Every check we run, split by what it takes to use it. Checks that need no ownership run on every scan, for any public website. Owner checks send probing requests, so they run only after you verify your domain. Paid checks are the advanced ones we are building next.
324 checks in 33 modules
| SEVERITY | CHECK | MODULE | ID | No ownership needed(179) | Website owner only(127) | Paid(18) |
|---|---|---|---|---|---|---|
| CRITICAL | LLM API key trong bundle (sk-/sk-ant-) | AI / LLM | AI-007 | No ownership neededComing soon | · | · |
| CRITICAL | Domain của NS chưa đăng ký (takeover) | DNS | DNS-011 | No ownership neededComing soon | · | · |
| CRITICAL | Environment file (.env) is publicly readable Anyone can download these variables — usually database URLs and API keys. Bots scan for | Exposed files | EXP-001 | No ownership needed | · | · |
| CRITICAL | Git repository is exposed
| Exposed files | EXP-002 | No ownership needed | · | · |
| CRITICAL | Backup archive is downloadable A site or database backup ( | Exposed files | EXP-003 | No ownership needed | · | · |
| CRITICAL | terraform.tfstate is exposed A Terraform state file is downloadable. State stores your infrastructure layout and often plaintext secrets (DB passwords, access keys). | Exposed files | EXP-025 | No ownership needed | · | · |
| CRITICAL | SQL database dump is exposed A full SQL dump is downloadable. It can contain your entire database — users, password hashes and private data. | Exposed files | EXP-026 | No ownership needed | · | · |
| CRITICAL | Private SSH key is exposed A private SSH key is downloadable. Anyone with it may be able to log in to your servers. | Exposed files | EXP-031 | No ownership needed | · | · |
| CRITICAL | SPF include trỏ domain chưa đăng ký | MAIL-010 | No ownership neededComing soon | · | · | |
| CRITICAL | Google Web Risk (không Safe Browsing) | Reputation | REP-001 | No ownership neededComing soon | · | · |
| CRITICAL | Chèn script/SEO spam/deface | Reputation | REP-003 | No ownership neededComing soon | · | · |
| CRITICAL | Secret keys exposed in client-side code Private API keys were found in JavaScript that is sent to every visitor. Anyone can copy them and use your accounts. | Client-side secrets | SEC-001 | No ownership needed | · | · |
| CRITICAL | Supabase service_role key exposed The service_role key bypasses Row Level Security completely. Anyone who has it can read and modify every table. | Client-side secrets | SEC-002 | No ownership needed | · | · |
| CRITICAL | Private key EC/OpenSSH/DSA/PGP | Secret phía client | SEC-029 | No ownership neededComing soon | · | · |
| CRITICAL | CVE trong CISA KEV | Tech / CVE / KEV / EOL | TECH-003 | No ownership neededComing soon | · | · |
| CRITICAL | Next.js version → CVE-2025-29927/55182 | Tech / CVE / KEV / EOL | TECH-015 | No ownership neededComing soon | · | · |
| CRITICAL | TLS certificate expired or expiring soon When the certificate expires, browsers show a full-page security warning and most visitors leave. | Transport & TLS | TLS-002 | No ownership needed | · | · |
| HIGH | WP plugin/theme CVE (Wordfence feed) | CMS | CMS-016 | No ownership neededComing soon | · | · |
| HIGH | Joomla config/version (CVE-2023-23752 KEV) | CMS | CMS-018 | No ownership neededComing soon | · | · |
| HIGH | Magento version + EOL + config | CMS | CMS-022 | No ownership neededComing soon | · | · |
| HIGH | CORS reflects any origin Your server echoes any Origin back in Access-Control-Allow-Origin. With credentials allowed, any website can read your users' data. | HTTP headers | COR-001 | No ownership needed | · | · |
| HIGH | Subdomain takeover (can-i-take-over-xyz) | DNS | DNS-006 | No ownership neededComing soon | · | · |
| HIGH | Domain sắp hết hạn (RDAP) | DNS | DNS-007 | No ownership neededComing soon | · | · |
| HIGH | Zone transfer AXFR mở | DNS | DNS-009 | No ownership neededComing soon | · | · |
| HIGH | DNSSEC hỏng/thuật toán yếu | DNS | DNS-015 | No ownership neededComing soon | · | · |
| HIGH | Subversion repository is exposed An | Exposed files | EXP-010 | No ownership needed | · | · |
| HIGH | .hg/ repo lộ | File & path bị lộ | EXP-011 | No ownership neededComing soon | · | · |
| HIGH | docker-compose.yml is exposed Your | Exposed files | EXP-013 | No ownership needed | · | · |
| HIGH | appsettings.json is exposed A .NET | Exposed files | EXP-015 | No ownership needed | · | · |
| HIGH | .npmrc auth token is exposed An | Exposed files | EXP-018 | No ownership needed | · | · |
| HIGH | .htpasswd is exposed An | Exposed files | EXP-030 | No ownership needed | · | · |
| HIGH | .pypirc credential is exposed A | Exposed files | EXP-032 | No ownership needed | · | · |
| HIGH | __NEXT_DATA__/RSC lộ dữ liệu server (PII, token) | JS & framework | JS-011 | No ownership neededComing soon | · | · |
