Skip to content
Vulnetix DocsSAST

SAST rules index

Every built-in Rego rule the Vulnetix CLI ships, filterable by language, severity, kind and CWE.

Updated 02 Nov 2026Checked against cli@de9b52a

The CLI embeds 1899 rules from internal/sast/rules/. vulnetix sast runs the 793 of kind sast; the other kinds run under their own commands and under vulnetix scan. Print the same list from the binary you have with vulnetix sast --list-default-rules.

Kind Rules Command
iac 7 vulnetix iac
oci 7 vulnetix containers
sast 793 vulnetix sast
secrets 1092 vulnetix secrets
Severity Rules
Critical 447
High 731
Medium 459
Low 262

Rule counts by language (a rule that names several languages counts once in each):

Language Rules
Android 5
Any file 1106
C 153
C# 48
C++ 156
Config files 3
Dockerfile 20
Go 163
HTML 15
Java 331
JavaScript / TypeScript 274
Kotlin 64
Kubernetes 1
Perl 2
PHP 126
PowerShell 2
Properties 1
Python 345
Ruby 81
Rust 17
Scala 1
Shell 17
SQL 1
Swift 7
Terraform 12
XML 4
YAML 2

Catalog secret rules (VNX-SEC-081 and up) link to a row on their category page; every other rule has its own page.

Find a rule

1899 rules
RuleNameSeverityKindLanguagesCWE
VNX-15External Control of System or Configuration SettingMediumsastGo, Java, JavaScript / TypeScript, PHP, PythonCWE-15
VNX-20Input validation performed but its result ignored or bypassedMediumsastGo, Java, JavaScript / TypeScript, PythonCWE-20
VNX-41Improper Resolution of Path EquivalenceMediumsastGo, Java, JavaScript / TypeScript, PythonCWE-41
VNX-59Improper Link Resolution Before File Access ('Link Following')HighsastC, C++, Go, PythonCWE-59
VNX-66Improper Handling of File Names that Identify Virtual ResourcesMediumsastC#, Go, Java, PythonCWE-66
VNX-73External Control of File Name or PathHighsastPHP, PythonCWE-73
VNX-76Improper Neutralization of Equivalent Special ElementsMediumsastJava, JavaScript / TypeScript, PHP, PythonCWE-76
VNX-91XML InjectionMediumsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-91
VNX-93CRLF Injection into mail or protocol headersMediumsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-93
VNX-94Code InjectionCriticalsastJavaScript / TypeScript, PHP, Python, RubyCWE-94
VNX-95Template Injection (Eval Injection)CriticalsastJavaScript / TypeScript, Python, RubyCWE-95
VNX-98PHP Remote File InclusionCriticalsastPHPCWE-98
VNX-112Missing XML ValidationHighsastJava, JavaScript / TypeScript, PythonCWE-112
VNX-114Process Control: request chooses the library or module loadedMediumsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-114
VNX-115Misinterpretation of InputMediumsastJavaScript / TypeScript, PHP, PythonCWE-115
VNX-117Improper Output Neutralization for LogsHighsastJava, JavaScript / TypeScript, PythonCWE-117
VNX-122Heap-based buffer overflow from an undersized string allocationMediumsastC, C++CWE-122
VNX-124Buffer Underwrite ('Buffer Underflow')HighsastC, C++CWE-124
VNX-125Out-of-bounds ReadHighsastC, C++CWE-125
VNX-128Wrap-around ErrorMediumsastC, C++CWE-128
VNX-130Improper Handling of Length Parameter InconsistencyHighsastC, C++CWE-130
VNX-135Incorrect Calculation of Multi-Byte String LengthMediumsastC, C++CWE-135
VNX-140Improper Neutralization of DelimitersMediumsastJavaScript / TypeScript, PythonCWE-140
VNX-166Improper Handling of Missing Special ElementLowsastJavaScript / TypeScript, PythonCWE-166
VNX-167Improper Handling of Additional Special ElementLowsastPython, JavaScript / TypeScriptCWE-167
VNX-168Improper Handling of Inconsistent Special ElementsLowsastPython, JavaScript / TypeScript, Java, Go, PHPCWE-168
VNX-170Improper Null TerminationHighsastC, C++CWE-170
VNX-178Improper Handling of Case SensitivityLowsastGo, Java, JavaScript / TypeScript, Python, PHPCWE-178
VNX-179Incorrect Behavior Order: Early ValidationMediumsastJava, Python, JavaScript / TypeScript, Go, PHPCWE-179
VNX-182Collapse of Data into Unsafe ValueMediumsastPython, JavaScript / TypeScript, Java, C#, Go, PHPCWE-182
VNX-183Permissive List of Allowed InputsMediumsastJava, JavaScript / TypeScript, Python, Go, PHPCWE-183
VNX-184Incomplete List of Disallowed InputsMediumsastGo, Java, JavaScript / TypeScript, Python, PHPCWE-184
VNX-186Overly Restrictive Regular ExpressionMediumsastJava, JavaScript / TypeScript, Python, PHP, RubyCWE-186
VNX-191Integer Underflow (Wrap or Wraparound)HighsastC, C++CWE-191
VNX-192Integer Coercion ErrorMediumsastGo, Java, C, C++CWE-192
VNX-193Off-by-one ErrorMediumsastC, C++CWE-193
VNX-194Unexpected Sign ExtensionMediumsastC, C++, JavaCWE-194
VNX-201Insertion of Sensitive Information Into Sent DataMediumsastGo, Java, JavaScript / TypeScript, PythonCWE-201
VNX-204Observable Response DiscrepancyLowsastGo, Java, JavaScript / TypeScript, Python, PHP, Ruby, C#CWE-204
VNX-205Observable Behavioral DiscrepancyLowsastPython, JavaScript / TypeScriptCWE-205
VNX-209Generation of Error Message Containing Sensitive InformationMediumsastJava, JavaScript / TypeScript, Python, PHP, Go, C#CWE-209
VNX-210Self-generated Error Message Containing Sensitive InformationLowsastGo, Java, JavaScript / TypeScript, PythonCWE-210
VNX-212Improper Removal of Sensitive Information Before Storage or TransferMediumsastGo, JavaScript / TypeScript, PHP, PythonCWE-212
VNX-213Exposure of Sensitive Information Due to Incompatible PoliciesMediumsastGo, Java, JavaScript / TypeScript, PythonCWE-213
VNX-214Invocation of Process Using Visible Sensitive InformationMediumsastJavaScript / TypeScript, Python, Go, Java, PHP, C#, Shell, DockerfileCWE-214
VNX-215Insertion of Sensitive Information Into Debugging CodeMediumsastJavaScript / TypeScript, Python, C#, Dockerfile, ShellCWE-215
VNX-222Truncation of Security-relevant InformationMediumsastC, C++CWE-222
VNX-223Omission of Security-relevant InformationLowsastPythonCWE-223
VNX-224Obscured Security-relevant Information by Alternate NameMediumsastJavaScript / TypeScript, PythonCWE-224
VNX-227Improper Fulfillment of API Contract: security verification result ignoredMediumsastC, C++, Go, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-227
VNX-229Improper Handling of ValuesLowsastJavaScript / TypeScript, PythonCWE-229
VNX-233Improper Handling of ParametersLowsastPythonCWE-233
VNX-237Improper Handling of Structural ElementsLowsastJavaScript / TypeScript, PythonCWE-237
VNX-241Improper Handling of Unexpected Data TypeLowsastPythonCWE-241
VNX-242Use of Inherently Dangerous FunctionHighsastC, C++CWE-242
VNX-243Creation of chroot Jail Without Changing Working DirectoryMediumsastC, C++, Go, Python, Ruby, RustCWE-243
VNX-244Secret left in heap memory when it is releasedMediumsastC, C++, JavaCWE-244
VNX-248Request input parsed without catching the parse exceptionLowsastJava, PythonCWE-248
VNX-252Unchecked Return ValueMediumsastC, C++, GoCWE-252
VNX-253Incorrect Check of Function Return ValueLowsastC, C++CWE-253
VNX-256Plaintext Storage of a PasswordHighsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-256
VNX-257Storing Passwords in a Recoverable FormatHighsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-257
VNX-259Hard-coded password passed to an authentication or connection APICriticalsastC#, Go, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-259
VNX-260Password in Configuration FileHighsastAny fileCWE-260
VNX-261Weak Encoding for PasswordHighsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-261
VNX-262Not Using Password AgingMediumsastJava, JavaScript / TypeScript, Python, Terraform, Shell, Dockerfile, PowerShellCWE-262
VNX-263Password Aging with Long ExpirationLowsastPython, JavaScript / TypeScript, Java, Terraform, Shell, Dockerfile, PowerShellCWE-263
VNX-266Incorrect Privilege AssignmentHighsastC, C++, PythonCWE-266
VNX-267Privilege Defined With Unsafe ActionsMediumsastC, C++, Shell, Dockerfile, Any fileCWE-267
VNX-268Privilege ChainingLowsastC, C++, PythonCWE-268
VNX-269Improper Privilege ManagementHighsastC, C++, PythonCWE-269
VNX-270Privilege Context Switching ErrorLowsastC, C++, PythonCWE-270
VNX-272Least Privilege ViolationMediumsastC, C++, Python, GoCWE-272
VNX-273Improper Check for Dropped PrivilegesMediumsastC, C++, Go, Rust, PHPCWE-273
VNX-274Improper Handling of Insufficient PrivilegesLowsastC, C++, Python, Go, PHPCWE-274
VNX-276Incorrect Default PermissionsMediumsastC, C++, Python, Go, PHP, JavaScript / TypeScript, Ruby, Java, Rust, Shell, Dockerfile, YAMLCWE-276
VNX-277Insecure Inherited PermissionsLowsastC, C++, Python, Go, PHP, Ruby, JavaScript / TypeScript, Rust, Shell, Dockerfile, C#CWE-277
VNX-278Insecure Preserved Inherited PermissionsLowsastC, C++, Python, Go, RustCWE-278
VNX-279Incorrect Execution-Assigned PermissionsMediumsastC, C++, Python, Go, PHP, JavaScript / TypeScript, Ruby, Rust, Shell, Dockerfile, YAMLCWE-279
VNX-280Improper Handling of Insufficient Permissions or Privileges LowsastC, C++, Python, GoCWE-280
VNX-281Improper Preservation of PermissionsLowsastC, C++CWE-281
VNX-283Unverified OwnershipMediumsastC, C++CWE-283
VNX-287Improper Authentication: check that always succeedsHighsastJava, JavaScript / TypeScript, PythonCWE-287
VNX-289Authentication Bypass by Alternate NameHighsastJava, JavaScript / TypeScript, PythonCWE-289
VNX-290Authentication Bypass by SpoofingHighsastJava, JavaScript / TypeScript, PythonCWE-290
VNX-294Authentication Bypass by Capture-replayHighsastJava, JavaScript / TypeScript, PythonCWE-294
VNX-301Reflection Attack in an Authentication ProtocolMediumsastJava, PythonCWE-301
VNX-303Incorrect Implementation of Authentication AlgorithmMediumsastJava, JavaScript / TypeScript, PythonCWE-303
VNX-305Authentication Bypass by Primary WeaknessHighsastJava, JavaScript / TypeScript, PythonCWE-305
VNX-306Missing Authentication for Critical FunctionHighsastPythonCWE-306
VNX-308Use of Single-factor AuthenticationMediumsastJava, JavaScript / TypeScript, Python, TerraformCWE-308
VNX-309Use of Password System for Primary AuthenticationMediumsastJava, JavaScript / TypeScript, PHP, PythonCWE-309
VNX-315Cleartext Storage of Sensitive Information in a CookieMediumsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-315
VNX-319Cleartext Transmission of Sensitive InformationHighsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-319
VNX-321Hard-coded cryptographic keyHighsastGo, Java, JavaScript / TypeScript, PythonCWE-321
VNX-323Reusing a Nonce, Key Pair in EncryptionMediumsastGo, Java, JavaScript / TypeScript, PythonCWE-323
VNX-324Use of a Key Past its Expiration DateMediumsastJava, Kotlin, JavaScript / TypeScript, Python, Ruby, C, C++CWE-324
VNX-325Missing Cryptographic StepMediumsastJava, Kotlin, JavaScript / TypeScript, PHP, Python, RubyCWE-325
VNX-326Inadequate Encryption Strength (undersized DSA, DH, EC or symmetric key)HighsastGo, Java, Kotlin, JavaScript / TypeScript, PHP, Python, RubyCWE-326
VNX-327Broken hash algorithm (MD5, SHA-1) protecting a password, token or signatureHighsastJava, Kotlin, JavaScript / TypeScript, PHP, Python, RubyCWE-327
VNX-329Predictable IV derived from the key or a non-cryptographic generatorHighsastGo, Java, Kotlin, JavaScript / TypeScript, PythonCWE-329
VNX-331Insufficient EntropyMediumsastJava, Kotlin, JavaScript / TypeScript, PHP, Python, RubyCWE-331
VNX-334Small Space of Random ValuesMediumsastJava, Kotlin, JavaScript / TypeScript, PHP, Python, RubyCWE-334
VNX-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)HighsastJava, Kotlin, PythonCWE-335
VNX-336Same Seed in Pseudo-Random Number Generator (PRNG)MediumsastPython, Java, Kotlin, Go, C, C++, PHP, Ruby, JavaScript / TypeScriptCWE-336
VNX-337Predictable Seed in Pseudo-Random Number Generator (PRNG)MediumsastPython, Java, Kotlin, Go, C, C++, PHP, Ruby, JavaScript / TypeScriptCWE-337
VNX-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)HighsastJavaScript / TypeScript, PHP, Ruby, GoCWE-338
VNX-339Small Seed Space in Pseudo-Random Number Generator (PRNG)MediumsastPython, Java, Kotlin, Go, C, C++, PHP, Ruby, JavaScript / TypeScriptCWE-339
VNX-340Generation of Predictable Numbers or IdentifiersMediumsastPython, JavaScript / TypeScript, PHP, Go, Java, Kotlin, RubyCWE-340
VNX-341Predictable from Observable StateMediumsastC, C++, Python, JavaScript / TypeScript, PHP, Java, Kotlin, Go, RubyCWE-341
VNX-342Predictable Exact Value from Previous ValuesMediumsastJava, Kotlin, Python, JavaScript / TypeScript, PHP, Ruby, GoCWE-342
VNX-343Predictable Value Range from Previous ValuesMediumsastPython, Java, Kotlin, JavaScript / TypeScript, PHP, Ruby, Go, C, C++CWE-343
VNX-344Use of Invariant Value in Dynamically Changing ContextMediumsastGo, Java, JavaScript / TypeScript, Python, PHP, HTMLCWE-344
VNX-345Insufficient Verification of Data AuthenticityMediumsastPythonCWE-345
VNX-346Origin Validation ErrorMediumsastJavaScript / TypeScript, Python, Java, GoCWE-346
VNX-347Improper Verification of Cryptographic SignatureHighsastGo, Java, JavaScript / TypeScript, PythonCWE-347
VNX-348Use of Less Trusted SourceMediumsastC#, Go, Java, Kotlin, JavaScript / TypeScript, PHP, Python, RubyCWE-348
VNX-349Acceptance of Extraneous Untrusted Data With Trusted DataMediumsastJava, JavaScript / TypeScript, PythonCWE-349
VNX-350Reliance on Reverse DNS Resolution for a Security-Critical ActionMediumsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-350
VNX-351Insufficient Type DistinctionLowsastPHPCWE-351
VNX-352Cross-Site Request Forgery protection disabled (Django, Flask-WTF, Node.js, Rails)HighsastJavaScript / TypeScript, Python, RubyCWE-352
VNX-353Third-party script or stylesheet loaded without Subresource IntegrityMediumsastHTML, PHPCWE-353
VNX-354Integrity check value validated so that a missing, partial or truncated value passesMediumsastJava, JavaScript / TypeScript, PythonCWE-354
VNX-356Electron app silently grants permissions or accepts invalid certificatesLowsastJavaScript / TypeScriptCWE-356
VNX-357Destructive link or button without a confirmation stepLowsastRuby, HTMLCWE-357
VNX-358Hand-rolled TLS host name or certificate identity check uses a partial string matchLowsastJava, PythonCWE-358
VNX-359Private personal information written to logs or standard outputMediumsastJava, JavaScript / TypeScript, PythonCWE-359
VNX-360Android receiver for a system broadcast trusts the intent without checking its actionLowsastAndroid, Java, KotlinCWE-360
VNX-362Check-then-use race on a file path (TOCTOU)MediumsastGo, PythonCWE-362
VNX-363Race condition enabling link following (symlink check, then open by name)MediumsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-363
VNX-364Signal Handler Race ConditionMediumsastC, C++CWE-364
VNX-366Race Condition within a ThreadLowsastJavaCWE-366
VNX-367Time-of-check Time-of-use (TOCTOU) Race ConditionMediumsastC, C++CWE-367
VNX-368Context Switching Race ConditionLowsastC, C++CWE-368
VNX-369Divide By ZeroMediumsastC, C++, Go, JavaCWE-369
VNX-372Incomplete Internal State DistinctionLowsastPython, PHP, JavaScript / TypeScriptCWE-372
VNX-374Passing Mutable Objects to an Untrusted MethodLowsastJavaCWE-374
VNX-375Returning a Mutable Object to an Untrusted CallerLowsastJavaCWE-375
VNX-378Creation of Temporary File With Insecure PermissionsHighsastC, C++CWE-378
VNX-379Creation of Temporary File in Directory with Insecure PermissionsMediumsastPythonCWE-379
VNX-384Session FixationMediumsastJava, XMLCWE-384
VNX-385Covert Timing ChannelLowsastJava, JavaScript / TypeScript, PythonCWE-385
VNX-386Symbolic Name not Mapping to Correct ObjectLowsastJavaCWE-386
VNX-390Detection of Error Condition Without ActionLowsastJavaCWE-390
VNX-391Unchecked Error ConditionMediumsastJava, PythonCWE-391
VNX-392Missing Report of Error ConditionLowsastPythonCWE-392
VNX-393Return of Wrong Status CodeLowsastJavaCWE-393
VNX-394Unexpected Status Code or Return ValueLowsastPythonCWE-394
VNX-395Use of NullPointerException Catch to Detect NULL Pointer DereferenceMediumsastJava, Kotlin, C#CWE-395
VNX-396Declaration of Catch for Generic ExceptionLowsastJava, C#CWE-396
VNX-397Declaration of Throws for Generic ExceptionLowsastJavaCWE-397
VNX-400Uncontrolled Resource Consumption from a request-supplied sizeMediumsastPythonCWE-400
VNX-401Missing Release of Memory after Effective Lifetime (memory leak)MediumsastC, C++CWE-401
VNX-403Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')MediumsastC, C++CWE-403
VNX-404Improper Resource Shutdown or ReleaseLowsastJavaCWE-404
VNX-408Incorrect Behavior Order: Early AmplificationMediumsastJavaScript / TypeScript, PythonCWE-408
VNX-409Improper Handling of Highly Compressed Data (Data Amplification)MediumsastJavaScript / TypeScript, PythonCWE-409
VNX-410Insufficient Resource PoolLowsastJava, Any fileCWE-410
VNX-412Unrestricted Externally Accessible LockMediumsastJavaCWE-412
VNX-413Improper Resource LockingLowsastJavaCWE-413
VNX-414Missing Lock CheckLowsastC, C++, Go, Java, PythonCWE-414
VNX-415Double freeHighsastC, C++CWE-415
VNX-416Use after free: stale pointer after realloc, or a pointer into a destroyed temporaryHighsastC, C++CWE-416
VNX-419Unprotected Primary ChannelMediumsastGo, Java, KotlinCWE-419
VNX-420Unprotected Alternate ChannelMediumsastC, C++, Go, PythonCWE-420
VNX-421Race Condition During Access to Alternate ChannelLowsastC, C++, Go, PythonCWE-421
VNX-425Direct Request ('Forced Browsing')MediumsastJavaScript / TypeScript, GoCWE-425
VNX-426Untrusted Search PathHighsastPythonCWE-426
VNX-427Uncontrolled Search Path ElementHighsastC, C++CWE-427
VNX-428Unquoted Search Path or ElementMediumsastC, C++, C#CWE-428
VNX-430Deployment of Wrong HandlerLowsastJavaScript / TypeScript, PythonCWE-430
VNX-431Missing HandlerLowsastJavaCWE-431
VNX-432Dangerous Signal Handler not Disabled During Sensitive OperationsLowsastC, C++CWE-432
VNX-437Incomplete Model of Endpoint FeaturesLowsastJavaScript / TypeScript, PythonCWE-437
VNX-439Behavioral Change in New Version or EnvironmentLowsastPythonCWE-439
VNX-440Expected Behavior ViolationLowsastPythonCWE-440
VNX-441Unintended proxy: request-chosen URL fetched and relayed to the clientMediumsastJavaScript / TypeScript, PythonCWE-441
VNX-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')MediumsastJavaScript / TypeScript, PythonCWE-444
VNX-447Unimplemented or Unsupported Feature in UILowsastJavaCWE-447
VNX-448Obsolete Feature in UILowsastJavaCWE-448
VNX-449The UI Performs the Wrong ActionLowsastC, C++CWE-449
VNX-450Multiple interpretations of input: a text flag read as a boolean by truthinessLowsastPython, JavaScript / TypeScriptCWE-450
VNX-451UI misrepresentation: hidden bidi controls in code, or a link that shows a different hostMediumsastAny fileCWE-451
VNX-453Insecure default: a security parameter defaults to its unsafe valueMediumsastPython, JavaScript / TypeScriptCWE-453
