Security requirements by language

In this page, you can see the security requirements assessed by Fluid Attacks' static application security testing (SAST) differentiating by the programming language in which the source code is written and by the scanner method that automates the check. To learn about support information, read the articles Supported languages and Supported frameworks.

C#

Scanner method name	Related security requirement verified
CS_ASPNET_ALLOWINSECUREHTTP_TRUE	224. Use secure cryptographic mechanisms
CS_ASPNET_COOKIE_SAMESITE_NONE	062. Define standard configurations 175. Protect pages from clickjacking 266. Disable insecure functionalities 349. Include HTTP security headers
CS_ASPNET_INSECURE_CORS_WITH_WILDCARDS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
CS_ASPN_DIRECTORYBROWSING_ENABLED	176. Restrict system objects 266. Disable insecure functionalities
CS_CERT_VALIDATION_DISABLED	158. Use a secure programming language
CS_CHECK_HASHES_SALT	266. Disable insecure functionalities
CS_COMMAND_INJECTION_VIA_PROCESS_START	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
CS_CONFLICTING_ANNOTATIONS	158. Use a secure programming language
CS_CREATE_TEMP_FILE	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CS_DIR_ENTRY_HARDCODED_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
CS_DIRECTORY_LISTING_EXPOSURE	176. Restrict system objects 266. Disable insecure functionalities
CS_DISABLED_HTTP_HEADER_CHECK	266. Disable insecure functionalities
CS_DISABLED_STRONG_CRYPTO	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_HARDCODED_INIT_VECTOR	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
CS_HARDCODED_SYMMETRIC_KEY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_HAS_PUBLIC_CACHE_HEADER	062. Define standard configurations 177. Avoid caching and temporary files 266. Disable insecure functionalities 349. Include HTTP security headers
CS_HTTP_LISTENER_WILDCARD	266. Disable insecure functionalities
CS_HTTP_ONLY_COOKIE	029. Cookies with security attributes
CS_HTTPCLIENT_NO_REVOCATION_LIST	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_INFO_LEAK_ERRORS	077. Avoid disclosing technical information 176. Restrict system objects
CS_INSECURE_ASSEMBLY_LOAD	040. Compare file format and extension 041. Scan files for malicious code
CS_INSECURE_AUTHENTICATION	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
CS_INSECURE_CBC_IV	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
CS_INSECURE_CERTIFICATE_VALIDATION	266. Disable insecure functionalities
CS_INSECURE_CHANNEL	181. Transmit data using secure protocols
CS_INSECURE_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_INSECURE_COOKIE_SECURE_FLAG_FALSE	029. Cookies with security attributes
CS_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
CS_INSECURE_CORS_HTTPWEBREQUEST	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
CS_INSECURE_CORS_ORIGIN	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
CS_INSECURE_DESERIAL	173. Discard unsafe inputs 321. Avoid deserializing untrusted data
CS_INSECURE_ECB_MODE	148. Set minimum size of asymmetric encryption 150. Set minimum size for hash functions
CS_INSECURE_ELLIPTIC_CURVE	148. Set minimum size of asymmetric encryption 150. Set minimum size for hash functions
CS_INSECURE_HASH	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_INSECURE_KEYS	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_INSECURE_LOGGING	080. Prevent log modification 173. Discard unsafe inputs
CS_INSECURE_RANDOM_KEY_GENERATION	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
CS_INSECURE_SHARED_ACCESS_PROTOCOL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_INSECURE_X509_CERT_2	266. Disable insecure functionalities
CS_INSEC_ADDHEADER_WRITE	029. Cookies with security attributes 173. Discard unsafe inputs
CS_INSEC_COOKIES	029. Cookies with security attributes
CS_INSEC_CREATE	173. Discard unsafe inputs 324. Control redirects
CS_INSEC_DIRECT_WRITE	029. Cookies with security attributes 173. Discard unsafe inputs
CS_INSECURE_FASTJSON_DES	173. Discard unsafe inputs 321. Avoid deserializing untrusted data
CS_INSECURE_FSPICKLER_DES	173. Discard unsafe inputs 321. Avoid deserializing untrusted data
CS_JS_DESERIALIZATION	173. Discard unsafe inputs 321. Avoid deserializing untrusted data
CS_JWT_SIGNED	032. Avoid session ID leakages 181. Transmit data using secure protocols
CS_LDAP_CONN_AUTH	266. Disable insecure functionalities
CS_LDAP_INJECTION	173. Discard unsafe inputs
CS_LOG_INJECTION	080. Prevent log modification 173. Discard unsafe inputs
CS_MANAGED_SECURE_MODE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_MEMORY_MARSHAL_CREATE_SPAN	062. Define standard configurations 266. Disable insecure functionalities
CS_OBSOLETE_KEY_DERIVATION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_OPEN_REDIRECT	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
CS_OVERRIDE_AUTH_MODIFIER	142. Change system default credentials 264. Request authentication 265. Restrict access to critical processes 266. Disable insecure functionalities 319. Make authentication options equally secure
CS_PATH_INJECTION	037. Parameters without sensitive data 320. Avoid client-side control enforcement
CS_REGEX_INJECTION	072. Set maximum response time 327. Set a rate limit
CS_REMOTE_COMMAND_EXECUTION	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
CS_RSA_SECURE_MODE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_SCHEMA_BY_URL	262. Verify third-party components
CS_SERVER_SIDE_TEMPLATE_INJECTION	173. Discard unsafe inputs 176. Restrict system objects 265. Restrict access to critical processes 266. Disable insecure functionalities
CS_SERVICE_POINT_MANAGER_DISABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_SQL_CONN_HARDCODED_SECRET	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information 229. Request access credentials 264. Request authentication 300. Mask sensitive data
CS_SQL_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
CS_SQL_INJECTION_REQUEST	169. Use parameterized queries 173. Discard unsafe inputs
CS_SQL_USER_PARAMS	169. Use parameterized queries 173. Discard unsafe inputs
CS_STACKTRACE_DISCLOSURE	077. Avoid disclosing technical information 176. Restrict system objects
CS_STORED_PASSWORD	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
CS_TRUST_BOUNDARY_VIOLATION_READXML	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
CS_TYPE_NAME_HANDLING	173. Discard unsafe inputs 321. Avoid deserializing untrusted data
CS_UNSAFE_EXCEPTION_HANDLING	161. Define secure default options 266. Disable insecure functionalities 359. Avoid using generic exceptions
CS_UNSAFE_PATH_TRAVERSAL	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
CS_UNSAFE_SQL_STATEMENT	169. Use parameterized queries 173. Discard unsafe inputs
CS_UNSAFE_SERIALIZATION_POINTER_FIELDS	266. Disable insecure functionalities
CS_UNSAFE_TOKEN_VALIDATION_DELEGATE	173. Discard unsafe inputs 320. Avoid client-side control enforcement 357. Use stateless session tokens
CS_UNTRUSTED_DLL_SEARCH_PATH	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
CS_UNTRUSTED_ROOT_CERTIFICATE_ADDITION	266. Disable insecure functionalities
CS_VERIFY_DECODER	032. Avoid session ID leakages 181. Transmit data using secure protocols
CS_VULN_REGEX	072. Set maximum response time 327. Set a rate limit
CS_WEAK_CREDENTIAL	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
CS_WEAK_PROTOCOL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_WEAK_RSA_ENCRYPT_PADDING	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CS_XAML_INJECTION	173. Discard unsafe inputs
CS_XML_SERIAL	173. Discard unsafe inputs 321. Avoid deserializing untrusted data
CS_XPATH_INJECTION	173. Discard unsafe inputs
CS_XPATH_INJECTION_EVALUATE	173. Discard unsafe inputs
CS_XPATH_INJECTION_NODE	173. Discard unsafe inputs
CS_XSL_TRANSFORM_OBJECT	262. Verify third-party components
CS_XXE_RESOLVER	173. Discard unsafe inputs
C_SHARP_ACCEPTS_ANY_MIME_TYPE_CHAIN	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
C_SHARP_PLAIN_TEXT_KEYS	145. Protect system cryptographic keys