| HIGH | Next/Vite/Nuxt phiên bản có CVE | JS & framework | JS-018 | No ownership neededComing soon | · | · |
| HIGH | DANE TLSA cho MX | MAIL-005 | No ownership neededComing soon | · | · | |
| HIGH | phpMyAdmin | Panel & dịch vụ bị lộ | PNL-001 | No ownership neededComing soon | · | · |
| HIGH | Adminer | Panel & dịch vụ bị lộ | PNL-002 | No ownership neededComing soon | · | · |
| HIGH | Spamhaus DBL/ZEN (cần DQS key) | Reputation | REP-002 | No ownership neededComing soon | · | · |
| HIGH | Script từ domain hết hạn | Reputation | REP-004 | No ownership neededComing soon | · | · |
| HIGH | URLhaus / ThreatFox | Reputation | REP-005 | No ownership neededComing soon | · | · |
| HIGH | OpenPhish feed | Reputation | REP-006 | No ownership neededComing soon | · | · |
| HIGH | NEXT_PUBLIC_/VITE_ var nhạy cảm | Secret phía client | SEC-005 | No ownership neededComing soon | · | · |
| HIGH | Mapbox secret token sk. | Secret phía client | SEC-014 | No ownership neededComing soon | · | · |
| HIGH | SendGrid API key | Secret phía client | SEC-016 | No ownership neededComing soon | · | · |
| HIGH | Twilio SID+key | Secret phía client | SEC-017 | No ownership neededComing soon | · | · |
| HIGH | Mailgun key | Secret phía client | SEC-018 | No ownership neededComing soon | · | · |
| HIGH | Shopify token (shpat_/shpca_…) | Secret phía client | SEC-019 | No ownership neededComing soon | · | · |
| HIGH | Google OAuth client secret GOCSPX- | Secret phía client | SEC-020 | No ownership neededComing soon | · | · |
| HIGH | Firebase FCM server key (legacy) | Secret phía client | SEC-021 | No ownership neededComing soon | · | · |
| HIGH | Doppler/Linear/Notion/Postman/npm/PyPI token | Secret phía client | SEC-023 | No ownership neededComing soon | · | · |
| HIGH | DigitalOcean/Cloudflare/HashiCorp token | Secret phía client | SEC-024 | No ownership neededComing soon | · | · |
| HIGH | Airtable PAT | Secret phía client | SEC-025 | No ownership neededComing soon | · | · |
| HIGH | Square/PayPal/Razorpay/Paystack key | Secret phía client | SEC-026 | No ownership neededComing soon | · | · |
| HIGH | Basic-auth creds trong URL | Secret phía client | SEC-032 | No ownership neededComing soon | · | · |
| HIGH | CDN bị chiếm (polyfill.io, bootcss…) | Supply chain | SUP-002 | No ownership neededComing soon | · | · |
| HIGH | Script trên bucket/host dangling | Supply chain | SUP-005 | No ownership neededComing soon | · | · |
| HIGH | JS library có CVE (retire.js) | Tech / CVE / KEV / EOL | TECH-011 | No ownership neededComing soon | · | · |
| HIGH | Vite dev server prod → CVE-2025-30208 | Tech / CVE / KEV / EOL | TECH-016 | No ownership neededComing soon | · | · |
| HIGH | HTTPS not enforced The site is not served over HTTPS, or plain HTTP does not redirect to HTTPS. Traffic can be read or modified on public Wi‑Fi. | Transport & TLS | TLS-001 | No ownership needed | · | · |
| HIGH | TLS certificate is not trusted Browsers reject the certificate (wrong hostname, self-signed or incomplete chain), so visitors see a security warning. | Transport & TLS | TLS-003 | No ownership needed | · | · |
| HIGH | Cert bị thu hồi (CRL) | Transport & TLS | TLS-007 | No ownership neededComing soon | · | · |
| MEDIUM | JWT thiếu exp / exp quá dài / thiếu aud | Auth / session / JWT | AUTH-003 | No ownership neededComing soon | · | · |
| MEDIUM | Session cookie flag (test login) | Auth / session / JWT | AUTH-006 | No ownership neededComing soon | · | · |
| MEDIUM | Cookies missing security flags Cookies without Secure, HttpOnly or SameSite can be stolen over HTTP, read by injected scripts, or sent with cross-site requests. | HTTP headers | CK-001 | No ownership needed | · | · |
| MEDIUM | Cookie/JWT đọc được (alg:none, PII, role trong claim) | Cookie | CK-006 | No ownership neededComing soon | · | · |
| MEDIUM | WP REST user enumeration | CMS | CMS-012 | No ownership neededComing soon | · | · |
| MEDIUM | WP xmlrpc listMethods | CMS | CMS-013 | No ownership neededComing soon | · | · |
| MEDIUM | Drupal version + EOL + user enum | CMS | CMS-020 | No ownership neededComing soon | · | · |
| MEDIUM | Shopify fingerprint + app secret leak | CMS | CMS-025 | No ownership neededComing soon | · | · |
| MEDIUM | SPF record missing Without SPF, receiving mail servers can't tell which servers may send email for your domain, which makes spoofing easier. | DNS & email | DNS-001 | No ownership needed | · | · |
| MEDIUM | DMARC missing or not enforced Without an enforcing DMARC policy, attackers can send email that appears to come from your domain. | DNS & email | DNS-002 | No ownership needed | · | · |
| MEDIUM | NS là open resolver | DNS | DNS-008 | No ownership neededComing soon | · | · |
