a fixed allowlisted origin\n", "vulnerable_code": "webView.addJavascriptInterface(JsBridge(), \"android\") // Android JS bridge (CWE-749)", "technical_impact": "Malicious page JS invokes native methods, reaching the app's permissions.", "business_impact": "Device/app compromise and theft of user data via a hostile web page.", "secret_sha256": "1217560a61528c7f8f32cfd303cfee75ab34e5bf6efb9ca91cf802e5c69bd8f5", "secret_redacted": ".addJavascriptInterface("} {"rule_id": "py-command-injection", "description": "Shell command built from dynamic input via os.system/subprocess/os.popen", "severity": "critical", "file": "examples/sample-app/src/app.py", "line": 5, "secret": "os.system(", "line_excerpt": "os.system(\"ping -c 1 \" + host) # command injection (CWE-78)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "OS Command Injection", "cwe": "CWE-78", "owasp": "A03:2021 Injection", "remediation": "Never build a shell string from input. Pass an argument list and avoid shell=True.", "secure_code": "subprocess.run([\"ping\", \"-c\", \"1\", host], shell=False, check=True)\n", "vulnerable_code": "os.system(\"ping -c 1 \" + host) # command injection (CWE-78)", "technical_impact": "Arbitrary command execution as the app user; full host compromise, lateral movement.", "business_impact": "Complete server takeover, data theft, ransomware staging, regulatory breach.", "secret_sha256": "5d8947ebf6201095ef120aaac26bad5301a6a8462bf64e4f77440633b191724d", "secret_redacted": "os.system("} {"rule_id": "py-sql-injection", "description": "SQL string built with %/format/f-string/concatenation instead of parameters", "severity": "high", "file": "examples/sample-app/src/app.py", "line": 6, "secret": ".execute(\"SELECT * FROM users WHERE", "line_excerpt": "cursor.execute(\"SELECT * FROM users WHERE name = '%s'\" % host) # SQL injection (CWE-89)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "SQL Injection", "cwe": "CWE-89", "owasp": "A03:2021 Injection", "remediation": "Use parameterized queries \u2014 pass values as the second argument, never interpolate.", "secure_code": "cursor.execute(\"SELECT * FROM users WHERE id = %s\", (user_id,))\n", "vulnerable_code": "cursor.execute(\"SELECT * FROM users WHERE name = '%s'\" % host) # SQL injection (CWE-89)", "technical_impact": "Read/modify arbitrary DB rows, authentication bypass, possible RCE via stacked queries.", "business_impact": "Mass data breach, account takeover, data integrity loss.", "secret_sha256": "b464307d33565b2bd8138caceb87738f1a8f706098ecf33925c87ddee5456b24", "secret_redacted": ".execute(\"SELECT * FROM users WHERE"} {"rule_id": "py-ssrf", "description": "Outbound HTTP request to a URL derived from user input", "severity": "high", "file": "examples/sample-app/src/app.py", "line": 7, "secret": "requests.get(", "line_excerpt": "requests.get(request.args.get(\"url\"), verify=False) # SSRF + disabled TLS (CWE-918/295)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "Server-Side Request Forgery (SSRF)", "cwe": "CWE-918", "owasp": "A10:2021 Server-Side Request Forgery", "remediation": "Allowlist destination hosts/schemes; block link-local/metadata ranges (169.254.169.254).", "secure_code": "host = urlparse(url).hostname\nif host not in ALLOWED_HOSTS: abort(400)\n", "vulnerable_code": "requests.get(request.args.get(\"url\"), verify=False) # SSRF + disabled TLS (CWE-918/295)", "technical_impact": "Access to internal services, cloud metadata credential theft.", "business_impact": "Cloud account takeover via stolen instance credentials.", "secret_sha256": "87668dec7eb9ebdb2337ad13739b9d14409e3a32a5a7515122a209d238f47df4", "secret_redacted": "requests.get("} {"rule_id": "py-insecure-tls", "description": "TLS verification turned off (verify=False / unverified context)", "severity": "high", "file": "examples/sample-app/src/app.py", "line": 