CloudFormation

Scanner method name	Related security requirement verified
CFN_ADMIN_POLICY_ATTACHED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_ALLOWS_PRIV_ESCALATION_ATTACH_POLICY	035. Manage privilege modifications
CFN_ALLOWS_PRIV_ESCALATION_BY_POLICIES_VERSIONS	035. Manage privilege modifications
CFN_ANYONE_ADMIN_PORTS	255. Allow access only to the necessary ports
CFN_API_GATEWAY_LOGGING_DISABLED	075. Record exceptional events in logs 079. Record exact occurrence time of events 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
CFN_AWS_EBS_VOLUMES_UNENCRYPTED	185. Encrypt sensitive information 300. Mask sensitive data
CFN_AWS_EFS_UNENCRYPTED	185. Encrypt sensitive information 300. Mask sensitive data
CFN_AWS_ELB_LISTENER_ON_HTTP	181. Transmit data using secure protocols
CFN_AWS_INSECURE_CORS_HEADER	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
CFN_AWS_SAM_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
CFN_AWS_SEC_GROUP_USING_TCP	181. Transmit data using secure protocols
CFN_BUCKET_ALLOWS_PUBLIC	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_BUCKET_HAS_LOGGING_CONF_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
CFN_BUCKET_POLICY_SEC_TRANSPORT	181. Transmit data using secure protocols
CFN_CF_DISTR_LOG_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
CFN_COGNITO_HAS_MFA_DISABLED	229. Request access credentials 231. Implement a biometric verification component 264. Request authentication 319. Make authentication options equally secure 328. Request MFA for critical systems
CFN_CONTENT_HTTP	181. Transmit data using secure protocols
CFN_DYNAMO_NOT_DEL_PROTEC	186. Use the principle of least privilege 265. Restrict access to critical processes
CFN_EC2_ASSOC_PUB_IP	266. Disable insecure functionalities
CFN_EC2_DEFAULT_SEC_GROUP	266. Disable insecure functionalities
CFN_EC2_NOT_TERMINATION_PROTEC	186. Use the principle of least privilege 265. Restrict access to critical processes
CFN_EC2_NO_IAM	266. Disable insecure functionalities
CFN_EC2_OPEN_ALL_PORTS_PUBLIC	255. Allow access only to the necessary ports
CFN_EC2_SEC_GROUPS_RFC1918	255. Allow access only to the necessary ports
CFN_EC2_TERMINATE_SHUTDOWN_BEHAVIOR	266. Disable insecure functionalities
CFN_EC2_UNENCRYPTED_BLOCK_DEVICES	266. Disable insecure functionalities
CFN_EC2_UNENCRYPTED_VOLUMES	266. Disable insecure functionalities
CFN_EC2_UNRESTRICTED_DNS	255. Allow access only to the necessary ports
CFN_EC2_UNRESTRICTED_FTP	255. Allow access only to the necessary ports
CFN_EC2_UNRESTRICTED_PORTS	255. Allow access only to the necessary ports
CFN_EKS_HAS_ENDPOINTS_PUBLICLY_ACCESSIBLE	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_ELASTICACHE_TRANSIT_ENCRYPTION_DISABLED	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_ELASTICACHE_USES_DEFAULT_PORT	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_ELB2_INSECURE_SEC_POLICY	266. Disable insecure functionalities
CFN_ELB2_INSEC_PROTO	181. Transmit data using secure protocols
CFN_ELB2_LOGS_S3_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
CFN_ELB2_NOT_DELETION_PROTEC	186. Use the principle of least privilege 265. Restrict access to critical processes
CFN_ELB2_USES_INSECURE_PROTOCOL	181. Transmit data using secure protocols
CFN_ELB_ACCESS_LOG_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
CFN_ELB_WITHOUT_SSLPOLICY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CFN_GROUPS_WITHOUT_EGRESS	255. Allow access only to the necessary ports
CFN_HTTP_METHODS_ENABLED	266. Disable insecure functionalities
CFN_IAM_EXCESSIVE_PRIVILEGES	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_IAM_EXCESSIVE_ROLE_POLICY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_IAM_FULL_ACCESS_SSM	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_IAM_MISSING_SECURITY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_IAM_PERMISSIONS_POLICY_NOT_ACTION	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_IAM_PERMISSIONS_POLICY_NOT_RESOURCE	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_IAM_PERMISSIONS_POLICY_WILDCARD_ACTIONS	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_IAM_PERMISSIONS_POLICY_WILDCARD_RESOURCES	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_IAM_POLICY_APPLY_TO_USERS	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_IAM_TRUST_POLICY_NOT_ACTION	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_IAM_TRUST_POLICY_NOT_PRINCIPAL	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_IAM_TRUST_POLICY_WILDCARD_ACTION	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_IAM_WILDCARD_WRITE	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_INSECURE_CERTIFICATE	266. Disable insecure functionalities
CFN_INSEC_GEN_SECRET	130. Limit password lifespan 132. Passphrases with at least 4 words 133. Passwords with at least 20 characters 139. Set minimum OTP length 332. Prevent the use of breached passwords
CFN_INSEC_PROTO	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CFN_INST_WITHOUT_PROFILE	255. Allow access only to the necessary ports
CFN_KMS_KEY_ROTATION_DISABLED	266. Disable insecure functionalities
CFN_KMS_MASTER_KEYS_EXPOSED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_LOG_CONF_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
CFN_LOG_NOT_VALIDATED	080. Prevent log modification
CFN_NEGATIVE_STATEMENT	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_NOT_POINT_TIME_RECOVERY	186. Use the principle of least privilege 265. Restrict access to critical processes
CFN_PERMISSIVE_POLICY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_POLICY_SERVER_ENCRYP_DISABLED	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information 227. Display access notification 229. Request access credentials 264. Request authentication 300. Mask sensitive data
CFN_RDS_NOT_AUTO_BACKUPS	186. Use the principle of least privilege 265. Restrict access to critical processes
CFN_RDS_NOT_INSIDE_DB_SUBNET	255. Allow access only to the necessary ports
CFN_RDS_NOT_TERMINATION_PROTECTION	186. Use the principle of least privilege 265. Restrict access to critical processes
CFN_RDS_NOT_USES_IAM_AUTHENTICATION	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_RDS_PUB_ACCESSIBLE	096. Set user's required privileges 176. Restrict system objects 265. Restrict access to critical processes
CFN_RDS_UNENCRYPTED_STORAGE	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information 229. Request access credentials 264. Request authentication 300. Mask sensitive data
CFN_REDSHIFT_HAS_AUDIT_LOGS_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
CFN_REDSHIFT_HAS_ENCRYPTION_DISABLED	185. Encrypt sensitive information 300. Mask sensitive data
CFN_REDSHIFT_HAS_PUBLIC_CLUSTERS	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_REDSHIFT_HAS_USER_ACTIVITY_LOG_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
CFN_REDSHIFT_NOT_REQUIRES_SSL	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_S3_BUCKETS_ALLOW_UNAUTHORIZED_PUBLIC_ACCESS	096. Set user's required privileges 176. Restrict system objects 264. Request authentication 320. Avoid client-side control enforcement
CFN_S3_VERSIONING_DISABLED	266. Disable insecure functionalities
CFN_SERVER_SSL_DISABLED	181. Transmit data using secure protocols
CFN_SERVES_CONTENT_OVER_INSECURE_PROTOCOLS	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
CFN_SNS_IS_SERVER_SIDE_ENCRYPTION_DISABLED	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_SQS_IS_ENCRYPTION_DISABLED	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
CFN_SQS_IS_PUBLIC	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CFN_TRAILS_NOT_MULTIREGION	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
CFN_UNRESTRICTED_CIDRS	255. Allow access only to the necessary ports
CFN_UNRESTRICTED_IP_PROTO	255. Allow access only to the necessary ports
CFN_UNSAFE_CERTIFICATE	266. Disable insecure functionalities
CFN_WILDCARD_IN_ALLOWED_ORIGINS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
CFN_YAML_SPRING_INSECURE_CORS_WILDCARD	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
YML_SERVERLESS_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers

Configuration files

Scanner method name	Related security requirement verified
CONF_FILES_CREDENTIALS_EXPOSED_IN_CODE	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
HELM_INSECURE_INGRESS_EGRESS	255. Allow access only to the necessary ports
JMX_HEADER_BASIC	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
JSON_ALLOWED_HOSTS	266. Disable insecure functionalities
JSON_ANON_CONNECTION_CONFIG	142. Change system default credentials 264. Request authentication 265. Restrict access to critical processes 266. Disable insecure functionalities 319. Make authentication options equally secure
JSON_API_MGMT_BACK_MINIMUM_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JSON_API_MGMT_FRONT_MINIMUM_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JSON_DB_CREDENTIALS_EXPOSED_IN_CODE	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JSON_DISABLE_HOST_CHECK	266. Disable insecure functionalities
JSON_HTTPS_FLAG_MISSING	181. Transmit data using secure protocols
JSON_PRINCIPAL_WILDCARD	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
JSON_SSL_PORT_MISSING	185. Encrypt sensitive information 266. Disable insecure functionalities
JWT_TOKEN	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
NGINX_INSECURE_CORS_HEADER	062. Define standard configurations 175. Protect pages from clickjacking 266. Disable insecure functionalities 349. Include HTTP security headers
NGINX_INSECURE_CSP_INLINE_SCRIPT	062. Define standard configurations 117. Do not interpret HTML code 175. Protect pages from clickjacking 349. Include HTTP security headers
NGINX_INSECURE_SSL_PROTOCOLS	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
PACKAGEJSON_NODEJS_GIT_CREDENTIALS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
SONAR_CREDENTIALS_EXPOSED	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
SENSITIVE_INFO_DOTNET_JSON	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
SENSITIVE_INFO_JSON	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
SENSITIVE_KEY_JSON	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
TSCONFIG_SOURCEMAP_ENABLED	077. Avoid disclosing technical information 176. Restrict system objects
WEB_DB_CONN	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
WEB_USER_PASS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
XML_ACCEPT_HEADER	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
XML_ALLOWS_ALL_DOMAINS	266. Disable insecure functionalities
XML_BASIC_AUTH_METHOD	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
XML_HAS_X_XSS_PROTECTION_HEADER	062. Define standard configurations 175. Protect pages from clickjacking 266. Disable insecure functionalities 349. Include HTTP security headers
XML_HEADER_ALLOW_ALL_METHODS	266. Disable insecure functionalities
XML_HEADER_ALLOW_DANGER_METHODS	266. Disable insecure functionalities
XML_INSECURE_CONFIGURATION	130. Limit password lifespan 138. Define lifespan for temporary passwords 140. Define OTP lifespan
XML_NETWORK_SSL_DISABLED	181. Transmit data using secure protocols
XML_X_FRAME_OPTIONS	062. Define standard configurations 175. Protect pages from clickjacking 266. Disable insecure functionalities 349. Include HTTP security headers
YAML_INSECURE_CHMOD_OTHER_WRITE_EXECUTE	033. Restrict administrative access 176. Restrict system objects 265. Restrict access to critical processes 280. Restrict service root directory