VNX-454External Initialization of Trusted Variables or Data StoresMediumsastPythonCWE-454
VNX-455Non-exit on Failed InitializationMediumsastC, C++CWE-455
VNX-457Use of Uninitialized VariableLowsastC, C++CWE-457
VNX-459Incomplete CleanupLowsastPythonCWE-459
VNX-460Improper Cleanup on Thrown ExceptionMediumsastJavaCWE-460
VNX-462Duplicate Key in Associative List (Alist)LowsastPythonCWE-462
VNX-463Deletion of Data Structure SentinelLowsastC, C++CWE-463
VNX-464Addition of Data Structure SentinelLowsastC, C++CWE-464
VNX-466Return of Pointer Value Outside of Expected RangeLowsastC, C++CWE-466
VNX-468Incorrect Pointer ScalingMediumsastC, C++CWE-468
VNX-469Use of Pointer Subtraction to Determine SizeLowsastC, C++CWE-469
VNX-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')HighsastJava, Python, RubyCWE-470
VNX-471Modification of Assumed-Immutable Data (MAID)MediumsastJavaCWE-471
VNX-472External Control of Assumed-Immutable Web ParameterMediumsastJavaScript / TypeScript, HTMLCWE-472
VNX-474Use of Function with Inconsistent ImplementationsMediumsastC, C++CWE-474
VNX-475Undefined Behavior for Input to APILowsastC, C++CWE-475
VNX-476NULL Pointer DereferenceMediumsastC, C++, JavaCWE-476
VNX-477Use of Obsolete FunctionLowsastJava, PythonCWE-477
VNX-478Missing Default Case in Multiple Condition ExpressionLowsastC, C++, JavaCWE-478
VNX-479Signal Handler Use of a Non-reentrant FunctionLowsastC, C++CWE-479
VNX-480Use of Incorrect OperatorMediumsastC, C++, JavaCWE-480
VNX-481Assigning instead of ComparingMediumsastC, C++, JavaCWE-481
VNX-482Comparing instead of AssigningMediumsastC, C++, JavaScript / TypeScript, PythonCWE-482
VNX-483Incorrect Block DelimitationLowsastC, C++, JavaCWE-483
VNX-484Omitted Break Statement in SwitchMediumsastC, C++, JavaCWE-484
VNX-486Comparison of Classes by NameMediumsastJava, C#, PythonCWE-486
VNX-487Reliance on Package-level ScopeLowsastJavaCWE-487
VNX-488Exposure of Data Element to Wrong SessionLowsastJavaCWE-488
VNX-491Public cloneable() Method Without Final ('Object Hijack')MediumsastJavaCWE-491
VNX-492Use of Inner Class Containing Sensitive DataLowsastJavaCWE-492
VNX-493Critical Public Variable Without Final ModifierLowsastJava, C#CWE-493
VNX-495Private Data Structure Returned From A Public MethodMediumsastJavaCWE-495
VNX-497Exposure of Sensitive System Information to an Unauthorized Control SphereMediumsastJavaCWE-497
VNX-498Cloneable Class Containing Sensitive InformationLowsastJavaCWE-498
VNX-499Serializable Class Containing Sensitive DataLowsastJavaCWE-499
VNX-500Public Static Field Not Marked FinalLowsastJava, C#CWE-500
VNX-501Trust Boundary ViolationMediumsastJava, PythonCWE-501
VNX-506Embedded Malicious Code: execution of decoded payloadMediumsastJavaScript / TypeScript, PythonCWE-506
VNX-511Logic/Time Bomb: destructive action gated on a hard-coded dateMediumsastJavaScript / TypeScript, PythonCWE-511
VNX-514Covert Channel: data encoded in sleep timing or DNS lookupsLowsastPythonCWE-514
VNX-515Covert Storage Channel: secret placed in the process environmentLowsastPythonCWE-515
VNX-521Weak Password RequirementsHighsastJava, JavaScript / TypeScript, Python, C#CWE-521
VNX-522Insufficiently Protected Credentials: credential file readable by other usersHighsastGo, Java, JavaScript / TypeScript, PythonCWE-522
VNX-523Unprotected Transport of CredentialsHighsastGo, Java, JavaScript / TypeScript, Python, HTMLCWE-523
VNX-524Use of Cache Containing Sensitive Information: plaintext password cachedMediumsastJava, JavaScript / TypeScript, PythonCWE-524
VNX-525Use of Web Browser Cache Containing Sensitive InformationMediumsastJavaScript / TypeScript, PythonCWE-525
VNX-532Insertion of Sensitive Information into Log File: whole request loggedMediumsastGo, Java, JavaScript / TypeScript, PythonCWE-532
VNX-536Servlet Runtime Error Message Containing Sensitive InformationMediumsastJavaCWE-536
VNX-538Insertion of Sensitive Information into Externally-Accessible File or DirectoryMediumsastJavaScript / TypeScript, PythonCWE-538
VNX-539Use of Persistent Cookies Containing Sensitive InformationMediumsastJavaScript / TypeScript, Python, Java, PHP, RubyCWE-539
VNX-540Inclusion of Sensitive Information in Source CodeMediumsastJavaScript / TypeScriptCWE-540
VNX-544Missing Standardized Error Handling MechanismLowsastJavaScript / TypeScriptCWE-544
VNX-546Suspicious CommentLowsastC, C++, Go, Java, JavaScript / TypeScript, PythonCWE-546
VNX-547Use of Hard-coded, Security-relevant ConstantsLowsastC, C++, JavaCWE-547
VNX-548Exposure of Information Through Directory ListingMediumsastJavaScript / TypeScript, Python, Java, Any fileCWE-548
VNX-549Missing Password Field MaskingMediumsastAny fileCWE-549
VNX-551Incorrect Behavior Order: Authorization Before Parsing and CanonicalizationLowsastJava, JavaScript / TypeScript, PythonCWE-551
VNX-553Command Shell in Externally Accessible DirectoryMediumsastShell, Dockerfile, Perl, PythonCWE-553
VNX-554ASP.NET Misconfiguration: Not Using Input Validation FrameworkMediumsastC#, XMLCWE-554
VNX-555J2EE Misconfiguration: Plaintext Password in Configuration FileMediumsastJava, XMLCWE-555
VNX-561Dead CodeLowsastJava, JavaScript / TypeScript, PythonCWE-561
VNX-562Return of Stack Variable AddressHighsastC, C++CWE-562
VNX-563Assignment to Variable without UseLowsastPythonCWE-563
VNX-565Reliance on Cookies without Validation and Integrity CheckingMediumsastJavaScript / TypeScript, PHP, PythonCWE-565
VNX-566Authorization Bypass Through User-Controlled SQL Primary KeyHighsastJava, PythonCWE-566
VNX-570Expression is Always FalseLowsastC, C++, Go, JavaCWE-570
VNX-571Expression is Always TrueLowsastC, C++, Go, JavaCWE-571
VNX-572Call to Thread run() instead of start()LowsastJava, KotlinCWE-572
VNX-573Remote URL read through an API that cannot set a timeoutMediumsastJava, KotlinCWE-573
VNX-578EJB Bad Practices: Use of Class LoaderLowsastJavaCWE-578
VNX-580clone() Method Without super.clone()MediumsastJavaCWE-580
VNX-581Object Model Violation: Just One of Equals and Hashcode DefinedMediumsastJava, KotlinCWE-581
VNX-582Array declared public, final and staticMediumsastJava, C#CWE-582
VNX-583finalize() method declared publicMediumsastJava, KotlinCWE-583
VNX-584Return Inside Finally BlockLowsastJava, JavaScript / TypeScript, PythonCWE-584
VNX-585Empty synchronized blockLowsastJava, KotlinCWE-585
VNX-586Explicit Call to Finalize()LowsastJavaCWE-586
VNX-587Assignment of a Fixed Address to a PointerLowsastC, C++CWE-587
VNX-588Attempt to access child of a non-structure pointerLowsastC, C++CWE-588
VNX-589Call to non-ubiquitous APILowsastC, C++CWE-589
VNX-591Password read into a char[] copied into an immutable StringLowsastJavaCWE-591
VNX-594Persisted or session-scoped Java class that is not SerializableLowsastJavaCWE-594
VNX-595Boxed number or value object compared by reference (== / !=)MediumsastJavaCWE-595
VNX-597String compared with == or != instead of equals()/strcmp()MediumsastJava, CCWE-597
VNX-598Credential or secret sent in a GET query stringMediumsastGo, Java, JavaScript / TypeScript, PHP, Python, HTMLCWE-598
VNX-600Servlet parses request input with no handler for the exceptionMediumsastJavaCWE-600
VNX-602Server trusts a client-supplied role or admin flagMediumsastJavaScript / TypeScript, Python, PHPCWE-602
VNX-603Authentication decided in browser codeMediumsastJavaScript / TypeScriptCWE-603
VNX-605Multiple Binds to the Same PortMediumsastC, C++, Go, PythonCWE-605
VNX-606Unchecked Input for Loop ConditionLowsastC, C++, Go, JavaCWE-606
VNX-607Public Static Final Field References Mutable ObjectLowsastJavaCWE-607
VNX-609Double-Checked LockingLowsastJavaCWE-609
VNX-610Externally Controlled Reference to a Resource in Another Sphere (XML external references enabled)MediumsastJavaCWE-610
VNX-614Sensitive Cookie in HTTPS Session Without 'Secure' AttributeHighsastJava, JavaScript / TypeScript, PythonCWE-614
VNX-615Inclusion of Sensitive Information in Source Code CommentsLowsastGo, Java, JavaScript / TypeScript, PythonCWE-615
VNX-617Reachable AssertionMediumsastPythonCWE-617
VNX-618ActiveX control marked safe for scripting, or unsafe control instantiated by a pageLowsastC, C++, HTML, JavaScript / TypeScriptCWE-618
VNX-619Database cursor opened in a function and never closed (Python DB-API)LowsastPythonCWE-619
VNX-620Password change that does not verify the current passwordHighsastC#, Java, JavaScript / TypeScript, PythonCWE-620
VNX-621Variable extraction from request data (PHP extract/parse_str/variable variables)MediumsastPHPCWE-621
VNX-622Client-supplied JSONP callback name written into the response unvalidatedMediumsastJavaScript / TypeScriptCWE-622
VNX-624Regular expression replacement evaluated as code (preg_replace /e, s///ee)MediumsastPHP, PerlCWE-624
VNX-625Permissive host/URL allow-list regular expressionMediumsastPython, JavaScript / TypeScript, Go, JavaCWE-625
VNX-626Request input with an appended file extension used as a file path (null byte truncation)MediumsastPHP, JavaCWE-626
VNX-627Dynamic Variable EvaluationHighsastPython, Ruby, PHP, JavaScript / TypeScriptCWE-627
VNX-628Function Call with Incorrectly Specified ArgumentsMediumsastC, C++CWE-628
VNX-635Unresolved security TODO/FIXME in production codeMediumsastGo, Java, Kotlin, JavaScript / TypeScript, PHP, Python, RubyCWE-635
VNX-636Not Failing Securely ('Failing Open')LowsastJava, JavaScript / TypeScript, PythonCWE-636
VNX-638Not Using Complete Mediation (cached authorization decision)MediumsastJava, JavaScript / TypeScript, PythonCWE-638
VNX-639Authorization Bypass Through User-Controlled KeyHighsastJava, JavaScript / TypeScript, Python, RubyCWE-639
VNX-640Weak Password Recovery Mechanism for Forgotten PasswordMediumsastJavaScript / TypeScript, Python, JavaCWE-640
VNX-641Improper Restriction of Names for Files and Other ResourcesLowsastJava, JavaScript / TypeScript, Python, PHPCWE-641
VNX-642Authorization state kept in a client-controlled cookieMediumsastJava, Kotlin, JavaScript / TypeScript, PythonCWE-642
VNX-643XPath injection: query built from a dynamic stringHighsastJava, PythonCWE-643
VNX-644HTTP response header set from request data without neutralisationMediumsastJavaScript / TypeScript, PythonCWE-644
VNX-645Overly Restrictive Account Lockout MechanismMediumsastJavaScript / TypeScript, PythonCWE-645
VNX-646Uploaded file accepted or classified by its client-supplied name or extensionMediumsastJavaScript / TypeScript, PythonCWE-646
VNX-647Authorization decided on a non-canonical request pathHighsastJava, Kotlin, JavaScript / TypeScript, PythonCWE-647
VNX-648Privilege drop in the wrong order or without clearing supplementary groupsMediumsastC, C++, PythonCWE-648
VNX-649Client-held state decoded or decrypted and trusted without an integrity checkMediumsastJavaScript / TypeScript, PythonCWE-649
VNX-651Exposure of WSDL File Containing Sensitive InformationMediumsastJava, Python, C#, XMLCWE-651
VNX-652XQuery injectionMediumsastJavaCWE-652
VNX-653Improper Isolation or CompartmentalizationLowsastPython, JavaScript / TypeScriptCWE-653
VNX-654Reliance on a Single Factor in a Security DecisionLowsastJavaScript / TypeScript, PythonCWE-654
VNX-656Reliance on Security Through ObscurityLowsastJavaScript / TypeScript, PythonCWE-656
VNX-657Violation of Secure Design PrinciplesLowsastJavaScript / TypeScript, PythonCWE-657
VNX-663Use of a Non-reentrant Function in a Concurrent ContextLowsastJava, C, C++CWE-663
VNX-665Improper InitializationLowsastJavaCWE-665
VNX-666HTTP response written after it was already sentLowsastJavaScript / TypeScriptCWE-666
VNX-667Improper locking: shared String/boxed monitor or Lock released outside finallyLowsastJavaCWE-667
VNX-671Application overrides an operator-controlled security switch in the environmentLowsastJavaScript / TypeScript, PythonCWE-671
VNX-672Operation on a file, socket, stream or connection after it was closedLowsastJavaScript / TypeScript, PythonCWE-672
VNX-673Control sphere (chroot jail, import or library search path) defined by remote inputLowsastPythonCWE-673
VNX-674Unconditional self-recursion or a disabled recursion guardMediumsastJava, JavaScript / TypeScript, PythonCWE-674
VNX-675Single-use operation repeated on the same handle (double close, relock, double unlock)LowsastC, C++CWE-675
VNX-676Use of Potentially Dangerous FunctionMediumsastC, C++CWE-676
VNX-680Integer Overflow to Buffer OverflowMediumsastC, C++CWE-680
VNX-681Incorrect Conversion between Numeric TypesMediumsastC, C++, JavaCWE-681
VNX-682Incorrect CalculationLowsastC, C++, JavaCWE-682
VNX-683Function Call With Incorrect Order of ArgumentsLowsastC, C++CWE-683
VNX-685Function Call With Incorrect Number of ArgumentsLowsastC, C++CWE-685
VNX-686Function Call With Incorrect Argument TypeLowsastC, C++CWE-686
VNX-687Function Call With Incorrectly Specified Argument ValueLowsastC, C++, Python, Go, PHP, JavaScript / TypeScript, RubyCWE-687
VNX-688Function Call With Incorrect Variable or Reference as ArgumentLowsastC, C++CWE-688
VNX-690Unchecked return value to NULL pointer dereferenceLowsastC, C++CWE-690
VNX-694Two route handlers registered under the same identifierLowsastPythonCWE-694
VNX-695Low-level functionality prohibited by the EJB specification used in an enterprise beanLowsastJavaCWE-695
VNX-697Incorrect comparison: compareTo() against 1/-1, equals(null), or equality with NaNLowsastJavaCWE-697
VNX-698Execution After Redirect (EAR)HighsastPHP, PythonCWE-698
VNX-703Optional value read with get() without checking that it is presentLowsastJavaCWE-703
VNX-704File or content size narrowed from long with an unchecked castLowsastJavaCWE-704
VNX-706Directory containment decided by a character prefix instead of a path prefixLowsastPythonCWE-706
VNX-708Incorrect Ownership AssignmentLowsastC, C++CWE-708
VNX-710Security-relevant compiler warning suppressed in sourceLowsastC, C++CWE-710
VNX-732Incorrect permission assignment for a critical resource (Python)HighsastPythonCWE-732
VNX-733Compiler Optimization Removal or Modification of Security-critical CodeLowsastC, C++CWE-733
VNX-749Dangerous capability exposed to WebView JavaScriptHighsastJava, KotlinCWE-749
VNX-754Class resource used without checking for nullLowsastJavaCWE-754
VNX-755Interrupt or JVM error caught and swallowedLowsastJavaCWE-755
VNX-756Framework traceback page served instead of a custom error pageLowsastPythonCWE-756
VNX-757TLS negotiation allows an obsolete protocol version or broken cipher suite (algorithm downgrade)HighsastGo, Java, PythonCWE-757
VNX-759Password hashed with a one-way hash and no saltHighsastJava, Python, PHP, JavaScript / TypeScriptCWE-759
VNX-760Password hash or KDF uses a constant or predictable saltHighsastGo, Java, JavaScript / TypeScript, PythonCWE-760
VNX-761free() of a pointer that is not at the start of its bufferLowsastC, C++CWE-761
VNX-762Memory released with a routine that does not match its allocatorLowsastC, C++CWE-762
VNX-763Release of a pointer that never came from the heapLowsastC, C++CWE-763
VNX-764Lock acquired again while it is already heldLowsastJava, GoCWE-764
VNX-765Lock released twice for one acquisitionLowsastJava, GoCWE-765
VNX-766Critical Data Element Declared PublicLowsastJavaCWE-766
VNX-767Access to Critical Private Variable via Public MethodLowsastJavaCWE-767
VNX-768Incorrect Short Circuit EvaluationLowsastJava, C#CWE-768
VNX-769Uncontrolled File Descriptor ConsumptionLowsastPythonCWE-769
VNX-770Allocation of Resources Without Limits or ThrottlingMediumsastJavaScript / TypeScript, PythonCWE-770
VNX-771Missing Reference to Active Allocated ResourceMediumsastC, C++CWE-771
VNX-772Missing Release of Resource after Effective LifetimeLowsastJavaCWE-772
VNX-775Missing Release of File Descriptor or Handle after Effective LifetimeLowsastPythonCWE-775
VNX-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')MediumsastPython, PHP, JavaScript / TypeScriptCWE-776
VNX-777Regular Expression without AnchorsMediumsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-777
VNX-778Insufficient LoggingLowsastPython, Java, Kotlin, JavaScript / TypeScript, Terraform, Config filesCWE-778
VNX-779Logging of Excessive DataLowsastJava, Kotlin, Python, JavaScript / TypeScript, Config filesCWE-779
VNX-780Use of RSA Algorithm without OAEPMediumsastJava, Kotlin, Python, JavaScript / TypeScript, Go, PHP, Ruby, C#CWE-780
VNX-781Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control CodeMediumsastC, C++CWE-781
VNX-783Operator Precedence Logic ErrorLowsastC, C++, Java, JavaScript / TypeScript, PHP, Python, C#CWE-783
VNX-784Reliance on Cookies without Validation and Integrity Checking in a Security DecisionMediumsastPython, JavaScript / TypeScript, PHP, Ruby, Java, Go, C#CWE-784
VNX-785Use of Path Manipulation Function without Maximum-sized BufferLowsastC, C++CWE-785
VNX-786Access of Memory Location Before Start of BufferMediumsastC, C++CWE-786
VNX-788Access of Memory Location After End of BufferHighsastC, C++CWE-788
VNX-789Memory Allocation with Excessive Size ValueMediumsastC, C++CWE-789
VNX-791Incomplete Filtering of Special ElementsMediumsastJavaScript / TypeScript, PythonCWE-791
VNX-792Incomplete Filtering of One or More Instances of Special ElementsLowsastJavaScript / TypeScript, PythonCWE-792
VNX-793Only Filtering One Instance of a Special ElementLowsastJavaScript / TypeScript, PythonCWE-793
VNX-796Only Filtering Special Elements Relative to a MarkerLowsastPython, JavaScript / TypeScriptCWE-796
VNX-799Authentication endpoint without attempt-rate controlMediumsastJavaScript / TypeScript, PythonCWE-799
VNX-804Guessable CAPTCHAMediumsastJavaScript / TypeScript, PythonCWE-804
VNX-805Buffer Access with Incorrect Length ValueMediumsastC, C++CWE-805
VNX-806Buffer Access Using Size of Source BufferMediumsastC, C++CWE-806
VNX-807Reliance on Untrusted Inputs in a Security DecisionMediumsastJava, JavaScript / TypeScript, PythonCWE-807
VNX-820Missing SynchronizationMediumsastJavaCWE-820
VNX-821Incorrect SynchronizationLowsastJavaCWE-821
VNX-822Untrusted Pointer DereferenceMediumsastC, C++CWE-822
VNX-823Use of Out-of-range Pointer OffsetMediumsastC, C++CWE-823
VNX-824Access of Uninitialized PointerLowsastC, C++CWE-824
VNX-825Expired Pointer DereferenceMediumsastC, C++CWE-825
VNX-826Premature Release of Resource During Expected LifetimeLowsastC, C++CWE-826
VNX-827Improper Control of Document Type DefinitionMediumsastJava, C#, Python, PHP, RubyCWE-827
VNX-828Signal Handler with Functionality that is not Asynchronous-SafeMediumsastC, C++CWE-828
VNX-831Signal Handler Function Associated with Multiple SignalsMediumsastC, C++CWE-831