| MEDIUM | CA lạ cấp cert (crt.sh) | Domain / CT | DOM-002 | No ownership neededComing soon | · | · |
| MEDIUM | Subdomain nhạy cảm từ CT log (dev/staging/admin) | Domain / CT | DOM-003 | No ownership neededComing soon | · | · |
| MEDIUM | Directory listing | File & path bị lộ | EXP-006 | No ownership neededComing soon | · | · |
| MEDIUM | web.config is exposed An ASP.NET | Exposed files | EXP-014 | No ownership needed | · | · |
| MEDIUM | Content-Security-Policy missing or weak Without a strong CSP, any injected script runs with full access to your page and your users' sessions. | HTTP headers | HDR-001 | No ownership needed | · | · |
| MEDIUM | Clickjacking protection missing Other sites can load your pages in a hidden frame and trick users into clicking buttons. | HTTP headers | HDR-002 | No ownership needed | · | · |
| MEDIUM | CSP yếu (unsafe-eval, *, data: trong script-src) — logic CSP Evaluator | HTTP header | HDR-005 | No ownership neededComing soon | · | · |
| MEDIUM | Response cache được mà có Set-Cookie | Hành vi HTTP | HTTP-010 | No ownership neededComing soon | · | · |
| MEDIUM | postMessage không kiểm Origin (static) | Injection / XSS / SSRF | INJ-010 | No ownership neededComing soon | · | · |
| MEDIUM | Nuxt __NUXT__ state leak | JS & framework | JS-012 | No ownership neededComing soon | · | · |
| MEDIUM | SvelteKit/Remix loader data leak | JS & framework | JS-013 | No ownership neededComing soon | · | · |
| MEDIUM | Next Server Action ID disclosure | JS & framework | JS-016 | No ownership neededComing soon | · | · |
| MEDIUM | Route admin/debug hardcode trong router | JS & framework | JS-021 | No ownership neededComing soon | · | · |
| MEDIUM | SPF quá rộng/invalid (+all, >10 lookup, ptr) | MAIL-001 | No ownership neededComing soon | · | · | |
| MEDIUM | MX thiếu STARTTLS / cert xấu (cần egress :25) | MAIL-003 | No ownership neededComing soon | · | · | |
| MEDIUM | MX dangling/misconfig | MAIL-007 | No ownership neededComing soon | · | · | |
| MEDIUM | Domain không gửi mail thiếu -all + p=reject | MAIL-008 | No ownership neededComing soon | · | · | |
| MEDIUM | DKIM key yếu (RSA ≤1024) / test mode | MAIL-011 | No ownership neededComing soon | · | · | |
| MEDIUM | Tracker/cookie trước khi consent (EU) | Privacy | PRV-003 | No ownership neededComing soon | · | · |
| MEDIUM | IP hosting có port/CVE lộ (Shodan InternetDB) | Reputation | REP-007 | No ownership neededComing soon | · | · |
| MEDIUM | UA cloaking (SEO spam) | Reputation | REP-008 | No ownership neededComing soon | · | · |
| MEDIUM | Google API key AIza… | Secret phía client | SEC-010 | No ownership neededComing soon | · | · |
| MEDIUM | Algolia app+API key | Secret phía client | SEC-012 | No ownership neededComing soon | · | · |
| MEDIUM | HuggingFace token hf_ | Secret phía client | SEC-022 | No ownership neededComing soon | · | · |
| MEDIUM | Slack webhook URL | Secret phía client | SEC-027 | No ownership neededComing soon | · | · |
| MEDIUM | JS library có CVE (retire.js) — gộp với TECH-011 | Supply chain | SUP-003 | No ownership neededComing soon | · | · |
| MEDIUM | Script không pin version (@latest, raw github) | Supply chain | SUP-004 | No ownership neededComing soon | · | · |
| MEDIUM | Form login/payment post sang host lạ/HTTP | Supply chain | SUP-008 | No ownership neededComing soon | · | · |
| MEDIUM | Version có CVE (OSV/NVD/GHSA) | Tech / CVE / KEV / EOL | TECH-002 | No ownership neededComing soon | · | · |
| MEDIUM | Phần mềm EOL (endoflife.date) | Tech / CVE / KEV / EOL | TECH-004 | No ownership neededComing soon | · | · |
| MEDIUM | WordPress core/plugin/theme CVE | Tech / CVE / KEV / EOL | TECH-005 | No ownership neededComing soon | · | · |
| MEDIUM | TLS 1.0/1.1, cipher yếu | Transport & TLS | TLS-004 | No ownership neededComing soon | · | · |
| MEDIUM | HSTS missing or too short Without Strict-Transport-Security, a visit can be downgraded to HTTP by an attacker on the same network. | Transport & TLS | TLS-005 | No ownership needed | · | · |
| MEDIUM | Khoá/chữ ký yếu (RSA<2048, SHA-1) | Transport & TLS | TLS-008 | No ownership neededComing soon | · | · |
| MEDIUM | DH params yếu (Logjam) | Transport & TLS | TLS-009 | No ownership neededComing soon | · | · |
| MEDIUM | Chain thiếu intermediate (browser giấu, API vỡ) | Transport & TLS | TLS-012 | No ownership neededComing soon | · | · |
| LOW | API thiếu security header | API | API-008 | No ownership neededComing soon | · | · |
| LOW | Thiếu header rate-limit | API | API-016 | No ownership neededComing soon | · | · |
| LOW | Vi phạm prefix (__Secure- không Secure, SameSite=None không Secure) | Cookie | CK-003 | No ownership neededComing soon | · | · |
| LOW | Cookie Domain quá rộng (.example.com) | Cookie | CK-004 | No ownership neededComing soon | · | · |