Dart

Scanner method name	Related security requirement verified
DART_INSECURE_LOGGING	080. Prevent log modification 173. Discard unsafe inputs
DART_SALT_IS_HARDCODED	266. Disable insecure functionalities
DART_SHELF_INSECURE_CORS_HEADER	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers

Docker

Scanner method name	Related security requirement verified
CONTAINER_DISABLED_SSL	181. Transmit data using secure protocols
CONTAINER_USING_SSHPASS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
CONTAINER_WITHOUT_USER	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
CONTAINER_WITH_USER_ROOT	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
DOCKER_CURL_NO_CHECKSUM	266. Disable insecure functionalities
DOCKER_DEBUGGING_ENABLED	077. Avoid disclosing technical information 078. Disable debugging events
DOCKER_DOWNGRADE_PROTOCOL	181. Transmit data using secure protocols
DOCKER_ENV_SECRETS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
DOCKER_HARDCODED_CREDENTIALS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
DOCKER_INSECURE_BUILDER_SANDBOX	266. Disable insecure functionalities
DOCKER_INSECURE_CLEARTEXT_PROTOCOL	266. Disable insecure functionalities
DOCKER_INSECURE_CONTEXT_DIRECTORY	266. Disable insecure functionalities
DOCKER_INSECURE_NETWORK_HOST	266. Disable insecure functionalities
DOCKER_PORT_EXPOSED	181. Transmit data using secure protocols
DOCKER_SENSITIVE_MOUNT	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
DOCKER_SOCKET_MOUNT	266. Disable insecure functionalities
DOCKER_USING_ADD_COMMAND	266. Disable insecure functionalities
DOCKER_WEAK_HASH_ALGORITHM	266. Disable insecure functionalities
DOCKER_WEAK_SSL_TLS	266. Disable insecure functionalities
DOCKER_WGET_NO_CHECKSUM	266. Disable insecure functionalities
DOCKERFILE_HARDCODED_CREDENTIALS_CHPASSWD	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
UNPINNED_DOCKER_IMAGE	266. Disable insecure functionalities

Docker Compose

Scanner method name	Related security requirement verified
DOCKER_COMPOSE_ENV_SECRETS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
DOCKER_COMPOSE_IMAGE_HAS_DIGEST	266. Disable insecure functionalities
DOCKER_COMPOSE_READ_ONLY	266. Disable insecure functionalities
DOCKER_COMPOSE_SSH_PASS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities

Go

Scanner method name	Related security requirement verified
GO_ACCEPTS_ANY_MIME_TYPE	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
GO_GIN_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
GO_GIN_INSECURE_CORS_HEADER	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
GO_HARDCODED_SYMMETRIC_KEY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
GO_INSECURE_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
GO_INSECURE_HASH	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
GO_INSECURE_QUERY	169. Use parameterized queries 173. Discard unsafe inputs
GO_SALT_IS_HARDCODED	266. Disable insecure functionalities

HTML

Scanner method name	Related security requirement verified
HTML_HAS_AUTOCOMPLETE	177. Avoid caching and temporary files
HTML_HAS_NOT_SUB_RESOURCE_INTEGRITY	178. Use digital signatures 262. Verify third-party components 330. Verify Subresource Integrity
HTML_HAS_REVERSE_TABNABBING	173. Discard unsafe inputs 324. Control redirects

