Check catalog
158 checks. Every one explained.
Each check has a permanent ID, the attack it models, why it matters and how to fix it.
158 checks
- ERT-RECON-001Tech fingerprintPassiveInfo
- ERT-RECON-002Crawl & route mapPassiveInfo
- ERT-RECON-003JavaScript bundle harvestPassiveInfo
- ERT-RECON-004API endpoint extraction from bundlesPassiveInfo
- ERT-RECON-005Subdomain enumerationPassiveInfo
- ERT-SECRETS-001Server secret in client JavaScriptPassiveCritical
- ERT-SECRETS-002Supabase service_role key in clientPassiveCritical
- ERT-SECRETS-003Supabase anon key presentPassiveInfo
- ERT-SECRETS-004.env file publicly downloadablePassiveCritical
- ERT-SECRETS-005.git directory exposedPassiveCritical
- ERT-SECRETS-006Public source maps in productionPassiveMedium
- ERT-SECRETS-007Backup or dump file reachablePassiveHigh
- ERT-SECRETS-008Secrets in repository working treeCodeCritical
- ERT-SECRETS-009Secrets in git historyCodeHigh
- ERT-SECRETS-010Public env variable holding a secretCodeHigh
- ERT-SECRETS-011.env missing from .gitignoreCodeMedium
- ERT-SECRETS-012Hardcoded or weak JWT/session secretCodeHigh
- ERT-BAAS-001Supabase table readable by anonymous usersPassiveCritical
- ERT-BAAS-002Supabase table writable by anonymous usersWriteCritical
- ERT-BAAS-003Supabase INSERT allowed for anonymous usersWriteHigh
- ERT-BAAS-004Supabase DELETE allowed for anonymous usersBackend configCritical
- ERT-BAAS-005Cross-user data access through SupabaseAuthenticatedCritical
- ERT-BAAS-006RLS disabled or permissive policiesBackend configCritical
- ERT-BAAS-007SECURITY DEFINER functions callable via RPCBackend configHigh
- ERT-BAAS-008Supabase Storage bucket public or listablePassiveHigh
- ERT-BAAS-009Supabase Auth email confirmation disabledBackend configHigh
- ERT-BAAS-010Open signup on an invite-only appPassiveMedium
- ERT-BAAS-011Supabase Security Advisor findingsBackend configMedium
- ERT-BAAS-012PostgREST schema exposed to anonymous usersPassiveLow
- ERT-BAAS-013Firestore collection readable without authPassiveCritical
- ERT-BAAS-014Firebase Realtime Database readablePassiveCritical
- ERT-BAAS-015Firebase Storage listablePassiveHigh
- ERT-BAAS-016Firebase data writable without authWriteCritical
- ERT-BAAS-017Firebase rules allow all or expired test modeCodeCritical
- ERT-BAAS-018Other BaaS public collectionsPassiveHigh
- ERT-ACCESS-001Unauthenticated access to authenticated API routesAuthenticatedCritical
- ERT-ACCESS-002IDOR: users can access other users' objectsAuthenticatedCritical
- ERT-ACCESS-003Vertical privilege escalationAuthenticatedCritical
- ERT-ACCESS-004Mass assignment of privileged fieldsWriteCritical
- ERT-ACCESS-005Admin route reachable without authPassiveHigh
- ERT-ACCESS-006Client-side-only route guardPassiveHigh
- ERT-ACCESS-007API over-fetching sensitive fieldsAuthenticatedHigh
- ERT-ACCESS-008CORS reflects any origin with credentialsPassiveHigh
- ERT-ACCESS-009GraphQL introspection enabled in productionPassiveMedium
- ERT-ACCESS-010Next.js middleware auth bypass (CVE-2025-29927)ActiveCritical
- ERT-ACCESS-011Unprotected preview deploymentsPassiveMedium
- ERT-ACCESS-012Private pages indexablePassiveLow
- ERT-AUTH-001No rate limit on loginActiveHigh