| LOW | Session cookie sống quá lâu (>30 ngày) | Cookie | CK-005 | No ownership neededComing soon | · | · |
| LOW | S3 bucket tồn tại (AccessDenied) | Cloud storage | CLD-002 | No ownership neededComing soon | · | · |
| LOW | Dấu hiệu SSRF metadata (169.254.169.254) | Cloud storage | CLD-010 | No ownership neededComing soon | · | · |
| LOW | WP wp-cron / uploads listing | CMS | CMS-014 | No ownership neededComing soon | · | · |
| LOW | Ghost admin + version | CMS | CMS-024 | No ownership neededComing soon | · | · |
| LOW | WP readme.html core version | CMS | CMS-027 | No ownership neededComing soon | · | · |
| LOW | ACAO * trên API JSON /api/* | CORS | COR-004 | No ownership neededComing soon | · | · |
| LOW | DKIM selector phổ biến | DNS | DNS-003 | No ownership neededComing soon | · | · |
| LOW | No CAA record Any certificate authority can issue certificates for your domain. CAA restricts issuance to the CAs you actually use. | DNS & email | DNS-004 | No ownership needed | · | · |
| LOW | NS kém bền (số lượng, cùng /24, lame) | DNS | DNS-010 | No ownership neededComing soon | · | · |
| LOW | IP nội bộ trong DNS công khai | DNS | DNS-016 | No ownership neededComing soon | · | · |
| LOW | Thiếu registrar transfer lock (RDAP) | Domain / CT | DOM-001 | No ownership neededComing soon | · | · |
| LOW | .DS_Store file is exposed A macOS | Exposed files | EXP-004 | No ownership needed | · | · |
| LOW | firebase.json / .firebaserc lộ | File & path bị lộ | EXP-019 | No ownership neededComing soon | · | · |
| LOW | vercel.json / netlify.toml lộ | File & path bị lộ | EXP-020 | No ownership neededComing soon | · | · |
| LOW | Baseline security headers missing X-Content-Type-Options and Referrer-Policy are cheap defaults that block MIME sniffing and stop full URLs leaking to other sites. | HTTP headers | HDR-003 | No ownership needed | · | · |
| LOW | Server or framework version disclosed Version banners help attackers match your stack to known vulnerabilities. | HTTP headers | HDR-004 | No ownership needed | · | · |
| LOW | Header lỗi thời/nguy hiểm (HPKP, X-XSS-Protection≠0) | HTTP header | HDR-009 | No ownership neededComing soon | · | · |
| LOW | Referrer-Policy yếu (unsafe-url) | HTTP header | HDR-010 | No ownership neededComing soon | · | · |
| LOW | Header trùng/xung đột/sai cú pháp | HTTP header | HDR-011 | No ownership neededComing soon | · | · |
| LOW | Header lộ stack (X-AspNet-Version, X-Runtime, IP nội bộ) | HTTP header | HDR-012 | No ownership neededComing soon | · | · |
| LOW | Trang auth thiếu Cache-Control: no-store | HTTP header | HDR-013 | No ownership neededComing soon | · | · |
| LOW | Header không nhất quán giữa các path | HTTP header | HDR-014 | No ownership neededComing soon | · | · |
| LOW | sitemap lộ URL/host không công khai | Hành vi HTTP | HTTP-007 | No ownership neededComing soon | · | · |
| LOW | Trang mặc định/placeholder (nginx welcome, parking) | Hành vi HTTP | HTTP-012 | No ownership neededComing soon | · | · |
| LOW | localhost/IP nội bộ/preview URL trong bundle | JS & framework | JS-020 | No ownership neededComing soon | · | · |
| LOW | Comment lộ TODO/credential/host nội bộ | JS & framework | JS-022 | No ownership neededComing soon | · | · |
| LOW | _buildManifest.js lộ route ẩn | JS & framework | JS-027 | No ownership neededComing soon | · | · |
| LOW | DMARC yếu (pct<100, sp=none, no rua) | MAIL-002 | No ownership neededComing soon | · | · | |
| LOW | MTA-STS / TLS-RPT thiếu/hỏng | MAIL-004 | No ownership neededComing soon | · | · | |
| LOW | Không có link privacy policy | Privacy | PRV-004 | No ownership neededComing soon | · | · |
| LOW | Session replay trên trang form (Hotjar/Clarity) | Privacy | PRV-006 | No ownership neededComing soon | · | · |
| LOW | Source maps publicly accessible Your original source code can be reconstructed from the | Client-side secrets | SEC-004 | No ownership needed | · | · |
| LOW | URL nội bộ/staging trong JS | Secret phía client | SEC-006 | No ownership neededComing soon | · | · |
| LOW | Sentry DSN | Secret phía client | SEC-015 | No ownership neededComing soon | · | · |
| LOW | Chuỗi entropy cao gần keyword credential | Secret phía client | SEC-030 | No ownership neededComing soon | · | · |
| LOW | Script/CSS bên thứ ba không SRI | Supply chain | SUP-001 | No ownership neededComing soon | · | · |
| LOW | SRI yếu (sha1/md5) / thiếu crossorigin | Supply chain | SUP-006 | No ownership neededComing soon | · | · |
| LOW | Link social/GitHub có thể hijack | Supply chain | SUP-007 | No ownership neededComing soon | · | · |
| LOW | Header version mở rộng (X-Runtime, X-Drupal-Cache) | Tech / CVE / KEV / EOL | TECH-013 | No ownership neededComing soon | · | · |
| LOW | <meta generator> lộ version | Tech / CVE / KEV / EOL | TECH-014 | No ownership neededComing soon | · | · |