VNX-832Unlock of a Resource that is not LockedLowsastJava, Python, C, C++CWE-832
VNX-833DeadlockLowsastJavaCWE-833
VNX-835Loop with Unreachable Exit Condition ('Infinite Loop')MediumsastJava, JavaScript / TypeScript, PythonCWE-835
VNX-836Use of Password Hash Instead of Password for AuthenticationMediumsastJava, JavaScript / TypeScript, PythonCWE-836
VNX-837Improper Enforcement of a Single, Unique ActionLowsastJavaScript / TypeScript, PythonCWE-837
VNX-838Inappropriate Encoding for Output ContextLowsastJavaScript / TypeScript, PythonCWE-838
VNX-839Numeric Range Comparison Without Minimum CheckMediumsastPython, Java, C, C++CWE-839
VNX-840Business Logic Error: Client-Controlled Monetary ValueLowsastJavaScript / TypeScript, PythonCWE-840
VNX-841Improper Enforcement of Behavioral WorkflowMediumsastJava, JavaScript / TypeScript, PythonCWE-841
VNX-842Placement of User into Incorrect GroupLowsastJavaScript / TypeScript, PythonCWE-842
VNX-843Access of Resource Using Incompatible Type ('Type Confusion')HighsastC, C++CWE-843
VNX-862Missing Authorization on a destructive or administrative handlerHighsastPythonCWE-862
VNX-863Incorrect AuthorizationHighsastJavaScript / TypeScript, PythonCWE-863
VNX-908Use of Uninitialized ResourceLowsastC, C++CWE-908
VNX-909Missing Initialization of ResourceLowsastJavaCWE-909
VNX-910Use of Expired File DescriptorLowsastC, C++CWE-910
VNX-911Improper Update of Reference CountMediumsastC, C++, JavaCWE-911
VNX-912Hidden functionality: master password or hidden account in a credential checkMediumsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-912
VNX-913Request data chooses the file of code the process loads or runs (improper control of dynamically-managed code resources)HighsastGo, Java, JavaScript / TypeScript, PythonCWE-913
VNX-914Attribute name chosen by the request in setattr()MediumsastPythonCWE-914
VNX-915Mass assignment: the whole request body is written onto a modelHighsastJavaScript / TypeScriptCWE-915
VNX-918Server-Side Request Forgery (SSRF)HighsastPythonCWE-918
VNX-920Android wake lock acquired without a timeoutMediumsastJava, KotlinCWE-920
VNX-924Plain TCP socket to a remote peer: no message integrity in transitMediumsastJavaCWE-924
VNX-925Broadcast receiver acts on an intent without verifying its action or senderMediumsastJava, KotlinCWE-925
VNX-926Android component exported with no permission protecting itMediumsastAny fileCWE-926
VNX-927Implicit Intent broadcast that any app can receiveMediumsastJava, KotlinCWE-927
VNX-928Broken or obsolete cipher (DES, 3DES, RC4, RC2, Blowfish) in KotlinMediumsastKotlinCWE-928
VNX-929Broken hash algorithm (MD5, MD2, MD4, SHA-1) in Java or KotlinMediumsastJava, KotlinCWE-929
VNX-930Android app runs commands as root through suMediumsastJava, KotlinCWE-930
VNX-931Authorization rule opens every request, an admin path or a state-changing endpoint to anyoneLowsastJava, KotlinCWE-931
VNX-932Source code switches off stack protection or FORTIFY_SOURCELowsastC, C++CWE-932
VNX-933Script loaded over plain HTTPMediumsastHTML, JavaScript / TypeScript, PHP, Java, C#, RubyCWE-933
VNX-935Administrative endpoint declared without a function-level access checkMediumsastJava, KotlinCWE-935
VNX-936Cross-Site Request Forgery protection disabled (Laravel, Symfony, Kotlin Spring Security)MediumsastPHP, KotlinCWE-936
VNX-937Build file pins a Java library release with a known remote-code-execution vulnerabilityMediumsastJava, KotlinCWE-937
VNX-938Unvalidated redirect or forward to a request-supplied destinationMediumsastPython, Java, KotlinCWE-938
VNX-939Improper Authorization in Handler for Custom URL SchemeMediumsastJava, KotlinCWE-939
VNX-940Cross-window message handler does not verify the sender's originMediumsastJavaScript / TypeScriptCWE-940
VNX-941Message sent without specifying its intended recipientMediumsastJavaScript / TypeScript, Java, KotlinCWE-941
VNX-942Permissive cross-origin (CORS) policy in a Node.js serverMediumsastJavaScript / TypeScriptCWE-942
VNX-943NoSQL injection in a MongoDB query (Python, PHP, Java)HighsastPython, PHP, JavaCWE-943
VNX-1004Sensitive cookie set without the HttpOnly flagMediumsastGo, JavaScript / TypeScript, PHP, Python, JavaCWE-1004
VNX-1007Mixed-script homoglyph in source codeLowsastJava, JavaScript / TypeScript, PythonCWE-1007
VNX-1021Improper Restriction of Rendered UI Layers (Clickjacking)MediumsastPython, Java, JavaScript / TypeScript, PHP, Ruby, Go, C#CWE-1021
VNX-1022New window opened to an untrusted target with window.opener access (tabnabbing)MediumsastHTML, JavaScript / TypeScriptCWE-1022
VNX-1023Secret compared by prefix, suffix or truncationLowsastJava, PythonCWE-1023
VNX-1024Comparison of incompatible types (always false)LowsastJava, PythonCWE-1024
VNX-1025Comparison Using Wrong FactorsLowsastJava, Python, JavaScript / TypeScript, Go, PHPCWE-1025
VNX-1027Request data in a require() or import() module specifier (Node.js)LowsastJavaScript / TypeScriptCWE-1027
VNX-1037Processor Optimization Removal of Security-critical CodeMediumsastC, C++CWE-1037, CWE-14
VNX-1039reCAPTCHA v3 verdict accepted without checking the scoreMediumsastJavaScript / TypeScript, PythonCWE-1039
VNX-1041Use of Redundant CodeLowsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-1041
VNX-1043Data Element Aggregating an Excessively Large Number of Non-Primitive ElementsLowsastJava, Python, JavaScript / TypeScript, GoCWE-1043
VNX-1044Architecture with Number of Horizontal Layers Outside of Expected RangeLowsastJava, Python, JavaScript / TypeScriptCWE-1044
VNX-1045Parent Class with Virtual Destructor and Child Without Virtual DestructorMediumsastC++CWE-1045
VNX-1046Creation of Immutable Text Using String ConcatenationLowsastJava, C#CWE-1046
VNX-1047Modules with Circular DependenciesLowsastPython, JavaScript / TypeScriptCWE-1047
VNX-1048Invokable Control Element with Large Number of Outward CallsLowsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-1048
VNX-1049Excessive Data Query Operations in a Large Data TableLowsastPython, Java, JavaScript / TypeScriptCWE-1049
VNX-1050Excessive Platform Resource Consumption within a LoopLowsastPythonCWE-1050
VNX-1051Initialization with Hard-Coded Network Resource Configuration DataMediumsastPython, JavaScript / TypeScript, Java, GoCWE-1051
VNX-1052Hard-coded Endpoint Literal in Datastore Client InitializationLowsastGo, Java, Python, JavaScript / TypeScript, PHPCWE-1052
VNX-1053Missing Documentation for DesignLowsastJava, PythonCWE-1053
VNX-1054Invokable Control Element with Excessive Volume of Commented-out CodeLowsastGo, Java, JavaScript / TypeScript, PHP, Python, RubyCWE-1054
VNX-1055Multiple Inheritance from Concrete ClassesLowsastPythonCWE-1055
VNX-1056Invokable Control Element with Variadic ParametersLowsastC, C++CWE-1056
VNX-1057Data Access Operations Outside of Expected Data Manager ComponentLowsastPythonCWE-1057
VNX-1058Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member ElementLowsastJavaCWE-1058
VNX-1060Excessive Number of Inefficient Server-Side Data AccessesLowsastPythonCWE-1060
VNX-1062Parent Class with References to Child ClassLowsastJavaCWE-1062
VNX-1063Creation of Class Instance within a Static Code BlockLowsastJavaCWE-1063
VNX-1064Invokable Control Element with Signature Containing an Excessive Number of ParametersLowsastJavaCWE-1064
VNX-1065Runtime Resource Management Control Element in a Component Built to Run on Application ServersLowsastJavaCWE-1065
VNX-1066Missing Serialization Control ElementLowsastJavaCWE-1066
VNX-1067Excessive Execution of Sequential Searches of Data ResourceLowsastJavaCWE-1067
VNX-1068Inconsistency Between Implementation and Documented DesignLowsastJavaCWE-1068
VNX-1069Empty Exception BlockLowsastJavaCWE-1069
VNX-1070Serializable Data Element Containing non-Serializable Item ElementsLowsastJavaCWE-1070
VNX-1071Empty Code BlockLowsastJavaCWE-1071
VNX-1072Data Resource Access without Use of Connection PoolingLowsastJavaCWE-1072
VNX-1073Non-SQL Invokable Control Element with Excessive Number of Data Resource AccessesLowsastJavaCWE-1073
VNX-1074Class with Excessively Deep InheritanceLowsastJavaCWE-1074
VNX-1075Unconditional Control Flow Transfer outside of Switch BlockLowsastCCWE-1075
VNX-1079Parent Class without Virtual Destructor MethodLowsastC++CWE-1079
VNX-1080Source Code File with Excessive Number of Lines of CodeLowsastPythonCWE-1080
VNX-1082Class Instance Self Destruction Control ElementLowsastC++CWE-1082
VNX-1083Data Access from Outside Expected Data Manager ComponentLowsastPythonCWE-1083
VNX-1084Invokable Control Element with Excessive File or Data Access OperationsLowsastPythonCWE-1084
VNX-1085Invokable Control Element with Excessive Volume of Commented-out CodeLowsastPythonCWE-1085
VNX-1086Class with Excessive Number of Child ClassesLowsastPythonCWE-1086
VNX-1087Class with Virtual Method without a Virtual DestructorMediumsastC++CWE-1087
VNX-1089Large Data Table with Excessive Number of IndicesLowsastSQLCWE-1089
VNX-1090Method Containing Access of a Member Element from Another ClassLowsastPythonCWE-1090
VNX-1092Use of Same Invokable Control Element in Multiple Architectural LayersLowsastPythonCWE-1092
VNX-1094Excessive Index Range Scan for a Data ResourceLowsastPythonCWE-1094
VNX-1095Loop Condition Value Update within the LoopLowsastPython, JavaCWE-1095
VNX-1097Persistent Storable Data Element without Associated Comparison Control ElementLowsastJava, Kotlin, PythonCWE-1097
VNX-1098Data Element containing Pointer Item without Proper Copy Control ElementLowsastC++CWE-1098
VNX-1099Inconsistent Naming Conventions for IdentifiersLowsastPython, JavaScript / TypeScriptCWE-1099
VNX-1100Insufficient Isolation of System-Dependent FunctionsLowsastJava, PythonCWE-1100
VNX-1101Reliance on Runtime Component in Generated CodeLowsastJava, KotlinCWE-1101
VNX-1102Reliance on Machine-Dependent Data RepresentationLowsastC, C++CWE-1102
VNX-1103Use of Platform-Dependent Third Party ComponentsLowsastJava, KotlinCWE-1103
VNX-1104Use of Unmaintained Third Party ComponentsMediumsastJavaScript / TypeScript, Python, Ruby, Java, KotlinCWE-1104
VNX-1105Insufficient Encapsulation of Machine-Dependent FunctionalityLowsastC, C++CWE-1105
VNX-1106Insufficient Use of Symbolic ConstantsLowsastJavaCWE-1106
VNX-1107Insufficient Isolation of Symbolic Constant DefinitionsLowsastJavaCWE-1107
VNX-1108Excessive Reliance on Global VariablesLowsastPython, PHPCWE-1108
VNX-1109Use of Same Variable for Multiple PurposesLowsastPython, JavaScript / TypeScript, C, C++, JavaCWE-1109
VNX-1110Incomplete Design DocumentationLowsastAny fileCWE-1110
VNX-1111Incomplete I/O DocumentationLowsastPythonCWE-1111
VNX-1112Incomplete Documentation of Program ExecutionLowsastPythonCWE-1112
VNX-1113Inappropriate Comment StyleLowsastC, C++, Java, JavaScript / TypeScript, Go, C#, PHPCWE-1113
VNX-1114Inappropriate Whitespace StyleLowsastPythonCWE-1114
VNX-1115Source Code Element without Standard PrologueLowsastC, C++, Go, Java, JavaScript / TypeScript, Python, RustCWE-1115
VNX-1116Inaccurate Source Code CommentsLowsastPythonCWE-1116
VNX-1117Callable with Insufficient Behavioral SummaryLowsastPythonCWE-1117
VNX-1118Insufficient Documentation of Error Handling TechniquesLowsastPythonCWE-1118
VNX-1119Excessive Use of Unconditional BranchingLowsastC++CWE-1119
VNX-1121Excessive McCabe Cyclomatic ComplexityLowsastPythonCWE-1121
VNX-1122Excessive Halstead ComplexityLowsastPythonCWE-1122
VNX-1123Excessive Use of Self-Modifying CodeMediumsastPython, JavaScript / TypeScriptCWE-1123
VNX-1124Excessively Deep NestingLowsastPythonCWE-1124
VNX-1125Excessive Attack SurfaceMediumsastPythonCWE-1125
VNX-1126Declaration of Variable with Unnecessarily Wide ScopeLowsastPythonCWE-1126
VNX-1127Compilation with Insufficient Warnings or ErrorsLowsastC, C++, Shell, Any fileCWE-1127
VNX-1173Improper Use of Validation FrameworkLowsastJava, Any fileCWE-1173
VNX-1188Initialization of a Resource with an Insecure DefaultMediumsastJavaScript / TypeScript, PythonCWE-1188
VNX-1204Generation of Weak Initialization Vector (IV)MediumsastJavaCWE-1204
VNX-1230Exposure of Sensitive Information Through MetadataMediumsastJavaScript / TypeScript, PythonCWE-1230
VNX-1235Incorrect Use of Autoboxing and Unboxing for Performance Critical OperationsLowsastJavaCWE-1235
VNX-1236Improper Neutralization of Formula Elements in a CSV FileMediumsastJava, JavaScript / TypeScript, PythonCWE-1236
VNX-1240Use of a Cryptographic Primitive with a Risky ImplementationMediumsastJavaCWE-1240
VNX-1241Use of Predictable Algorithm in Random Number GeneratorMediumsastJavaCWE-1241
VNX-1254Incorrect Comparison Logic GranularityLowsastJavaCWE-1254
VNX-1265Unintended Reentrant Invocation of Non-reentrant Code Via Nested CallsMediumsastCCWE-1265
VNX-1269Product Released in Non-Release ConfigurationLowsastPythonCWE-1269
VNX-1275Sensitive Cookie with Improper SameSite AttributeMediumsastJavaScript / TypeScript, PythonCWE-1275
VNX-1284Improper Validation of Specified Quantity in InputMediumsastJavaScript / TypeScript, PythonCWE-1284
VNX-1285Improper Validation of Specified Index, Position, or Offset in InputMediumsastJavaScript / TypeScript, PythonCWE-1285
VNX-1286Improper Validation of Syntactic Correctness of InputLowsastJavaScript / TypeScript, PythonCWE-1286
VNX-1287Improper Validation of Specified Type of InputLowsastJavaScript / TypeScriptCWE-1287
VNX-1288Improper Validation of Consistency within InputLowsastJavaScript / TypeScript, PythonCWE-1288
VNX-1289Improper Validation of Unsafe Equivalence in InputLowsastPython, JavaScript / TypeScriptCWE-1289
VNX-1290Security identifier decoded from client data without verificationMediumsastPythonCWE-1290
VNX-1304Security state restored from unprotected saved stateMediumsastJava, KotlinCWE-1304
VNX-1320Fault or watchdog alert signal suppressedLowsastC, C++CWE-1320
VNX-1321Prototype pollution through unguarded computed-key assignmentHighsastJavaScript / TypeScriptCWE-1321
VNX-1322Use of Blocking Code in Single-threaded, Non-blocking ContextMediumsastJavaScript / TypeScriptCWE-1322
VNX-1324Hardware debug interface (JTAG/SWD) enabled in firmware outside a debug buildMediumsastC, C++CWE-1324
VNX-1325Improperly Controlled Sequential Memory AllocationMediumsastC, C++, Go, JavaCWE-1325
VNX-1327Binding to an Unrestricted IP AddressMediumsastGo, JavaScript / TypeScript, PythonCWE-1327
VNX-1335Incorrect Bitwise Shift of IntegerLowsastC, C++CWE-1335
VNX-1336Server-side template injection: template source built from request dataMediumsastJavaScript / TypeScript, PythonCWE-1336
VNX-1339Insufficient Precision or Accuracy of a Real NumberLowsastPython, JavaScript / TypeScript, Java, GoCWE-1339
VNX-1341Multiple Releases of Same Resource or HandleMediumsastC, C++CWE-1341
VNX-1389Incorrect Parsing of Numbers with Different RadicesLowsastJavaScript / TypeScript, Python, Go, Java, Kotlin, C, C++CWE-1389
VNX-1390Weak Authentication: HTTP Digest or NTLM authentication schemeLowsastPython, JavaScript / TypeScript, Java, Kotlin, C#, GoCWE-1390
VNX-1391Use of Weak Credentials: trivially guessable password literalLowsastPython, JavaScript / TypeScript, Go, Java, PHP, Ruby, C#, Dockerfile, Config filesCWE-1391
VNX-1392Use of Default Credentials: default account with a default passwordLowsastPython, JavaScript / TypeScript, Go, Java, PHP, Ruby, C#, DockerfileCWE-1392
VNX-1393Use of Default PasswordLowsastPython, JavaScript / TypeScript, Go, Java, PHP, Ruby, C#, DockerfileCWE-1393
VNX-1395Dependency on a third-party component release with a well-known vulnerabilityLowsastJavaScript / TypeScript, Python, HTMLCWE-1395
VNX-1427Improper Neutralization of Input Used for LLM Prompting: request data in the system promptMediumsastGo, Java, PHP, RubyCWE-1427
VNX-ANDROID-001Android app shipped debuggable or with unrestricted backupHighsastAndroidCWE-489, CWE-921
VNX-ANDROID-002Android WebView runs JavaScript from untrusted contentHighsastJava, KotlinCWE-79
VNX-ANDROID-003Android component exported without a permissionHighsastAndroidCWE-926
VNX-ANDROID-004Android credential stored in plaintext SharedPreferencesHighsastJava, KotlinCWE-312
VNX-ANDROID-005Android app permits cleartext HTTP trafficHighsastAndroidCWE-319
VNX-ANDROID-006Android credential hard-coded in a string resourceHighsecretsAndroidCWE-798
VNX-ANDROID-007AES cipher in ECB mode (Java/Kotlin)HighsastJava, KotlinCWE-327
VNX-BASH-001eval or sh -c of a dynamically built stringCriticalsastShell, Any fileCWE-78
VNX-BASH-002Downloaded script executed without an integrity checkHighsastShellCWE-494, CWE-829
VNX-BASH-003Failure ignored in a script without set -e / set -uMediumsastShellCWE-755
VNX-BASH-004Unquoted variable used in command or testMediumsastShell, Any fileCWE-78, CWE-88
VNX-BASH-005Hardcoded secret or password in shell scriptHighsastShell, Any fileCWE-798, CWE-259
VNX-BASH-006Global IFS reassignment in shell scriptMediumsastShell, Any fileCWE-20
VNX-BASH-007Unquoted command substitution in shell scriptMediumsastShell, Any fileCWE-88
VNX-C-001Unbounded copy into a buffer (strcpy, strcat, gets, sprintf %s, scanf %s)HighsastC, C++CWE-120, CWE-676, CWE-787
VNX-C-002Format string injection via non-literal format argumentHighsastC, C++CWE-134
VNX-C-003OS command injection: a shell command built from or read from untrusted dataCriticalsastC, C++CWE-78, CWE-88, CWE-676
VNX-C-004Use-after-free: pointer used after free()HighsastC, C++CWE-416
VNX-C-005Integer overflow in malloc/calloc size arithmeticHighsastC, C++CWE-190, CWE-131, CWE-787
VNX-C-006Use of alloca() for dynamic stack allocationHighsastC, C++CWE-676, CWE-1325
VNX-CRYPTO-001MD5 usage detectedMediumsastPython, JavaScript / TypeScript, Go, Java, Ruby, PHPCWE-327, CWE-328
VNX-CRYPTO-002SHA-1 usage detectedMediumsastPython, JavaScript / TypeScript, Go, Java, Ruby, PHPCWE-328
VNX-CRYPTO-003AES in ECB modeHighsastPython, JavaScript / TypeScript, Go, Java, Ruby, PHPCWE-327
VNX-CRYPTO-004Broken or obsolete cipherHighsastPython, JavaScript / TypeScript, Go, Java, Ruby, PHPCWE-327
VNX-CRYPTO-005TLS certificate validation disabledHighsastPython, JavaScript / TypeScript, GoCWE-295
VNX-CRYPTO-006Weak RSA key sizeHighsastPython, Go, Java, JavaScript / TypeScriptCWE-326
VNX-CRYPTO-007Weak password hashing (insufficient iterations or missing KDF)HighsastPython, JavaScript / TypeScript, Java, PHP, Ruby, GoCWE-916
VNX-CRYPTO-008Timing attack via direct comparison of secretsMediumsastPython, JavaScript / TypeScript, Go, Java, PHP, RubyCWE-208
VNX-CRYPTO-009Use of cryptographically weak PRNG (rand/srand/random in C/C++)HighsastC, C++CWE-338, CWE-330