- ERT-AUTH-002No rate limit on signup/reset emailsActiveMedium
- ERT-AUTH-003User enumeration via login or resetActiveLow
- ERT-AUTH-004Session cookie missing security flagsAuthenticatedMedium
- ERT-AUTH-005Auth tokens stored in localStorageAuthenticatedMedium
- ERT-AUTH-006Session not invalidated on logoutAuthenticatedMedium
- ERT-AUTH-007Password reset token reusable or long-livedActiveHigh
- ERT-AUTH-008JWT weaknesses (alg:none, weak secret, no exp)ActiveCritical
- ERT-AUTH-009OAuth redirect / next= open redirectActiveHigh
- ERT-AUTH-010Weak password policyActiveLow
- ERT-AUTH-011No MFA option for admin accountsAuthenticatedLow
- ERT-AUTH-012No bot protection on public formsPassiveLow
- ERT-INJECT-001SQL injectionActiveCritical
- ERT-INJECT-002Reflected XSSActiveHigh
- ERT-INJECT-003Stored XSSWriteHigh
- ERT-INJECT-004DOM XSS sinks fed from the URLActiveHigh
- ERT-INJECT-005NoSQL injectionActiveCritical
- ERT-INJECT-006Server-side template injectionActiveCritical
- ERT-INJECT-007OS command injectionActiveCritical
- ERT-INJECT-008Path traversal / local file readActiveHigh
- ERT-INJECT-009Server-side request forgery (SSRF)ActiveCritical
- ERT-INJECT-010Open redirectActiveMedium
- ERT-INJECT-011CRLF / header injectionActiveMedium
- ERT-INJECT-012Unrestricted file uploadWriteHigh
- ERT-INJECT-013Prototype pollutionActiveMedium
- ERT-CONFIG-001Missing or weak Content-Security-PolicyPassiveMedium
- ERT-CONFIG-002Missing HSTSPassiveMedium
- ERT-CONFIG-003Clickjacking protection missingPassiveMedium
- ERT-CONFIG-004Missing X-Content-Type-OptionsPassiveLow
- ERT-CONFIG-005Missing Referrer-PolicyPassiveLow
- ERT-CONFIG-006Missing Permissions-PolicyPassiveLow
- ERT-CONFIG-007TLS certificate or protocol weaknessPassiveHigh
- ERT-CONFIG-008HTTP not redirected to HTTPSPassiveMedium
- ERT-CONFIG-009Verbose errors or debug modePassiveMedium
- ERT-CONFIG-010Directory listing enabledPassiveMedium
- ERT-CONFIG-011Server or framework version disclosedPassiveLow
- ERT-CONFIG-012Exposed internal toolingPassiveHigh
- ERT-CONFIG-013Email spoofing protection weak (SPF/DMARC)PassiveMedium
- ERT-CONFIG-014Subdomain takeoverPassiveHigh
- ERT-CONFIG-015Missing security.txtPassiveInfo
- ERT-CONFIG-016Missing CAA DNS recordPassiveInfo
- ERT-CONFIG-017Cookies without Secure flagPassiveLow
- ERT-CONFIG-018Dockerfile / IaC misconfigurationCodeMedium
- ERT-SUPPLY-001Dependencies with known CVEsCodeHigh
- ERT-SUPPLY-002Vulnerable framework version on the live appPassiveHigh
- ERT-SUPPLY-003Client-side library with known CVEsPassiveMedium
- ERT-SUPPLY-004Hallucinated or slopsquatted packageCodeHigh
- ERT-SUPPLY-005Known-malicious packageCodeCritical
- ERT-SUPPLY-006Install scripts in low-reputation dependencyCodeMedium
- ERT-SUPPLY-007Third-party scripts without integrityPassiveLow
- ERT-SUPPLY-008No lockfile committedCodeMedium
- ERT-SUPPLY-009No automated dependency updatesCodeLow
- ERT-SUPPLY-010Unsafe GitHub Actions workflowsCodeHigh
- ERT-CRYPTO-001Weak password hashingCodeCritical
- ERT-CRYPTO-002Math.random() used for tokensCodeMedium
- ERT-CRYPTO-003Sensitive data in URLsPassiveMedium
- ERT-CRYPTO-004PII or secrets written to logsCodeMedium