| LOW | Mixed content | Transport & TLS | TLS-006 | No ownership neededComing soon | · | · |
| LOW | Không forward secrecy / không AEAD (TLS1.2) | Transport & TLS | TLS-011 | No ownership neededComing soon | · | · |
| LOW | Thiếu SCT (CT policy) | Transport & TLS | TLS-013 | No ownership neededComing soon | · | · |
| LOW | Redirect sang host khác trước khi set HSTS | Transport & TLS | TLS-015 | No ownership neededComing soon | · | · |
| LOW | Liệt kê table qua PostgREST OpenAPI | BaaS (Supabase/Firebase) | BAAS-001 | No ownership neededComing soon | · | · |
| LOW | Supabase project + anon key (nền) | BaaS (Supabase/Firebase) | BAAS-010 | No ownership neededComing soon | · | · |
| LOW | Firebase config extract (nền) | BaaS (Supabase/Firebase) | BAAS-021 | No ownership neededComing soon | · | · |
| LOW | Session cookie thiếu prefix __Host- | Cookie | CK-002 | No ownership neededComing soon | · | · |
| LOW | DNSSEC | DNS | DNS-005 | No ownership neededComing soon | · | · |
| LOW | Wildcard DNS | DNS | DNS-014 | No ownership neededComing soon | · | · |
| LOW | CSP chỉ report-only hoặc chỉ trong meta tag | HTTP header | HDR-006 | No ownership neededComing soon | · | · |
| LOW | COOP thiếu | HTTP header | HDR-007 | No ownership neededComing soon | · | · |
| LOW | CORP/COEP không set | HTTP header | HDR-008 | No ownership neededComing soon | · | · |
| LOW | robots.txt lộ path nhạy cảm | Hành vi HTTP | HTTP-006 | No ownership neededComing soon | · | · |
| LOW | Không hỗ trợ HTTP/2; HTTP/3 info | Hành vi HTTP | HTTP-008 | No ownership neededComing soon | · | · |
| LOW | Dấu hiệu request smuggling (passive) | Hành vi HTTP | HTTP-009 | No ownership neededComing soon | · | · |
| LOW | Liệt kê bundle + trích endpoint (jsluice) — nền cho nhiều check | JS & framework | JS-010 | No ownership neededComing soon | · | · |
| LOW | Fingerprint framework + version | JS & framework | JS-017 | No ownership neededComing soon | · | · |
| LOW | BIMI record (info) | MAIL-006 | No ownership neededComing soon | · | · | |
| LOW | security.txt thiếu | Privacy | PRV-001 | No ownership neededComing soon | · | · |
| LOW | security.txt invalid | Privacy | PRV-002 | No ownership neededComing soon | · | · |
| LOW | Google Fonts/3rd-party nhạy cảm EU | Privacy | PRV-005 | No ownership neededComing soon | · | · |
| LOW | Nhận diện công nghệ + version (webappanalyzer) | Tech / CVE / KEV / EOL | TECH-001 | No ownership neededComing soon | · | · |
| LOW | EPSS enrichment (xếp hạng ưu tiên) | Tech / CVE / KEV / EOL | TECH-018 | No ownership neededComing soon | · | · |
| LOW | Không hỗ trợ TLS 1.3 | Transport & TLS | TLS-010 | No ownership neededComing soon | · | · |
| LOW | HSTS thiếu includeSubDomains/preload | Transport & TLS | TLS-014 | No ownership neededComing soon | · | · |
| CRITICAL | Next.js middleware bypass (gộp JS-014) | Access control / IDOR | AC-003 | · | Website owner onlyComing soon | · |
| CRITICAL | LLM proxy endpoint không auth (abuse) | AI / LLM | AI-002 | · | Website owner onlyComing soon | · |
| CRITICAL | Key provider lộ qua error | AI / LLM | AI-006 | · | Website owner onlyComing soon | · |
| CRITICAL | MCP server lộ (tools/list, không gọi tool) | AI / LLM | AI-009 | · | Website owner onlyComing soon | · |
| CRITICAL | ChromaDB lộ (metadata) | AI / LLM | AI-012 | · | Website owner onlyComing soon | · |
| CRITICAL | Stripe sk_live lộ / webhook không verify sig | API | API-015 | · | Website owner onlyComing soon | · |
| CRITICAL | Supabase tables readable without login Using the public anon key from your site, we could read rows from these tables. Row Level Security is off or a policy allows public reads. | Backend (Supabase / Firebase) | BAAS-002 | · | Website owner only | · |
| CRITICAL | Firebase Realtime Database is publicly readable Your database rules allow reads without authentication, so anyone can download the data. | Backend (Supabase / Firebase) | BAAS-004 | · | Website owner only | · |
| CRITICAL | Supabase table ghi được bằng anon (CVE-2025-48757) | BaaS (Supabase/Firebase) | BAAS-011 | · | Website owner onlyComing soon | · |
| CRITICAL | auth.users lộ qua view/API | BaaS (Supabase/Firebase) | BAAS-012 | · | Website owner onlyComing soon | · |
| CRITICAL | RLS tắt hàng loạt (splinter 0013) | BaaS (Supabase/Firebase) | BAAS-013 | · | Website owner onlyComing soon | · |
| CRITICAL | Firestore đọc không auth | BaaS (Supabase/Firebase) | BAAS-022 | · | Website owner onlyComing soon | · |
| CRITICAL | Hasura query anon (role permissive) | BaaS (Supabase/Firebase) | BAAS-032 | · | Website owner onlyComing soon | · |
| CRITICAL | Firebase RTDB world-readable (GET only) | Cloud storage | CLD-008 | · | Website owner onlyComing soon | · |
| CRITICAL | WP DB backup / repair.php | CMS | CMS-011 | · | Website owner onlyComing soon | · |