Java

Machine method name	Related security requirement verified
GRADLE_CREDENTIALS_PASSWORD_HARDCODED	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
GRADLE_MISSING_CHECKSUM_VERIFICATION	266. Disable insecure functionalities
JAVA_ACCEPTS_ANY_MIME_TYPE_CHAIN	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVA_ACCEPTS_ANY_MIME_TYPE_OBJ	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVA_ALLOWED_EXTERNAL_ENTITIES	173. Discard unsafe inputs
JAVA_ANONYMOUS_LDAP_BIND	266. Disable insecure functionalities
JAVA_BASIC_AUTHENTICATION	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
JAVA_COOKIE_MISSING_SECURE	029. Cookies with security attributes
JAVA_COOKIE_SERIALIZER_SECURE_FALSE	029. Cookies with security attributes
JAVA_CREATE_TEMP_FILE	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
JAVA_CREDENTIALS_EXPOSED_IN_CODE	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_CSRF_HANDLER_HARDCODED_PASSWORD	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_CSRF_PROTECTIONS_DISABLED	029. Cookies with security attributes 174. Transactions without a distinguishable pattern
JAVA_DANGEROUS_PERMISSION_COMBINATION	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
JAVA_DATANUCLEUS_HARDCODED_CONNECT_PASSWORD	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_DATASOURCE_NO_ENCRYPTION_PROPERTIES	181. Transmit data using secure protocols
JAVA_DECLARE_INSECURE_TRUST_MANAGER	088. Request client certificates 089. Limit validity of certificates 090. Use valid certificates 091. Use internally signed certificates 092. Use externally signed certificates 093. Use consistent certificates
JAVA_DRIVERMANAGER_HARDCODED_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_HARDCODED_AUTH0_JWT_SIGN_KEY	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_HARDCODED_INIT_VECTOR	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
JAVA_HARDCODED_INIT_VECTOR_BASE64	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
JAVA_HARDCODED_JWT_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_HOST_KEY_CHECKING	255. Allow access only to the necessary ports
JAVA_HOSTNAME_VERIFICATION_OFF	088. Request client certificates 089. Limit validity of certificates 090. Use valid certificates 091. Use internally signed certificates 092. Use externally signed certificates 093. Use consistent certificates
JAVA_HTTP_ONLY_COOKIE	029. Cookies with security attributes
JAVA_HTTP_REQ_ACCEPTS_ANY_MIMETYPE	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVA_IGNORE_SSL_CERTIFICATE_ERRORS	088. Request client certificates 089. Limit validity of certificates 090. Use valid certificates 091. Use internally signed certificates 092. Use externally signed certificates 093. Use consistent certificates
JAVA_INSECURE_AUTHENTICATION	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
JAVA_INSECURE_CHANNEL	181. Transmit data using secure protocols
JAVA_INSECURE_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_CIPHER_JMQI	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_CIPHER_MODE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_HTTP_COMPONENTS	181. Transmit data using secure protocols
JAVA_INSECURE_HTTP_OPEN_CONNECTION	181. Transmit data using secure protocols
JAVA_INSECURE_SPRING_HTTP_REQUEST	181. Transmit data using secure protocols
JAVA_INSECURE_HTTP_COMPONENTS	181. Transmit data using secure protocols
JAVA_INSECURE_SSLCONTEXT_TLS	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_CIPHER_SSL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_CONNECTION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_CORS_ORIGIN	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVA_INSECURE_CORS_WEB_VIEW	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVA_INSECURE_CSP_INLINE_SCRIPT	062. Define standard configurations 117. Do not interpret HTML code 175. Protect pages from clickjacking 349. Include HTTP security headers
JAVA_INSECURE_ENGINE_CIPHER_SSL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_FTP_CLIENT	181. Transmit data using secure protocols
JAVA_INSECURE_FTP_SESSION_FACTORY	181. Transmit data using secure protocols
JAVA_INSECURE_FTP_URL	181. Transmit data using secure protocols
JAVA_INSECURE_HASH	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_KEY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_KEY_EC	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_KEY_RSA	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_KEY_SECRET	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_PASS	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_SMTP_CONNECTION	181. Transmit data using secure protocols
JAVA_INSECURE_SMTP_SSL	181. Transmit data using secure protocols
JAVA_INSECURE_TRUST_MANAGER	088. Request client certificates 089. Limit validity of certificates 090. Use valid certificates 091. Use internally signed certificates 092. Use externally signed certificates 093. Use consistent certificates
JAVA_INSEC_SIGN_ALGORITHM	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_JAX_RS_PATH_TRAVERSAL	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
JAVA_JEDIS_HARDCODED_CREDENTIALS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_JEDIS_HARDCODED_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_JEDIS_HARDCODED_SECRET_AUTH	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_JPA_LIKE	169. Use parameterized queries 173. Discard unsafe inputs
JAVA_JSCH_HARDCODED_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_JSCH_STRICTHOSTKEYCHECKING_DISABLED	266. Disable insecure functionalities
JAVA_JWT_UNSAFE_DECODE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_JWT_WITHOUT_PROPER_SIGN	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_KEY_MANAGER_FACTORY_HARDCODED_PASSWORDS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_KEYSTORE_HARDCODED_PASSWORDS	266. Disable insecure functionalities
JAVA_LDAP_INJECTION	173. Discard unsafe inputs
JAVA_MONGO_HOSTNAME_VERIFICATION_DISABLED	266. Disable insecure functionalities
JAVA_MONGODB_HARDCODED_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_MYSQL_JDBC_HARDCODED_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_NONE_ALG_AUTH0_JWT_SIGN_KEY	228. Authenticate using standard protocols
JAVA_NOOPHOSTNAMEVERIFIER_USE	266. Disable insecure functionalities
JAVA_NULL_CIPHER	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information 229. Request access credentials 264. Request authentication 300. Mask sensitive data
JAVA_NULL_POINTER_EXCEPTION	161. Define secure default options 266. Disable insecure functionalities 359. Avoid using generic exceptions
JAVA_OKHTTP_HARDCODED_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_PASSWORD_AUTHENTICATION_HARDCODED_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_PBEKEYSPEC_KERBEROS_HARDCODED_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_PROP_MISSING_SSL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_PROP_SENSITIVE_DATA	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_PROP_UNENCRYPTED_TRANSPORT	181. Transmit data using secure protocols
JAVA_PROP_WEAK_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_PROPERTIES_HARDCODED_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_PROPERTIES_SPRING_COOKIE_SAMESITE_NONE	029. Cookies with security attributes
JAVA_PROPERTIES_SPRING_INSECURE_CORS_WILDCARD	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVA_PROPERTIES_SPRING_INSECURE_SMTP	181. Transmit data using secure protocols
JAVA_REMOTE_COMMAND_EXECUTION	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
JAVA_RPC_ENABLED_EXTENSIONS	185. Encrypt sensitive information 266. Disable insecure functionalities
JAVA_SALT_IS_HARDCODED	266. Disable insecure functionalities
JAVA_SALT_IS_HARDCODED_BYTES	266. Disable insecure functionalities
JAVA_SAML_IGNORE_COMMENTS	185. Encrypt sensitive information 266. Disable insecure functionalities
JAVA_SCRIPT_ENGINE_CODE_INJECTION	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
JAVA_SECURE_COOKIE	029. Cookies with security attributes
JAVA_SPRING_CONCURRENT_SESSIONS	025. Manage concurrent sessions
JAVA_SPRING_COOKIE_SAMESITE_NONE	029. Cookies with security attributes
JAVA_SPRING_COOKIEGENERATOR_SECURE_FALSE	029. Cookies with security attributes
JAVA_SPRING_DATASOURCE_NO_ENCRYPTION	181. Transmit data using secure protocols
JAVA_SPRING_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVA_SPRING_WEAK_CBC_CIPHER_SUITES	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_SQL_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
JAVA_SYSTEM_SETPROPERTY_HARDCODED_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_TELNET_REQUEST	181. Transmit data using secure protocols
JAVA_TRUST_BOUNDARY_VIOLATION	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
JAVA_UNENCRYPTED_SOCKET	181. Transmit data using secure protocols
JAVA_UNSAFE_DEFAULT_HTTP_CLIENT	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_UNSAFE_HOSTNAME_VERIFIER	266. Disable insecure functionalities
JAVA_UNSAFE_PATH_TRAVERSAL	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
JAVA_UNSAFE_SSL_TLS_PROTOCOL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_UNSAFE_TLS_RENEGOTIATION	181. Transmit data using secure protocols
JAVA_UNSAFE_XSS_CONTENT	029. Cookies with security attributes 173. Discard unsafe inputs
JAVA_UPLOAD_SIZE_LIMIT	040. Compare file format and extension 041. Scan files for malicious code
JAVA_USES_SYSTEM_EXIT	164. Use optimized structures 167. Close unused resources 072. Set maximum response time 327. Set a rate limit
JAVA_VULN_REGEX	072. Set maximum response time 327. Set a rate limit
JAVA_WEAK_CRYPTO_IN_SECRETKEYFACTORY	148. Set minimum size of asymmetric encryption 150. Set minimum size for hash functions
JAVA_WEAK_RANDOM_COOKIE	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
JAVA_WEAK_RSA_KEY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_WEBVIEW_DEBUG_MODE_ENABLED	077. Avoid disclosing technical information 078. Disable debugging events
JAVA_WICKET_STRING_ESCAPING_DISABLED	185. Encrypt sensitive information 266. Disable insecure functionalities
JAVA_XML_PARSER	173. Discard unsafe inputs
JAVA_XMLINPUTFACTORY_EXTERNAL_ENTITIES	173. Discard unsafe inputs
JAVA_XPATH_INJECTION_EVALUATE	173. Discard unsafe inputs
JAVA_YAML_SPRING_PROMETHEUS_EXPOSURE	077. Avoid disclosing technical information 176. Restrict system objects
JAVA_YML_SPRING_INSECURE_SMTP	181. Transmit data using secure protocols
JAVA_ZIP_SLIP_INJECTION	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
XML_JAVA_EE_INSECURE_CORS_WILDCARD	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers

JavaScript

Scanner method name	Related security requirement verified
JAVASCRIPT_ACCEPTS_ANY_MIME_DEFAULT	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVASCRIPT_ACCEPTS_ANY_MIME_METHOD	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVASCRIPT_EXPRESS_ACCEPTS_ANY_MIME	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVASCRIPT_INSECURE_CORS_ORIGIN	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JSX_LACK_OF_VALIDATION_EVENT_LISTENER	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
JS_AJV_ALLERRORS_UNCONTROLLED	072. Set maximum response time 158. Use a secure programming language 164. Use optimized structures 173. Discard unsafe inputs
JS_CLIENT_STORAGE	177. Avoid caching and temporary files 329. Keep client-side storage without sensitive data
JS_COOKIE_SERVICE_SENSITIVE_INFO	029. Cookies with security attributes
JS_CREDENTIALS_EXPOSED_IN_CODE	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JS_CRYPTO_CREDENTIALS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JS_CRYPTOJS_INSECURE_USE_OF_CBC_MODE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_CSP_UNSAFE_INLINE_SCRIPT	062. Define standard configurations 117. Do not interpret HTML code 175. Protect pages from clickjacking 349. Include HTTP security headers
JS_DEBUGGER_ENABLED	077. Avoid disclosing technical information 078. Disable debugging events
JS_DETECT_ANGULAR_INNER_HTML	173. Discard unsafe inputs
JS_DECODE_INSECURE_JWT_TOKEN	173. Discard unsafe inputs 320. Avoid client-side control enforcement 357. Use stateless session tokens
JS_DYNAMIC_X_PATH	173. Discard unsafe inputs
JS_EXPOSED_PRIVATE_KEY	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information
JS_EXPRESS_COOKIE_SAMESITE_NONE	029. Cookies with security attributes
JS_EXPRESS_COOKIE_SECURE	029. Cookies with security attributes
JS_EXPRESS_DEBUG_MODE_ENABLED	077. Avoid disclosing technical information 078. Disable debugging events
JS_EXPRESS_INSEC_HTTPONLY	029. Cookies with security attributes
JS_EXPRESS_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JS_EXPRESS_SSRF	173. Discard unsafe inputs 324. Control redirects
JS_EXPRESSJS_HARDCODED_SESS_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JS_FILE_CREATE_TEMP_FILE	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
JS_FILE_SIZE_LIMIT_MISSING	039. Define maximum file size
JS_GRPC_INSECURE_CONNECTION_ANONYMOUS_ACCESS	181. Transmit data using secure protocols
JS_HARDCODED_CREDENTIALS_IN_TEST	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JS_HARDCODED_JWT_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JS_HARDCODED_KEY_HMAC	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information
JS_HARDCODED_PASSWORD	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JS_HAS_REVERSE_TABNABBING	173. Discard unsafe inputs 324. Control redirects
JS_HTML_CODE_INJECTION_VIA_INPUT	173. Discard unsafe inputs 324. Control redirects
JS_IMPROPER_CSRF_MIDDLEWARE_ORDER	062. Define standard configurations 266. Disable insecure functionalities 273. Define a fixed security suite
JS_INSECURE_COMPRESSION_ALGORITHM	266. Disable insecure functionalities
JS_INSECURE_COOKIE	029. Cookies with security attributes
JS_INSECURE_CREATE_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_INSECURE_ECDH_KEY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_INSECURE_EC_KEYPAIR	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_INSECURE_ENCRYPT	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_INSECURE_HASH	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_INSECURE_HASH_LIBRARY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_INSECURE_JWT_TOKEN	228. Authenticate using standard protocols
JS_INSECURE_RSA_KEYPAIR	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_INSEC_COOKIES	029. Cookies with security attributes
JS_INSEC_MSG_AUTH_MECHANISM	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_JSON_PARSE_UNVALIDATED_DATA	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
JS_JWT_INSEC_SIGN_ALGORITHM	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_JWT_INSEC_SIGN_ALGO_ASYNC	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_JWT_NONE_ALGORITHM_TOKEN_FORGERY	228. Authenticate using standard protocols
JS_KOA_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JS_LAMBDA_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JS_LOCAL_STORAGE_SENS_DATA_ASSIGNMENT	173. Discard unsafe inputs 320. Avoid client-side control enforcement 357. Use stateless session tokens
JS_LOCAL_STORAGE_SENSITIVE_DATA_ASYNC	173. Discard unsafe inputs 320. Avoid client-side control enforcement 357. Use stateless session tokens
JS_LOCAL_STORAGE_WITH_SENSITIVE_DATA	173. Discard unsafe inputs 320. Avoid client-side control enforcement 357. Use stateless session tokens
JS_NESTJS_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JS_NEXTJS_REVERSE_TABNABBING	173. Discard unsafe inputs 324. Control redirects
JS_NON_SECURE_CONSTRUCTION_OF_COOKIES	030. Avoid object reutilization
JS_INSECURE_PATH_TRAVERSAL	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
JS_JQUERY_REVERSE_TABNABBING	173. Discard unsafe inputs 324. Control redirects
JS_NOSQL_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
JS_NOSQL_INJECTION_TERNARY	169. Use parameterized queries 173. Discard unsafe inputs
JS_PATH_UNDEFINED_IN_SESSION_COOKIE	029. Cookies with security attributes
JS_REGEX_INJECTION	072. Set maximum response time 327. Set a rate limit
JS_REMOTE_COMMAND_EXECUTION	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
JS_SALT_IS_HARDCODED	266. Disable insecure functionalities
JS_SQL_API_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
JS_SQL_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
JS_SSH2SFTPCLIENT_CBC_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_TLS_REJECT_UNAUTHORIZED_FALSE	266. Disable insecure functionalities
JS_UNSAFE_HTTP_XSS_PROTECTION	062. Define standard configurations 175. Protect pages from clickjacking 266. Disable insecure functionalities 349. Include HTTP security headers
JS_UNSAFE_HTTP_XFRAME_OPTIONS	062. Define standard configurations 175. Protect pages from clickjacking 266. Disable insecure functionalities 349. Include HTTP security headers
JS_UNSAFE_ORIGIN	266. Disable insecure functionalities
JS_UNSAFE_XSS_CONTENT	029. Cookies with security attributes 173. Discard unsafe inputs
JS_USES_BYPASS_SECURITY_TRUST_URL	173. Discard unsafe inputs
JS_USES_DANGEROUSLY_SET_HTML	173. Discard unsafe inputs
JS_USES_EVAL	266. Disable insecure functionalities
JS_USES_INNERHTML	173. Discard unsafe inputs
JS_WEAK_RANDOM	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
JS_WEAK_SSL_TLS_PROTOCOL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JS_XML_PARSER	173. Discard unsafe inputs
JS_ZIP_SLIP	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters

