Check catalog
158 checks. Every one explained.
Each check has a permanent ID, the attack it models, why it matters and how to fix it.
12 checks
- ERT-AUTH-001No rate limit on loginActiveHigh
- ERT-AUTH-002No rate limit on signup/reset emailsActiveMedium
- ERT-AUTH-003User enumeration via login or resetActiveLow
- ERT-AUTH-004Session cookie missing security flagsAuthenticatedMedium
- ERT-AUTH-005Auth tokens stored in localStorageAuthenticatedMedium
- ERT-AUTH-006Session not invalidated on logoutAuthenticatedMedium
- ERT-AUTH-007Password reset token reusable or long-livedActiveHigh
- ERT-AUTH-008JWT weaknesses (alg:none, weak secret, no exp)ActiveCritical
- ERT-AUTH-009OAuth redirect / next= open redirectActiveHigh
- ERT-AUTH-010Weak password policyActiveLow
- ERT-AUTH-011No MFA option for admin accountsAuthenticatedLow
- ERT-AUTH-012No bot protection on public formsPassiveLow