| CRITICAL | WP wp-config backup / setup reachable | CMS | CMS-015 | · | Website owner onlyComing soon | · |
| CRITICAL | Backup config CMS (wp-config.php~, .bak) | File & path bị lộ | EXP-027 | · | Website owner onlyComing soon | · |
| CRITICAL | Hasura/PostGraphile admin mở | GraphQL | GQL-006 | · | Website owner onlyComing soon | · |
| CRITICAL | Next.js middleware bypass CVE-2025-29927 (header) | JS & framework | JS-014 | · | Website owner onlyComing soon | · |
| CRITICAL | RSC RCE CVE-2025-55182 (probe không thực thi) | JS & framework | JS-015 | · | Website owner onlyComing soon | · |
| CRITICAL | Actuator /heapdump tải được | Panel & dịch vụ bị lộ | PNL-005 | · | Website owner onlyComing soon | · |
| CRITICAL | Elasticsearch không auth | Panel & dịch vụ bị lộ | PNL-009 | · | Website owner onlyComing soon | · |
| CRITICAL | Docker Engine API lộ | Panel & dịch vụ bị lộ | PNL-010 | · | Website owner onlyComing soon | · |
| CRITICAL | Kubelet/K8s API read-only | Panel & dịch vụ bị lộ | PNL-012 | · | Website owner onlyComing soon | · |
| CRITICAL | Supabase Studio lộ | Panel & dịch vụ bị lộ | PNL-021 | · | Website owner onlyComing soon | · |
| CRITICAL | Jupyter Notebook không auth | Panel & dịch vụ bị lộ | PNL-025 | · | Website owner onlyComing soon | · |
| CRITICAL | Flask/Werkzeug debugger | Panel & dịch vụ bị lộ | PNL-030 | · | Website owner onlyComing soon | · |
| HIGH | AI route thiếu rate limit | AI / LLM | AI-003 | · | Website owner onlyComing soon | · |
| HIGH | System prompt leakage | AI / LLM | AI-004 | · | Website owner onlyComing soon | · |
| HIGH | Client override model/max_tokens | AI / LLM | AI-008 | · | Website owner onlyComing soon | · |
| HIGH | Ollama lộ (/api/tags) | AI / LLM | AI-010 | · | Website owner onlyComing soon | · |
| HIGH | LM Studio/Open WebUI/vLLM lộ | AI / LLM | AI-011 | · | Website owner onlyComing soon | · |
| HIGH | Qdrant lộ | AI / LLM | AI-013 | · | Website owner onlyComing soon | · |
| HIGH | Weaviate lộ | AI / LLM | AI-014 | · | Website owner onlyComing soon | · |
| HIGH | Output LLM render thành HTML (XSS) | AI / LLM | AI-017 | · | Website owner onlyComing soon | · |
| HIGH | Mass assignment / field thừa (role, password_hash) | API | API-005 | · | Website owner onlyComing soon | · |
| HIGH | CORS reflect + credentials (API) | API | API-006 | · | Website owner onlyComing soon | · |
| HIGH | Endpoint secured trả data khi không auth | API | API-007 | · | Website owner onlyComing soon | · |
| HIGH | Actuator/metrics/debug lộ (gộp PNL-004/06) | API | API-011 | · | Website owner onlyComing soon | · |
| HIGH | OAuth redirect_uri validation yếu | Auth / session / JWT | AUTH-009 | · | Website owner onlyComing soon | · |
| HIGH | Credential mặc định trên panel (1 lần/panel) | Auth / session / JWT | AUTH-010 | · | Website owner onlyComing soon | · |
| HIGH | Supabase storage buckets are listable Anyone with your public key can list files in these buckets, which often exposes user uploads. | Backend (Supabase / Firebase) | BAAS-003 | · | Website owner only | · |
| HIGH | Firebase Storage bucket is publicly listable Your Storage rules allow listing files without authentication. | Backend (Supabase / Firebase) | BAAS-005 | · | Website owner only | · |
| HIGH | Security-definer view bypass RLS | BaaS (Supabase/Firebase) | BAAS-014 | · | Website owner onlyComing soon | · |
| HIGH | RPC function anon gọi được | BaaS (Supabase/Firebase) | BAAS-015 | · | Website owner onlyComing soon | · |
| HIGH | Appwrite collection public | BaaS (Supabase/Firebase) | BAAS-027 | · | Website owner onlyComing soon | · |
| HIGH | PocketBase collection public list | BaaS (Supabase/Firebase) | BAAS-028 | · | Website owner onlyComing soon | · |
| HIGH | Hasura introspection bật | BaaS (Supabase/Firebase) | BAAS-031 | · | Website owner onlyComing soon | · |
| HIGH | Directus collection public | BaaS (Supabase/Firebase) | BAAS-033 | · | Website owner onlyComing soon | · |
| HIGH | Strapi public API over-exposed | BaaS (Supabase/Firebase) | BAAS-034 | · | Website owner onlyComing soon | · |
| HIGH | S3 bucket public listing | Cloud storage | CLD-001 | · | Website owner onlyComing soon | · |
| HIGH | GCS bucket public listing | Cloud storage | CLD-003 | · | Website owner onlyComing soon | · |
| HIGH | Azure Blob container public | Cloud storage | CLD-004 | · | Website owner onlyComing soon | · |
| HIGH | DigitalOcean Spaces public | Cloud storage | CLD-005 | · | Website owner onlyComing soon | · |
| HIGH | Firebase Storage/Firestore open (GET only) | Cloud storage | CLD-009 | · | Website owner onlyComing soon | · |
| HIGH | Subdomain takeover (dangling CNAME) | Cloud storage | CLD-011 | · | Website owner onlyComing soon | · |
| HIGH | WP debug.log lộ | CMS | CMS-010 | · | Website owner onlyComing soon | · |