- ERT-CRYPTO-005Sensitive columns not encryptedCodeLow
- ERT-INTEGRITY-001Webhook without signature verificationCodeHigh
- ERT-INTEGRITY-002Webhook replay not preventedCodeMedium
- ERT-INTEGRITY-003Payment amount trusted from clientCodeCritical
- ERT-INTEGRITY-004Fail-open auth checksCodeHigh
- ERT-INTEGRITY-005Unhandled errors on malformed inputActiveMedium
- ERT-INTEGRITY-006eval or insecure deserialization of inputCodeCritical
- ERT-LOGGING-001No server-side error monitoringCodeInfo
- ERT-LOGGING-002No audit trail for admin actionsCodeLow
- ERT-LOGGING-003Auth failures not loggedCodeLow
- ERT-ABUSE-001Unprotected AI endpointActiveHigh
- ERT-ABUSE-002No rate limit on expensive endpointsActiveMedium
- ERT-ABUSE-003Public form without spam protectionPassiveLow
- ERT-ABUSE-004SMS/email endpoint accepts any recipientActiveHigh
- ERT-ABUSE-005Missing request body size limitActiveLow
- ERT-LLM-001Direct prompt injectionActiveHigh
- ERT-LLM-002System prompt leakageActiveMedium
- ERT-LLM-003AI discloses other users' dataAuthenticatedCritical
- ERT-LLM-004Excessive agencyActiveCritical
- ERT-LLM-005Improper AI output handlingActiveHigh
- ERT-LLM-006Unbounded AI consumptionActiveHigh
- ERT-LLM-007Indirect prompt injectionWriteHigh
- ERT-LLM-008Client-side model calls with exposed provider keyPassiveCritical
- ERT-LLM-009Client controls model or providerActiveMedium
- ERT-PRIVACY-001PII discoverable without loginPassiveHigh
- ERT-PRIVACY-002Private data indexed by search enginesPassiveMedium
- ERT-PRIVACY-003Undisclosed third-party data sharingPassiveMedium
- ERT-PRIVACY-004Session replay on sensitive pagesPassiveHigh
- ERT-PRIVACY-005User uploads at public, guessable URLsPassiveHigh
- ERT-LIAB-001Privacy policy missing or unreachablePassiveHigh
- ERT-LIAB-002Privacy policy doesn't name detected vendorsPassiveMedium
- ERT-LIAB-003Terms of service missingPassiveMedium
- ERT-LIAB-004Browsewrap signup (no clickwrap)PassiveMedium
- ERT-LIAB-005Tracking before consentPassiveHigh
- ERT-LIAB-006No equal 'Reject all' optionPassiveHigh
- ERT-LIAB-007Global Privacy Control ignoredPassiveHigh
- ERT-LIAB-008Ad pixels without 'Your Privacy Choices' linkPassiveMedium
- ERT-LIAB-009Accessibility failures (WCAG 2.2 AA)PassiveHigh
- ERT-LIAB-010Accessibility overlay widget installedPassiveMedium
- ERT-LIAB-011Accessibility statement missingPassiveLow
- ERT-LIAB-012Testimonials look like placeholdersPassiveMedium
- ERT-LIAB-013Fake scarcity or urgencyPassiveMedium
- ERT-LIAB-014Subscription disclosures missing at checkoutPassiveHigh
- ERT-LIAB-015Cancel path harder than signupAuthenticatedHigh
- ERT-LIAB-016AI chatbot without AI disclosureActiveMedium
- ERT-LIAB-017AI chat lacks crisis handlingActiveHigh
- ERT-LIAB-018Phone field without TCPA consent languagePassiveMedium
- ERT-LIAB-019No business contact info on sitePassiveLow
- ERT-LIAB-020User uploads with no DMCA/copyright pagePassiveLow
- ERT-LIAB-021Copyleft licenses in a closed-source SaaSCodeMedium
- ERT-LIAB-022Kids signals without an age gatePassiveMedium
- ERT-LIAB-023Health-data pages with ad pixelsPassiveHigh
- ERT-LIAB-024Unsupported security or compliance claimsPassiveMedium
- ERT-LIAB-025Email signup without privacy noticePassiveLow