VNX-CRYPTO-010Hardcoded IV, nonce, or salt in cryptographic operationHighsastPython, JavaScript / TypeScript, Go, Java, Kotlin, C, C++, Rust, C#, PHP, RubyCWE-329, CWE-330, CWE-760
VNX-CS-001C# SQL injection: query text built by concatenation, interpolation or string.FormatHighsastC#CWE-89
VNX-CS-002C# command injection: request data or a dynamic shell command reaches Process.StartHighsastC#CWE-78
VNX-CS-003C# XXE: XML parser resolves external entitiesHighsastC#CWE-611
VNX-CS-004C# insecure deserialization: type-embedding formatter or serializer settingHighsastC#CWE-502
VNX-CS-005C# MVC action accepting cross-site form posts without anti-forgery validationMediumsastC#CWE-352
VNX-CS-006C# System.Random output used for a token, password, key, salt, nonce or session valueHighsastC#CWE-338
VNX-CS-007C# path traversal: request data reaches Path.Combine, MapPath or a file-system APIHighsastC#CWE-22
VNX-CS-008C# SSRF: request data chooses the host of an HttpClient, WebClient or WebRequest callHighsastC#CWE-918
VNX-CS-009C# use of weak cryptographic algorithm (MD5, SHA-1, DES, 3DES, RC2, RC4)HighsastC#CWE-327
VNX-CS-010C# hardcoded connection string with credentialsHighsecretsC#CWE-798
VNX-DOCKER-001Dockerfile final stage runs as rootMediumociDockerfileCWE-250
VNX-DOCKER-002Dockerfile base image not pinned (:latest or no tag)MediumociDockerfileCWE-829
VNX-DOCKER-003Secret in Dockerfile ARG or ENVHighsecretsDockerfileCWE-798
VNX-DOCKER-004Dockerfile ADD downloads a remote source without a checksumMediumociDockerfileCWE-829, CWE-494
VNX-DOCKER-005Privileged container in a Dockerfile, Compose file or Kubernetes manifestCriticalociDockerfile, KubernetesCWE-250
VNX-DOCKER-006Dockerfile uses ADD instead of COPY for local filesLowociDockerfileCWE-829
VNX-DOCKER-007Service image without a HEALTHCHECKLowociDockerfileCWE-754
VNX-DOCKER-008Dockerfile OS package install without version pinningLowociDockerfileCWE-1357
VNX-GO-001Missing go.sumHighsastGoCWE-829
VNX-GO-002Command injection via exec.CommandHighsastGoCWE-78
VNX-GO-003SQL injection via fmt.SprintfCriticalsastGoCWE-89
VNX-GO-004TLS InsecureSkipVerify enabledHighsastGoCWE-295
VNX-GO-005Go open redirectMediumsastGoCWE-601
VNX-GO-006Go server-side request forgeryHighsastGoCWE-918
VNX-GO-007Go path traversalHighsastGoCWE-22
VNX-GO-008Go weak PRNG for securityMediumsastGoCWE-338
VNX-GO-009Go text/template used for HTMLHighsastGoCWE-79
VNX-GO-010Go weak cipher usageHighsastGoCWE-327
VNX-GO-011Go gob deserialization of an HTTP request body or accepted connectionMediumsastGoCWE-502
VNX-GO-012Go HTTP response header set from a request parameterMediumsastGoCWE-113
VNX-GO-013Go zip/tar slip via archive entry nameHighsastGoCWE-22
VNX-GO-014sync.Mutex or sync.RWMutex held across an exit without UnlockHighsastGoCWE-667, CWE-833
VNX-GO-015sync.WaitGroup.Add() called inside goroutineHighsastGoCWE-362, CWE-667
VNX-GO-016Integer downcast or sign-change after strconv.Atoi/ParseInt/ParseUintMediumsastGoCWE-681, CWE-190
VNX-GO-017Go SQL injection via fmt.Sprintf in db.Exec or db.QueryHighsastGoCWE-89
VNX-GO-018Go arbitrary file write via os.WriteFile/os.Create with user-controlled pathHighsastGoCWE-22
VNX-GO-019Go debug endpoints (pprof, expvar) served on all interfacesMediumsastGoCWE-200
VNX-GO-020Use of template.HTML with potential user inputMediumsastGoCWE-79
VNX-GO-021Potential XSS via fmt.Fprintf with HTML tagsMediumsastGoCWE-79
VNX-GO-022Use of eval() or dynamic code executionHighsastGoCWE-94
VNX-GO-023SQL injection via string concatenationHighsastGoCWE-89
VNX-GO-024Request parameter reaches a dangerous sink without validationMediumsastGoCWE-20
VNX-GO-025Potential open redirect via HTTP redirectMediumsastGoCWE-601
VNX-GO-026Missing file type validation on uploadHighsastGoCWE-434
VNX-GO-027Potential path traversal via file path constructionHighsastGoCWE-22
VNX-GO-028Use of weak cryptographic hash for password hashingHighsastGoCWE-327, CWE-916
VNX-GO-029Hardcoded weak or default passwordHighsastGoCWE-798
VNX-GO-030Missing Secure flag on cookieMediumsastGoCWE-614
VNX-GO-031Missing signature validation on JWTHighsastGoCWE-347
VNX-GO-032JWT missing expiration validationMediumsastGoCWE-613
VNX-GO-033JWT missing audience validationMediumsastGoCWE-347
VNX-GO-034OAuth redirect URI without validation against allowlistMediumsastGoCWE-601
VNX-GO-035Missing HttpOnly flag on cookieMediumsastGoCWE-1004
VNX-GO-036Use of ECB block modeHighsastGoCWE-327
VNX-GO-037Missing security headers in HTTP responseMediumsastGoCWE-693
VNX-GO-038Potential mass assignment via struct bindingMediumsastGoCWE-915
VNX-GO-039Missing rate limiting on login endpointMediumsastGoCWE-307
VNX-GO-040Logging of sensitive dataHighsastGoCWE-532
VNX-GO-041Use of deprecated TLS versionHighsastGoCWE-326
VNX-GQL-001GraphQL introspection enabled in productionMediumsastJavaScript / TypeScript, PythonCWE-200
VNX-GQL-002GraphQL query batching enabled without a limit (DoS)MediumsastJavaScript / TypeScript, PythonCWE-770
VNX-GQL-003GraphQL query string injection via string concatenationHighsastJavaScript / TypeScript, PythonCWE-943
VNX-GQL-004GraphQL field suggestion disclosure enabledLowsastJavaScript / TypeScriptCWE-200
VNX-HTML-001Use of Jinja2 |safe filterMediumsastHTMLCWE-79
VNX-JAVA-001Command injection via Runtime.exec() or a shell ProcessBuilderHighsastJavaCWE-78
VNX-JAVA-002Spring actuator endpoints exposedMediumsastJava, KotlinCWE-200
VNX-JAVA-003SQL injection via string concatenationCriticalsastJavaCWE-89
VNX-JAVA-004XML external entity (XXE) injectionHighsastJavaCWE-611
VNX-JAVA-005Insecure deserializationCriticalsastJavaCWE-502
VNX-JAVA-006Insecure TLS trust managerCriticalsastJavaCWE-295
VNX-JAVA-007Java open redirectMediumsastJavaCWE-601
VNX-JAVA-008Java server-side request forgeryHighsastJavaCWE-918
VNX-JAVA-009Java path traversalHighsastJavaCWE-22
VNX-JAVA-010Spring CSRF protection disabledMediumsastJavaCWE-352
VNX-JAVA-011Java expression language injectionCriticalsastJavaCWE-917
VNX-JAVA-012Java LDAP injectionHighsastJavaCWE-90
VNX-JAVA-013Java XPath injectionHighsastJavaCWE-643
VNX-JAVA-014Java zip/tar slip via archive entry nameHighsastJavaCWE-22
VNX-JAVA-015Java JPQL/HQL injection via string concatenationHighsastJavaCWE-89
VNX-JAVA-016Java weak PRNG (java.util.Random) used for security-sensitive valueHighsastJavaCWE-330
VNX-JAVA-017Java HTTP response splitting via unsanitised header valueHighsastJavaCWE-113
VNX-JAVA-018Java RSA cipher without OAEP paddingHighsastJavaCWE-780
VNX-JAVA-019Java hardcoded cryptographic key literalCriticalsecretsJavaCWE-321
VNX-JAVA-020Java static IV reuse in block cipherHighsastJavaCWE-329
VNX-JAVA-021Java sensitive data logged (password, token, secret, key)MediumsecretsJavaCWE-532
VNX-JAVA-022Java insecure temporary file creationMediumsastJavaCWE-377
VNX-JAVA-023Java unrestricted file upload, no content-type or extension validationHighsastJavaCWE-434
VNX-JAVA-024Java XML entity expansion (Billion Laughs), DTD not disabledHighsastJavaCWE-776
VNX-JAVA-025Java hardcoded password or credential in source codeCriticalsecretsJavaCWE-259
VNX-JAVA-026Java Spring/servlet file serving without access controlHighsastJavaCWE-552
VNX-JAVA-027Java Spring security headers disabled or absent (clickjacking, CSP)MediumsastJavaCWE-693
VNX-JAVA-028SQL injection via StringBuilder-assembled SQL in JavaHighsastJavaCWE-89
VNX-JAVA-029XML External Entity (XXE) via DocumentBuilderFactoryHighsastJavaCWE-611
VNX-JAVA-030Java reflected cross-site scriptingHighsastJavaCWE-79
VNX-JWT-001JWT signature verification disabledCriticalsastPython, JavaScript / TypeScript, Go, Java, Kotlin, Ruby, C#CWE-347
VNX-JWT-002JWT token signed without expirationMediumsastPython, JavaScript / TypeScript, Java, Go, Ruby, PHPCWE-613
VNX-JWT-003JWT signing with hardcoded secretHighsecretsPython, JavaScript / TypeScript, Java, Go, Ruby, PHP, C#, PropertiesCWE-798
VNX-JWT-004JWT algorithm explicitly set to 'none'CriticalsastPython, JavaScript / TypeScript, Ruby, Java, Kotlin, GoCWE-327
VNX-JWT-005Sensitive credential data stored in JWT payloadHighsastPython, JavaScript / TypeScript, Java, Go, Ruby, PHPCWE-522
VNX-JWT-006JWT missing audience or issuer verificationMediumsastPython, JavaScript / TypeScript, C#, Java, GoCWE-287
VNX-KOTLIN-001Kotlin block cipher in ECB modeHighsastKotlinCWE-327
VNX-KOTLIN-002Kotlin RSA, DSA or DH key smaller than 2048 bitsHighsastKotlinCWE-326
VNX-KOTLIN-003Kotlin sensitive cookie without HttpOnlyMediumsastKotlinCWE-1004
VNX-KOTLIN-004Kotlin unencrypted plain socket (cleartext transmission)HighsastKotlinCWE-319
VNX-KOTLIN-005Kotlin MD5 or SHA-1 used as cryptographic hashMediumsastKotlinCWE-328
VNX-LLM-001LLM prompt injection via user-controlled inputHighsastPython, JavaScript / TypeScriptCWE-77
VNX-LLM-002LLM output passed to code execution (RCE)CriticalsastPython, JavaScript / TypeScriptCWE-95
VNX-LLM-003Hardcoded LLM API keyCriticalsecretsAny fileCWE-798
VNX-LLM-004User input directly in LLM system promptHighsastPython, JavaScript / TypeScriptCWE-77
VNX-LLM-005LangChain arbitrary code execution toolCriticalsastPythonCWE-94
VNX-LLM-006LLM output interpolated into SQL queryCriticalsastPythonCWE-89
VNX-LLM-007torch.load() without weights_only=True (ML model deserialization)HighsastPythonCWE-502
VNX-NODE-001Missing npm lock fileHighsastJavaScript / TypeScriptCWE-829
VNX-NODE-002eval() or new Function() in JavaScriptHighsastJavaScript / TypeScriptCWE-94
VNX-NODE-003Command injection via child_processHighsastJavaScript / TypeScriptCWE-78
VNX-NODE-004Express app without helmetMediumsastJavaScript / TypeScriptCWE-693
VNX-NODE-005innerHTML or dangerouslySetInnerHTML usageMediumsastJavaScript / TypeScriptCWE-79
VNX-NODE-006Prototype pollution via mergeHighsastJavaScript / TypeScriptCWE-915
VNX-NODE-007Node.js SQL injectionCriticalsastJavaScript / TypeScriptCWE-89
VNX-NODE-008Node.js open redirectMediumsastJavaScript / TypeScriptCWE-601
VNX-NODE-009Node.js server-side request forgeryHighsastJavaScript / TypeScriptCWE-918
VNX-NODE-010Node.js path traversalHighsastJavaScript / TypeScriptCWE-22
VNX-NODE-011Node.js server-side template injectionCriticalsastJavaScript / TypeScriptCWE-1336
VNX-NODE-012Client-side XSS via innerHTML or v-htmlHighsastJavaScript / TypeScript, HTMLCWE-79
VNX-NODE-013Node.js command injection via child_processCriticalsastJavaScript / TypeScriptCWE-78
VNX-NODE-014NoSQL injection in MongoDBHighsastJavaScript / TypeScriptCWE-943
VNX-NODE-015WebSocket server without origin verification (CSWSH)HighsastJavaScript / TypeScriptCWE-1385
VNX-NODE-016ReDoS via user-controlled regular expressionHighsastJavaScript / TypeScriptCWE-1333
VNX-NODE-017Deserialization of untrusted data via node-serialize or serialize-to-jsCriticalsastJavaScript / TypeScriptCWE-502
VNX-NODE-018JWT decoded without signature verificationHighsastJavaScript / TypeScriptCWE-347
VNX-NODE-019Hardcoded JWT or session secretHighsastJavaScript / TypeScriptCWE-798
VNX-NODE-020Deprecated crypto.createCipher/createDecipher without IVHighsastJavaScript / TypeScriptCWE-330
VNX-NODE-021XXE via libxmljs with noent:trueHighsastJavaScript / TypeScriptCWE-611
VNX-NODE-022Shell injection via shelljs exec()CriticalsastJavaScript / TypeScriptCWE-78
VNX-NODE-023Unsafe YAML.load() with untrusted inputHighsastJavaScript / TypeScriptCWE-502
VNX-NODE-024postMessage without origin validation (CSWSH/XSS)MediumsastJavaScript / TypeScriptCWE-345
VNX-NODE-025Insecure express-session or cookie-session configurationMediumsastJavaScript / TypeScriptCWE-614
VNX-NODE-026Child process spawn with shell:true enables command injectionHighsastJavaScript / TypeScriptCWE-78
VNX-NODE-027Assignment to innerHTML without sanitizationHighsastJavaScript / TypeScript, HTMLCWE-79
VNX-NODE-028Missing Content-Security-Policy headerMediumsastJavaScript / TypeScriptCWE-693
VNX-NODE-029Missing HttpOnly flag on cookieMediumsastJavaScript / TypeScriptCWE-1004
VNX-NODE-030TURN server allowing reserved IP addressesMediumsastAny fileCWE-200
VNX-NODE-031Logging of sensitive dataHighsastJavaScript / TypeScriptCWE-532
VNX-NODE-032Angular DomSanitizer bypass with a non-constant valueHighsastJavaScript / TypeScriptCWE-79
VNX-PHP-001Missing composer.lockHighsastPHP, Any fileCWE-829
VNX-PHP-002Dangerous function in PHPHighsastPHPCWE-78
VNX-PHP-003PHP file inclusion with variable pathCriticalsastPHPCWE-98
VNX-PHP-004PHP open redirectMediumsastPHPCWE-601
VNX-PHP-005PHP server-side request forgeryHighsastPHPCWE-918
VNX-PHP-006PHP object injection via unserializeCriticalsastPHPCWE-502
VNX-PHP-007PHP extract on superglobalHighsastPHPCWE-621
VNX-PHP-008PHP phpinfo exposureMediumsastPHPCWE-200
VNX-PHP-009PHP preg_replace with /e modifierCriticalsastPHPCWE-94
VNX-PHP-010PHP type juggling in comparisonHighsastPHPCWE-697
VNX-PHP-011PHP SQL injection via string concatenationCriticalsastPHPCWE-89
VNX-PHP-012PHP reflected XSS via echo/print of user inputHighsastPHPCWE-79
VNX-PHP-013PHP XXE via LIBXML_NOENT or LIBXML_DTDLOAD flagHighsastPHPCWE-611
VNX-PHP-014PHP session fixation via user-controlled session IDHighsastPHPCWE-384
VNX-PHP-015PHP unrestricted file upload via move_uploaded_fileHighsastPHPCWE-434
VNX-PHP-016PHP weak hash function (md5/sha1)MediumsastPHPCWE-328
VNX-PHP-017PHP LDAP injection via user-controlled filterHighsastPHPCWE-90
VNX-PHP-018PHP sensitive debug output disclosureMediumsastPHPCWE-200
VNX-PHP-019PHP insecure cipher mode (AES-CBC)MediumsastPHPCWE-327
VNX-PHP-020PHP curl SSL certificate verification disabledHighsastPHPCWE-295
VNX-PHP-021Laravel mass assignment via empty guarded arrayHighsastPHPCWE-915
VNX-PHP-022PHP open redirect via non-literal redirect destinationMediumsastPHPCWE-601
VNX-PHP-023PHP anonymous LDAP bind without passwordHighsastPHPCWE-287
VNX-PHP-024PHP mb_ereg_replace with variable options enabling eval modifierCriticalsastPHPCWE-94
VNX-PHP-025PHP deprecated mcrypt encryption functionsHighsastPHPCWE-327
VNX-PHP-026PHP session poisoning via user-controlled session keyHighsastPHPCWE-284
VNX-PY-001Missing Python lock fileHighsastPythonCWE-829
VNX-PY-002eval()/exec() usage in PythonHighsastPythonCWE-94
VNX-PY-003Insecure deserialization with pickleHighsastPythonCWE-502
VNX-PY-004yaml.load() without SafeLoaderHighsastPythonCWE-502
VNX-PY-005Weak PRNG for security operationsMediumsastPythonCWE-338
VNX-PY-006Django DEBUG=TrueMediumsastPythonCWE-489
VNX-PY-007subprocess with shell=TrueHighsastPythonCWE-78
VNX-PY-008Flask debug mode enabledHighsastPythonCWE-489
VNX-PY-009Jinja2 autoescape disabledHighsastPython, HTMLCWE-79
VNX-PY-010SSL verification disabled in requestsHighsastPythonCWE-295
VNX-PY-011Python SQL injectionCriticalsastPythonCWE-89
VNX-PY-012Python server-side template injectionCriticalsastPythonCWE-1336
VNX-PY-013Python ML/AI insecure deserializationCriticalsastPythonCWE-502
VNX-PY-014Python XML external entity injectionHighsastPythonCWE-611
VNX-PY-015Python ReDoS via user-controlled regular expressionHighsastPythonCWE-1333
VNX-PY-016Django mass assignment via request data unpackingHighsastPythonCWE-915
VNX-PY-017MD5 or SHA1 used as password hashHighsastPythonCWE-327
VNX-PY-018Insecure temporary file creation via tempfile.mktemp()MediumsastPythonCWE-377
VNX-PY-019Paramiko implicit host key trustHighsastPythonCWE-322
VNX-PY-020tarfile.extractall() without path validation (zip slip)HighsastPythonCWE-22
VNX-PY-021Weak or deprecated SSL/TLS protocol versionHighsastPythonCWE-326
VNX-PY-022SQL injection via joined SQL pieces in PythonHighsastPythonCWE-89
VNX-RUBY-001Missing Gemfile.lockHighsastRubyCWE-829
VNX-RUBY-002eval() or system() in RubyHighsastRubyCWE-94
VNX-RUBY-003Insecure deserialization in RubyCriticalsastRubyCWE-502
VNX-RUBY-004Ruby SQL injectionCriticalsastRubyCWE-89
VNX-RUBY-005Ruby XSS via html_safe or rawHighsastRubyCWE-79
VNX-RUBY-006Ruby mass assignmentHighsastRubyCWE-915
VNX-RUBY-007YAML.load() insecure deserializationCriticalsastRubyCWE-502
VNX-RUBY-008Open3 shell command built from request inputHighsastRubyCWE-78
VNX-RUBY-009Ruby dynamic method dispatch via send with user-controlled method nameHighsastRubyCWE-94, CWE-470
VNX-RUBY-010OpenSSL certificate verification disabled (VERIFY_NONE)HighsastRubyCWE-295
VNX-RUST-001Missing Cargo.lockHighsastRustCWE-829
VNX-RUST-002Rust unwrap/expect on parsing or decoding runtime inputLowsastRustCWE-248
VNX-RUST-003Rust unsafe code without a safety justificationMediumsastRustCWE-119
VNX-RUST-004Rust command injection via a shell or a request-controlled program in process::CommandHighsastRustCWE-78
VNX-RUST-005panic!() or unwrap()/expect() in function that returns ResultMediumsastRustCWE-755
VNX-RUST-006Integer truncation or sign-change cast after parsingMediumsastRustCWE-681, CWE-190
VNX-RUST-007Rust integer arithmetic overflow without checked arithmeticMediumsastRustCWE-190
VNX-RUST-008Rust path traversal in Actix-web or Axum file-serving handlerHighsastRustCWE-22
VNX-SEC-001AWS access key IDCriticalsecretsAny fileCWE-798
VNX-SEC-002Private key committedCriticalsecretsAny fileCWE-321
VNX-SEC-003AWS secret access keyCriticalsecretsAny fileCWE-798
VNX-SEC-004GitHub or GitLab tokenCriticalsecretsAny fileCWE-798
VNX-SEC-005GCP API keyCriticalsecretsAny fileCWE-798
VNX-SEC-006Stripe secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-007Slack token or webhookHighsecretsAny fileCWE-798
VNX-SEC-008Database connection string with credentialsCriticalsecretsAny fileCWE-798
VNX-SEC-009SendGrid API keyHighsecretsAny fileCWE-798
VNX-SEC-010Package registry tokenCriticalsecretsAny fileCWE-798
VNX-SEC-011Hardcoded JWT tokenHighsecretsAny fileCWE-798
VNX-SEC-012CORS wildcard or origin reflectionHighsastAny fileCWE-942
VNX-SEC-013Insecure cookie configurationMediumsastAny fileCWE-614, CWE-1004
VNX-SEC-014Hardcoded password in variableHighsecretsAny fileCWE-798, CWE-259
VNX-SEC-015JWT algorithm none attackCriticalsastAny fileCWE-345, CWE-327
VNX-SEC-016TLS verification disabled in shell commandMediumsastAny fileCWE-295
VNX-SEC-017Plaintext protocol URLMediumsastAny fileCWE-319
VNX-SEC-018AI provider API keyCriticalsecretsAny fileCWE-798
VNX-SEC-019GCP service account keyCriticalsecretsAny fileCWE-798
VNX-SEC-020GitLab access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-021Twilio API credentialsCriticalsecretsAny fileCWE-798
VNX-SEC-022Sensitive data in log statementMediumsecretsPython, JavaScript / TypeScript, Java, Kotlin, Go, Ruby, PHP, C#, Swift, Rust, C, C++, ScalaCWE-532
VNX-SEC-023GitHub Actions expression injection via event dataCriticalsastAny fileCWE-77
VNX-SEC-024OAuth token stored in localStorageMediumsastJavaScript / TypeScript, HTMLCWE-922
VNX-SEC-025Azure Storage Account key hardcodedCriticalsecretsAny fileCWE-798