7, "secret": "verify=False", "line_excerpt": "requests.get(request.args.get(\"url\"), verify=False) # SSRF + disabled TLS (CWE-918/295)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "Disabled TLS Certificate Verification", "cwe": "CWE-295", "owasp": "A02:2021 Cryptographic Failures", "remediation": "Leave verification enabled; pin/verify against a trusted CA bundle.", "secure_code": "requests.get(url, verify=True) # or verify=\"/path/ca-bundle.pem\"\n", "vulnerable_code": "requests.get(request.args.get(\"url\"), verify=False) # SSRF + disabled TLS (CWE-918/295)", "technical_impact": "Man-in-the-middle interception of \"encrypted\" traffic.", "business_impact": "Credential/session theft over hostile networks.", "secret_sha256": "f069d11494dad698a0725923ce40995ae00d47a190fef4dbea454faed73dc4a3", "secret_redacted": "verify=False"} {"rule_id": "py-path-traversal", "description": "File path built from request input without normalization", "severity": "high", "file": "examples/sample-app/src/app.py", "line": 8, "secret": "open(", "line_excerpt": "open(\"/data/\" + request.args.get(\"f\")) # path traversal (CWE-22)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "Path Traversal", "cwe": "CWE-22", "owasp": "A01:2021 Broken Access Control", "remediation": "Resolve the real path and confirm it stays within an allowed base dir.", "secure_code": "base = Path(\"/srv/data\").resolve()\ntarget = (base / name).resolve()\nif base not in target.parents: abort(403)\n", "vulnerable_code": "open(\"/data/\" + request.args.get(\"f\")) # path traversal (CWE-22)", "technical_impact": "Read/write arbitrary files (/etc/passwd, source, keys).", "business_impact": "Source/secret disclosure, config tampering.", "secret_sha256": "578dfbac7dcc3893034716e90e1905109261b13471697036411436f6ef6cde63", "secret_redacted": "open("} {"rule_id": "py-weak-hash", "description": "MD5/SHA1 used for security-sensitive hashing", "severity": "medium", "file": "examples/sample-app/src/app.py", "line": 9, "secret": "hashlib.md5(", "line_excerpt": "hashlib.md5(host.encode()) # weak hash (CWE-327)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "Weak Cryptographic Hash", "cwe": "CWE-327", "owasp": "A02:2021 Cryptographic Failures", "remediation": "Use SHA-256+ for integrity; use bcrypt/scrypt/argon2 for passwords.", "secure_code": "hashlib.sha256(data).hexdigest()\nbcrypt.hashpw(pw, bcrypt.gensalt()) # passwords\n", "vulnerable_code": "hashlib.md5(host.encode()) # weak hash (CWE-327)", "technical_impact": "Collision/preimage attacks; fast password cracking.", "business_impact": "Credential compromise, integrity bypass.", "secret_sha256": "acf981814450b1cc32885ac30a26c074e9ab4381f249d2c05c95894bc91bec72", "secret_redacted": "hashlib.md5("} {"rule_id": "react-dangerous-innerhtml", "description": "Raw HTML injected into the DOM via dangerouslySetInnerHTML", "severity": "high", "file": "examples/sample-app/src/Widget.jsx", "line": 3, "secret": "dangerouslySetInnerHTML={{", "line_excerpt": "return
;", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "Cross-Site Scripting (dangerouslySetInnerHTML)", "cwe": "CWE-79", "owasp": "A03:2021 Injection", "remediation": "Render as text, or sanitize with DOMPurify before injecting.", "secure_code": "
\n", "vulnerable_code": "return
;", "technical_impact": "Script execution in the victim's session (XSS).", "business_impact": "Account takeover, session theft, defacement.", "secret_sha256": "4114e8806e8b45c0c40ad004daa185def45f6bd2c7dd46bd47fa1216204c51e7", "secret_redacted": "dangerouslySetInnerHTML={{"} {"rule_id": "web-xss-node-response-taint", "description": "Request query/body/param concatenated into an HTML response body unescaped.", "severity": "high", "file": "examples/sample-app/src/server.js", "line": 3, "secret": "res.send(`

