What the checks look at
How many checks are there?
A report runs 34 checks against what your app shows to any visitor, and 84 more that read your code once you connect the app’s repository. The report lists them as the questions they answer: 129 in all, below.
What do the checks not look at?
Pages and APIs behind a sign-in, your business rules, attacks and load tests, your live cloud account, and the build of a mobile or desktop app.
Servers in other languages than JavaScript and TypeScript, code in packages your repository does not contain, and what route middleware in Express and Hono does with a token or key.
Code in your repository counts as live, even when it is no longer deployed. A report without findings says nothing about these parts.
All 129 questions
Your website34
- Does your app answer, and how fast?
- Is the certificate valid, trusted and far from expiring?
- Do your pages ask browsers to protect them?
- Can scripts or other sites read your session cookies?
- Do secure pages load anything over an insecure connection?
- Are search engines told what they may list?
- Are secret keys or passwords in what browsers download?
- Can anyone download files like .env or .git?
- Are backups, database exports or folder listings reachable?
- Does your API answer requests from any website?
- Can your database tables be read without signing in?
- Can strangers sign up as someone else, or without an account?
- Does your file storage show strangers what it holds?
- Do your pages load libraries with known flaws?
- Can someone send email that claims to come from you?
- Is your domain registration close to expiring?
- Do old subdomains point at services that are gone?
- Is your app running in development mode?
- Do your pages load scripts from hijacked domains?
- Does your http address switch to https?
- Do forms send passwords unencrypted or in the address?
- Are keys or tokens written into your page’s links?
- Would your Content Security Policy stop an injected script?
- Can a shared cache hand one visitor’s sign-in to another?
- Does your GraphQL API describe itself to strangers?
- Can your Firebase database be read without signing in?
- Does your server still accept outdated encryption?
- Do files from other websites load without a fingerprint?
- Does your app run a framework version with known flaws?
- Can files with passwords or keys be downloaded?
- Are admin panels or status pages open to anyone?
- Does your file storage list its files to anyone?
- Can someone claim one of your subdomains?
- Can a link on your address send visitors on to any other website?
Who can reach which data27
- Can anyone change or delete data without signing in?
- Can signed-in users reach other customers’ records?
- Can users give themselves more rights?
- Does the request get to say which user it is?
- Can users make themselves admins or give themselves a paid plan?
- Can someone pose as another user with a made-up cookie or token?
- Can anyone send your app fake sign-in events?
- Can someone make their own sign-in tokens, or reuse expired ones?
- Can any website use your API as a signed-in user?
- Are passwords stored so they can be read or cracked?
- Can reset links or invite codes be guessed?
- Can passwords and codes be guessed without limit?
- Is data encrypted with a weak method or a key in the code?
- Do passwords, keys or sign-in details end up in your logs?
- Is the key that signs sessions written into your code?
- Can scripts read the session cookie, or can it travel unencrypted?
- Can a link from another site change your users’ data?
- Can another site finish a sign-in with another service for your users?
- Can the caller choose the key behind their sign-in token?
- Can a shared cache return another owner’s private data?
- Do your database rules let anyone change other people’s data?
- Do your Firebase rules let strangers read or change data?
- Do database views show rows your rules hide?
- Can anyone call a database function that skips your rules?
- Do your database rules trust a field users can edit?
- Can the browser read your users’ sign-in records?
- Can people upload files without signing in?
Where money can leak6
What a request can make your server do24
- Can strangers use your AI features on your bill?
- Can the browser pick which AI model you pay for?
- Can a request send your server to any address?
- Can a request choose what your server runs?
- Can a request rewrite a database query?
- Can a request open files outside their folder?
- Can a link on your domain send visitors elsewhere?
- Can a request make your server run its own code?
- Can anyone start your scheduled jobs?
- Do your endpoints send back keys or error internals?
- Can a signature be worked out by timing your checks?
- Can outside text run as code on your pages?
- Can text your AI reads make its tools do harm?
- Does your server check who it connects to?
- Can any website send your pages messages they act on?
- Can a request send your database a search command instead of a value?
- Can anyone send your app fake events from GitHub, Shopify or Slack?
- Can one request stall your server with a search pattern?
- Can a webhook act after its signature check fails?
- Can request keys change properties inherited by other objects?
- Can uploaded archive paths write outside their destination?
- Can anyone use your app to fetch images from any website?
- Can SVG images you serve run scripts?
- Can other websites trigger your app’s actions?
What your repository carries38
- Do the libraries you install have known flaws?
- Are secret keys written into your repository?
- Are private keys named so they ship to the browser?
- Can a stranger run commands in your GitHub Actions?
- Does your build copy every environment variable into the browser code?
- Are keys or database dumps in the folder your site publishes?
- Is infrastructure state with passwords in your repository?
- Do your workflows use an action release known to be malicious?
- An explicit request to run a container with elevated host privileges
- An explicit request for the host network instead of a separate container network
- An explicit request to share the host process namespace
- An explicit request to share the host communication namespace
- An explicit request for engine API access or a host socket for Docker, containerd or CRI-O
- A bind mount of the whole host root into a container
- An explicit addition of SYS_ADMIN or all Linux capabilities
- An explicit unconfined seccomp profile
- An explicit unconfined AppArmor profile
- An explicit root user or user ID zero, rather than an inferred image default
- Reads unconditional S3 bucket policy grants to a wildcard principal.
- Reads unconditional S3 bucket policy grants allowing public object changes.
- Reads explicitly enabled S3 public canned ACLs without a local ACL block.
- Reads world-wide TCP ingress that includes SSH or Remote Desktop ports.
- Reads worldwide TCP ingress to common database and cache service ports.
- Reads explicit PubliclyAccessible true on standalone RDS instances and Multi-AZ clusters.
- Reads explicit StorageEncrypted false on standalone RDS instances and provisioned clusters.
- Reads explicit BackupRetentionPeriod zero on a standalone RDS instance.
- Reads unconditional Action and Resource wildcard grants in IAM identity policies.
- Reads unconditional role trust allowing a wildcard AWS principal to assume the role.
- Finds GitHub Actions jobs that explicitly request write-all permissions.
- Finds literal self-hosted pull_request jobs that check out and execute pull request code.
- Reads the final literal strict-ssl setting in each committed .npmrc.
- Finds final HTTP registry settings in .npmrc, including package scopes, except loopback hosts.
- Finds remote actions and reusable workflows without a full commit SHA and Docker steps without an image digest.
- Finds explicit Encrypted=false on CloudFormation EBS volumes.
- Finds explicit TransitEncryptionEnabled=false on CloudFormation ElastiCache replication groups.
- Finds explicit AtRestEncryptionEnabled=false on CloudFormation ElastiCache replication groups.
- Finds explicit IsLogging=false on unconditional CloudFormation CloudTrail trails.
- Finds literal allow-all viewer protocol policies on enabled CloudFormation CloudFront distributions.