VNX-SEC-026DigitalOcean personal access token hardcodedCriticalsecretsAny fileCWE-798
VNX-SEC-027Hugging Face API token hardcodedHighsecretsAny fileCWE-798
VNX-SEC-028npm access token hardcodedHighsecretsAny fileCWE-798
VNX-SEC-029PyPI upload token hardcodedHighsecretsAny fileCWE-798
VNX-SEC-030Google OAuth client secret hardcodedHighsecretsAny fileCWE-798
VNX-SEC-031Mailgun API key hardcodedHighsecretsAny fileCWE-798
VNX-SEC-032PGP private key block hardcodedCriticalsecretsAny fileCWE-321
VNX-SEC-033AWS Bedrock API key (long-lived)CriticalsecretsAny fileCWE-798
VNX-SEC-034Alibaba Cloud access keyCriticalsecretsAny fileCWE-798
VNX-SEC-035DigitalOcean personal access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-036Heroku API keyCriticalsecretsAny fileCWE-798
VNX-SEC-037HashiCorp Vault tokenCriticalsecretsAny fileCWE-798
VNX-SEC-038HashiCorp Terraform Cloud tokenCriticalsecretsAny fileCWE-798
VNX-SEC-039GitLab personal access token (legacy)CriticalsecretsAny fileCWE-798
VNX-SEC-040GitLab pipeline trigger / deploy / runner tokenCriticalsecretsAny fileCWE-798
VNX-SEC-041Atlassian API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-042Slack webhook URLHighsecretsAny fileCWE-798
VNX-SEC-043Twilio API keyCriticalsecretsAny fileCWE-798
VNX-SEC-044Microsoft Teams webhook URLHighsecretsAny fileCWE-798
VNX-SEC-045Discord bot tokenCriticalsecretsAny fileCWE-798
VNX-SEC-046Square access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-047Shopify access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-048OpenAI project / service / admin keyCriticalsecretsAny fileCWE-798
VNX-SEC-049Anthropic admin API keyCriticalsecretsAny fileCWE-798
VNX-SEC-050Google Gemini / Vertex AI / PaLM API keyCriticalsecretsAny fileCWE-798
VNX-SEC-051RubyGems API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-052Artifactory / JFrog API keyCriticalsecretsAny fileCWE-798
VNX-SEC-053SonarQube / SonarCloud tokenCriticalsecretsAny fileCWE-798
VNX-SEC-054Datadog API / APP keyCriticalsecretsAny fileCWE-798
VNX-SEC-055New Relic API keyCriticalsecretsAny fileCWE-798
VNX-SEC-056Sentry auth tokenCriticalsecretsAny fileCWE-798
VNX-SEC-057Grafana API / service account tokenCriticalsecretsAny fileCWE-798
VNX-SEC-058Notion API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-059Linear API keyCriticalsecretsAny fileCWE-798
VNX-SEC-060Airtable personal access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-061PostgreSQL connection string with credentialsCriticalsecretsAny fileCWE-798
VNX-SEC-062MySQL connection string with credentialsCriticalsecretsAny fileCWE-798
VNX-SEC-063MongoDB connection string with credentialsCriticalsecretsAny fileCWE-798
VNX-SEC-064Redis connection string with credentialsCriticalsecretsAny fileCWE-798
VNX-SEC-065HTTP basic authentication headerHighsecretsAny fileCWE-798
VNX-SEC-066HTTP bearer authentication headerHighsecretsAny fileCWE-798
VNX-SEC-067Curl command with embedded credentialsHighsecretsAny fileCWE-798
VNX-SEC-068Ethereum private keyCriticalsecretsAny fileCWE-798
VNX-SEC-069age secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-0701Password secret key / service accountCriticalsecretsAny fileCWE-798
VNX-SEC-071GitLab session cookieCriticalsecretsAny fileCWE-798
VNX-SEC-072Generic high-entropy API key / secretHighsecretsAny fileCWE-798
VNX-SEC-073URL with embedded credentialsHighsecretsAny fileCWE-798
VNX-SEC-074Kubernetes Secret manifest with credential dataHighsecretsAny fileCWE-798
VNX-SEC-075WireGuard private keyCriticalsecretsAny fileCWE-798
VNX-SEC-076Telegram bot API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-077Mapbox access tokenHighsecretsAny fileCWE-798
VNX-SEC-078Doppler API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-079GitHub fine-grained personal access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-080GitHub OAuth / App / Refresh tokenCriticalsecretsAny fileCWE-798
VNX-SEC-081Cloudflare API token (cfk_)CriticalsecretsAny fileCWE-798
VNX-SEC-082Cloudflare user/account token (cfut_/cfat_)CriticalsecretsAny fileCWE-798
VNX-SEC-083Heroku API key (v2 HRKU-)CriticalsecretsAny fileCWE-798
VNX-SEC-084Salesforce access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-086Cohere API keyCriticalsecretsAny fileCWE-798
VNX-SEC-087Mistral AI API keyCriticalsecretsAny fileCWE-798
VNX-SEC-088Stripe webhook signing secret (whsec_)CriticalsecretsAny fileCWE-798
VNX-SEC-089PayPal / Braintree access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-090Figma personal access token (figd_)CriticalsecretsAny fileCWE-798
VNX-SEC-091Vercel API token (vc*_)CriticalsecretsAny fileCWE-798
VNX-SEC-092Netlify API token (nf*_)CriticalsecretsAny fileCWE-798
VNX-SEC-093HubSpot private app token (pat-)CriticalsecretsAny fileCWE-798
VNX-SEC-094Canva client secret (cnvca)CriticalsecretsAny fileCWE-798
VNX-SEC-095PagerDuty API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-096Sentry DSN with secretHighsecretsAny fileCWE-798
VNX-SEC-097Postmark server API tokenHighsecretsAny fileCWE-798
VNX-SEC-098Crates.io (Rust) API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-099Zapier webhook URLHighsecretsAny fileCWE-798
VNX-SEC-100Linear API key (lin_api_)HighsecretsAny fileCWE-798
VNX-SEC-101Oracle Cloud (OCI) API private keyCriticalsecretsAny fileCWE-798
VNX-SEC-102Oracle Cloud (OCI) auth tokenHighsecretsAny fileCWE-798
VNX-SEC-103IBM Cloud IAM API keyCriticalsecretsAny fileCWE-798
VNX-SEC-104Tencent Cloud secret ID (AKID)HighsecretsAny fileCWE-798
VNX-SEC-105Tencent Cloud secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-106Yandex Cloud IAM tokenHighsecretsAny fileCWE-798
VNX-SEC-107Yandex Cloud OAuth tokenCriticalsecretsAny fileCWE-798
VNX-SEC-108Scaleway secret key (UUID)CriticalsecretsAny fileCWE-798
VNX-SEC-109Scaleway access key (SCW prefix)HighsecretsAny fileCWE-798
VNX-SEC-110Hetzner Cloud API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-111Linode personal access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-112Vultr API keyCriticalsecretsAny fileCWE-798
VNX-SEC-113Fastly API tokenHighsecretsAny fileCWE-798
VNX-SEC-114Akamai EdgeGrid client tokenHighsecretsAny fileCWE-798
VNX-SEC-115Akamai EdgeGrid client secretCriticalsecretsAny fileCWE-798
VNX-SEC-116AWS SES SMTP passwordHighsecretsAny fileCWE-798
VNX-SEC-117AWS MWS auth tokenHighsecretsAny fileCWE-798
VNX-SEC-118AWS AppSync GraphQL API key (da2-)HighsecretsAny fileCWE-798
VNX-SEC-119AWS Cognito identity/user pool IDMediumsecretsAny fileCWE-798
VNX-SEC-120AWS Cognito app client secretHighsecretsAny fileCWE-798
VNX-SEC-121AWS Amplify app deploy/webhook IDMediumsecretsAny fileCWE-798
VNX-SEC-122AWS SNS topic ARN with credentials contextMediumsecretsAny fileCWE-798
VNX-SEC-123Azure AD client secretCriticalsecretsAny fileCWE-798
VNX-SEC-124Azure SAS token (shared access signature)HighsecretsAny fileCWE-798
VNX-SEC-125Azure Service Bus connection stringCriticalsecretsAny fileCWE-798
VNX-SEC-126Azure Cosmos DB account keyCriticalsecretsAny fileCWE-798
VNX-SEC-127Azure Cognitive Search admin keyHighsecretsAny fileCWE-798
VNX-SEC-128Azure Container Registry passwordHighsecretsAny fileCWE-798
VNX-SEC-129Azure DevOps personal access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-130GCP OAuth access token (ya29.)HighsecretsAny fileCWE-798
VNX-SEC-131GCP OAuth refresh token (1//)CriticalsecretsAny fileCWE-798
VNX-SEC-132Google reCAPTCHA secret keyMediumsecretsAny fileCWE-798
VNX-SEC-133Firebase Cloud Messaging server key (AAAA)HighsecretsAny fileCWE-798
VNX-SEC-134Firebase Realtime Database URLMediumsecretsAny fileCWE-798
VNX-SEC-135DigitalOcean Spaces access keyHighsecretsAny fileCWE-798
VNX-SEC-136DigitalOcean Spaces secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-137Render API key (rnd_)CriticalsecretsAny fileCWE-798
VNX-SEC-138Railway API/project tokenCriticalsecretsAny fileCWE-798
VNX-SEC-139Fly.io API token (fo1_ / FlyV1)CriticalsecretsAny fileCWE-798
VNX-SEC-140Aiven API token (aivenv1 / context)CriticalsecretsAny fileCWE-798
VNX-SEC-141Cloudflare Origin CA key (v1.0-)HighsecretsAny fileCWE-798
VNX-SEC-142Cloudflare Stream signing key contextHighsecretsAny fileCWE-798
VNX-SEC-143OVH application secret / consumer keyHighsecretsAny fileCWE-798
VNX-SEC-144UpCloud API credentials contextHighsecretsAny fileCWE-798
VNX-SEC-145Alibaba Cloud STS temporary access key (STS.)HighsecretsAny fileCWE-798
VNX-SEC-146IBM Cloud Object Storage HMAC secret access keyCriticalsecretsAny fileCWE-798
VNX-SEC-147Azure Storage connection stringCriticalsecretsAny fileCWE-798
VNX-SEC-148GCP service account email + key contextHighsecretsAny fileCWE-798
VNX-SEC-149Google Maps Platform API key (AIza, restricted-context)MediumsecretsAny fileCWE-798
VNX-SEC-150Scaleway API token (UUID, context)HighsecretsAny fileCWE-798
VNX-SEC-151Tencent Cloud COS connection (SecretId+SecretKey)HighsecretsAny fileCWE-798
VNX-SEC-152Cloudflare Global API key (legacy 37-hex)CriticalsecretsAny fileCWE-798
VNX-SEC-153GCP Firebase web API config apiKey (AIza, firebase context)MediumsecretsAny fileCWE-798
VNX-SEC-154Hetzner DNS API token (context)HighsecretsAny fileCWE-798
VNX-SEC-155Vultr Object Storage S3 secret (context)HighsecretsAny fileCWE-798
VNX-SEC-156Fastly Compute / service ID with token contextMediumsecretsAny fileCWE-798
VNX-SEC-157Render deploy hook URLMediumsecretsAny fileCWE-798
VNX-SEC-158Linode Object Storage access key (context)HighsecretsAny fileCWE-798
VNX-SEC-159Azure Maps subscription key (context)MediumsecretsAny fileCWE-798
VNX-SEC-160GCP Cloud Run / IAP service identity token (context)HighsecretsAny fileCWE-798
VNX-SEC-161Alibaba Cloud secret access key (context)CriticalsecretsAny fileCWE-798
VNX-SEC-162OVH application key (context)MediumsecretsAny fileCWE-798
VNX-SEC-163Yandex Cloud API key (AQVN context)CriticalsecretsAny fileCWE-798
VNX-SEC-164IBM Cloud IAM bearer token (context)HighsecretsAny fileCWE-798
VNX-SEC-165Aiven service connection URI (context)CriticalsecretsAny fileCWE-798
VNX-SEC-166Scaleway IAM API secret key (context)CriticalsecretsAny fileCWE-798
VNX-SEC-167Tencent Cloud SCF / API gateway secret (context)CriticalsecretsAny fileCWE-798
VNX-SEC-168Cloudflare R2 S3 secret access key (context)CriticalsecretsAny fileCWE-798
VNX-SEC-169Azure subscription / tenant credential bundle (context)CriticalsecretsAny fileCWE-798
VNX-SEC-170GCP API key (AIza) genericHighsecretsAny fileCWE-798
VNX-SEC-171Hetzner Cloud robot webservice password (context)HighsecretsAny fileCWE-798
VNX-SEC-172Vultr deploy / API token (context, hex)HighsecretsAny fileCWE-798
VNX-SEC-173Akamai EdgeGrid access token (context)HighsecretsAny fileCWE-798
VNX-SEC-174GCP service account private key (PEM in JSON)CriticalsecretsAny fileCWE-798
VNX-SEC-175Railway project deploy token (context, base64)HighsecretsAny fileCWE-798
VNX-SEC-176Oracle Cloud (OCI) config fingerprint+key contextMediumsecretsAny fileCWE-798
VNX-SEC-177DigitalOcean App Platform / function deploy URL (context)MediumsecretsAny fileCWE-798
VNX-SEC-178Fly.io org deploy token (FlyV1 macaroon)HighsecretsAny fileCWE-798
VNX-SEC-179Tencent Cloud webhook URL (context)MediumsecretsAny fileCWE-798
VNX-SEC-180Cloudflare Workers / Pages deploy webhook URLMediumsecretsAny fileCWE-798
VNX-SEC-181Bitbucket app passwordHighsecretsAny fileCWE-798
VNX-SEC-182Bitbucket app password (ATBB prefix)HighsecretsAny fileCWE-798
VNX-SEC-183Bitbucket OAuth client secretHighsecretsAny fileCWE-798
VNX-SEC-184Azure DevOps personal access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-185CircleCI personal API tokenHighsecretsAny fileCWE-798
VNX-SEC-186CircleCI project API token (CCIP)HighsecretsAny fileCWE-798
VNX-SEC-187Travis CI API tokenHighsecretsAny fileCWE-798
VNX-SEC-188Buildkite agent tokenCriticalsecretsAny fileCWE-798
VNX-SEC-189Buildkite API access tokenHighsecretsAny fileCWE-798
VNX-SEC-190Jenkins API tokenHighsecretsAny fileCWE-798
VNX-SEC-191Jenkins crumb (CSRF token)MediumsecretsAny fileCWE-798
VNX-SEC-192Drone CI tokenHighsecretsAny fileCWE-798
VNX-SEC-193TeamCity access tokenHighsecretsAny fileCWE-798
VNX-SEC-194TeamCity access token (generic)HighsecretsAny fileCWE-798
VNX-SEC-195Gitea access tokenHighsecretsAny fileCWE-798
VNX-SEC-196Gitee access tokenHighsecretsAny fileCWE-798
VNX-SEC-197Codecov upload tokenMediumsecretsAny fileCWE-798
VNX-SEC-198Coveralls repo tokenMediumsecretsAny fileCWE-798
VNX-SEC-199Code Climate test reporter IDMediumsecretsAny fileCWE-798
VNX-SEC-200Sourcegraph access token (sgp_)HighsecretsAny fileCWE-798
VNX-SEC-201Sourcegraph dotcom token (sgph_)HighsecretsAny fileCWE-798
VNX-SEC-202Semaphore CI tokenHighsecretsAny fileCWE-798
VNX-SEC-203Harness personal access token (pat.)CriticalsecretsAny fileCWE-798
VNX-SEC-204Harness service account token (sat.)CriticalsecretsAny fileCWE-798
VNX-SEC-205Spacelift API tokenHighsecretsAny fileCWE-798
VNX-SEC-206Pulumi access token (pul-)CriticalsecretsAny fileCWE-798
VNX-SEC-207Octopus Deploy API key (API-)HighsecretsAny fileCWE-798
VNX-SEC-208Terraform Cloud team/org tokenCriticalsecretsAny fileCWE-798
VNX-SEC-209JFrog access/identity tokenHighsecretsAny fileCWE-798
VNX-SEC-210JFrog reference token (cmVmdGtuOjA)HighsecretsAny fileCWE-798
VNX-SEC-211Argo CD auth token (JWT)CriticalsecretsAny fileCWE-798
VNX-SEC-212FluxCD git credentialsHighsecretsAny fileCWE-798
VNX-SEC-213GitHub App private key (PEM)CriticalsecretsAny fileCWE-798
VNX-SEC-214GitHub Actions runner registration token (BBBB)HighsecretsAny fileCWE-798
VNX-SEC-215Vercel deploy hook URLHighsecretsAny fileCWE-798
VNX-SEC-216Vercel API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-217Bitrise access tokenHighsecretsAny fileCWE-798
VNX-SEC-218Codefresh API tokenHighsecretsAny fileCWE-798
VNX-SEC-219Woodpecker CI tokenHighsecretsAny fileCWE-798
VNX-SEC-220Concourse CI tokenHighsecretsAny fileCWE-798
VNX-SEC-221GoCD access tokenHighsecretsAny fileCWE-798
VNX-SEC-222Sentry CLI auth token (sntrys_)HighsecretsAny fileCWE-798
VNX-SEC-223Sentry user auth token (sntryu_)HighsecretsAny fileCWE-798
VNX-SEC-224ReadTheDocs API tokenMediumsecretsAny fileCWE-798
VNX-SEC-225Netlify build hook URLHighsecretsAny fileCWE-798
VNX-SEC-226Netlify API access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-227Cloudsmith API keyHighsecretsAny fileCWE-798
VNX-SEC-228Bitbucket Pipelines OIDC/step tokenHighsecretsAny fileCWE-798
VNX-SEC-229TeamCity superuser tokenCriticalsecretsAny fileCWE-798
VNX-SEC-230Drone CI RPC secretCriticalsecretsAny fileCWE-798
VNX-SEC-231Sourcegraph dotcom token (sgd_)HighsecretsAny fileCWE-798
VNX-SEC-232Buildkite registration token (bkua_)CriticalsecretsAny fileCWE-798
VNX-SEC-233Codecov global upload token (legacy)MediumsecretsAny fileCWE-798
VNX-SEC-234Argo CD admin passwordCriticalsecretsAny fileCWE-798
VNX-SEC-235Semaphore organization API token (legacy)HighsecretsAny fileCWE-798
VNX-SEC-236Spacelift API key secretHighsecretsAny fileCWE-798
VNX-SEC-237Codefresh runtime/agent tokenHighsecretsAny fileCWE-798
VNX-SEC-238TeamCity build agent authorization tokenHighsecretsAny fileCWE-798
VNX-SEC-239JFrog Pipelines integration tokenHighsecretsAny fileCWE-798
VNX-SEC-240GitHub Actions runner token (config.sh)HighsecretsAny fileCWE-798
VNX-SEC-241Gitea OAuth client secretHighsecretsAny fileCWE-798
VNX-SEC-242Travis CI Pro/Enterprise access token (legacy)HighsecretsAny fileCWE-798
VNX-SEC-243FluxCD GitRepository SSH private keyCriticalsecretsAny fileCWE-798
VNX-SEC-244Concourse fly target tokenHighsecretsAny fileCWE-798
VNX-SEC-245Cloudsmith entitlement token (cmVudA / ent_)HighsecretsAny fileCWE-798
VNX-SEC-246Octopus Deploy server API key (assignment)HighsecretsAny fileCWE-798
VNX-SEC-247Pulumi config passphraseHighsecretsAny fileCWE-798
VNX-SEC-248Drone CI machine/user token (legacy)HighsecretsAny fileCWE-798
VNX-SEC-249Gitee OAuth client secretHighsecretsAny fileCWE-798
VNX-SEC-250CircleCI context/environment token (assignment)HighsecretsAny fileCWE-798
VNX-SEC-251OpenAI classic API key (sk-)CriticalsecretsAny fileCWE-798
VNX-SEC-252OpenAI legacy API key (sk- 48 char)CriticalsecretsAny fileCWE-798
VNX-SEC-253OpenAI organization ID (org-)MediumsecretsAny fileCWE-798
VNX-SEC-254OpenAI project ID (proj_)MediumsecretsAny fileCWE-798
VNX-SEC-255Azure OpenAI API keyCriticalsecretsAny fileCWE-798
VNX-SEC-256Replicate API token (r8_)CriticalsecretsAny fileCWE-798
VNX-SEC-257Together AI API keyCriticalsecretsAny fileCWE-798
VNX-SEC-258Groq API key (gsk_)CriticalsecretsAny fileCWE-798
VNX-SEC-259Perplexity API key (pplx-)CriticalsecretsAny fileCWE-798
VNX-SEC-260DeepSeek API key (sk-)CriticalsecretsAny fileCWE-798
VNX-SEC-261Stability AI API key (sk-)CriticalsecretsAny fileCWE-798
VNX-SEC-262ElevenLabs API keyCriticalsecretsAny fileCWE-798
VNX-SEC-263ElevenLabs API key (sk_ prefix)CriticalsecretsAny fileCWE-798
VNX-SEC-264AssemblyAI API keyCriticalsecretsAny fileCWE-798
VNX-SEC-265Deepgram API key (Token)CriticalsecretsAny fileCWE-798
VNX-SEC-266Pinecone API keyCriticalsecretsAny fileCWE-798
VNX-SEC-267Pinecone API key (pckey_)CriticalsecretsAny fileCWE-798
VNX-SEC-268Weaviate API keyHighsecretsAny fileCWE-798
VNX-SEC-269Qdrant API keyHighsecretsAny fileCWE-798
VNX-SEC-270LangSmith personal API key (lsv2_pt_)CriticalsecretsAny fileCWE-798
VNX-SEC-271LangSmith service API key (lsv2_sk_)CriticalsecretsAny fileCWE-798
VNX-SEC-272LangChain/LangSmith legacy API key (ls__)HighsecretsAny fileCWE-798
VNX-SEC-273Weights & Biases API keyHighsecretsAny fileCWE-798
VNX-SEC-274CometML API keyHighsecretsAny fileCWE-798
VNX-SEC-275Clarifai personal access tokenHighsecretsAny fileCWE-798
VNX-SEC-276Scale AI API keyHighsecretsAny fileCWE-798
VNX-SEC-277Anyscale API key (esecret_)CriticalsecretsAny fileCWE-798
VNX-SEC-278Fireworks AI API key (fw_)CriticalsecretsAny fileCWE-798
VNX-SEC-279OctoAI API tokenHighsecretsAny fileCWE-798
VNX-SEC-280Voyage AI API key (pa-)CriticalsecretsAny fileCWE-798
VNX-SEC-281Jina AI API key (jina_)CriticalsecretsAny fileCWE-798
VNX-SEC-282AI21 Labs API keyCriticalsecretsAny fileCWE-798
VNX-SEC-283Aleph Alpha API tokenHighsecretsAny fileCWE-798
VNX-SEC-284NVIDIA NGC API key (nvapi-)CriticalsecretsAny fileCWE-798
VNX-SEC-285Hugging Face fine-grained token (hf_oauth/api)CriticalsecretsAny fileCWE-798
VNX-SEC-286Modal token ID (ak-)HighsecretsAny fileCWE-798
VNX-SEC-287Modal token secret (as-)CriticalsecretsAny fileCWE-798
VNX-SEC-288Baseten API keyHighsecretsAny fileCWE-798
VNX-SEC-289RunPod API keyCriticalsecretsAny fileCWE-798
VNX-SEC-290Lambda Labs Cloud API keyCriticalsecretsAny fileCWE-798