| HIGH | Drupal install.php reachable | CMS | CMS-021 | · | Website owner onlyComing soon | · |
| HIGH | Installer CMS còn mở (wp/joomla/drupal) | CMS | CMS-026 | · | Website owner onlyComing soon | · |
| HIGH | Origin: null được tin + credentials | CORS | COR-002 | · | Website owner onlyComing soon | · |
| HIGH | Validate Origin theo prefix/suffix (bypass) | CORS | COR-003 | · | Website owner onlyComing soon | · |
| HIGH | Trang debug (Django/Laravel/Next) | File & path bị lộ | EXP-007 | · | Website owner onlyComing soon | · |
| HIGH | Core dump lộ | File & path bị lộ | EXP-033 | · | Website owner onlyComing soon | · |
| HIGH | Không giới hạn depth/complexity | GraphQL | GQL-005 | · | Website owner onlyComing soon | · |
| HIGH | Mutation reachable không auth (báo hiện diện) | GraphQL | GQL-007 | · | Website owner onlyComing soon | · |
| HIGH | Reflected XSS (canary, không thực thi) | Injection / XSS / SSRF | INJ-001 | · | Website owner onlyComing soon | · |
| HIGH | SQLi indicator (error-based, 1 dấu nháy) | Injection / XSS / SSRF | INJ-004 | · | Website owner onlyComing soon | · |
| HIGH | NoSQL injection indicator ($ne) | Injection / XSS / SSRF | INJ-005 | · | Website owner onlyComing soon | · |
| HIGH | Path traversal indicator (1 probe) | Injection / XSS / SSRF | INJ-007 | · | Website owner onlyComing soon | · |
| HIGH | SSTI indicator ({{7*7}}→49) | Injection / XSS / SSRF | INJ-008 | · | Website owner onlyComing soon | · |
| HIGH | Open relay (cần egress :25) | MAIL-009 | · | Website owner onlyComing soon | · | |
| HIGH | Spring Boot Actuator (/env, /mappings) | Panel & dịch vụ bị lộ | PNL-004 | · | Website owner onlyComing soon | · |
| HIGH | Kubernetes Dashboard | Panel & dịch vụ bị lộ | PNL-011 | · | Website owner onlyComing soon | · |
| HIGH | Jenkins | Panel & dịch vụ bị lộ | PNL-013 | · | Website owner onlyComing soon | · |
| HIGH | MinIO console | Panel & dịch vụ bị lộ | PNL-017 | · | Website owner onlyComing soon | · |
| HIGH | Redis Commander | Panel & dịch vụ bị lộ | PNL-018 | · | Website owner onlyComing soon | · |
| HIGH | Apache Solr admin | Panel & dịch vụ bị lộ | PNL-019 | · | Website owner onlyComing soon | · |
| HIGH | Apache Airflow | Panel & dịch vụ bị lộ | PNL-020 | · | Website owner onlyComing soon | · |
| HIGH | Laravel Telescope | Panel & dịch vụ bị lộ | PNL-027 | · | Website owner onlyComing soon | · |
| HIGH | Google Maps key không giới hạn | Secret phía client | SEC-011 | · | Website owner onlyComing soon | · |
| HIGH | Algolia key có ACL ghi/admin | Secret phía client | SEC-013 | · | Website owner onlyComing soon | · |
| HIGH | Heartbleed/ROBOT/insecure renegotiation | Transport & TLS | TLS-017 | · | Website owner onlyComing soon | · |
| MEDIUM | ID tuần tự/đoán được (dấu hiệu IDOR) | Access control / IDOR | AC-008 | · | Website owner onlyComing soon | · |
| MEDIUM | Rate limit login/AI endpoint | Quét chủ động | ACT-005 | · | Website owner onlyComing soon | · |
| MEDIUM | API version cũ/không tài liệu reachable | API | API-002 | · | Website owner onlyComing soon | · |
| MEDIUM | Lỗi verbose (stack/DB driver) | API | API-003 | · | Website owner onlyComing soon | · |
| MEDIUM | Method tampering / unsafe methods | API | API-004 | · | Website owner onlyComing soon | · |
| MEDIUM | Lạm dụng pagination/limit | API | API-009 | · | Website owner onlyComing soon | · |
| MEDIUM | Enumeration qua login/reset | Auth / session / JWT | AUTH-004 | · | Website owner onlyComing soon | · |
| MEDIUM | pg_graphql introspection mở cho anon | BaaS (Supabase/Firebase) | BAAS-016 | · | Website owner onlyComing soon | · |
| MEDIUM | Realtime anon subscribe được | BaaS (Supabase/Firebase) | BAAS-017 | · | Website owner onlyComing soon | · |
| MEDIUM | Edge Function không auth | BaaS (Supabase/Firebase) | BAAS-018 | · | Website owner onlyComing soon | · |
| MEDIUM | Supabase signup mở (spraying) | BaaS (Supabase/Firebase) | BAAS-020 | · | Website owner onlyComing soon | · |
| MEDIUM | Firebase anonymous auth bật | BaaS (Supabase/Firebase) | BAAS-024 | · | Website owner onlyComing soon | · |
| MEDIUM | Firebase Remote Config đọc được | BaaS (Supabase/Firebase) | BAAS-026 | · | Website owner onlyComing soon | · |
| MEDIUM | Convex function public | BaaS (Supabase/Firebase) | BAAS-030 | · | Website owner onlyComing soon | · |
| MEDIUM | Cloudflare R2 public bucket | Cloud storage | CLD-006 | · | Website owner onlyComing soon | · |
| MEDIUM | Swagger/OpenAPI, GraphQL introspection | File & path bị lộ | EXP-005 | · | Website owner onlyComing soon | · |
| MEDIUM | Sourcemap .map lộ (full source) | File & path bị lộ | EXP-023 | · | Website owner onlyComing soon | · |
| MEDIUM | Introspection bật ở prod | GraphQL | GQL-002 | · | Website owner onlyComing soon | · |
