Check catalog
158 checks. Every one explained.
Each check has a permanent ID, the attack it models, why it matters and how to fix it.
12 checks
- ERT-ACCESS-001Unauthenticated access to authenticated API routesAuthenticatedCritical
- ERT-ACCESS-002IDOR: users can access other users' objectsAuthenticatedCritical
- ERT-ACCESS-003Vertical privilege escalationAuthenticatedCritical
- ERT-ACCESS-004Mass assignment of privileged fieldsWriteCritical
- ERT-ACCESS-005Admin route reachable without authPassiveHigh
- ERT-ACCESS-006Client-side-only route guardPassiveHigh
- ERT-ACCESS-007API over-fetching sensitive fieldsAuthenticatedHigh
- ERT-ACCESS-008CORS reflects any origin with credentialsPassiveHigh
- ERT-ACCESS-009GraphQL introspection enabled in productionPassiveMedium
- ERT-ACCESS-010Next.js middleware auth bypass (CVE-2025-29927)ActiveCritical
- ERT-ACCESS-011Unprotected preview deploymentsPassiveMedium
- ERT-ACCESS-012Private pages indexablePassiveLow