VNX-SEC-291Cerebras API key (csk-)CriticalsecretsAny fileCWE-798
VNX-SEC-292Replicate API token (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-293Voyage AI API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-294Together AI API key (40 hex)CriticalsecretsAny fileCWE-798
VNX-SEC-295Fireworks AI API key (fw- dash form)CriticalsecretsAny fileCWE-798
VNX-SEC-296Groq API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-297Mistral API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-298Hugging Face token (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-299Anthropic API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-300Perplexity API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-301DeepSeek API key (sk- standalone)HighsecretsAny fileCWE-798
VNX-SEC-302Cerebras API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-303AssemblyAI API key (32 hex assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-304Deepgram API key (Token header)CriticalsecretsAny fileCWE-798
VNX-SEC-305LangChain endpoint API key (assignment context)HighsecretsAny fileCWE-798
VNX-SEC-306Stability AI API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-307NVIDIA NGC API key (legacy hex)CriticalsecretsAny fileCWE-798
VNX-SEC-308ElevenLabs API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-309Qdrant API key (JWT form)HighsecretsAny fileCWE-798
VNX-SEC-310CometML API key (assignment context)HighsecretsAny fileCWE-798
VNX-SEC-311RunPod API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-312Baseten API key (assignment context)HighsecretsAny fileCWE-798
VNX-SEC-313Jina AI API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-314Anyscale API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-315AI21 Labs API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-316Pinecone API key (assignment context)CriticalsecretsAny fileCWE-798
VNX-SEC-317Weaviate API key (assignment context)HighsecretsAny fileCWE-798
VNX-SEC-318OctoAI token (assignment context)HighsecretsAny fileCWE-798
VNX-SEC-319Lambda Labs API key (lambda. prefix)CriticalsecretsAny fileCWE-798
VNX-SEC-320Clarifai PAT (assignment context)HighsecretsAny fileCWE-798
VNX-SEC-321Stripe restricted key (rk_live)CriticalsecretsAny fileCWE-798
VNX-SEC-322Stripe restricted key (rk_test)HighsecretsAny fileCWE-798
VNX-SEC-323Stripe publishable key (pk_live)MediumsecretsAny fileCWE-798
VNX-SEC-324Stripe publishable key (pk_test)MediumsecretsAny fileCWE-798
VNX-SEC-325Stripe Connect OAuth refresh/access token (ca_)CriticalsecretsAny fileCWE-798
VNX-SEC-326PayPal client secretCriticalsecretsAny fileCWE-798
VNX-SEC-327PayPal/Braintree client idMediumsecretsAny fileCWE-798
VNX-SEC-328Square OAuth access token (sq0atp-)CriticalsecretsAny fileCWE-798
VNX-SEC-329Square OAuth client secret (sq0csp-)CriticalsecretsAny fileCWE-798
VNX-SEC-330Square personal access token (EAAA)CriticalsecretsAny fileCWE-798
VNX-SEC-331Adyen API keyCriticalsecretsAny fileCWE-798
VNX-SEC-332Adyen HMAC keyHighsecretsAny fileCWE-798
VNX-SEC-333Plaid client idMediumsecretsAny fileCWE-798
VNX-SEC-334Plaid secretCriticalsecretsAny fileCWE-798
VNX-SEC-335Coinbase API keyCriticalsecretsAny fileCWE-798
VNX-SEC-336Coinbase Commerce API keyCriticalsecretsAny fileCWE-798
VNX-SEC-337Coinbase Pro API keyCriticalsecretsAny fileCWE-798
VNX-SEC-338Razorpay key id (rzp_live)HighsecretsAny fileCWE-798
VNX-SEC-339Razorpay key id (rzp_test)MediumsecretsAny fileCWE-798
VNX-SEC-340Razorpay key secretCriticalsecretsAny fileCWE-798
VNX-SEC-341Paystack secret key (sk_live)CriticalsecretsAny fileCWE-798
VNX-SEC-342Paystack public key (pk_live)MediumsecretsAny fileCWE-798
VNX-SEC-343Flutterwave secret key (FLWSECK-)CriticalsecretsAny fileCWE-798
VNX-SEC-344Flutterwave test secret key (FLWSECK_TEST-)HighsecretsAny fileCWE-798
VNX-SEC-345Flutterwave public key (FLWPUBK-)MediumsecretsAny fileCWE-798
VNX-SEC-346Mollie live API key (live_)CriticalsecretsAny fileCWE-798
VNX-SEC-347Mollie test API key (test_)MediumsecretsAny fileCWE-798
VNX-SEC-348GoCardless live access token (live_)CriticalsecretsAny fileCWE-798
VNX-SEC-349GoCardless sandbox access token (sandbox_)MediumsecretsAny fileCWE-798
VNX-SEC-350Checkout.com secret key (sk_)CriticalsecretsAny fileCWE-798
VNX-SEC-351Checkout.com public key (pk_)MediumsecretsAny fileCWE-798
VNX-SEC-352Dwolla API key/secretCriticalsecretsAny fileCWE-798
VNX-SEC-353Marqeta API key/tokenCriticalsecretsAny fileCWE-798
VNX-SEC-354Lithic API keyCriticalsecretsAny fileCWE-798
VNX-SEC-355Recurly API keyCriticalsecretsAny fileCWE-798
VNX-SEC-356Chargebee API keyCriticalsecretsAny fileCWE-798
VNX-SEC-357Paddle API key/auth codeCriticalsecretsAny fileCWE-798
VNX-SEC-358Lemon Squeezy API keyCriticalsecretsAny fileCWE-798
VNX-SEC-359Mercado Pago access token (APP_USR-)CriticalsecretsAny fileCWE-798
VNX-SEC-360Klarna API credentialCriticalsecretsAny fileCWE-798
VNX-SEC-361Wise/TransferWise API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-362Brex API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-363Ramp API client secretCriticalsecretsAny fileCWE-798
VNX-SEC-364Authorize.net transaction keyCriticalsecretsAny fileCWE-798
VNX-SEC-365Authorize.net signature keyHighsecretsAny fileCWE-798
VNX-SEC-366Braintree tokenization keyHighsecretsAny fileCWE-798
VNX-SEC-367Braintree private keyCriticalsecretsAny fileCWE-798
VNX-SEC-3682Checkout (Verifone) secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-369BlueSnap API credentialCriticalsecretsAny fileCWE-798
VNX-SEC-370Worldpay API/service keyCriticalsecretsAny fileCWE-798
VNX-SEC-371Checkout.com OAuth client secretCriticalsecretsAny fileCWE-798
VNX-SEC-372Adyen client/checkout key (pubkey)MediumsecretsAny fileCWE-798
VNX-SEC-373Coinbase API secretCriticalsecretsAny fileCWE-798
VNX-SEC-374Recurly public keyMediumsecretsAny fileCWE-798
VNX-SEC-375Chargebee site/key combinationHighsecretsAny fileCWE-798
VNX-SEC-376Plaid access token (access-)CriticalsecretsAny fileCWE-798
VNX-SEC-377Square sandbox access token (EAAAl)MediumsecretsAny fileCWE-798
VNX-SEC-378Mercado Pago test access token (TEST-)MediumsecretsAny fileCWE-798
VNX-SEC-379Dwolla webhook secretHighsecretsAny fileCWE-798
VNX-SEC-380Paddle webhook/notification secretHighsecretsAny fileCWE-798
VNX-SEC-381Paddle API key (pdl_)CriticalsecretsAny fileCWE-798
VNX-SEC-382Lemon Squeezy webhook signing secretHighsecretsAny fileCWE-798
VNX-SEC-383Klarna API username (PK)MediumsecretsAny fileCWE-798
VNX-SEC-384GoCardless webhook secretHighsecretsAny fileCWE-798
VNX-SEC-385Stripe webhook signing secret (Connect)HighsecretsAny fileCWE-798
VNX-SEC-386Marqeta admin API password (Basic auth)CriticalsecretsAny fileCWE-798
VNX-SEC-387Lithic API key (live/test prefix)CriticalsecretsAny fileCWE-798
VNX-SEC-388BlueSnap data-protection keyHighsecretsAny fileCWE-798
VNX-SEC-389Wise API token (raw UUID, no keyword)HighsecretsAny fileCWE-798
VNX-SEC-390Razorpay webhook secretHighsecretsAny fileCWE-798
VNX-SEC-391Coinbase Pro passphraseHighsecretsAny fileCWE-798
VNX-SEC-392Adyen merchant account + key combo (live URL prefix key)MediumsecretsAny fileCWE-798
VNX-SEC-393Brex client secret (OAuth)CriticalsecretsAny fileCWE-798
VNX-SEC-394Worldpay client/checkout key (live URL)MediumsecretsAny fileCWE-798
VNX-SEC-395Ramp client idMediumsecretsAny fileCWE-798
VNX-SEC-396Authorize.net public client keyMediumsecretsAny fileCWE-798
VNX-SEC-397Stripe Connect account id (acct_)MediumsecretsAny fileCWE-798
VNX-SEC-398Mollie OAuth access token (access_)CriticalsecretsAny fileCWE-798
VNX-SEC-399Square application secret (sq0idp- app id)MediumsecretsAny fileCWE-798
VNX-SEC-400Paystack secret key (sk_test)MediumsecretsAny fileCWE-798
VNX-SEC-401Mailchimp API key (-us datacenter)CriticalsecretsAny fileCWE-798
VNX-SEC-402Mandrill API keyHighsecretsAny fileCWE-798
VNX-SEC-403SparkPost API keyHighsecretsAny fileCWE-798
VNX-SEC-404Mailjet API key (public)MediumsecretsAny fileCWE-798
VNX-SEC-405Mailjet secret keyHighsecretsAny fileCWE-798
VNX-SEC-406Vonage/Nexmo API secretHighsecretsAny fileCWE-798
VNX-SEC-407Vonage/Nexmo API keyMediumsecretsAny fileCWE-798
VNX-SEC-408MessageBird/Bird access keyHighsecretsAny fileCWE-798
VNX-SEC-409Plivo Auth ID (MA)MediumsecretsAny fileCWE-798
VNX-SEC-410Plivo Auth ID (SA subaccount)MediumsecretsAny fileCWE-798
VNX-SEC-411Plivo Auth TokenHighsecretsAny fileCWE-798
VNX-SEC-412Telnyx API key (KEY)CriticalsecretsAny fileCWE-798
VNX-SEC-413Bandwidth API token/secretHighsecretsAny fileCWE-798
VNX-SEC-414Sinch service plan API tokenHighsecretsAny fileCWE-798
VNX-SEC-415Infobip API keyHighsecretsAny fileCWE-798
VNX-SEC-416ClickSend API keyHighsecretsAny fileCWE-798
VNX-SEC-417Discord webhook URLHighsecretsAny fileCWE-798
VNX-SEC-418Discord client secretHighsecretsAny fileCWE-798
VNX-SEC-419Slack app-level token (xapp-)CriticalsecretsAny fileCWE-798
VNX-SEC-420Slack config refresh token (xoxe-)CriticalsecretsAny fileCWE-798
VNX-SEC-421Slack config access token (xoxe.xoxp-/xoxb-)CriticalsecretsAny fileCWE-798
VNX-SEC-422Microsoft Graph / Azure AD client secretCriticalsecretsAny fileCWE-798
VNX-SEC-423Intercom access tokenHighsecretsAny fileCWE-798
VNX-SEC-424Zendesk API tokenHighsecretsAny fileCWE-798
VNX-SEC-425Freshchat API tokenHighsecretsAny fileCWE-798
VNX-SEC-426Front API tokenHighsecretsAny fileCWE-798
VNX-SEC-427Help Scout API key / app secretHighsecretsAny fileCWE-798
VNX-SEC-428Crisp API key / identifierHighsecretsAny fileCWE-798
VNX-SEC-429Drift API tokenHighsecretsAny fileCWE-798
VNX-SEC-430Customer.io tracking/app API keyHighsecretsAny fileCWE-798
VNX-SEC-431Klaviyo private API key (pk_)CriticalsecretsAny fileCWE-798
VNX-SEC-432Klaviyo OAuth refresh tokenHighsecretsAny fileCWE-798
VNX-SEC-433Iterable API keyHighsecretsAny fileCWE-798
VNX-SEC-434Braze REST API keyHighsecretsAny fileCWE-798
VNX-SEC-435OneSignal REST API key (os_v2)CriticalsecretsAny fileCWE-798
VNX-SEC-436OneSignal REST API key (legacy hex)HighsecretsAny fileCWE-798
VNX-SEC-437Pusher Channels app secretHighsecretsAny fileCWE-798
VNX-SEC-438Pusher Channels app keyMediumsecretsAny fileCWE-798
VNX-SEC-439Ably API keyCriticalsecretsAny fileCWE-798
VNX-SEC-440PubNub publish key (pub-c-)HighsecretsAny fileCWE-798
VNX-SEC-441PubNub subscribe key (sub-c-)MediumsecretsAny fileCWE-798
VNX-SEC-442PubNub secret key (sec-c-)CriticalsecretsAny fileCWE-798
VNX-SEC-443Stream (getstream) API secretHighsecretsAny fileCWE-798
VNX-SEC-444Stream (getstream) API keyMediumsecretsAny fileCWE-798
VNX-SEC-445Courier auth token (pk_prod_/pk_test_)HighsecretsAny fileCWE-798
VNX-SEC-446Knock API key (sk_/sk_test_)HighsecretsAny fileCWE-798
VNX-SEC-447Loops API keyHighsecretsAny fileCWE-798
VNX-SEC-448Resend API key (re_)CriticalsecretsAny fileCWE-798
VNX-SEC-449Brevo/Sendinblue API key (xkeysib-)CriticalsecretsAny fileCWE-798
VNX-SEC-450Brevo/Sendinblue SMTP key (xsmtpsib-)HighsecretsAny fileCWE-798
VNX-SEC-451Mailtrap API tokenHighsecretsAny fileCWE-798
VNX-SEC-452SMTP2GO API key (api-)HighsecretsAny fileCWE-798
VNX-SEC-453SendGrid subuser/marketing API key (SG.)HighsecretsAny fileCWE-798
VNX-SEC-454Mailgun sending API key (key-)HighsecretsAny fileCWE-798
VNX-SEC-455Postmark account tokenHighsecretsAny fileCWE-798
VNX-SEC-456Telnyx public key (TKEY/v2 public)MediumsecretsAny fileCWE-798
VNX-SEC-457Microsoft Teams incoming webhook URL (Power Automate)HighsecretsAny fileCWE-798
VNX-SEC-458Twilio SendGrid subuser SMTP passwordHighsecretsAny fileCWE-798
VNX-SEC-459Telnyx Messaging Profile secretHighsecretsAny fileCWE-798
VNX-SEC-460Mailchimp Transactional (Mandrill md- key)HighsecretsAny fileCWE-798
VNX-SEC-461Knock public API key (pk_)LowsecretsAny fileCWE-798
VNX-SEC-462Customer.io App API key (Bearer)HighsecretsAny fileCWE-798
VNX-SEC-463Customer.io tracking site/API key pairHighsecretsAny fileCWE-798
VNX-SEC-464Infobip Basic auth API key (App)HighsecretsAny fileCWE-798
VNX-SEC-465Ably API key (keyword context)CriticalsecretsAny fileCWE-798
VNX-SEC-466PubNub secret/keyword keyHighsecretsAny fileCWE-798
VNX-SEC-467Courier auth token (keyword context)HighsecretsAny fileCWE-798
VNX-SEC-468Loops transactional API key (keyword)HighsecretsAny fileCWE-798
VNX-SEC-469Sinch service plan ID + token (Bearer)HighsecretsAny fileCWE-798
VNX-SEC-470Help Scout OAuth2 app id/secret pairHighsecretsAny fileCWE-798
VNX-SEC-471Intercom OAuth client secretHighsecretsAny fileCWE-798
VNX-SEC-472ClickSend username+API key Basic headerHighsecretsAny fileCWE-798
VNX-SEC-473Bandwidth account API token+secret pairHighsecretsAny fileCWE-798
VNX-SEC-474Plivo Basic auth header (Auth ID:Token)HighsecretsAny fileCWE-798
VNX-SEC-475Stream getstream JWT server tokenHighsecretsAny fileCWE-798
VNX-SEC-476Freshchat bundle/app token (keyword)HighsecretsAny fileCWE-798
VNX-SEC-477Resend webhook signing secret (whsec_)MediumsecretsAny fileCWE-798
VNX-SEC-478Drift OAuth client secretHighsecretsAny fileCWE-798
VNX-SEC-479Crisp plugin token (keyword)HighsecretsAny fileCWE-798
VNX-SEC-480Iterable JWT-enabled API keyHighsecretsAny fileCWE-798
VNX-SEC-481Auth0 client secretCriticalsecretsAny fileCWE-798
VNX-SEC-482Auth0 Management API token (JWT)CriticalsecretsAny fileCWE-798
VNX-SEC-483Okta SSWS API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-484Okta API token (00 prefix)CriticalsecretsAny fileCWE-798
VNX-SEC-485Clerk secret key (live)CriticalsecretsAny fileCWE-798
VNX-SEC-486Clerk secret key (test)HighsecretsAny fileCWE-798
VNX-SEC-487Clerk publishable key (live)MediumsecretsAny fileCWE-798
VNX-SEC-488WorkOS API key (live)CriticalsecretsAny fileCWE-798
VNX-SEC-489WorkOS API key (test)HighsecretsAny fileCWE-798
VNX-SEC-490Stytch secret (live)CriticalsecretsAny fileCWE-798
VNX-SEC-491Stytch secret (test)HighsecretsAny fileCWE-798
VNX-SEC-492Supabase service_role JWTCriticalsecretsAny fileCWE-798
VNX-SEC-493Supabase anon JWTMediumsecretsAny fileCWE-798
VNX-SEC-494Supabase access token (sbp_)CriticalsecretsAny fileCWE-798
VNX-SEC-495Contentful Content Management token (CFPAT-)CriticalsecretsAny fileCWE-798
VNX-SEC-496Contentful Content Delivery API tokenMediumsecretsAny fileCWE-798
VNX-SEC-497Contentful Content Preview API tokenHighsecretsAny fileCWE-798
VNX-SEC-498Sanity API token (sk)HighsecretsAny fileCWE-798
VNX-SEC-499Storyblok personal access tokenHighsecretsAny fileCWE-798
VNX-SEC-500Algolia admin API keyCriticalsecretsAny fileCWE-798
VNX-SEC-501Typesense API keyHighsecretsAny fileCWE-798
VNX-SEC-502Meilisearch master/API keyCriticalsecretsAny fileCWE-798
VNX-SEC-503Typeform personal access token (tfp_)HighsecretsAny fileCWE-798
VNX-SEC-504Calendly personal access tokenHighsecretsAny fileCWE-798
VNX-SEC-505Webflow API tokenHighsecretsAny fileCWE-798
VNX-SEC-506Framer API tokenHighsecretsAny fileCWE-798
VNX-SEC-507Retool API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-508Asana personal access token (1/)HighsecretsAny fileCWE-798
VNX-SEC-509Asana personal access token (2/)HighsecretsAny fileCWE-798
VNX-SEC-510monday.com API token (JWT)HighsecretsAny fileCWE-798
VNX-SEC-511ClickUp personal API token (pk_)HighsecretsAny fileCWE-798
VNX-SEC-512Trello API keyMediumsecretsAny fileCWE-798
VNX-SEC-513Trello API tokenHighsecretsAny fileCWE-798
VNX-SEC-514Miro access tokenHighsecretsAny fileCWE-798
VNX-SEC-515Loom API keyMediumsecretsAny fileCWE-798
VNX-SEC-516Dropbox short-lived access token (sl.)HighsecretsAny fileCWE-798
VNX-SEC-517Dropbox long-lived access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-518Box developer tokenHighsecretsAny fileCWE-798
VNX-SEC-519Zoom Server-to-Server OAuth client secretCriticalsecretsAny fileCWE-798
VNX-SEC-520Zoom JWT app tokenHighsecretsAny fileCWE-798
VNX-SEC-521DocuSign integration secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-522Dropbox Sign (HelloSign) API keyCriticalsecretsAny fileCWE-798
VNX-SEC-523Adobe IMS client secretCriticalsecretsAny fileCWE-798
VNX-SEC-524Salesforce consumer key (3MVG9)HighsecretsAny fileCWE-798
VNX-SEC-525Salesforce refresh token (5Aep861)CriticalsecretsAny fileCWE-798
VNX-SEC-526ServiceNow credentialsHighsecretsAny fileCWE-798
VNX-SEC-527Zoho OAuth token (1000.)HighsecretsAny fileCWE-798
VNX-SEC-528Freshservice/Freshworks API keyHighsecretsAny fileCWE-798
VNX-SEC-529Pipedrive API tokenHighsecretsAny fileCWE-798
VNX-SEC-530Close API keyHighsecretsAny fileCWE-798
VNX-SEC-531Copper API keyHighsecretsAny fileCWE-798
VNX-SEC-532Segment write keyMediumsecretsAny fileCWE-798
VNX-SEC-533LaunchDarkly SDK key (sdk-)HighsecretsAny fileCWE-798
VNX-SEC-534LaunchDarkly API access token (api-)CriticalsecretsAny fileCWE-798
VNX-SEC-535LaunchDarkly mobile key (mob-)MediumsecretsAny fileCWE-798
VNX-SEC-536Split.io API keyHighsecretsAny fileCWE-798
VNX-SEC-537Statsig server secret key (secret-)HighsecretsAny fileCWE-798
VNX-SEC-538Unleash API tokenHighsecretsAny fileCWE-798
VNX-SEC-539Optimizely SDK/API tokenHighsecretsAny fileCWE-798
VNX-SEC-540PostHog personal API key (phx_)CriticalsecretsAny fileCWE-798
VNX-SEC-541PostHog project API key (phc_)MediumsecretsAny fileCWE-798
VNX-SEC-542Mixpanel API secretHighsecretsAny fileCWE-798
VNX-SEC-543Mixpanel service account secretCriticalsecretsAny fileCWE-798
VNX-SEC-544Amplitude API keyMediumsecretsAny fileCWE-798
VNX-SEC-545Amplitude secret keyHighsecretsAny fileCWE-798
VNX-SEC-546Pendo integration keyHighsecretsAny fileCWE-798
VNX-SEC-547Heap app ID / API keyMediumsecretsAny fileCWE-798
VNX-SEC-548FullStory API keyHighsecretsAny fileCWE-798
VNX-SEC-549Hotjar API keyMediumsecretsAny fileCWE-798
VNX-SEC-550Smartsheet API access tokenHighsecretsAny fileCWE-798
VNX-SEC-551WorkOS publishable keyMediumsecretsAny fileCWE-798
VNX-SEC-552Okta client secretCriticalsecretsAny fileCWE-798
VNX-SEC-553Auth0 API key/token (generic)HighsecretsAny fileCWE-798
VNX-SEC-554Sanity project token (keyword)HighsecretsAny fileCWE-798
VNX-SEC-555Algolia search/usage key (keyword)MediumsecretsAny fileCWE-798
VNX-SEC-556Statsig console API key (console-)CriticalsecretsAny fileCWE-798
VNX-SEC-557Meilisearch tenant token (JWT)MediumsecretsAny fileCWE-798
VNX-SEC-558Contentful management token (keyword)CriticalsecretsAny fileCWE-798
VNX-SEC-559Calendly OAuth client secretHighsecretsAny fileCWE-798
VNX-SEC-560Webflow site API token (Bearer keyword)HighsecretsAny fileCWE-798
VNX-SEC-561Snowflake account identifier + password connectionCriticalsecretsAny fileCWE-798
VNX-SEC-562Snowflake programmatic access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-563Databricks personal access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-564PlanetScale service tokenCriticalsecretsAny fileCWE-798