Kotlin

Scanner method name	Related security requirement verified
KOTLIN_ACCEPTS_ANY_MIME_TYPE	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
KOTLIN_CREDENTIALS_EXPOSED_IN_CODE	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
KOTLIN_HTTP_ONLY_COOKIE	029. Cookies with security attributes
KOTLIN_SALT_IS_HARDCODED	266. Disable insecure functionalities
KOTLIN_SALT_IS_HARDCODED_BYTES	266. Disable insecure functionalities
KOTLIN_SECURE_COOKIE	029. Cookies with security attributes
KOTLIN_VULN_REGEX	072. Set maximum response time 327. Set a rate limit
KT_ANONYMOUS_LDAP	173. Discard unsafe inputs
KT_DEFAULT_HTTP_CLIENT_DEPRECATED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_HARDCODED_INIT_VECTOR	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
KT_HC_SECRET_ALG_INSTANCE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_CERTIFICATE_VALIDATION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_CIPHER_HTTP	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_CIPHER_MODE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_CIPHER_SSL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_CSP_INLINE_SCRIPT	062. Define standard configurations 117. Do not interpret HTML code 175. Protect pages from clickjacking 349. Include HTTP security headers
KT_INSECURE_ENCRYPTION_KEY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_HASH	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_HOST_VERIFICATION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_INIT_VECTOR	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_KEY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_KEY_EC	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_KEY_GEN	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_KEY_PAIR_GEN	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_INSECURE_PARAMETER_SPEC	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
KT_REMOTE_COMMAND_EXECUTION	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
KT_UNENCRYPTED_CHANNEL	181. Transmit data using secure protocols
KT_WEAK_RANDOM	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
KT_XML_PARSER	173. Discard unsafe inputs

Kubernetes

Scanner method name	Related security requirement verified
K8S_CHECK_ADD_CAPABILITY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_CHECK_DROP_CAPABILITY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_CHECK_HOST_PID	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_CHECK_IF_CAPABILITY_EXISTS	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_CHECK_IF_SYS_ADMIN_EXISTS	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_CHECK_PRIVILEGED_USED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_CHECK_RUN_AS_USER	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_CHECK_SECCOMP_PROFILE	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_CONTAINER_WITHOUT_SECURITYCONTEXT	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_HOST_IPC_ENABLED	077. Avoid disclosing technical information 176. Restrict system objects
K8S_HOST_NETWORK_ENABLED	077. Avoid disclosing technical information 176. Restrict system objects
K8S_HOST_PATH_VOLUMES	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_HOST_PROCESS_ENABLED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_HOSTPID_ENABLED	077. Avoid disclosing technical information 176. Restrict system objects
K8S_IMAGE_HAS_DIGEST	266. Disable insecure functionalities
K8S_PRIVILEGE_ESCALATION_ENABLED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_ROOT_CONTAINER	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_ROOT_FILESYSTEM_READ_ONLY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
K8S_SA_TOKEN_ENABLED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
KUBERNETES_INSECURE_PORT	181. Transmit data using secure protocols
KUBERNETES_USES_HTTP	181. Transmit data using secure protocols
KUBERNETES_USES_HTTP_SERVER	181. Transmit data using secure protocols

PHP

Scanner method name	Related security requirement verified
PHP_BASIC_AUTHENTICATION	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
PHP_DISCLOSES_SERVER_VERSION	077. Avoid disclosing technical information 176. Restrict system objects
PHP_EXCESSIVE_ACCESS_MODE	033. Restrict administrative access 176. Restrict system objects 265. Restrict access to critical processes 280. Restrict service root directory
PHP_GENERATES_INSECURE_TOKEN	224. Use secure cryptographic mechanisms
PHP_HARDCODED_INIT_VECTOR	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
PHP_HARDCODED_PASSWORD	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
PHP_HTTP_ONLY_DISABLED	029. Cookies with security attributes
PHP_INSECURE_ELLIPTIC_CURVE	148. Set minimum size of asymmetric encryption 150. Set minimum size for hash functions
PHP_INSECURE_HASH	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
PHP_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
PHP_INSECURE_DESERIALIZATION	173. Discard unsafe inputs 321. Avoid deserializing untrusted data
PHP_INSECURE_EXPIRATION_TIME	023. Terminate inactive user sessions
PHP_INSECURE_MCRYPT	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
PHP_INSECURE_OPENSSL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
PHP_INSECURE_REFERRER_POLICY	062. Define standard configurations 349. Include HTTP security headers
PHP_INSECURE_SSL_TLS_HTTP	266. Disable insecure functionalities
PHP_INSECURE_SSL_TLS_STREAM	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
PHP_INFO_LEAK_ERRORS	077. Avoid disclosing technical information 176. Restrict system objects
PHP_INSECURE_CONTENT_SECURITY_POLICY	062. Define standard configurations 117. Do not interpret HTML code 175. Protect pages from clickjacking 349. Include HTTP security headers
PHP_INSECURE_ENCRYPT_AES	148. Set minimum size of asymmetric encryption 150. Set minimum size for hash functions
PHP_LARAVEL_COOKIE_SECURE	029. Cookies with security attributes
PHP_LARAVEL_INSECURE_CORS_CONFIG	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
PHP_LARAVEL_XSS	029. Cookies with security attributes 173. Discard unsafe inputs
PHP_MYSQL_QUERY_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
PHP_REMOTE_COMMAND_EXECUTION	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
PHP_SENSITIVE_HTTP_SENT	032. Avoid session ID leakages 181. Transmit data using secure protocols
PHP_SERVER_LEAKS_ERRORS	077. Avoid disclosing technical information 176. Restrict system objects
PHP_SQL_LEAK_ERRORS	077. Avoid disclosing technical information 176. Restrict system objects
PHP_TECHNICAL_INFO_LEAK	077. Avoid disclosing technical information 176. Restrict system objects
PHP_UNSAFE_PATH_TRAVERSAL	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
PHP_UNSAFE_XSS_CONTENT	029. Cookies with security attributes 173. Discard unsafe inputs
PHP_USES_EVAL	266. Disable insecure functionalities
PHP_USES_SHA1_IN_QUERY	148. Set minimum size of asymmetric encryption 150. Set minimum size for hash functions
PHP_WEAK_RANDOM	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
PHP_XML_PARSER	173. Discard unsafe inputs

