All 223 Security Rules

These rules detect security patterns in code written with AI tools (Cursor, Bolt, Lovable, Replit) and modern web frameworks (Next.js, Supabase, Clerk, Stripe). They use a two-layer approach: a fast pattern-matching pre-filter plus a Babel-parsed AST layer with taint tracking for data-flow rules (SSRF, prototype pollution, mass assignment, SSTI, and more). The authentication checks work from the endpoint shape rather than the file name, so they cover Next.js App Router routes and server actions, Express and Hono routes, Supabase Edge Functions, Vercel serverless functions, and Netlify functions. Detection quality is scored publicly against a labeled fixture corpus on the benchmark page.

Free plan: 30 core rules (including hardcoded secrets, SQL injection, XSS, missing API authentication and Stripe webhook verification) — marked FREE below. Paid plans unlock the other 193 rules (PRO): command injection, XXE, SSTI, mass assignment, IDOR, GraphQL abuse, AI/LLM prompt-injection patterns, payment security, and 39 vendor-specific API-key detectors. From $19/mo →

Note: XploitScan is not a replacement for professional security auditing. Pattern-based scanning cannot catch every vulnerability, especially logic flaws and business-logic issues. For production applications handling sensitive data, we recommend combining automated scanning with penetration testing and manual code review.