VNX-SEC-565PlanetScale database passwordCriticalsecretsAny fileCWE-798
VNX-SEC-566Neon database connection stringCriticalsecretsAny fileCWE-798
VNX-SEC-567Neon API keyHighsecretsAny fileCWE-798
VNX-SEC-568CockroachDB Cloud connection stringCriticalsecretsAny fileCWE-798
VNX-SEC-569FaunaDB secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-570InfluxDB v2 API tokenHighsecretsAny fileCWE-798
VNX-SEC-571InfluxDB v1 user:password connectionHighsecretsAny fileCWE-798
VNX-SEC-572Elastic Cloud API key (base64)HighsecretsAny fileCWE-798
VNX-SEC-573Elastic Cloud IDMediumsecretsAny fileCWE-798
VNX-SEC-574MongoDB Atlas API public keyMediumsecretsAny fileCWE-798
VNX-SEC-575MongoDB Atlas API private keyCriticalsecretsAny fileCWE-798
VNX-SEC-576Upstash Redis REST tokenHighsecretsAny fileCWE-798
VNX-SEC-577Redis Cloud / rediss URL with passwordHighsecretsAny fileCWE-798
VNX-SEC-578RabbitMQ AMQP URL with credentialsHighsecretsAny fileCWE-798
VNX-SEC-579Confluent Cloud API keyHighsecretsAny fileCWE-798
VNX-SEC-580Confluent Cloud API secretCriticalsecretsAny fileCWE-798
VNX-SEC-581Cloudinary URL with API secretCriticalsecretsAny fileCWE-798
VNX-SEC-582Mux access token IDMediumsecretsAny fileCWE-798
VNX-SEC-583Mux access token secretCriticalsecretsAny fileCWE-798
VNX-SEC-584Bunny CDN API / storage keyHighsecretsAny fileCWE-798
VNX-SEC-585ImageKit private keyCriticalsecretsAny fileCWE-798
VNX-SEC-586Filestack API keyHighsecretsAny fileCWE-798
VNX-SEC-587Uploadcare secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-588Uploadcare public keyMediumsecretsAny fileCWE-798
VNX-SEC-589AWS RDS / Aurora connection stringCriticalsecretsAny fileCWE-798
VNX-SEC-590ClickHouse connection string with passwordHighsecretsAny fileCWE-798
VNX-SEC-591TimescaleDB Cloud connection stringCriticalsecretsAny fileCWE-798
VNX-SEC-592SingleStore connection string with passwordHighsecretsAny fileCWE-798
VNX-SEC-593DataStax Astra DB tokenCriticalsecretsAny fileCWE-798
VNX-SEC-594Couchbase connection string with passwordHighsecretsAny fileCWE-798
VNX-SEC-595Neo4j Aura connection string with passwordCriticalsecretsAny fileCWE-798
VNX-SEC-596ArangoDB connection string with passwordHighsecretsAny fileCWE-798
VNX-SEC-597Memcached SASL connection with credentialsMediumsecretsAny fileCWE-798
VNX-SEC-598MSSQL connection string with passwordCriticalsecretsAny fileCWE-798
VNX-SEC-599Oracle DB connection string with passwordCriticalsecretsAny fileCWE-798
VNX-SEC-600Cassandra connection string with passwordHighsecretsAny fileCWE-798
VNX-SEC-601Snowflake key-pair private key (JWT auth)CriticalsecretsAny fileCWE-798
VNX-SEC-602Databricks OAuth client secretCriticalsecretsAny fileCWE-798
VNX-SEC-603Datadog application key (app key)HighsecretsAny fileCWE-798
VNX-SEC-604Honeycomb API keyHighsecretsAny fileCWE-798
VNX-SEC-605Lightstep / Cloud Observability access tokenHighsecretsAny fileCWE-798
VNX-SEC-606Dynatrace API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-607Splunk HEC tokenHighsecretsAny fileCWE-798
VNX-SEC-608Splunk session / authentication tokenHighsecretsAny fileCWE-798
VNX-SEC-609Rollbar project access tokenHighsecretsAny fileCWE-798
VNX-SEC-610Bugsnag API keyMediumsecretsAny fileCWE-798
VNX-SEC-611Honeybadger API keyHighsecretsAny fileCWE-798
VNX-SEC-612Logz.io shipping / API tokenHighsecretsAny fileCWE-798
VNX-SEC-613Loggly customer tokenMediumsecretsAny fileCWE-798
VNX-SEC-614Better Stack / Logtail source tokenHighsecretsAny fileCWE-798
VNX-SEC-615Grafana Cloud access policy tokenCriticalsecretsAny fileCWE-798
VNX-SEC-616Grafana service account tokenHighsecretsAny fileCWE-798
VNX-SEC-617New Relic user API key (NRAK)HighsecretsAny fileCWE-798
VNX-SEC-618New Relic REST API key (NRAA)HighsecretsAny fileCWE-798
VNX-SEC-619New Relic insert / ingest key (NRII)HighsecretsAny fileCWE-798
VNX-SEC-620AppDynamics access keyHighsecretsAny fileCWE-798
VNX-SEC-621Instana agent keyHighsecretsAny fileCWE-798
VNX-SEC-622Sumo Logic collector access keyHighsecretsAny fileCWE-798
VNX-SEC-623Prometheus remote-write basic-auth URLHighsecretsAny fileCWE-798
VNX-SEC-624Elastic APM secret tokenHighsecretsAny fileCWE-798
VNX-SEC-625Raygun API keyMediumsecretsAny fileCWE-798
VNX-SEC-626Datadog client token (pub)MediumsecretsAny fileCWE-798
VNX-SEC-627Honeycomb ingest key (hcaik / hcxik)HighsecretsAny fileCWE-798
VNX-SEC-628Upstash Kafka REST passwordHighsecretsAny fileCWE-798
VNX-SEC-629MongoDB Atlas SRV connection with passwordCriticalsecretsAny fileCWE-798
VNX-SEC-630Snowflake account locator + regionMediumsecretsAny fileCWE-798
VNX-SEC-631Redis Cloud / Upstash REST URL (https with token)HighsecretsAny fileCWE-798
VNX-SEC-632Datadog API key (dd context)HighsecretsAny fileCWE-798
VNX-SEC-633Logtail / Better Stack ingesting host token (https)HighsecretsAny fileCWE-798
VNX-SEC-634Dynatrace platform token (dt0s)CriticalsecretsAny fileCWE-798
VNX-SEC-635ScyllaDB Cloud connection string with passwordHighsecretsAny fileCWE-798
VNX-SEC-636Aiven service connection string with passwordCriticalsecretsAny fileCWE-798
VNX-SEC-637Aiven API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-638Sentry organization auth token (sntrys)HighsecretsAny fileCWE-798
VNX-SEC-639Pyroscope / Grafana profiling ingest URL with tokenHighsecretsAny fileCWE-798
VNX-SEC-640Sumo Logic HTTP source collector URLHighsecretsAny fileCWE-798
VNX-SEC-641OpenSSH private key blockCriticalsecretsAny fileCWE-798
VNX-SEC-642RSA private key blockCriticalsecretsAny fileCWE-798
VNX-SEC-643EC private key blockCriticalsecretsAny fileCWE-798
VNX-SEC-644DSA private key blockCriticalsecretsAny fileCWE-798
VNX-SEC-645PKCS8 private key blockCriticalsecretsAny fileCWE-798
VNX-SEC-646Encrypted private key blockHighsecretsAny fileCWE-798
VNX-SEC-647PuTTY private key file (.ppk)CriticalsecretsAny fileCWE-798
VNX-SEC-648SSH2 private key blockCriticalsecretsAny fileCWE-798
VNX-SEC-649PKCS12 keystore referenceHighsecretsAny fileCWE-798
VNX-SEC-650Certificate bundled with private keyMediumsecretsAny fileCWE-798
VNX-SEC-651JWT HS256 hardcoded signing secretCriticalsecretsAny fileCWE-798
VNX-SEC-652Bitcoin WIF private keyCriticalsecretsAny fileCWE-798
VNX-SEC-653BIP39 mnemonic seed phraseCriticalsecretsAny fileCWE-798
VNX-SEC-654Solana keypair byte arrayCriticalsecretsAny fileCWE-798
VNX-SEC-655Tron (TRX) private keyCriticalsecretsAny fileCWE-798
VNX-SEC-656Infura project IDMediumsecretsAny fileCWE-798
VNX-SEC-657Infura project secretHighsecretsAny fileCWE-798
VNX-SEC-658Alchemy auth token (alcht_)HighsecretsAny fileCWE-798
VNX-SEC-659Alchemy API keyHighsecretsAny fileCWE-798
VNX-SEC-660QuickNode API tokenHighsecretsAny fileCWE-798
VNX-SEC-661Moralis API keyHighsecretsAny fileCWE-798
VNX-SEC-662Etherscan API keyMediumsecretsAny fileCWE-798
VNX-SEC-663BscScan API keyMediumsecretsAny fileCWE-798
VNX-SEC-664PolygonScan API keyMediumsecretsAny fileCWE-798
VNX-SEC-665Blockchain.com API keyHighsecretsAny fileCWE-798
VNX-SEC-666Coinbase Wallet API secretCriticalsecretsAny fileCWE-798
VNX-SEC-667Binance API keyCriticalsecretsAny fileCWE-798
VNX-SEC-668Binance API secretCriticalsecretsAny fileCWE-798
VNX-SEC-669Kraken API keyCriticalsecretsAny fileCWE-798
VNX-SEC-670Kraken private API keyCriticalsecretsAny fileCWE-798
VNX-SEC-671Bitfinex API keyCriticalsecretsAny fileCWE-798
VNX-SEC-672Tatum API keyHighsecretsAny fileCWE-798
VNX-SEC-673thirdweb secret key (sk_)HighsecretsAny fileCWE-798
VNX-SEC-674WalletConnect project IDMediumsecretsAny fileCWE-798
VNX-SEC-675Twitch client IDMediumsecretsAny fileCWE-798
VNX-SEC-676Twitch client secretHighsecretsAny fileCWE-798
VNX-SEC-677Twitch OAuth access token (oauth:)HighsecretsAny fileCWE-798
VNX-SEC-678Spotify client secretHighsecretsAny fileCWE-798
VNX-SEC-679Reddit client secretHighsecretsAny fileCWE-798
VNX-SEC-680LinkedIn client secretHighsecretsAny fileCWE-798
VNX-SEC-681Facebook/Meta app secretCriticalsecretsAny fileCWE-798
VNX-SEC-682Facebook/Meta access token (EAAB)CriticalsecretsAny fileCWE-798
VNX-SEC-683Instagram access token (IGQ)CriticalsecretsAny fileCWE-798
VNX-SEC-684Twitter/X API key (consumer key)HighsecretsAny fileCWE-798
VNX-SEC-685Twitter/X API secret (consumer secret)HighsecretsAny fileCWE-798
VNX-SEC-686Twitter/X bearer token (AAAAAAAA)HighsecretsAny fileCWE-798
VNX-SEC-687Twitter/X access tokenHighsecretsAny fileCWE-798
VNX-SEC-688TikTok client secretHighsecretsAny fileCWE-798
VNX-SEC-689Pinterest access tokenHighsecretsAny fileCWE-798
VNX-SEC-690Snapchat client secretHighsecretsAny fileCWE-798
VNX-SEC-691Mastodon access tokenHighsecretsAny fileCWE-798
VNX-SEC-692Bluesky app passwordHighsecretsAny fileCWE-798
VNX-SEC-693WooCommerce consumer key (ck_)HighsecretsAny fileCWE-798
VNX-SEC-694WooCommerce consumer secret (cs_)HighsecretsAny fileCWE-798
VNX-SEC-695Magento integration access tokenHighsecretsAny fileCWE-798
VNX-SEC-696PuTTY private key MAC lineHighsecretsAny fileCWE-798
VNX-SEC-697SSH private key beginning marker (generic)CriticalsecretsAny fileCWE-798
VNX-SEC-698BscScan/Etherscan-family multichain key (V2)MediumsecretsAny fileCWE-798
VNX-SEC-699Coinbase API key (organizations/ EC key name)HighsecretsAny fileCWE-798
VNX-SEC-700Ethereum keystore JSON (V3 wallet)HighsecretsAny fileCWE-798
VNX-SEC-701Spotify access token (BQ...)HighsecretsAny fileCWE-798
VNX-SEC-702YouTube data API client secret (GOCSPX context)HighsecretsAny fileCWE-798
VNX-SEC-703TikTok access token (act.)HighsecretsAny fileCWE-798
VNX-SEC-704Reddit refresh tokenHighsecretsAny fileCWE-798
VNX-SEC-705Discourse API keyHighsecretsAny fileCWE-798
VNX-SEC-706Bitcoin testnet WIF private keyMediumsecretsAny fileCWE-798
VNX-SEC-707Solana base58 secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-708Helius API keyHighsecretsAny fileCWE-798
VNX-SEC-709LinkedIn access token (AQ...)HighsecretsAny fileCWE-798
VNX-SEC-710Snapchat OAuth access tokenHighsecretsAny fileCWE-798
VNX-SEC-711Pinterest app secretHighsecretsAny fileCWE-798
VNX-SEC-712Mastodon application client secretHighsecretsAny fileCWE-798
VNX-SEC-713OKX API passphraseCriticalsecretsAny fileCWE-798
VNX-SEC-714OKX API secretCriticalsecretsAny fileCWE-798
VNX-SEC-715Bybit API keyCriticalsecretsAny fileCWE-798
VNX-SEC-716Bybit API secretCriticalsecretsAny fileCWE-798
VNX-SEC-717Gemini exchange API key (account-/master-)CriticalsecretsAny fileCWE-798
VNX-SEC-718Dune Analytics API keyMediumsecretsAny fileCWE-798
VNX-SEC-719Pinata JWT (IPFS)HighsecretsAny fileCWE-798
VNX-SEC-720Twitch app access token (context)HighsecretsAny fileCWE-798
VNX-SEC-721Facebook page/app access token (context)HighsecretsAny fileCWE-798
VNX-SEC-722YouTube/Google OAuth refresh token (1//)CriticalsecretsAny fileCWE-798
VNX-SEC-723Twitch refresh token (context)HighsecretsAny fileCWE-798
VNX-SEC-724Coinbase Commerce API keyHighsecretsAny fileCWE-798
VNX-SEC-725Ankr API keyMediumsecretsAny fileCWE-798
VNX-SEC-726Discord webhook URLMediumsecretsAny fileCWE-798
VNX-SEC-727Slack webhook URLMediumsecretsAny fileCWE-798
VNX-SEC-728Telegram bot tokenHighsecretsAny fileCWE-798
VNX-SEC-729Vimeo access tokenHighsecretsAny fileCWE-798
VNX-SEC-730Twitch extension secretHighsecretsAny fileCWE-798
VNX-SEC-731Hardcoded session/cookie signing secretHighsecretsAny fileCWE-798
VNX-SEC-732Hardcoded encryption key (AES/Fernet context)HighsecretsAny fileCWE-798
VNX-SEC-733Bittrex/legacy exchange API secretHighsecretsAny fileCWE-798
VNX-SEC-734KuCoin API passphraseCriticalsecretsAny fileCWE-798
VNX-SEC-735CoinMarketCap API keyMediumsecretsAny fileCWE-798
VNX-SEC-736PostHog project API key (phc_)MediumsecretsAny fileCWE-798
VNX-SEC-737PostHog personal API key (phx_)HighsecretsAny fileCWE-798
VNX-SEC-738LaunchDarkly SDK/API key (sdk-/api-)HighsecretsAny fileCWE-798
VNX-SEC-739Flagsmith / Unleash feature-flag server keyMediumsecretsAny fileCWE-798
VNX-SEC-740Statsig server secret key (secret-)HighsecretsAny fileCWE-798
VNX-SEC-741Workday OAuth client secretCriticalsecretsAny fileCWE-798
VNX-SEC-742Workday ISU integration passwordHighsecretsAny fileCWE-798
VNX-SEC-743SAP BTP XSUAA client secretCriticalsecretsAny fileCWE-798
VNX-SEC-744SAP SuccessFactors OAuth API keyHighsecretsAny fileCWE-798
VNX-SEC-745SAP Concur OAuth access tokenHighsecretsAny fileCWE-798
VNX-SEC-746SAP Concur OAuth refresh tokenCriticalsecretsAny fileCWE-798
VNX-SEC-747NetSuite TBA consumer secretCriticalsecretsAny fileCWE-798
VNX-SEC-748NetSuite TBA token secretCriticalsecretsAny fileCWE-798
VNX-SEC-749ADP OAuth client secretHighsecretsAny fileCWE-798
VNX-SEC-750Paychex OAuth client secretHighsecretsAny fileCWE-798
VNX-SEC-751Justworks API access tokenHighsecretsAny fileCWE-798
VNX-SEC-752Gusto OAuth access tokenHighsecretsAny fileCWE-798
VNX-SEC-753Gusto API tokenHighsecretsAny fileCWE-798
VNX-SEC-754BambooHR API keyHighsecretsAny fileCWE-798
VNX-SEC-755Rippling API tokenCriticalsecretsAny fileCWE-798
VNX-SEC-756Deel API tokenHighsecretsAny fileCWE-798
VNX-SEC-757Expensify partner user secretHighsecretsAny fileCWE-798
VNX-SEC-758Greenhouse Harvest API keyHighsecretsAny fileCWE-798
VNX-SEC-759Lever Data API keyHighsecretsAny fileCWE-798
VNX-SEC-760Workable API access tokenHighsecretsAny fileCWE-798
VNX-SEC-761SmartRecruiters SmartTokenHighsecretsAny fileCWE-798
VNX-SEC-762DocuSign JWT user access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-763DocuSign OAuth secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-764Box JWT app private-key passphraseCriticalsecretsAny fileCWE-798
VNX-SEC-765Box client secretCriticalsecretsAny fileCWE-798
VNX-SEC-766Egnyte access tokenHighsecretsAny fileCWE-798
VNX-SEC-767Smartsheet API access tokenHighsecretsAny fileCWE-798
VNX-SEC-768ZoomInfo private keyHighsecretsAny fileCWE-798
VNX-SEC-769Apollo.io API keyHighsecretsAny fileCWE-798
VNX-SEC-770Outreach OAuth access tokenHighsecretsAny fileCWE-798
VNX-SEC-771Salesloft API keyHighsecretsAny fileCWE-798
VNX-SEC-772Gong API access key secretCriticalsecretsAny fileCWE-798
VNX-SEC-773Chorus.ai API tokenHighsecretsAny fileCWE-798
VNX-SEC-774Clari API tokenHighsecretsAny fileCWE-798
VNX-SEC-775Pipedrive OAuth access tokenHighsecretsAny fileCWE-798
VNX-SEC-776Freshsales CRM API keyHighsecretsAny fileCWE-798
VNX-SEC-777Keap/Infusionsoft OAuth access tokenHighsecretsAny fileCWE-798
VNX-SEC-778Keap/Infusionsoft legacy API keyHighsecretsAny fileCWE-798
VNX-SEC-779Insightly API keyHighsecretsAny fileCWE-798
VNX-SEC-780ActiveCampaign API keyHighsecretsAny fileCWE-798
VNX-SEC-781Copper CRM API tokenHighsecretsAny fileCWE-798
VNX-SEC-782Salesforce OAuth bearer JWTCriticalsecretsAny fileCWE-798
VNX-SEC-783Salesforce session ID (00D)CriticalsecretsAny fileCWE-798
VNX-SEC-784ServiceNow OAuth refresh tokenCriticalsecretsAny fileCWE-798
VNX-SEC-785ServiceNow OAuth client secretCriticalsecretsAny fileCWE-798
VNX-SEC-786ClickUp OAuth access tokenHighsecretsAny fileCWE-798
VNX-SEC-787Wrike permanent access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-788Confluence/Jira OAuth 2.0 access tokenHighsecretsAny fileCWE-798
VNX-SEC-789Confluence/Jira Connect app shared secretCriticalsecretsAny fileCWE-798
VNX-SEC-790Productboard API tokenHighsecretsAny fileCWE-798
VNX-SEC-791Pendo integration keyHighsecretsAny fileCWE-798
VNX-SEC-792Amplitude secret keyHighsecretsAny fileCWE-798
VNX-SEC-793Heap server API keyHighsecretsAny fileCWE-798
VNX-SEC-794FullStory server API keyHighsecretsAny fileCWE-798
VNX-SEC-795LogRocket API keyHighsecretsAny fileCWE-798
VNX-SEC-796Smartlook API tokenHighsecretsAny fileCWE-798
VNX-SEC-797Mouseflow API keyMediumsecretsAny fileCWE-798
VNX-SEC-798Hotjar API tokenMediumsecretsAny fileCWE-798
VNX-SEC-799Qualtrics API tokenHighsecretsAny fileCWE-798
VNX-SEC-800SurveyMonkey access tokenHighsecretsAny fileCWE-798
VNX-SEC-801Delighted API keyHighsecretsAny fileCWE-798
VNX-SEC-802Sprig API keyHighsecretsAny fileCWE-798
VNX-SEC-803Intercom OAuth access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-804Zoho CRM client secretCriticalsecretsAny fileCWE-798
VNX-SEC-821BigCommerce API access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-822BigCommerce client secretCriticalsecretsAny fileCWE-798
VNX-SEC-823WooCommerce REST consumer key (ck_)HighsecretsAny fileCWE-798
VNX-SEC-824WooCommerce REST consumer secret (cs_)CriticalsecretsAny fileCWE-798
VNX-SEC-825Magento integration access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-826Squarespace API keyHighsecretsAny fileCWE-798
VNX-SEC-827Wix API keyCriticalsecretsAny fileCWE-798
VNX-SEC-828Wix OAuth app secretCriticalsecretsAny fileCWE-798
VNX-SEC-829Ecwid secret tokenCriticalsecretsAny fileCWE-798
VNX-SEC-830Ecwid public tokenMediumsecretsAny fileCWE-798
VNX-SEC-831PrestaShop webservice API keyHighsecretsAny fileCWE-798
VNX-SEC-832Recharge API token (sk_)CriticalsecretsAny fileCWE-798
VNX-SEC-833Gorgias API keyHighsecretsAny fileCWE-798
VNX-SEC-834Loop Returns API keyHighsecretsAny fileCWE-798
VNX-SEC-835ShipStation API keyHighsecretsAny fileCWE-798
VNX-SEC-836ShipStation API secretCriticalsecretsAny fileCWE-798
VNX-SEC-837Shippo live API token (shippo_live_)CriticalsecretsAny fileCWE-798
VNX-SEC-838Shippo test API token (shippo_test_)MediumsecretsAny fileCWE-798
VNX-SEC-839EasyPost production API key (EZAK)CriticalsecretsAny fileCWE-798
VNX-SEC-840EasyPost test API key (EZTK)MediumsecretsAny fileCWE-798
VNX-SEC-841Avalara AvaTax license keyHighsecretsAny fileCWE-798
VNX-SEC-842TaxJar API tokenHighsecretsAny fileCWE-798
VNX-SEC-843Printful API tokenHighsecretsAny fileCWE-798
VNX-SEC-844Printify API token (JWT)HighsecretsAny fileCWE-798
VNX-SEC-845Gelato API keyHighsecretsAny fileCWE-798
VNX-SEC-846eBay OAuth user access token (v^1.1)CriticalsecretsAny fileCWE-798
VNX-SEC-847eBay developer cert id (client secret)CriticalsecretsAny fileCWE-798
VNX-SEC-848Etsy API keystringHighsecretsAny fileCWE-798
VNX-SEC-849Amazon SP-API LWA refresh token (Atzr|)CriticalsecretsAny fileCWE-798
VNX-SEC-850Amazon LWA client secret (amzn1)CriticalsecretsAny fileCWE-798
VNX-SEC-851Walmart Marketplace client secretCriticalsecretsAny fileCWE-798
VNX-SEC-852Rakuten API secretHighsecretsAny fileCWE-798
VNX-SEC-853Mercado Libre access token (APP_USR)CriticalsecretsAny fileCWE-798
VNX-SEC-854Mercado Libre client secret (APP_USR secret)CriticalsecretsAny fileCWE-798
VNX-SEC-855Faire API access tokenHighsecretsAny fileCWE-798
VNX-SEC-856Cratejoy API secretHighsecretsAny fileCWE-798
VNX-SEC-857ActiveCampaign API keyHighsecretsAny fileCWE-798
VNX-SEC-858ConvertKit API keyHighsecretsAny fileCWE-798
VNX-SEC-859ConvertKit API secretCriticalsecretsAny fileCWE-798
VNX-SEC-860Drip API tokenHighsecretsAny fileCWE-798
VNX-SEC-861Omnisend API keyHighsecretsAny fileCWE-798