| MEDIUM | Field suggestion ("did you mean") | GraphQL | GQL-003 | · | Website owner onlyComing soon | · |
| MEDIUM | Batching/aliasing cho phép | GraphQL | GQL-004 | · | Website owner onlyComing soon | · |
| MEDIUM | GraphQL CSRF (GET/form mutation) | GraphQL | GQL-009 | · | Website owner onlyComing soon | · |
| MEDIUM | Method nguy hiểm (PUT/DELETE/PROPFIND) | Hành vi HTTP | HTTP-002 | · | Website owner onlyComing soon | · |
| MEDIUM | Host header injection | Hành vi HTTP | HTTP-003 | · | Website owner onlyComing soon | · |
| MEDIUM | Open redirect qua ?next/url/redirect/returnTo | Hành vi HTTP | HTTP-004 | · | Website owner onlyComing soon | · |
| MEDIUM | Lỗi/stack trace lộ (malformed request) | Hành vi HTTP | HTTP-005 | · | Website owner onlyComing soon | · |
| MEDIUM | Web cache deception | Hành vi HTTP | HTTP-011 | · | Website owner onlyComing soon | · |
| MEDIUM | Open redirect (canary host) | Injection / XSS / SSRF | INJ-002 | · | Website owner onlyComing soon | · |
| MEDIUM | Header/host injection | Injection / XSS / SSRF | INJ-006 | · | Website owner onlyComing soon | · |
| MEDIUM | Vite dev server shipped to prod (/@vite/client, /@fs/) | JS & framework | JS-025 | · | Website owner onlyComing soon | · |
| MEDIUM | Prometheus /metrics | Panel & dịch vụ bị lộ | PNL-006 | · | Website owner onlyComing soon | · |
| MEDIUM | Grafana (anon/default) | Panel & dịch vụ bị lộ | PNL-007 | · | Website owner onlyComing soon | · |
| MEDIUM | Kibana | Panel & dịch vụ bị lộ | PNL-008 | · | Website owner onlyComing soon | · |
| MEDIUM | Portainer | Panel & dịch vụ bị lộ | PNL-014 | · | Website owner onlyComing soon | · |
| MEDIUM | Traefik dashboard/API | Panel & dịch vụ bị lộ | PNL-015 | · | Website owner onlyComing soon | · |
| MEDIUM | RabbitMQ management | Panel & dịch vụ bị lộ | PNL-016 | · | Website owner onlyComing soon | · |
| MEDIUM | Go pprof/expvar | Panel & dịch vụ bị lộ | PNL-031 | · | Website owner onlyComing soon | · |
| MEDIUM | Xác minh key còn sống (whoami an toàn) | Secret phía client | SEC-007 | · | Website owner onlyComing soon | · |
| MEDIUM | Dep từ package.json/composer.json → OSV | Tech / CVE / KEV / EOL | TECH-019 | · | Website owner onlyComing soon | · |
| LOW | Joomla admin + registration mở | CMS | CMS-019 | · | Website owner onlyComing soon | · |
| LOW | Preflight quá dễ dãi (ACAM PUT/DELETE) | CORS | COR-005 | · | Website owner onlyComing soon | · |
| LOW | next/nuxt/vite config lộ | File & path bị lộ | EXP-022 | · | Website owner onlyComing soon | · |
| LOW | TRACE/TRACK bật | Hành vi HTTP | HTTP-001 | · | Website owner onlyComing soon | · |
| LOW | Phát hiện OpenAPI/Swagger + inventory | API | API-001 | · | Website owner onlyComing soon | · |
| LOW | Phát hiện endpoint GraphQL | GraphQL | GQL-001 | · | Website owner onlyComing soon | · |
| LOW | Thiếu Clear-Site-Data khi logout | HTTP header | HDR-015 | · | Website owner onlyComing soon | · |
| CRITICAL | BOLA/IDOR (2 tài khoản test) | Access control / IDOR | AC-001 | · | · | PaidComing soon |
| CRITICAL | Role escalation qua mass assignment (no-op) | Access control / IDOR | AC-009 | · | · | PaidComing soon |
| CRITICAL | JWT alg:none / alg-confusion (token của chủ site) | Auth / session / JWT | AUTH-001 | · | · | PaidComing soon |
| CRITICAL | SSRF qua url/webhook param (OOB) | Injection / XSS / SSRF | INJ-003 | · | · | PaidComing soon |
| HIGH | Broken function-level auth (user → admin route) | Access control / IDOR | AC-002 | · | · | PaidComing soon |
| HIGH | Quét có đăng nhập + IDOR | Quét chủ động | ACT-004 | · | · | PaidComing soon |
| HIGH | Excessive agency (read-only probe) | AI / LLM | AI-016 | · | · | PaidComing soon |
| HIGH | JWT HS256 secret yếu (offline) | Auth / session / JWT | AUTH-002 | · | · | PaidComing soon |
| HIGH | Reset token yếu (dự đoán/trong response) | Auth / session / JWT | AUTH-005 | · | · | PaidComing soon |
| HIGH | Flow nhạy cảm thiếu anti-automation | Business logic | BIZ-001 | · | · | PaidComing soon |
| HIGH | Coupon/price/quantity tampering (no-op) | Business logic | BIZ-002 | · | · | PaidComing soon |
| HIGH | Bypass plan/feature-gate | Business logic | BIZ-003 | · | · | PaidComing soon |
| HIGH | Race condition redeem (2 request) | Business logic | BIZ-004 | · | · | PaidComing soon |
| HIGH | AI agent dò logic nghiệp vụ | Business logic | BIZ-006 | · | · | PaidComing soon |
| HIGH | A record trỏ IP cloud có thể mất quyền | Domain / CT | DOM-005 | · | · | PaidComing soon |
| MEDIUM | Session không huỷ khi logout | Auth / session / JWT | AUTH-007 | · | · | PaidComing soon |
| MEDIUM | Domain lookalike/typosquat (dnstwist) | Domain / CT | DOM-004 | · | · | PaidComing soon |
| MEDIUM | Origin truy cập trực tiếp, bypass CDN/WAF | Hành vi HTTP | HTTP-013 | · | · | PaidComing soon |