Skip to content
FendixDocumentationDocs

.fendix.yaml · SEC-001 · SARIF

Current release v3.7.0
Browse docs

.fendix.yaml · SEC-001 · SARIF

CatalogStablev3.7.0

Check Library

Search the executable check catalog by ID, analyzer, category, severity, CWE, and execution mode.

On this page

This catalog is generated from the executable DAST registry, native secrets and textscan rules, and the embedded Semgrep packs in v3.7.0. Rule facts come from the engine; explanatory prose is maintained separately.

A check's default severity is an intrinsic input. It does not determine BLOCK, WARN, or the release decision by itself. Evidence, confidence, policy, and coverage remain separate.

Executable check catalog

Search exact check IDs and CWE identifiers, or filter by the fields encoded in the current contract.

85 of 85 checks
CheckAnalyzerCategorySeverityCWEExecution
Authentication enforcementauthdastAuthentication bypass——Authenticated
Exposed configuration filesconfigleakdastData exposure——Passive
Cookie security attributescookie-flagsdastCookies——Passive
Cross-origin resource sharingcorsdastCORS——Passive
Django raw SQL with a non-literal argumentdjango-orm-raw-sqlsemgrepInjectionHIGHCWE-89Passive
Django view without LoginRequiredMixindjango-view-missing-login-requiredsemgrepAuthenticationMEDIUMCWE-306Passive
Sensitive data exposureexposuredastData exposure——Passive
FastAPI route without an authentication dependencyfastapi-route-missing-auth-dependencysemgrepAuthenticationMEDIUMCWE-306Passive
Flask route missing @login_requiredflask-missing-login-requiredsemgrepAuthenticationHIGHCWE-306Passive
Server-side template injection via render_template_string()flask-render-template-string-injectionsemgrepInjectionHIGHCWE-94Passive
Flask route with no auth-style decoratorflask-route-no-auth-decoratorsemgrepAuthenticationMEDIUMCWE-306Passive
Command injection: exec.Command with shell wrapper or concatenated argvGO_EXEC_COMMAND_INJECTIONtextscanInjectionHIGHCWE-78Passive
AWS access-key ID literal embedded in sourceGO_HARDCODED_AWS_KEYtextscanSecretsCRITICALCWE-798Passive
SQL injection: query built via string formattingGO_SQL_INJECTIONtextscanInjectionHIGHCWE-89Passive
Weak hash used for password storageGO_WEAK_HASH_PASSWORDtextscanSecretsHIGHCWE-327Passive
GraphQL exposuregraphqldastGraphQL——Active
Security headersheadersdastHeaders——Passive
Host header injectionhost-headerdastHost header——Active
Dockerfile uses ADD when COPY would sufficeIAC_DOCKER_ADD_INSTEAD_OF_COPYtextscanInfrastructure as codeLOWCWE-829Passive
Dockerfile base image is not pinned to a digestIAC_DOCKER_FLOATING_TAGtextscanInfrastructure as codeINFOCWE-829Passive
Dockerfile pins to :latest (or no tag at all)IAC_DOCKER_LATEST_TAGtextscanInfrastructure as codeMEDIUMCWE-829Passive
Dockerfile doesn't drop privileges (no USER directive in file)IAC_DOCKER_RUNS_AS_ROOTtextscanInfrastructure as codeMEDIUMCWE-250Passive
Kubernetes container allowPrivilegeEscalation: trueIAC_K8S_ALLOW_PRIVILEGE_ESCALATIONtextscanInfrastructure as codeMEDIUMCWE-250Passive
Kubernetes pod uses hostNetwork: trueIAC_K8S_HOST_NETWORKtextscanInfrastructure as codeHIGHCWE-250Passive
Kubernetes pod runs with privileged: trueIAC_K8S_PRIVILEGED_CONTAINERtextscanInfrastructure as codeHIGHCWE-250Passive
Kubernetes container runAsUser: 0 (root)IAC_K8S_RUNS_AS_ROOTtextscanInfrastructure as codeHIGHCWE-250Passive
Cross-user object accessidordastObject authorization——Two-user
Injection probesinjectiondastInjection——Active
Command injection: Runtime.exec / ProcessBuilder with a concatenated argumentJAVA_EXEC_COMMAND_INJECTIONtextscanInjectionHIGHCWE-78Passive
Insecure cookie: Secure/HttpOnly explicitly disabledJAVA_INSECURE_COOKIEtextscanAuthenticationMEDIUMCWE-614Passive
Insecure deserialization: Java ObjectInputStreamJAVA_INSECURE_DESERIALIZATIONtextscanInjectionHIGHCWE-502Passive
LDAP injection: search filter built by string concatenationJAVA_LDAP_INJECTIONtextscanInjectionHIGHCWE-90Passive
Path traversal: filesystem path built from a request parameterJAVA_PATH_TRAVERSALtextscanInjectionHIGHCWE-22Passive
SQL injection: query built by string concatenationJAVA_SQL_INJECTIONtextscanInjectionHIGHCWE-89Passive