VNX-SEC-862Yotpo API secretHighsecretsAny fileCWE-798
VNX-SEC-863Mailmodo API keyHighsecretsAny fileCWE-798
VNX-SEC-864Customer.io app API token (Bearer)CriticalsecretsAny fileCWE-798
VNX-SEC-865Customer.io tracking site/key pairHighsecretsAny fileCWE-798
VNX-SEC-866Klaviyo private API key (pk_)CriticalsecretsAny fileCWE-798
VNX-SEC-867Mailchimp Transactional (Mandrill) API keyCriticalsecretsAny fileCWE-798
VNX-SEC-868Constant Contact access token (JWT)CriticalsecretsAny fileCWE-798
VNX-SEC-869Constant Contact client secretCriticalsecretsAny fileCWE-798
VNX-SEC-870Campaign Monitor API keyHighsecretsAny fileCWE-798
VNX-SEC-871GetResponse API keyHighsecretsAny fileCWE-798
VNX-SEC-872MailerLite API token (JWT)HighsecretsAny fileCWE-798
VNX-SEC-873Moosend API keyHighsecretsAny fileCWE-798
VNX-SEC-874Brevo (Sendinblue) API key (xkeysib-)CriticalsecretsAny fileCWE-798
VNX-SEC-875Brevo SMTP key (xsmtpsib-)CriticalsecretsAny fileCWE-798
VNX-SEC-876Beehiiv API keyHighsecretsAny fileCWE-798
VNX-SEC-877Substack session cookie tokenHighsecretsAny fileCWE-798
VNX-SEC-878Ghost Admin API key (id:secret)CriticalsecretsAny fileCWE-798
VNX-SEC-879Ghost Content API keyMediumsecretsAny fileCWE-798
VNX-SEC-880WordPress.com OAuth access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-881Webflow API token (site/v2 Bearer)CriticalsecretsAny fileCWE-798
VNX-SEC-882Shopify Storefront API access tokenHighsecretsAny fileCWE-798
VNX-SEC-883Shopify private app API secret key (shpss alt)CriticalsecretsAny fileCWE-798
VNX-SEC-884Snipcart API key (secret)CriticalsecretsAny fileCWE-798
VNX-SEC-885Swell API secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-886Medusa API token (JWT)CriticalsecretsAny fileCWE-798
VNX-SEC-887Saleor app auth tokenCriticalsecretsAny fileCWE-798
VNX-SEC-888commercetools client secretCriticalsecretsAny fileCWE-798
VNX-SEC-889BigCommerce client idMediumsecretsAny fileCWE-798
VNX-SEC-890Recharge API token (legacy hex)HighsecretsAny fileCWE-798
VNX-SEC-891Klaviyo company id (public key)MediumsecretsAny fileCWE-798
VNX-SEC-892Avalara account idMediumsecretsAny fileCWE-798
VNX-SEC-893Gorgias account subdomain credential pairHighsecretsAny fileCWE-798
VNX-SEC-894ShipStation v2 API key (TEST/PROD)CriticalsecretsAny fileCWE-798
VNX-SEC-895TaxJar sandbox API tokenMediumsecretsAny fileCWE-798
VNX-SEC-896Printful store API key (legacy basic)HighsecretsAny fileCWE-798
VNX-SEC-897ActiveCampaign account API URLMediumsecretsAny fileCWE-798
VNX-SEC-898Webflow site api token (legacy prefix)HighsecretsAny fileCWE-798
VNX-SEC-899Etsy OAuth2 access token (prefix.token)CriticalsecretsAny fileCWE-798
VNX-SEC-900Gelato API key (single uuid form)HighsecretsAny fileCWE-798
VNX-SEC-901HERE Maps API keyHighsecretsAny fileCWE-798
VNX-SEC-902TomTom API keyHighsecretsAny fileCWE-798
VNX-SEC-903MapQuest API keyMediumsecretsAny fileCWE-798
VNX-SEC-904Mapbox secret access token (sk.)CriticalsecretsAny fileCWE-798
VNX-SEC-905Google Maps server API key (context)HighsecretsAny fileCWE-798
VNX-SEC-906OpenWeatherMap API keyMediumsecretsAny fileCWE-798
VNX-SEC-907Weatherbit API keyMediumsecretsAny fileCWE-798
VNX-SEC-908AccuWeather API keyMediumsecretsAny fileCWE-798
VNX-SEC-909Visual Crossing weather API keyMediumsecretsAny fileCWE-798
VNX-SEC-910Tomorrow.io API keyMediumsecretsAny fileCWE-798
VNX-SEC-911IPstack API access keyMediumsecretsAny fileCWE-798
VNX-SEC-912IPinfo access tokenMediumsecretsAny fileCWE-798
VNX-SEC-913IPgeolocation API keyMediumsecretsAny fileCWE-798
VNX-SEC-914ipdata API keyMediumsecretsAny fileCWE-798
VNX-SEC-915MaxMind license keyHighsecretsAny fileCWE-798
VNX-SEC-916Abstract API keyMediumsecretsAny fileCWE-798
VNX-SEC-917Clearbit API key (sk_)HighsecretsAny fileCWE-798
VNX-SEC-918Hunter.io API keyMediumsecretsAny fileCWE-798
VNX-SEC-919People Data Labs API keyHighsecretsAny fileCWE-798
VNX-SEC-920FullContact API keyMediumsecretsAny fileCWE-798
VNX-SEC-921Numverify API access keyMediumsecretsAny fileCWE-798
VNX-SEC-922NumLookup API keyMediumsecretsAny fileCWE-798
VNX-SEC-923Veriphone API keyMediumsecretsAny fileCWE-798
VNX-SEC-924Apollo.io API keyHighsecretsAny fileCWE-798
VNX-SEC-925AWS IoT certificate private key (context)CriticalsecretsAny fileCWE-798
VNX-SEC-926Azure IoT Hub SharedAccessKeyCriticalsecretsAny fileCWE-798
VNX-SEC-927GCP IoT Core device key (context)CriticalsecretsAny fileCWE-798
VNX-SEC-928Particle access tokenCriticalsecretsAny fileCWE-798
VNX-SEC-929Blynk auth tokenHighsecretsAny fileCWE-798
VNX-SEC-930Losant access tokenHighsecretsAny fileCWE-798
VNX-SEC-931ThingSpeak write/read API keyMediumsecretsAny fileCWE-798
VNX-SEC-932Adafruit IO key (aio_)HighsecretsAny fileCWE-798
VNX-SEC-933Ubidots API tokenHighsecretsAny fileCWE-798
VNX-SEC-934Helium API keyHighsecretsAny fileCWE-798
VNX-SEC-935Sigfox API credentialHighsecretsAny fileCWE-798
VNX-SEC-936Soracom auth/API keyHighsecretsAny fileCWE-798
VNX-SEC-937Twilio Super SIM / IoT API key (SK)HighsecretsAny fileCWE-798
VNX-SEC-93846elks API credentialHighsecretsAny fileCWE-798
VNX-SEC-939BulkSMS token / credentialHighsecretsAny fileCWE-798
VNX-SEC-940Telesign customer ID + API keyHighsecretsAny fileCWE-798
VNX-SEC-941Agora App CertificateCriticalsecretsAny fileCWE-798
VNX-SEC-942Agora App IDMediumsecretsAny fileCWE-798
VNX-SEC-943Daily.co API keyHighsecretsAny fileCWE-798
VNX-SEC-944LiveKit API secretCriticalsecretsAny fileCWE-798
VNX-SEC-945LiveKit API key (APIxxxx)HighsecretsAny fileCWE-798
VNX-SEC-946100ms management token / secretCriticalsecretsAny fileCWE-798
VNX-SEC-947Vonage Video / OpenTok API secretHighsecretsAny fileCWE-798
VNX-SEC-981Coinbase CDP API key ID (organizations path)HighsecretsAny fileCWE-798
VNX-SEC-982Coinbase CDP EC private key (PEM, assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-983Kraken API secret (base64 private key)CriticalsecretsAny fileCWE-798
VNX-SEC-984Gemini API secret (master/account secret)CriticalsecretsAny fileCWE-798
VNX-SEC-985KuCoin API keyHighsecretsAny fileCWE-798
VNX-SEC-986KuCoin API secret (UUID)CriticalsecretsAny fileCWE-798
VNX-SEC-987OKX API key (UUID)HighsecretsAny fileCWE-798
VNX-SEC-988Bitstamp API keyHighsecretsAny fileCWE-798
VNX-SEC-989Bitstamp API secretCriticalsecretsAny fileCWE-798
VNX-SEC-990Gate.io API keyHighsecretsAny fileCWE-798
VNX-SEC-991Gate.io API secretCriticalsecretsAny fileCWE-798
VNX-SEC-992Crypto.com Exchange API keyHighsecretsAny fileCWE-798
VNX-SEC-993Crypto.com Exchange API secretCriticalsecretsAny fileCWE-798
VNX-SEC-994Huobi/HTX API keyHighsecretsAny fileCWE-798
VNX-SEC-995Huobi/HTX secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-996MEXC API keyHighsecretsAny fileCWE-798
VNX-SEC-997MEXC API secretCriticalsecretsAny fileCWE-798
VNX-SEC-998Deribit client IDHighsecretsAny fileCWE-798
VNX-SEC-999Deribit client secretCriticalsecretsAny fileCWE-798
VNX-SEC-1000dYdX API key (UUID)HighsecretsAny fileCWE-798
VNX-SEC-1001dYdX API secretCriticalsecretsAny fileCWE-798
VNX-SEC-1002Fireblocks API key (UUID)CriticalsecretsAny fileCWE-798
VNX-SEC-1003Fireblocks API secret (RSA private key)CriticalsecretsAny fileCWE-798
VNX-SEC-1004BitGo access token (v2x)CriticalsecretsAny fileCWE-798
VNX-SEC-1005Anchorage API key (assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1006Circle USDC API key (live)CriticalsecretsAny fileCWE-798
VNX-SEC-1007Chainalysis API key (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1008TRM Labs API key (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1009web3.storage API token (legacy JWT, assignment)HighsecretsAny fileCWE-798
VNX-SEC-1010Pinata API key (legacy, assignment)HighsecretsAny fileCWE-798
VNX-SEC-1011Pinata API secret (legacy, assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1012NFT.storage API token (JWT, assignment)HighsecretsAny fileCWE-798
VNX-SEC-1013Crossmint API key (server-side)CriticalsecretsAny fileCWE-798
VNX-SEC-1014Binance API secret (assignment, alt context)CriticalsecretsAny fileCWE-798
VNX-SEC-1015Bybit API secret (assignment, alt context)CriticalsecretsAny fileCWE-798
VNX-SEC-1016KuCoin API secret (passphrase-paired, alt context)CriticalsecretsAny fileCWE-798
VNX-SEC-1017Bitfinex API secret (assignment, alt context)CriticalsecretsAny fileCWE-798
VNX-SEC-1018GitGuardian personal access token (ggp_)HighsecretsAny fileCWE-798
VNX-SEC-1019GitGuardian service account token (gg_)HighsecretsAny fileCWE-798
VNX-SEC-1020Snyk API token (UUID, assignment)HighsecretsAny fileCWE-798
VNX-SEC-1021Snyk org/service account token (snyk_ prefix)HighsecretsAny fileCWE-798
VNX-SEC-1022Doppler service token (dp.st.)CriticalsecretsAny fileCWE-798
VNX-SEC-1023Doppler CLI token (dp.ct.)CriticalsecretsAny fileCWE-798
VNX-SEC-1024Doppler service-account token (dp.sa.)CriticalsecretsAny fileCWE-798
VNX-SEC-1025Doppler audit token (dp.audit.)HighsecretsAny fileCWE-798
VNX-SEC-1026HashiCorp Vault service token (hvs.)CriticalsecretsAny fileCWE-798
VNX-SEC-1027HashiCorp Vault batch token (hvb.)HighsecretsAny fileCWE-798
VNX-SEC-1028HashiCorp Vault recovery token (hvr.)CriticalsecretsAny fileCWE-798
VNX-SEC-1029Vault AppRole role_id (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1030Vault AppRole secret_id (assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1031HCP Vault Secrets / HCP API client secret (assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1032Bitwarden / Secrets Manager access token (0.uuid)CriticalsecretsAny fileCWE-798
VNX-SEC-1033Akeyless access ID (p-)HighsecretsAny fileCWE-798
VNX-SEC-1034Akeyless access key (assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1035CyberArk Conjur API key (assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1036Keeper Secrets Manager config token (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1037Infisical service token (st.)CriticalsecretsAny fileCWE-798
VNX-SEC-1038Infisical machine identity client secret (ssk-/st- assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1039AWS Secrets Manager secret ARNMediumsecretsAny fileCWE-798
VNX-SEC-1040Veracode API ID (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1041Veracode API key (assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1042Checkmarx API key / refresh token (assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1043SonarQube/SonarCloud user token (squ_)HighsecretsAny fileCWE-798
VNX-SEC-1044SonarCloud project analysis token (sqp_)HighsecretsAny fileCWE-798
VNX-SEC-1045SonarQube global analysis token (sqa_)HighsecretsAny fileCWE-798
VNX-SEC-1046Mend/WhiteSource API key (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1047FOSSA API token (fossa_)HighsecretsAny fileCWE-798
VNX-SEC-1048Semgrep AppSec API token (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1049Aqua Security API key (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1050Sysdig Secure API token (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1051Wiz service account client secret (assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1052Orca Security API token (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1053Lacework API secret (assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1054Prisma Cloud access key secret (assignment)CriticalsecretsAny fileCWE-798
VNX-SEC-1055Tenable.io access/secret key (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1056Qualys API credentials (basic auth, assignment)HighsecretsAny fileCWE-798
VNX-SEC-1057Rapid7 InsightVM/InsightAppSec API key (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1058Detectify API key (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1059Probely API token (assignment)HighsecretsAny fileCWE-798
VNX-SEC-1060StackHawk API key (hawk.)HighsecretsAny fileCWE-798
VNX-SEC-1061Steam Web API keyHighsecretsAny fileCWE-798
VNX-SEC-1062Riot Games API key (RGAPI-)HighsecretsAny fileCWE-798
VNX-SEC-1063Twitch app access token (OAuth)HighsecretsAny fileCWE-798
VNX-SEC-1064Twitch EventSub webhook secretHighsecretsAny fileCWE-798
VNX-SEC-1065Unity Cloud Build API keyHighsecretsAny fileCWE-798
VNX-SEC-1066PlayFab secret keyCriticalsecretsAny fileCWE-798
VNX-SEC-1067GameAnalytics secret keyMediumsecretsAny fileCWE-798
VNX-SEC-1068Vimeo access token (bearer)HighsecretsAny fileCWE-798
VNX-SEC-1069Brightcove OAuth client secretHighsecretsAny fileCWE-798
VNX-SEC-1070JW Player API v2 secretHighsecretsAny fileCWE-798
VNX-SEC-1071Wistia API tokenHighsecretsAny fileCWE-798
VNX-SEC-1072api.video API keyHighsecretsAny fileCWE-798
VNX-SEC-1073Dolby.io API secretHighsecretsAny fileCWE-798
VNX-SEC-1074Spotify refresh tokenHighsecretsAny fileCWE-798
VNX-SEC-1075SoundCloud OAuth client secretHighsecretsAny fileCWE-798
VNX-SEC-1076Last.fm API secretMediumsecretsAny fileCWE-798
VNX-SEC-1077Discogs personal access tokenMediumsecretsAny fileCWE-798
VNX-SEC-1078TMDB API key (v3)MediumsecretsAny fileCWE-798
VNX-SEC-1079TMDB API read access token (v4 JWT)HighsecretsAny fileCWE-798
VNX-SEC-1080OMDb API keyMediumsecretsAny fileCWE-798
VNX-SEC-1081Giphy API keyMediumsecretsAny fileCWE-798
VNX-SEC-1082Tenor API keyMediumsecretsAny fileCWE-798
VNX-SEC-1083Unsplash access key (Client-ID)MediumsecretsAny fileCWE-798
VNX-SEC-1084Unsplash secret keyHighsecretsAny fileCWE-798
VNX-SEC-1085Pexels API keyMediumsecretsAny fileCWE-798
VNX-SEC-1086Pixabay API keyMediumsecretsAny fileCWE-798
VNX-SEC-1087Flickr API secretMediumsecretsAny fileCWE-798
VNX-SEC-1088Imgur Client-IDMediumsecretsAny fileCWE-798
VNX-SEC-1089Imgur client secretHighsecretsAny fileCWE-798
VNX-SEC-1090KeyCDN API keyHighsecretsAny fileCWE-798
VNX-SEC-1091StackPath client secretHighsecretsAny fileCWE-798
VNX-SEC-1092G-Core Labs API token (APIKey)HighsecretsAny fileCWE-798
VNX-SEC-1093CDN77 API tokenHighsecretsAny fileCWE-798
VNX-SEC-1094ConfigCat SDK key (configcat-)MediumsecretsAny fileCWE-798
VNX-SEC-1095Flagsmith server-side environment key (ser.)HighsecretsAny fileCWE-798
VNX-SEC-1096GrowthBook SDK secret keyHighsecretsAny fileCWE-798
VNX-SEC-1097Countly API keyMediumsecretsAny fileCWE-798
VNX-SEC-1098Plausible Analytics API keyMediumsecretsAny fileCWE-798
VNX-SEC-1099Fathom Analytics API tokenMediumsecretsAny fileCWE-798
VNX-SEC-1100Matomo API token_authHighsecretsAny fileCWE-798
VNX-SEC-1101Umami API key/tokenMediumsecretsAny fileCWE-798
VNX-SEC-1102Datadog RUM client token (pub)MediumsecretsAny fileCWE-798
VNX-SEC-1103Steam publisher Web API key (partner)CriticalsecretsAny fileCWE-798
VNX-SEC-1104Riot Games production API key (production RGAPI)CriticalsecretsAny fileCWE-798
VNX-SEC-1105Twitch client IDMediumsecretsAny fileCWE-798
VNX-SEC-1106Unity Cloud Build organization secretHighsecretsAny fileCWE-798
VNX-SEC-1107PlayFab title ID + secret contextCriticalsecretsAny fileCWE-798
VNX-SEC-1108Vimeo OAuth client secretHighsecretsAny fileCWE-798
VNX-SEC-1109JW Player API v1 secretHighsecretsAny fileCWE-798
VNX-SEC-1110Brightcove policy key (BCpkc)MediumsecretsAny fileCWE-798
VNX-SEC-1111Wistia OAuth access tokenHighsecretsAny fileCWE-798
VNX-SEC-1112Deepgram-style media key skip placeholderHighsecretsAny fileCWE-798
VNX-SEC-1113Dolby.io media app keyMediumsecretsAny fileCWE-798
VNX-SEC-1114SoundCloud OAuth access tokenHighsecretsAny fileCWE-798
VNX-SEC-1115Discogs consumer secretHighsecretsAny fileCWE-798
VNX-SEC-1116Giphy production app key contextMediumsecretsAny fileCWE-798
VNX-SEC-1117Pixabay numeric key contextMediumsecretsAny fileCWE-798
VNX-SEC-1118Flickr API keyMediumsecretsAny fileCWE-798
VNX-SEC-1119Imgur access token (bearer)HighsecretsAny fileCWE-798
VNX-SEC-1120KeyCDN account-context API keyHighsecretsAny fileCWE-798
VNX-SEC-1121StackPath client IDMediumsecretsAny fileCWE-798
VNX-SEC-1122CDN77 login token contextHighsecretsAny fileCWE-798
VNX-SEC-1123G-Core Labs permanent API token (gcore_)HighsecretsAny fileCWE-798
VNX-SEC-1124Statsig server secret key (secret-)HighsecretsAny fileCWE-798
VNX-SEC-1125Split.io server-side API keyHighsecretsAny fileCWE-798
VNX-SEC-1126Optimizely SDK datafile tokenMediumsecretsAny fileCWE-798
VNX-SEC-1127TMDB v4 access token contextHighsecretsAny fileCWE-798
VNX-SEC-1128Unsplash application id contextMediumsecretsAny fileCWE-798
VNX-SEC-1129Vimeo personal access token contextHighsecretsAny fileCWE-798
VNX-SEC-1130JW Player API key (v2 key)MediumsecretsAny fileCWE-798
VNX-SEC-1131TMDB session idHighsecretsAny fileCWE-798
VNX-SEC-1132Last.fm API keyMediumsecretsAny fileCWE-798
VNX-SEC-1133Spotify OAuth access token (bearer)HighsecretsAny fileCWE-798
VNX-SEC-1134GameAnalytics game keyMediumsecretsAny fileCWE-798
VNX-SEC-1135Tenor v2 client key contextMediumsecretsAny fileCWE-798
VNX-SEC-1136Steam server API key contextHighsecretsAny fileCWE-798
VNX-SEC-1137Wistia data API token contextHighsecretsAny fileCWE-798
VNX-SEC-1138PlayFab title shared secret contextCriticalsecretsAny fileCWE-798
VNX-SEC-1139api.video sandbox key contextMediumsecretsAny fileCWE-798
VNX-SEC-1140ConfigCat SDK key (assignment context)MediumsecretsAny fileCWE-798
VNX-SWIFT-001Swift hardcoded API key or secret in sourceHighsastSwiftCWE-798
VNX-SWIFT-002Swift credential written to the device log (NSLog, print, public os_log/Logger)MediumsastSwiftCWE-532
VNX-SWIFT-003Swift credential stored in UserDefaultsHighsastSwiftCWE-311
VNX-SWIFT-004Swift TLS certificate validation disabled in URLSession or AlamoFireHighsastSwiftCWE-295
VNX-SWIFT-005Swift WKWebView JavaScript auto-open-windows enabled, or deprecated UIWebView in useMediumsastSwiftCWE-272
VNX-SWIFT-006Swift non-cryptographic PRNG (libc rand/random/drand48, GameplayKit) used for a security valueHighsastSwiftCWE-338
VNX-TF-001Terraform S3 bucket or object with a public ACLHighiacTerraformCWE-200
VNX-TF-002Terraform AWS security group with unrestricted ingress (0.0.0.0/0)HighiacTerraformCWE-1220
VNX-TF-003Terraform AWS RDS instance publicly accessibleHighiacTerraformCWE-1220
VNX-TF-004Terraform IAM policy with wildcard Action (*)HighiacTerraformCWE-269
VNX-TF-005Terraform AWS EBS volume unencryptedHighiacTerraformCWE-311
VNX-TF-006Terraform AWS EC2 instance metadata service v1 (IMDSv1) enabledHighiacTerraformCWE-918
VNX-TF-007Terraform AWS EKS cluster public API endpoint enabledHighiacTerraformCWE-200
VNX-TF-008Terraform AWS provider with hardcoded static credentialsHighsecretsTerraformCWE-798

Filters are kept in the address bar, so a filtered view can be linked: /sast/rules/?lang=go&sev=high.

Edit this pageSources: cli/internal/sast/rules/, cli/internal/sast/language_filter.go, cli/internal/sast/kinds.go
esc
↑ ↓ move↵ openSearches in your browser. A key like autonomy.max or a code like threshold_required jumps straight to it.