All 212 Security Rules
Every rule XploitScan uses, organized by OWASP Top 10 category. Each rule maps to CWE, SOC 2, and ISO 27001 controls.
About our rule set
These rules detect security patterns specific to AI-generated code (Cursor, Bolt, Lovable, Replit) and modern web frameworks (Next.js, Supabase, Clerk, Stripe). They use a two-layer approach: a fast pattern-matching pre-filter plus a Babel-parsed AST layer with taint tracking for data-flow rules (SSRF, prototype pollution, mass assignment, SSTI, and more). Detection quality is scored publicly against a labeled fixture corpus on the benchmark page.
Free plan: 30 core rules covering the most common vulnerabilities — marked FREE below. Paid plans unlock the other 182 rules (PRO): command injection, XXE, SSTI, mass assignment, IDOR, GraphQL abuse, AI/LLM prompt-injection patterns, payment security, and 50+ vendor API-key detectors. From $9/mo →
Note: XploitScan is not a replacement for professional security auditing. Pattern-based scanning cannot catch every vulnerability, especially logic flaws and business-logic issues. For production applications handling sensitive data, we recommend combining automated scanning with penetration testing and manual code review.
A01:2021 — Broken Access Control
19 rules| Rule | Description | CWE |
|---|---|---|
| VC003FREE | Missing auth on API routes | CWE-306 |
| VC004FREE | Insecure direct object reference | CWE-639 |
| VC005FREE | Missing CSRF protection | CWE-352 |
| VC010FREE | Missing authorization checks | CWE-862 |
| VC013PRO | Path traversal | CWE-22 |
| VC023PRO | Open redirect | CWE-601 |
| VC029PRO | Missing access control on file operations | CWE-732 |
| VC041PRO | Insecure redirect handling | CWE-601 |
| VC042PRO | Missing role-based access control | CWE-285 |
| VC057PRO | Missing least privilege enforcement | CWE-250 |
| VC070PRO | Insecure file permissions | CWE-732 |
| VC085PRO | Missing privilege escalation protection | CWE-269 |
| VC117PRO | Path traversal | CWE-22 |
| VC127PRO | Insecure HTTP methods | CWE-862 |
| VC158PRO | IDOR / missing ownership check | CWE-639 |
| VC201PRO | AI/RAG: vector-store query without user/tenant filter | CWE-639 |
| VC202PRO | AI/RAG: vector-store upsert without user/tenant metadata | CWE-639 |
| VC206PRO | GraphQL: Apollo Server with csrfPrevention: false | CWE-352 |
| VC210PRO | Auth middleware matcher excludes API routes | CWE-862 |
A02:2021 — Cryptographic Failures
30 rulesA03:2021 — Injection
19 rules| Rule | Description | CWE |
|---|---|---|
| VC006FREE | SQL injection | CWE-89 |
| VC007FREE | XSS vulnerability | CWE-79 |
| VC012PRO | Missing input sanitization | CWE-20 |
| VC015FREE | Command injection | CWE-78 |
| VC016FREE | Prototype pollution | CWE-1321 |
| VC030PRO | eval() usage | CWE-95 |
| VC080PRO | Insecure database queries | CWE-89 |
| VC100PRO | Insecure XML processing | CWE-611 |
| VC101PRO | Missing input encoding | CWE-116 |
| VC106PRO | Insecure PDF generation | CWE-918 |
| VC116PRO | Insecure AI/LLM integration | CWE-74 |
| VC154PRO | Missing request body validation | CWE-20 |
| VC186PRO | GitHub Actions: expression injection in run block | CWE-78 |
| VC192PRO | Python: Jinja2 Environment with autoescape=False | CWE-79 |
| VC194PRO | Python: Django mark_safe() with non-literal input | CWE-79 |
| VC198PRO | AI/LLM: user input concatenated into model message content | CWE-94 |
| VC199PRO | AI/LLM: system prompt constructed with non-literal content | CWE-94 |
| VC200PRO | AI/LLM: model output rendered as raw HTML (XSS via model) | CWE-79 |
| VC207PRO | AI/LLM: model output passed to a code, command, query, or file sink | CWE-94 |
A04:2021 — Insecure Design
25 rulesA05:2021 — Security Misconfiguration
34 rulesA06:2021 — Vulnerable Components
8 rules| Rule | Description | CWE |
|---|---|---|
| VC039FREE | Outdated dependencies | CWE-1104 |
| VC048PRO | Missing dependency vulnerability check | CWE-1104 |
| VC081PRO | Missing malware scanning | CWE-509 |
| VC082PRO | Insecure third-party scripts | CWE-829 |
| VC083PRO | Missing supply chain security | CWE-1104 |
| VC094PRO | Insecure dependency pinning | CWE-1104 |
| VC114PRO | Insecure third-party integration | CWE-829 |
| VC131PRO | Known vulnerable dependencies | CWE-1104 |
A07:2021 — Identification & Auth Failures
55 rulesA08:2021 — Software & Data Integrity
10 rules| Rule | Description | CWE |
|---|---|---|
| VC021PRO | Insecure deserialization | CWE-502 |
| VC055PRO | Missing code signing | CWE-353 |
| VC071PRO | Missing subresource integrity | CWE-353 |
| VC075PRO | Missing CI/CD security checks | CWE-1127 |
| VC112PRO | Insecure release management | CWE-1127 |
| VC121PRO | Unpinned GitHub Actions | CWE-829 |
| VC152PRO | Missing webhook signature verification | CWE-345 |
| VC184PRO | GitHub Actions: pull_request_target with checkout of PR head | CWE-829 |
| VC187PRO | GitHub Actions: secrets passed to third-party action | CWE-829 |
| VC189PRO | Dockerfile: RUN with unverified shell pipe (curl|sh) | CWE-494 |
A09:2021 — Security Logging Failures
11 rules| Rule | Description | CWE |
|---|---|---|
| VC018FREE | Missing error handling | CWE-755 |
| VC033FREE | Missing logging for security events | CWE-778 |
| VC037FREE | Insufficient logging | CWE-223 |
| VC044PRO | Missing audit trail | CWE-778 |
| VC109PRO | Missing security monitoring | CWE-778 |
| VC110PRO | Insecure log management | CWE-532 |
| VC111PRO | Missing intrusion detection | CWE-778 |
| VC118PRO | PII in logs | CWE-532 |
| VC147PRO | Secret logged to console | CWE-532 |
| VC148PRO | Secret in error response | CWE-209 |
| VC208PRO | AI/LLM: secret or credential interpolated into a model prompt | CWE-532 |
A10:2021 — Server-Side Request Forgery
1 rule| Rule | Description | CWE |
|---|---|---|
| VC022PRO | Server-side request forgery | CWE-918 |
Run these rules against your own code
Free, no signup required. Drag and drop a zip or run npx xploitscan scan .