Python

Scanner method name	Related security requirement verified
PYTHON_ACCEPTS_ANY_MIME	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
PYTHON_AWS_HARDCODED_CREDENTIALS	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information 229. Request access credentials 264. Request authentication 300. Mask sensitive data
PYTHON_CREDENTIALS_EXPOSED_IN_CODE	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
PYTHON_DESERIALIZATION_INJECTION	173. Discard unsafe inputs 321. Avoid deserializing untrusted data
PYTHON_DJANGO_DEBUG_MODE_ENABLED	077. Avoid disclosing technical information 078. Disable debugging events
PYTHON_DJANGO_HARDCODED_CREDS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
PYTHON_DJANGO_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
PYTHON_DJANGO_SQL_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
PYTHON_EXPOSED_AUTH_TOKEN	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
PYTHON_FASTAPI_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
PYTHON_FASTAPI_STARLETTE_DEBUG_ON	077. Avoid disclosing technical information 078. Disable debugging events
PYTHON_FLASK_COOKIE_SAMESITE_NONE	029. Cookies with security attributes
PYTHON_FLASK_DEBUG_MODE_ENABLED	077. Avoid disclosing technical information 078. Disable debugging events
PYTHON_FLASK_HARDCODED_SECRET_KEY	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
PYTHON_FLASK_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
PYTHON_FLASK_LOG_INJECTION	080. Prevent log modification 173. Discard unsafe inputs
PYTHON_HARDCODED_CREDENTIALS_PYMYSQL	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
PYTHON_HC_AES_KEY	145. Protect system cryptographic keys
PYTHON_HTTP_ONLY_COOKIE	029. Cookies with security attributes
PYTHON_INSECURE_AUTHENTICATION	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
PYTHON_INSECURE_CIPHER_MODE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
PYTHON_INSECURE_JWT_KEY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
PYTHON_INSECURE_REDIRECT	173. Discard unsafe inputs 324. Control redirects
PYTHON_INSEC_HASH_LIBRARY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
PYTHON_IO_PATH_TRAVERSAL	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
PYTHON_LDAP_CONN_AUTH	266. Disable insecure functionalities
PYTHON_LDAP_INJECTION	173. Discard unsafe inputs
PYTHON_REGEX_DOS	072. Set maximum response time 327. Set a rate limit
PYTHON_REGEX_INJECTION	072. Set maximum response time 327. Set a rate limit
PYTHON_REMOTE_COMMAND_EXECUTION	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
PYTHON_SECURE_COOKIE	029. Cookies with security attributes
PYTHON_SESSION_FIXATION	030. Avoid object reutilization
PYTHON_STARLETTE_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
PYTHON_UNSAFE_CERTIFICATE_VALIDATION	266. Disable insecure functionalities
PYTHON_UNSAFE_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
PYTHON_UNSAFE_LDAP_CONNECTIONS	266. Disable insecure functionalities
PYTHON_UNSAFE_SSL_HOSTNAME	266. Disable insecure functionalities
PYTHON_UNSAFE_TEMP_FILE	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
PYTHON_XML_PARSER	173. Discard unsafe inputs

Ruby

Scanner method name	Related security requirement verified
RUBY_HTTP_CLIENT_REQUESTS	181. Transmit data using secure protocols
RUBY_JWT_DECODE_WITHOUT_VERIFY	173. Discard unsafe inputs 320. Avoid client-side control enforcement 357. Use stateless session tokens
RUBY_NET_FTP_REQUEST	181. Transmit data using secure protocols
RUBY_NET_HTTP_CLIENT_REQUESTS	181. Transmit data using secure protocols
RUBY_NET_TELNET_REQUEST	181. Transmit data using secure protocols
RUBY_ON_RAILS_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
RUBY_OPENURI_REQUEST	181. Transmit data using secure protocols

Scala

Scanner method name	Related security requirement verified
SCALA_INSECURE_CIPHER_MODE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
SCALA_INSECURE_HASH_ARGUMENT	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
SCALA_INSECURE_KEY_EC	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
SCALA_INSECURE_PASS	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
SCALA_JWT_WITHOUT_PROPER_SIGN	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
SCALA_PLAY_INSECURE_CORS_HEADER	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers

Swift

Scanner method name	Related security requirement verified
SWIFT_CREDENTIALS_EXPOSED_IN_CODE	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
SWIFT_HC_SECRET_JWT	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
SWIFT_INSECURE_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
SWIFT_INSECURE_CRYPTOR	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
SWIFT_INSECURE_HTTP	181. Transmit data using secure protocols
SWIFT_NETWORK_INSECURE_TCP_CONNECTION	181. Transmit data using secure protocols
SWIFT_VAPOR_INSECURE_CORS_HEADER	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
SWIFT_WEBKIT_UNSAFE_LOCAL_FILE_ACCESS	266. Disable insecure functionalities