${req.query", "line_excerpt": "res.send(`

${req.query.q}

`); // reflected XSS (CWE-79)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "Reflected XSS via Express response of request input", "cwe": "CWE-79", "owasp": "A03:2021 Injection", "remediation": "Escape user input or render through an auto-escaping template engine.", "secure_code": "res.send(`

${escapeHtml(req.query.q)}

`);\n", "vulnerable_code": "res.send(`

${req.query.q}

`); // reflected XSS (CWE-79)", "technical_impact": "Arbitrary script execution in the victim browser against the application origin.", "business_impact": "Credential and token theft leading to account takeover and reputational damage.", "secret_sha256": "1d9135929f74ce8cdb646dfade391fbfa6478e918c45d123db87080d8fcecc39", "secret_redacted": "res.send(`

${req.query"} {"rule_id": "node-sql-injection", "description": "SQL built with string concatenation / template literals", "severity": "high", "file": "examples/sample-app/src/server.js", "line": 4, "secret": ".query(`SELECT * FROM u WHERE", "line_excerpt": "db.query(`SELECT * FROM u WHERE id = ${req.params.id}`); // SQL injection (CWE-89)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "SQL Injection", "cwe": "CWE-89", "owasp": "A03:2021 Injection", "remediation": "Use parameterized queries / bound placeholders.", "secure_code": "db.query(\"SELECT * FROM users WHERE id = ?\", [userId]);\n", "vulnerable_code": "db.query(`SELECT * FROM u WHERE id = ${req.params.id}`); // SQL injection (CWE-89)", "technical_impact": "Full database read/write, auth bypass.", "business_impact": "Mass data breach and account takeover.", "secret_sha256": "93ea174be270ad700098e79fcaea58cc3262855f2467df5961c319604a9d95e0", "secret_redacted": ".query(`SELECT * FROM u WHERE"} {"rule_id": "node-command-injection", "description": "child_process shell exec built from dynamic input", "severity": "critical", "file": "examples/sample-app/src/server.js", "line": 5, "secret": "exec(", "line_excerpt": "cp.exec('convert ' + req.query.file); // command injection (CWE-78)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "OS Command Injection", "cwe": "CWE-78", "owasp": "A03:2021 Injection", "remediation": "Use execFile/spawn with an argument array and shell:false; never concatenate.", "secure_code": "execFile(\"ping\", [\"-c\", \"1\", host], (e, out) => { ... })\n", "vulnerable_code": "cp.exec('convert ' + req.query.file); // command injection (CWE-78)", "technical_impact": "Arbitrary command execution on the server.", "business_impact": "Full host takeover and data breach.", "secret_sha256": "f02e6334315a717ce81ace60036991d39d517297af4c881c033eaf3275c573c7", "secret_redacted": "exec("} {"rule_id": "node-open-redirect", "description": "Redirect target taken directly from request input", "severity": "medium", "file": "examples/sample-app/src/server.js", "line": 6, "secret": "res.redirect(", "line_excerpt": "res.redirect(req.query.next); // open redirect (CWE-601)", "entropy": 0.0, "verified": null, "source": "sast", "commit": null, "rule_category": "vuln", "name": "Open Redirect", "cwe": "CWE-601", "owasp": "A01:2021 Broken Access Control", "remediation": "Allowlist redirect targets or restrict to same-origin relative paths.", "secure_code": "const dest = SAFE_PATHS.has(req.query.next) ? req.query.next : \"/\";\nres.redirect(dest);\n", "vulnerable_code": "res.redirect(req.query.next); // open redirect (CWE-601)", "technical_impact": "Phishing and OAuth token theft via attacker-controlled redirect.", "business_impact": "Credential/token theft, brand abuse.", "secret_sha256": "e02ea9d3425a8226708eb0119e651bb4f90baa8f362df8809963e36dfa615f75", "secret_redacted": "res.redirect("} {"rule_id": "xml-secret-bearing-tag", "description": "Base64/high-entropy value inside a secret-bearing XML tag (SAML AttributeValue, config , etc.)", "severity": "low", "file": "examples/sample-app/config/services.xml", "line": 4, "secret": "xyz23kdt3uij3430xA9", "line_excerpt": "xyz23kdt3uij3430xA9", "entropy": 3.72, "verified": null, "source": "sast", "commit": null, "rule_category": null, "name": null, "cwe": null, "owasp": null, "remediation": null, "secure_code": null, "vulnerable_code": null, "technical_impact": null, "business_impact": null, "secret_sha256": "d58f98cbd953fc396f6f0eebc83e9c53cd488cd9b2e8c7a06786ccc5937f27f7", "secret_redacted": "xyz2***********0xA9"} {"rule_id": "xml-secret-bearing-tag", "description": "Base64/high-entropy value inside a secret-bearing XML tag (SAML AttributeValue, config , etc.)", "severity": "low", "file": "examples/sample-app/config/services.xml", "line": 8, "secret": "pk7Hs92jLm4nQr8tVw1zXy", "line_excerpt": "pk7Hs92jLm4nQr8tVw1zXy", "entropy": 4.46, "verified": null, "source": "sast", "commit": null, "rule_category": null, "name": null, "cwe": null, "owasp": null, "remediation": null, "secure_code": null, "vulnerable_code": null, "technical_impact": null, "business_impact": null, "secret_sha256": "5b011f3f6a5465abfe04a033da47a147c0b4ff3f425c8e99b8327f0ea21db029", "secret_redacted": "pk7H**************1zXy"}