All 210 Security Rules

Every rule XploitScan uses, organized by OWASP Top 10 category. Each rule maps to CWE, SOC 2, and ISO 27001 controls.

About our rule set

These rules detect security patterns specific to AI-generated code (Cursor, Bolt, Lovable, Replit) and modern web frameworks (Next.js, Supabase, Clerk, Stripe). They use a two-layer approach: a fast pattern-matching pre-filter plus a Babel-parsed AST layer with taint tracking for data-flow rules (SSRF, prototype pollution, mass assignment, SSTI, and more). Detection quality is scored publicly against a labeled fixture corpus on the benchmark page.

Free plan: 30 core rules covering the most common vulnerabilities. Pro plan: all 210 rules including framework-specific patterns, payment security, and IDE/mobile code.

Note: XploitScan is not a replacement for professional security auditing. Pattern-based scanning cannot catch every vulnerability, especially logic flaws and business-logic issues. For production applications handling sensitive data, we recommend combining automated scanning with penetration testing and manual code review.

A01:2021 — Broken Access Control

19 rules
RuleDescriptionCWE
VC003Missing auth on API routesCWE-306
VC004Insecure direct object referenceCWE-639
VC005Missing CSRF protectionCWE-352
VC010Missing authorization checksCWE-862
VC013Path traversalCWE-22
VC023Open redirectCWE-601
VC029Missing access control on file operationsCWE-732
VC041Insecure redirect handlingCWE-601
VC042Missing role-based access controlCWE-285
VC057Missing least privilege enforcementCWE-250
VC070Insecure file permissionsCWE-732
VC085Missing privilege escalation protectionCWE-269
VC117Path traversalCWE-22
VC127Insecure HTTP methodsCWE-862
VC158IDOR / missing ownership checkCWE-639
VC201AI/RAG: vector-store query without user/tenant filterCWE-639
VC202AI/RAG: vector-store upsert without user/tenant metadataCWE-639
VC206GraphQL: Apollo Server with csrfPrevention: falseCWE-352
VC210Auth middleware matcher excludes API routesCWE-862

A02:2021 — Cryptographic Failures

28 rules
RuleDescriptionCWE
VC001Hardcoded secretsCWE-798
VC002Hardcoded passwordsCWE-259
VC014Sensitive data in source codeCWE-200
VC031Weak cryptographic algorithmCWE-327
VC032HTTP used instead of HTTPSCWE-319
VC034Hardcoded encryption keysCWE-321
VC035Insecure random number generationCWE-338
VC043Insecure password storageCWE-916
VC049Insecure API key handlingCWE-798
VC050Missing data encryption at restCWE-311
VC058Hardcoded database credentialsCWE-798
VC060Insecure TLS configurationCWE-326
VC061Missing certificate validationCWE-295
VC078Insecure secrets managementCWE-798
VC079Missing encryption in transitCWE-319
VC086Insecure data storageCWE-922
VC087Missing data maskingCWE-200
VC096Insecure local storage usageCWE-922
VC107Missing data encryption for PIICWE-311
VC119Hardcoded OAuth client secretCWE-798
VC122Deprecated TLS versionCWE-326
VC123Weak RSA key sizeCWE-326
VC124ECB mode encryptionCWE-327
VC126Terraform state exposedCWE-200
VC129Unencrypted PII in databaseCWE-312
VC191Python: requests called with verify=False (TLS disabled)CWE-295
VC195Python: paramiko AutoAddPolicy (accepts unknown SSH host keys)CWE-295
VC197Python: PyJWT decode without algorithm allowlistCWE-347

A03:2021 — Injection

19 rules
RuleDescriptionCWE
VC006SQL injectionCWE-89
VC007XSS vulnerabilityCWE-79
VC012Missing input sanitizationCWE-20
VC015Command injectionCWE-78
VC016Prototype pollutionCWE-1321
VC030eval() usageCWE-95
VC080Insecure database queriesCWE-89
VC100Insecure XML processingCWE-611
VC101Missing input encodingCWE-116
VC106Insecure PDF generationCWE-918
VC116Insecure AI/LLM integrationCWE-74
VC154Missing request body validationCWE-20
VC186GitHub Actions: expression injection in run blockCWE-78
VC192Python: Jinja2 Environment with autoescape=FalseCWE-79
VC194Python: Django mark_safe() with non-literal inputCWE-79
VC198AI/LLM: user input concatenated into model message contentCWE-94
VC199AI/LLM: system prompt constructed with non-literal contentCWE-94
VC200AI/LLM: model output rendered as raw HTML (XSS via model)CWE-79
VC207AI/LLM: model output passed to a code, command, query, or file sinkCWE-94

