All pull requests

Pull requests

• feat(php): detect server-side template injection via request-controlled template source (CWE-94)

  #224·ai-anant opened Oct 29, 2026·

  ·

• feat(java): detect authentication filter released on mere presence of a request header (CWE-287)

  #223·ai-anant opened Oct 26, 2026·

  ·

• feat(php): detect payment/webhook callback completing an order without signature verification (CWE-345)

  #222·ai-anant opened Oct 25, 2026·

  ·

• feat(javascript): detect DOM URL sinks fed by network response data without scheme validation (CWE-601/79/918)

  #221·ai-anant opened Oct 24, 2026·

  ·

• feat(php): detect unsafe deserialization of a stored database column (CWE-502)

  #220·ai-anant opened Oct 23, 2026·

  ·

• feat(php): detect arbitrary file write via request-controlled destination (CWE-22/73)

  #219·ai-anant opened Oct 22, 2026·

  ·

• feat(bash): detect sourcing of a workspace-resolved config file (CWE-94)

  #218·ai-anant opened Oct 16, 2026·

  ·

• feat(python): detect SSH host-key verification disabled (CWE-322)

  #217·ai-anant opened Oct 7, 2026·

  ·

• feat(java): detect non-literal value used as the regex argument of String.replaceFirst/replaceAll/matches (CWE-625)

  #216·ai-anant opened Oct 6, 2026·

  ·

• feat(java): detect raw exception message reflected in a form-validation response (CWE-209)

  #215·ai-anant opened Oct 2, 2026·

  ·
  1

• feat(php): detect arbitrary file/directory deletion via request-controlled path (CWE-22)

  #214·ai-anant opened Oct 1, 2026·

  ·

• feat(java): detect unconditional CloudFormation IAM capability grant (CWE-269)

  #213·ai-anant opened Sep 29, 2026·

  ·

• feat(java): detect decrypted secret-store value injected into build environment unmasked (CWE-532)

  #212·ai-anant opened Sep 29, 2026·

  ·

• feat(php): detect PHP object injection via base64-encoded request/shortcode data (CWE-502)

  #211·ai-anant opened Sep 28, 2026·

  ·

• feat(php): detect arbitrary file download via request-controlled path in file-read sinks (CWE-22)

  #210·ai-anant opened Sep 28, 2026·

  ·

• feat(xml): detect dependency version declared with a moving RELEASE/LATEST marker (CWE-1357)

  #209·ai-anant opened Sep 27, 2026·

  ·

• feat(yaml): detect runtime-fetched script execution in workflow steps (CWE-829/494)

  #208·ai-anant opened Sep 27, 2026·

  ·

• feat(yaml): detect reusable workflow call through a mutable ref while secrets are passed (CWE-1357)

  #207·ai-anant opened Sep 25, 2026·

  ·

• feat(php): detect request-supplied metadata key on WordPress meta writes (CWE-639)

  #206·ai-anant opened Sep 23, 2026·

  ·

• feat(php): detect REST route registered with a no-op permission callback (CWE-306)

  #205·ai-anant opened Sep 22, 2026·

  ·

• feat(bash): detect SQL statement assembled with an interpolated quoted identifier (CWE-89)

  #204·ai-anant opened Sep 22, 2026·

  ·

• feat(java): detect AWS SDK client endpoint assembled from configuration by concatenation (CWE-918)

  #203·ai-anant opened Sep 20, 2026·

  ·

• feat(java): detect symlink-following recursive tree walk used to collect files (CWE-59)

  #202·ai-anant opened Sep 20, 2026·

  ·

• feat(php): detect WordPress file upload with client-controlled destination (CWE-434)

  #201·ai-anant opened Sep 20, 2026·

  ·

• feat(php): detect object writes keyed by request input without object-scoped authorization (CWE-639)

  #200·ai-anant opened Sep 19, 2026·

  ·