SSRF: outbound request built directly from a request parameterJAVA_SSRFtextscanInjectionHIGHCWE-918Passive
Weak cryptography: MD5/SHA-1 digest or DES/ECB/RC4 cipherJAVA_WEAK_CRYPTOtextscanCryptographyMEDIUMCWE-327Passive
Insecure randomness: java.util.Random / Math.random in a security contextJAVA_WEAK_RANDOMtextscanCryptographyMEDIUMCWE-330Passive
Reflected XSS: request value written straight to the servlet responseJAVA_XSS_REFLECTEDtextscanXSSHIGHCWE-79Passive
XML external entity (XXE): XML parser factory created without hardeningJAVA_XXEtextscanInjectionHIGHCWE-611Passive
child_process.exec with shell semanticsJS_CHILD_PROCESS_SHELLtextscanInjectionHIGHCWE-78Passive
document.write — DOM-based XSS surfaceJS_DOCUMENT_WRITEtextscanXSSMEDIUMCWE-79Passive
eval() with non-literal argumentJS_EVAL_LITERALtextscanInjectionHIGHCWE-95Passive
AWS access-key ID literal embedded in JavaScript sourceJS_HARDCODED_AWS_KEYtextscanSecretsCRITICALCWE-798Passive
innerHTML assigned from a non-literal expressionJS_INNER_HTML_USER_INPUTtextscanXSSHIGHCWE-79Passive
require() called with a non-literal pathJS_REQUIRE_INTERPOLATIONtextscanInjectionHIGHCWE-95Passive
HTTP method tamperingmethod-tamperdastMethod tampering——Active
Open redirectopen-redirectdastRedirects——Active
AWS access-key ID literal in Python sourcepython-aws-access-key-id-literalsemgrepSecretsCRITICALCWE-798Passive
Command execution with user-controlled inputpython-command-injection-shell-truesemgrepInjectionCRITICALCWE-78Passive
eval() or exec() with a dynamic argumentpython-eval-injectionsemgrepInjectionCRITICALCWE-95Passive
Inline GCP service-account JSON in Python sourcepython-gcp-service-account-inlinesemgrepSecretsCRITICALCWE-798Passive
Hardcoded database URL with embedded credentialspython-hardcoded-db-urlsemgrepSecretsHIGHCWE-214Passive
Hardcoded secret in a Python assignmentpython-hardcoded-secret-assignmentsemgrepSecretsCRITICALCWE-798Passive
JWT decoded without signature verificationpython-jwt-decode-no-verificationsemgrepAuthenticationCRITICALCWE-347Passive
Legacy symmetric cipher imported (DES, 3DES, RC4, ARC2, Blowfish)python-legacy-cipher-importsemgrepSecretsHIGHCWE-327Passive
hashlib.md5() on a password variablepython-md5-used-for-passwordsemgrepSecretsHIGHCWE-327Passive
PEM private key literal in Python sourcepython-pem-private-key-literalsemgrepSecretsCRITICALCWE-798Passive
pickle.loads() on a non-literal byte stringpython-pickle-loads-untrustedsemgrepInjectionHIGHCWE-502Passive
random module used for a security-sensitive valuepython-random-for-token-generationsemgrepSecretsHIGHCWE-338Passive
hashlib.sha1() on a password variablepython-sha1-used-for-passwordsemgrepSecretsHIGHCWE-327Passive
Hardcoded Slack incoming-webhook URLpython-slack-webhook-url-literalsemgrepSecretsHIGHCWE-798Passive
SQL query built with string formattingpython-sql-injection-string-formatsemgrepInjectionCRITICALCWE-89Passive
subprocess with shell=True and a non-literal commandpython-subprocess-shell-true-with-variablesemgrepInjectionCRITICALCWE-78Passive
yaml.load() without SafeLoaderpython-yaml-load-unsafesemgrepInjectionHIGHCWE-502Passive
Rate limitingratelimitdastRate limiting——Passive
Anthropic API key hardcodedsecrets/ANTHROPIC_API_KEYsecretsSecretsCRITICALCWE-798Passive
AWS Access Key ID hardcodedsecrets/AWS_ACCESS_KEYsecretsSecretsCRITICALCWE-798Passive
AWS Secret Access Key hardcodedsecrets/AWS_SECRET_KEYsecretsSecretsCRITICALCWE-798Passive
Database connection string with credentialssecrets/DB_CONNECTION_STRINGsecretsSecretsHIGHCWE-214Passive
Hardcoded credential in .env filesecrets/ENV_SECRETsecretsSecretsHIGHCWE-798Passive
GCP service-account JSON key hardcodedsecrets/GCP_SERVICE_ACCOUNTsecretsSecretsCRITICALCWE-798Passive
Hardcoded API key or tokensecrets/GENERIC_API_KEYsecretsSecretsHIGHCWE-798Passive
GitHub token hardcodedsecrets/GITHUB_TOKENsecretsSecretsCRITICALCWE-798Passive
Google API key hardcodedsecrets/GOOGLE_API_KEYsecretsSecretsHIGHCWE-798Passive
Hardcoded password in source codesecrets/HARDCODED_PASSWORDsecretsSecretsHIGHCWE-259Passive