A04:2021 — Insecure Design

25 rules
RuleDescriptionCWE
VC008Missing rate limitingCWE-770
VC028Insecure file uploadCWE-434
VC036Missing input length validationCWE-20
VC051Insecure WebSocket handlingCWE-1385
VC053Insecure email handlingCWE-200
VC064Insecure GraphQL endpointCWE-200
VC065Missing query depth limitingCWE-400
VC067Missing API versioningCWE-1059
VC069Missing request validationCWE-20
VC074Insecure postMessage usageCWE-345
VC088Insecure cachingCWE-524
VC089Missing data retention policyCWE-212
VC092Insecure service workerCWE-349
VC104Insecure SSR data leakageCWE-200
VC113Missing vulnerability disclosure policyCWE-1059
VC115Missing security training indicatorsCWE-1059
VC130Missing rate limit on authCWE-307
VC155Missing rate limit on AI/LLM callsCWE-770
VC156Missing pagination on list endpointCWE-770
VC190Dockerfile: missing HEALTHCHECK directiveCWE-754
VC193Python: tempfile.mktemp() — TOCTOU raceCWE-377
VC203AI/LLM: model call without max_tokens (denial of wallet)CWE-770
VC204GraphQL: server has no query depth limitCWE-770
VC205GraphQL: server has no query complexity limitCWE-770
VC209Webhook handler without idempotency / replay protectionCWE-799

A05:2021 — Security Misconfiguration

34 rules
RuleDescriptionCWE
VC009CORS misconfigurationCWE-942
VC017Insecure default configurationCWE-1188
VC019Debug mode in productionCWE-489
VC020Information exposure in error messagesCWE-209
VC024Missing content security policyCWE-1021
VC025Insecure cookie flagsCWE-614
VC026Missing security headersCWE-693
VC027Unsafe regular expressionsCWE-1333
VC038Missing timeout configurationCWE-400
VC040Missing helmet/security middlewareCWE-693
VC056Insecure DNS configurationCWE-350
VC059Missing environment separationCWE-489
VC066Insecure GraphQL introspectionCWE-200
VC068Insecure middleware orderingCWE-696
VC072Insecure iframe embeddingCWE-1021
VC073Missing clickjacking protectionCWE-1021
VC076Insecure deployment configurationCWE-16
VC077Missing container securityCWE-250
VC090Insecure backup configurationCWE-530
VC091Missing cross-origin isolationCWE-346
VC093Missing HSTSCWE-523
VC095Missing network segmentationCWE-923
VC097Missing secure flag on cookiesCWE-614
VC099Missing secure headers in API responsesCWE-693
VC102Insecure regexCWE-1333
VC103Missing HTTP method restrictionCWE-749
VC105Missing referrer policyCWE-200
VC108Insecure server configurationCWE-16
VC128HTTP request smugglingCWE-444
VC153Reflected CORS origin with credentialsCWE-942
VC157Exposed database studioCWE-16
VC185GitHub Actions: permissions set to write-allCWE-732
VC188Dockerfile: ADD used for local files instead of COPYCWE-1357
VC196Python: Django ALLOWED_HOSTS contains wildcardCWE-20

A06:2021 — Vulnerable Components

8 rules
RuleDescriptionCWE
VC039Outdated dependenciesCWE-1104
VC048Missing dependency vulnerability checkCWE-1104
VC081Missing malware scanningCWE-509
VC082Insecure third-party scriptsCWE-829
VC083Missing supply chain securityCWE-1104
VC094Insecure dependency pinningCWE-1104
VC114Insecure third-party integrationCWE-829
VC131Known vulnerable dependenciesCWE-1104