Terraform

Scanner technique name	Related security requirement verified
CHECK_REQUIRED_VERSION	266. Disable insecure functionalities
EC2_DEFAULT_SEC_GROUP	266. Disable insecure functionalities
EC2_NOT_TERMINATION_PROTEC	186. Use the principle of least privilege 265. Restrict access to critical processes
EC2_TERMINATE_SHUTDOWN_BEHAVIOR	266. Disable insecure functionalities
TFM_ADMIN_MANAGED_POLICIES	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_ADMIN_POLICY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_ALLOWS_PRIV_ESCALATION_ATTACH_POLICY	035. Manage privilege modifications
TFM_ALLOWS_PRIV_ESCALATION_BY_POLICIES_VERSIONS	035. Manage privilege modifications
TFM_ANYONE_ADMIN_PORTS	255. Allow access only to the necessary ports
TFM_API_ALL_HTTP_METHODS_ENABLED	266. Disable insecure functionalities
TFM_API_GATEWAY_LOGGING_DISABLED	075. Record exceptional events in logs 079. Record exact occurrence time of events 376. Register severity level
TFM_AWS_ACL_BROAD_NETWORK_ACCESS	255. Allow access only to the necessary ports
TFM_AWS_EBS_VOLUMES_UNENCRYPTED	185. Encrypt sensitive information 300. Mask sensitive data
TFM_AWS_EC2_ALL_TRAFFIC	255. Allow access only to the necessary ports
TFM_AWS_EC2_CFN_UNRESTR_IP_PROT	255. Allow access only to the necessary ports
TFM_AWS_EC2_UNRESTRICTED_CIDRS	255. Allow access only to the necessary ports
TFM_AWS_EFS_UNENCRYPTED	185. Encrypt sensitive information 300. Mask sensitive data
TFM_AWS_ELB_LISTENER_ON_HTTP	181. Transmit data using secure protocols
TFM_AWS_ELB_WITHOUT_SSLPOLICY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TFM_AWS_INSEC_PROTO	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TFM_AWS_S3_VERSIONING_DISABLED	080. Prevent log modification
TFM_AWS_SEC_GROUP_USING_TCP	181. Transmit data using secure protocols
TFM_AZURE_API_MGMT_BACK_MINIMUM_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TFM_AZURE_API_MGMT_FRONT_MINIMUM_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TFM_AZURE_APP_LOG_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
TFM_AZURE_APP_SERVICE_FTP_DEPLOYMENTS_ENABLED	181. Transmit data using secure protocols
TFM_AZURE_APP_SERVICE_LOGGING_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
TFM_AZURE_APP_SERVICE_MINIMUM_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TFM_AZURE_APP_SERVICE_AUTHENTICATION_IS_NOT_ENABLED	227. Display access notification 228. Authenticate using standard protocols 229. Request access credentials 231. Implement a biometric verification component 235. Define credential interface 264. Request authentication 323. Exclude unverifiable files
TFM_AZURE_CLIENT_CERT_ENABLED	227. Display access notification 228. Authenticate using standard protocols 229. Request access credentials 231. Implement a biometric verification component 235. Define credential interface 264. Request authentication 323. Exclude unverifiable files
TFM_AZURE_DB_MYSQL_SSL_DISABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TFM_AZURE_DB_POSTGRESQL_INSECURE_LOG_RETENTION_DAYS	186. Use the principle of least privilege 265. Restrict access to critical processes
TFM_AZURE_DB_POSTGRESQL_SSL_DISABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TFM_AZURE_DEV_PORTAL_HAS_AUTH_METHODS_INACTIVE	227. Display access notification 228. Authenticate using standard protocols 229. Request access credentials 231. Implement a biometric verification component 235. Define credential interface 264. Request authentication 323. Exclude unverifiable files
TFM_AZURE_INSEC_PROTO	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TFM_AZURE_KEY_VAULT_NOT_RECOVER	186. Use the principle of least privilege 265. Restrict access to critical processes
TFM_AZURE_KEY_VAULT_PURGE_PROTECTION_DISABLED	186. Use the principle of least privilege 265. Restrict access to critical processes
TFM_AZURE_KV_DANGER_BYPASS	255. Allow access only to the necessary ports
TFM_AZURE_KV_DEFAULT_NETWORK_ACCESS	255. Allow access only to the necessary ports
TFM_AZURE_KV_ONLY_ACCESS_HTTPS	181. Transmit data using secure protocols
TFM_AZURE_KV_SECRET_NO_EXPIRATION	130. Limit password lifespan 138. Define lifespan for temporary passwords 140. Define OTP lifespan
TFM_AZURE_LNX_VM_INSEC_AUTH	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
TFM_AZURE_NSG_UNRESTRICTED_MONGODB_ACCESS	255. Allow access only to the necessary ports
TFM_AZURE_NSG_UNRESTRICTED_MSQL_ACCESS	255. Allow access only to the necessary ports
TFM_AZURE_NSG_UNRESTRICTED_NETBIOS_ACCESS	255. Allow access only to the necessary ports
TFM_AZURE_NSG_UNRESTRICTED_ORACLE_ACCESS	255. Allow access only to the necessary ports
TFM_AZURE_NSG_POSTGRESQL_PUBLIC_ACCESS	255. Allow access only to the necessary ports
TFM_AZURE_NSG_UNRESTRICTED_RPC_ACCESS	255. Allow access only to the necessary ports
TFM_AZURE_NSG_UNRESTRICTED_SMTP_ACCESS	255. Allow access only to the necessary ports
TFM_AZURE_NSG_UNRESTRICTED_SSH_ACCESS	255. Allow access only to the necessary ports
TFM_AZURE_POSTGRESQL_MINIMUM_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TFM_AZURE_REDIS_FRONT_INSECURE_PORT_SSL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TFM_AZURE_REDIS_MINIMUM_TLS_VERSION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TFM_AZURE_SA_DEFAULT_NETWORK_ACCESS	255. Allow access only to the necessary ports
TFM_AZURE_SA_INSEC_TRANSFER	181. Transmit data using secure protocols
TFM_AZURE_SQL_LOG_RETENT	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
TFM_AZURE_SQL_SERVER_AUDIT_LOG_RETENTION	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
TFM_AZURE_STORAGE_ACCOUNT_BLOB_SOFT_DELETE_DISABLED	186. Use the principle of least privilege 265. Restrict access to critical processes
TFM_AZURE_STORAGE_ACCOUNT_GEO_REPLICATION_DISABLED	186. Use the principle of least privilege 265. Restrict access to critical processes
TFM_AZURE_STORAGE_LOG_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
TFM_AZURE_UNRESTRICTED_ACCESS_NETWORK_SEGMENTS	255. Allow access only to the necessary ports
TFM_AZURE_VM_INSEC_AUTH	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
TFM_BUCKET_ALLOWS_PUBLIC	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_BUCKET_POLICY_SEC_TRANSPORT	181. Transmit data using secure protocols
TFM_CF_DISTR_LOG_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
TFM_COGNITO_HAS_MFA_DISABLED	229. Request access credentials 231. Implement a biometric verification component 264. Request authentication 319. Make authentication options equally secure 328. Request MFA for critical systems
TFM_CONTENT_HTTP	181. Transmit data using secure protocols
TFM_CTRAIL_LOG_NOT_VALIDATED	080. Prevent log modification
TFM_DB_INSTANCE_PUBLICLY_ACCESSIBLE	096. Set user's required privileges 176. Restrict system objects 265. Restrict access to critical processes
TFM_DB_NO_POINT_TIME_RECOVERY	186. Use the principle of least privilege 265. Restrict access to critical processes
TFM_DISTRIBUTION_HAS_LOGGING_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
TFM_DYNAMO_NOT_DEL_PROTEC	186. Use the principle of least privilege 265. Restrict access to critical processes
TFM_EBS_UNENCRYPTED_DEFAULT	266. Disable insecure functionalities
TFM_EBS_UNENCRYPTED_VOLUMES	266. Disable insecure functionalities
TFM_EC2_ASSOC_PUB_IP	266. Disable insecure functionalities
TFM_EC2_INSTANCE_UNENCRYPTED_EBS_BLOCK_DEVICES	266. Disable insecure functionalities
TFM_EC2_NO_IAM	266. Disable insecure functionalities
TFM_EC2_OPEN_ALL_PORTS_PUBLIC	255. Allow access only to the necessary ports
TFM_EC2_SEC_GROUPS_RFC1918	255. Allow access only to the necessary ports
TFM_EC2_UNENCRYPTED_BLOCK_DEVICES	266. Disable insecure functionalities
TFM_EC2_UNRESTRICTED_DNS	255. Allow access only to the necessary ports
TFM_EC2_UNRESTRICTED_FTP	255. Allow access only to the necessary ports
TFM_EC2_UNRESTRICTED_PORTS	255. Allow access only to the necessary ports
TFM_EKS_HAS_ENDPOINTS_PUBLICLY_ACCESSIBLE	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_ELASTICACHE_TRANSIT_ENCRYPTION_DISABLED	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_ELASTICACHE_USES_DEFAULT_PORT	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_ELB2_INSECURE_SEC_POLICY	266. Disable insecure functionalities
TFM_ELB2_INSEC_PROTO	181. Transmit data using secure protocols
TFM_ELB2_NOT_DELETION_PROTEC	186. Use the principle of least privilege 265. Restrict access to critical processes
TFM_ELB2_USES_INSECURE_PROTOCOL	181. Transmit data using secure protocols
TFM_ELB_LOGGING_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
TFM_HTTP_METHODS_ENABLED	266. Disable insecure functionalities
TFM_IAM_EXCESSIVE_PRIVILEGES	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_IAM_EXCESSIVE_ROLE_POLICY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_IAM_FULL_ACCESS_SSM	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_IAM_MISSING_SECURITY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_IAM_PERMISSIONS_POLICY_NOT_ACTION	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_IAM_PERMISSIONS_POLICY_NOT_RESOURCE	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_IAM_POLICY_APPLY_TO_USERS	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_IAM_ROLE_IS_OVER_PRIVILEGED	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_IAM_TRUST_POLICY_NOT_ACTION	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_IAM_TRUST_POLICY_NOT_PRINCIPAL	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_IAM_TRUST_POLICY_WILDCARD_ACTION	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_IAM_WILDCARD_WRITE	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_INST_WITHOUT_PROFILE	255. Allow access only to the necessary ports
TFM_K8S_ALLOW_PRIVILEGE_ESCALATION_ENABLED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_CHECK_DROP_CAPABILITY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_CHECK_IF_CAPABILITY_EXISTS	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_CHECK_IF_SYS_ADMIN_EXISTS	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_CHECK_PRIVILEGED_USED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_CHECK_RUN_AS_USER	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_CHECK_SECCOMP_PROFILE	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_CONTAINER_WITHOUT_SECURITYCONTEXT	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_HOST_IPC_ENABLED	077. Avoid disclosing technical information 176. Restrict system objects
TFM_K8S_HOST_NETWORK_ENABLED	077. Avoid disclosing technical information 176. Restrict system objects
TFM_K8S_HOST_PATH_VOLUMES	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_HOST_PROCESS_ENABLED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_HOSTPID_ENABLED	077. Avoid disclosing technical information 176. Restrict system objects
TFM_K8S_IMAGE_HAS_DIGEST	266. Disable insecure functionalities
TFM_K8S_ROOT_CONTAINER	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_ROOT_FILESYSTEM_READ_ONLY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_K8S_SA_TOKEN_ENABLED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_KMS_KEY_ROTATION_DISABLED	266. Disable insecure functionalities
TFM_KMS_MASTER_KEYS_EXPOSED	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_KUBERNETES_INSECURE_PORT	181. Transmit data using secure protocols
TFM_NEGATIVE_STATEMENT	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_PERMISSIVE_POLICY	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_POLICY_SERVER_ENCRYP_DISABLED	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information 227. Display access notification 229. Request access credentials 264. Request authentication 300. Mask sensitive data
TFM_PUBLIC_BUCKETS_ACL	096. Set user's required privileges 176. Restrict system objects 264. Request authentication 320. Avoid client-side control enforcement
TFM_RDS_INSIDE_SUBNET	255. Allow access only to the necessary ports
TFM_RDS_NO_DELETION_PROTECTION	186. Use the principle of least privilege 265. Restrict access to critical processes
TFM_RDS_NOT_AUTO_BACKUPS	186. Use the principle of least privilege 265. Restrict access to critical processes
TFM_RDS_NOT_USES_IAM_AUTHENTICATION	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_RDS_IS_PUBLICLY_ACCESSIBLE	096. Set user's required privileges 176. Restrict system objects 265. Restrict access to critical processes
TFM_RDS_UNENCRYPTED_STORAGE	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information 229. Request access credentials 264. Request authentication 300. Mask sensitive data
TFM_REDIS_CACHE_AUTHNOTREQUIRED_ENABLED	227. Display access notification 228. Authenticate using standard protocols 229. Request access credentials 231. Implement a biometric verification component 235. Define credential interface 264. Request authentication 323. Exclude unverifiable files
TFM_REDSHIFT_HAS_AUDIT_LOGS_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
TFM_REDSHIFT_HAS_ENCRYPTION_DISABLED	185. Encrypt sensitive information 300. Mask sensitive data
TFM_REDSHIFT_HAS_PUBLIC_CLUSTERS	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_REDSHIFT_HAS_USER_ACTIVITY_LOG_DISABLED	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system
TFM_REDSHIFT_NOT_REQUIRES_SSL	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_S3_BUCKETS_ALLOW_UNAUTHORIZED_PUBLIC_ACCESS	096. Set user's required privileges 176. Restrict system objects 264. Request authentication 320. Avoid client-side control enforcement
TFM_S3_VERSIONING_DISABLED	266. Disable insecure functionalities
TFM_SNS_IS_SERVER_SIDE_ENCRYPTION_DISABLED	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_SQS_IS_ENCRYPTION_DISABLED	185. Encrypt sensitive information 265. Restrict access to critical processes 266. Disable insecure functionalities
TFM_SQS_IS_PUBLIC	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
TFM_TRAILS_NOT_MULTIREGION	075. Record exceptional events in logs 376. Register severity level 377. Store logs based on valid regulation 378. Use of log management system