Hardcoded secret value in config-style assignmentsecrets/HARDCODED_SECRET_CONFIGsecretsSecretsHIGHCWE-798Passive
Hardcoded JWT tokensecrets/JWT_TOKENsecretsSecretsHIGHCWE-798Passive
Hardcoded JWT tokensecrets/JWT_TOKEN_HEADERsecretsSecretsHIGHCWE-798Passive
npm registry token hardcodedsecrets/NPM_TOKENsecretsSecretsHIGHCWE-798Passive
OpenAI API key hardcodedsecrets/OPENAI_API_KEYsecretsSecretsCRITICALCWE-798Passive
Private key material hardcodedsecrets/PRIVATE_KEYsecretsSecretsCRITICALCWE-321Passive
Slack token hardcodedsecrets/SLACK_TOKENsecretsSecretsHIGHCWE-798Passive
Stripe live secret key hardcodedsecrets/STRIPE_LIVE_KEYsecretsSecretsCRITICALCWE-798Passive
Server-side request forgeryssrfdastSSRF——Active
Reflected cross-site scriptingxssdastInjection——Active
Authentication enforcementauth
Analyzer
dast
Category
Authentication bypass
Severity
—
CWE
—
Execution
Authenticated
Authentication
One credential
Sensitive data exposureexposure
Analyzer
dast
Category
Data exposure
Severity
—
CWE
—
Execution
Passive
Authentication
Not required
GraphQL exposuregraphql
Analyzer
dast
Category
GraphQL
Severity
—
CWE
—
Execution
Active
Authentication
Not required
Security headersheaders
Analyzer
dast
Category
Headers
Severity
—
CWE
—
Execution
Passive
Authentication
Not required
Host header injectionhost-header
Analyzer
dast
Category
Host header
Severity
—
CWE
—
Execution
Active
Authentication
Not required
Cross-user object accessidor
Analyzer
dast
Category
Object authorization
Severity
—
CWE
—
Execution
Two-user
Authentication
Two identities
Injection probesinjection
Analyzer
dast
Category
Injection
Severity
—
CWE
—
Execution
Active
Authentication
Not required
HTTP method tamperingmethod-tamper
Analyzer
dast
Category
Method tampering
Severity
—
CWE
—
Execution
Active
Authentication
Not required
Open redirectopen-redirect
Analyzer
dast
Category
Redirects
Severity
—
CWE
—
Execution
Active
Authentication
Not required
yaml.load() without SafeLoaderpython-yaml-load-unsafe
Analyzer
semgrep
Category
Injection
Severity
HIGH
CWE
CWE-502
Execution
Passive
Authentication
Not required
Rate limitingratelimit
Analyzer
dast
Category
Rate limiting
Severity
—
CWE
—
Execution
Passive
Authentication
Not required
Anthropic API key hardcodedsecrets/ANTHROPIC_API_KEY
Analyzer
secrets
Category
Secrets
Severity
CRITICAL
CWE
CWE-798
Execution
Passive
Authentication
Not required
AWS Access Key ID hardcodedsecrets/AWS_ACCESS_KEY
Analyzer
secrets
Category
Secrets
Severity
CRITICAL
CWE
CWE-798
Execution
Passive
Authentication
Not required
Hardcoded API key or tokensecrets/GENERIC_API_KEY
Analyzer
secrets
Category
Secrets
Severity
HIGH
CWE
CWE-798
Execution
Passive
Authentication
Not required
GitHub token hardcodedsecrets/GITHUB_TOKEN
Analyzer
secrets
Category
Secrets
Severity
CRITICAL
CWE
CWE-798
Execution
Passive
Authentication
Not required
Google API key hardcodedsecrets/GOOGLE_API_KEY
Analyzer
secrets
Category
Secrets
Severity
HIGH
CWE
CWE-798
Execution
Passive
Authentication
Not required
Hardcoded JWT tokensecrets/JWT_TOKEN
Analyzer
secrets
Category
Secrets
Severity
HIGH
CWE
CWE-798
Execution
Passive
Authentication
Not required
Hardcoded JWT tokensecrets/JWT_TOKEN_HEADER
Analyzer
secrets
Category
Secrets
Severity
HIGH
CWE
CWE-798
Execution
Passive
Authentication
Not required
npm registry token hardcodedsecrets/NPM_TOKEN
Analyzer
secrets
Category
Secrets
Severity
HIGH
CWE
CWE-798
Execution
Passive
Authentication
Not required
OpenAI API key hardcodedsecrets/OPENAI_API_KEY
Analyzer
secrets
Category
Secrets
Severity
CRITICAL
CWE
CWE-798
Execution
Passive
Authentication
Not required
Slack token hardcodedsecrets/SLACK_TOKEN
Analyzer
secrets
Category
Secrets
Severity
HIGH
CWE
CWE-798
Execution
Passive
Authentication
Not required

Catalog boundaries

Dependency advisories and third-party plugin findings are data-dependent, so they do not form a finite rule list. The Python engine also has producer-side rule identifiers that v3.7.0 finalization does not preserve as durable report rule IDs. This catalog does not present those identifiers as stable public check IDs. Their execution and coverage remain visible in the Analyzer Registry.

Open the Analyzer Registry