A07:2021 — Identification & Auth Failures

55 rules
RuleDescriptionCWE
VC011Insecure session managementCWE-384
VC045JWT misconfigurationCWE-347
VC046Missing token expirationCWE-613
VC047Insecure token storageCWE-922
VC052Missing brute force protectionCWE-307
VC054Missing multi-factor authenticationCWE-308
VC062Weak password policyCWE-521
VC063Missing account lockoutCWE-307
VC084Insecure OAuth implementationCWE-346
VC098Insecure password reset flowCWE-640
VC120Missing OAuth state parameterCWE-352
VC125Insecure password resetCWE-640
VC132Hardcoded Anthropic API keyCWE-798
VC133Hardcoded GitHub PATCWE-798
VC134Hardcoded SendGrid API keyCWE-798
VC135Hardcoded Slack tokenCWE-798
VC136Hardcoded GCP service account keyCWE-798
VC137Hardcoded Shopify access tokenCWE-798
VC138Hardcoded GitLab tokenCWE-798
VC139Hardcoded Twilio API keyCWE-798
VC140Hardcoded Mailgun API keyCWE-798
VC141Hardcoded Datadog API keyCWE-798
VC142Hardcoded Vercel tokenCWE-798
VC143Hardcoded Supabase service role keyCWE-798
VC144Hardcoded Vault tokenCWE-798
VC145Hardcoded Pinecone API keyCWE-798
VC146Secret in URL parameterCWE-598
VC149Secret in client bundle configCWE-798
VC150Secret in HTML attributeCWE-615
VC151Secret in CLI argumentCWE-214
VC159Hardcoded Cohere API keyCWE-798
VC160Hardcoded Replicate API tokenCWE-798
VC161Hardcoded Mistral API keyCWE-798
VC162Hardcoded Together AI API keyCWE-798
VC163Hardcoded Groq API keyCWE-798
VC164Hardcoded Fireworks AI API keyCWE-798
VC165Hardcoded Postmark server tokenCWE-798
VC166Hardcoded Resend API keyCWE-798
VC167Hardcoded Loops API keyCWE-798
VC168Hardcoded Cloudflare API tokenCWE-798
VC169Hardcoded Fastly API tokenCWE-798
VC170Hardcoded Netlify access tokenCWE-798
VC171Hardcoded Railway API tokenCWE-798
VC172Hardcoded Fly.io auth tokenCWE-798
VC173Hardcoded Algolia admin API keyCWE-798
VC174Hardcoded Qdrant API keyCWE-798
VC175Hardcoded Weaviate API keyCWE-798
VC176Hardcoded Linear API keyCWE-798
VC177Hardcoded Notion integration tokenCWE-798
VC178Hardcoded Discord bot tokenCWE-798
VC179Hardcoded Intercom access tokenCWE-798
VC180Hardcoded Sentry auth tokenCWE-798
VC181Hardcoded Better Stack (Logtail) tokenCWE-798
VC182Hardcoded Highlight.io API keyCWE-798
VC183Hardcoded Plivo auth tokenCWE-798

A08:2021 — Software & Data Integrity

10 rules
RuleDescriptionCWE
VC021Insecure deserializationCWE-502
VC055Missing code signingCWE-353
VC071Missing subresource integrityCWE-353
VC075Missing CI/CD security checksCWE-1127
VC112Insecure release managementCWE-1127
VC121Unpinned GitHub ActionsCWE-829
VC152Missing webhook signature verificationCWE-345
VC184GitHub Actions: pull_request_target with checkout of PR headCWE-829
VC187GitHub Actions: secrets passed to third-party actionCWE-829
VC189Dockerfile: RUN with unverified shell pipe (curl|sh)CWE-494

A09:2021 — Security Logging Failures

11 rules
RuleDescriptionCWE
VC018Missing error handlingCWE-755
VC033Missing logging for security eventsCWE-778
VC037Insufficient loggingCWE-223
VC044Missing audit trailCWE-778
VC109Missing security monitoringCWE-778
VC110Insecure log managementCWE-532
VC111Missing intrusion detectionCWE-778
VC118PII in logsCWE-532
VC147Secret logged to consoleCWE-532
VC148Secret in error responseCWE-209
VC208AI/LLM: secret or credential interpolated into a model promptCWE-532

A10:2021 — Server-Side Request Forgery

1 rule
RuleDescriptionCWE
VC022Server-side request forgeryCWE-918

Run these rules against your own code

Free, no signup required. Drag and drop a zip or run npx xploitscan scan .

Scan Your Code →
210 Security Rules for AI-Generated Code | XploitScan