TypeScript

Scanner method name	Related security requirement verified
TSX_LACK_OF_VALIDATION_EVENT_LISTENER	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
TS_AJV_ALLERRORS_UNCONTROLLED	072. Set maximum response time 158. Use a secure programming language 164. Use optimized structures 173. Discard unsafe inputs
TS_CLIENT_STORAGE	177. Avoid caching and temporary files 329. Keep client-side storage without sensitive data
TS_COOKIE_SERVICE_SENSITIVE_INFO	029. Cookies with security attributes
TS_CRYPTO_CREDENTIALS	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
TS_CRYPTOJS_INSECURE_USE_OF_CBC_MODE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_DEBUGGER_ENABLED	077. Avoid disclosing technical information 078. Disable debugging events
TS_DETECT_ANGULAR_INNER_HTML	173. Discard unsafe inputs
TS_DECODE_INSECURE_JWT_TOKEN	173. Discard unsafe inputs 320. Avoid client-side control enforcement 357. Use stateless session tokens
TS_DYNAMIC_X_PATH	173. Discard unsafe inputs
TS_EXPOSED_PRIVATE_KEY	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information
TS_EXPRESS_COOKIE_SAMESITE_NONE	029. Cookies with security attributes
TS_EXPRESS_COOKIE_SECURE	029. Cookies with security attributes
TS_EXPRESS_DEBUG_MODE_ENABLED	077. Avoid disclosing technical information 078. Disable debugging events
TS_EXPRESS_HARDCODED_SESS_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
TS_EXPRESS_INSEC_HTTPONLY	029. Cookies with security attributes
TS_EXPRESS_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
TS_EXPRESS_INSECURE_RATE_LIMIT	327. Set a rate limit
TS_EXPRESS_SSRF	173. Discard unsafe inputs 324. Control redirects
TS_FILE_SIZE_LIMIT_MISSING	039. Define maximum file size
TS_FILE_UNAUTHORIZED_ACCESS	173. Discard unsafe inputs 176. Restrict system objects
TS_GRPC_INSECURE_CONNECTION_ANONYMOUS_ACCESS	181. Transmit data using secure protocols
TS_HARDCODED_CREDENTIALS_IN_TEST	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
TS_HARDCODED_JWT_SECRET	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
TS_HARDCODED_KEY_HMAC	134. Store passwords with salt 135. Passwords with random salt 185. Encrypt sensitive information
TS_HARDCODED_PASSWORD	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
TS_HAS_REVERSE_TABNABBING	173. Discard unsafe inputs 324. Control redirects
TS_HTML_CODE_INJECTION_VIA_INPUT	173. Discard unsafe inputs 324. Control redirects
TS_IMPROPER_CSRF_MIDDLEWARE_ORDER	062. Define standard configurations 266. Disable insecure functionalities 273. Define a fixed security suite
TS_INSECURE_COMPRESSION_ALGORITHM	266. Disable insecure functionalities
TS_INSECURE_COOKIE	029. Cookies with security attributes
TS_INSECURE_CORS_ORIGIN	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
TS_INSECURE_CREATE_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_INSECURE_ECDH_KEY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_INSECURE_EC_KEYPAIR	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_INSECURE_ENCRYPT	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_INSECURE_HASH	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_INSECURE_JWT_TOKEN	228. Authenticate using standard protocols
TS_INSECURE_LOGGING	080. Prevent log modification 173. Discard unsafe inputs
TS_INSECURE_RSA_KEYPAIR	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_INSEC_COOKIES	029. Cookies with security attributes
TS_INSEC_MSG_AUTH_MECHANISM	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_JSON_PARSE_UNVALIDATED_DATA	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
TS_JWT_INSEC_SIGN_ALGORITHM	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_JWT_INSEC_SIGN_ALGO_ASYNC	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_JWT_NONE_ALGORITHM_TOKEN_FORGERY	228. Authenticate using standard protocols
TS_KOA_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
TS_LAMBDA_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
TS_LOCAL_STORAGE_SENS_DATA_ASSIGNMENT	173. Discard unsafe inputs 320. Avoid client-side control enforcement 357. Use stateless session tokens
TS_NESTJS_INSECURE_CORS	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
TS_NEXTJS_REVERSE_TABNABBING	173. Discard unsafe inputs 324. Control redirects
TS_NON_SECURE_CONSTRUCTION_OF_COOKIES	030. Avoid object reutilization
TS_INSECURE_PATH_TRAVERSAL	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
TS_JQUERY_REVERSE_TABNABBING	173. Discard unsafe inputs 324. Control redirects
TS_NOSQL_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
TS_NOSQL_INJECTION_TERNARY	169. Use parameterized queries 173. Discard unsafe inputs
TS_PATH_UNDEFINED_IN_SESSION_COOKIE	029. Cookies with security attributes
TS_REGEX_INJECTION	072. Set maximum response time 327. Set a rate limit
TS_REMOTE_COMMAND_EXECUTION	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
TS_SALT_IS_HARDCODED	266. Disable insecure functionalities
TS_SEQUELIZE_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
TS_SQL_API_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
TS_SQL_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
TS_SSH2SFTPCLIENT_CBC_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_TLS_REJECT_UNAUTHORIZED_FALSE	266. Disable insecure functionalities
TS_UNNECESSARY_IMPORTS	158. Use a secure programming language
TS_UNSAFE_HTTP_XSS_PROTECTION	062. Define standard configurations 175. Protect pages from clickjacking 266. Disable insecure functionalities 349. Include HTTP security headers
TS_UNSAFE_HTTP_XFRAME_OPTIONS	062. Define standard configurations 175. Protect pages from clickjacking 266. Disable insecure functionalities 349. Include HTTP security headers
TS_UNSAFE_ORIGIN	266. Disable insecure functionalities
TS_UNSAFE_XSS_CONTENT	029. Cookies with security attributes 173. Discard unsafe inputs
TS_UNVALIDATED_XML_PARSED_IN_VM	040. Compare file format and extension 041. Scan files for malicious code
TS_USES_BYPASS_SECURITY_TRUST_URL	173. Discard unsafe inputs
TS_USES_DANGEROUSLY_SET_HTML	173. Discard unsafe inputs
TS_USES_EVAL	266. Disable insecure functionalities
TS_USES_INNERHTML	173. Discard unsafe inputs
TS_WEAK_RANDOM	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
TS_WEAK_SSL_TLS_PROTOCOL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TS_XML_PARSER	173. Discard unsafe inputs
TS_XML_PARSER_INSIDE_CONTEXT	173. Discard unsafe inputs
TS_ZIP_SLIP	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
TYPESCRIPT_ACCEPTS_ANY_MIME_DEFAULT	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
TYPESCRIPT_ACCEPTS_ANY_MIME_METHOD	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
TYPESCRIPT_EXPRESS_ACCEPTS_ANY_MIME	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers

.NET

Scanner method name	Related security requirement verified
CS_ASPNET_COOKIE_SAMESITE_NONE_CF	062. Define standard configurations 175. Protect pages from clickjacking 266. Disable insecure functionalities 349. Include HTTP security headers
DOTNETCONFIG_ANON_AUTH_ENABLED	142. Change system default credentials 264. Request authentication 265. Restrict access to critical processes 266. Disable insecure functionalities 319. Make authentication options equally secure
DOTNETCONFIG_ASP_VERSION_ENABLED	077. Avoid disclosing technical information 176. Restrict system objects
DOTNETCONFIG_EXCESSIVE_AUTH_PRIVILEGES	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
DOTNETCONFIG_HAS_DEBUG_ENABLED	077. Avoid disclosing technical information 078. Disable debugging events
DOTNETCONFIG_HAS_SSL_DISABLED	266. Disable insecure functionalities
DOTNETCONFIG_NOT_CUSTOM_ERRORS	077. Avoid disclosing technical information 176. Restrict system objects
DOTNETCONFIG_NOT_SUPPRESS_VULN_HEADER	077. Avoid disclosing technical information 176. Restrict system objects
XML_DOTNET_WEAK_ENCRYPTION_ALGORITHM	148. Set minimum size of asymmetric encryption 150. Set minimum size for hash functions

General

Scanner method name	Related security requirement verified
NON_UPGRADEABLE_DEPS	302. Declare dependencies explicitly
UNVERIFIABLE_FILES	323. Exclude unverifiable files

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.

Security requirements by language | Fluid Attacks Help