Security detectors
If statement with identical bodies in if and else blocks
Redundant mutex guards on channels in Go
Disabled TLS certificate validation
S3 bucket operations without owner validation
Improper resource handling leading to resource exhaustion or arbitrary code execution
Cookies created without HttpOnly and Secure flags
Use of insecure math/rand for random number generation
Redundant equality checks affect code quality and return predictable results
Disabling SSH host key validation
Use of adversary-controlled input in reflection
Unhandled failures in AWS batch operations
AWS client re-creation in Lambda handlers
OS command injection from untrusted input
Redundant conditional checks
Log injection from untrusted input
Using http.FileServer as handler
Exposed pprof endpoints enable information leaks
XSS from untrusted input in web outputs
Security risks and quality issues from deprecated AWS APIs and clients
Asynchronous hidden goroutine function invocations
Insecure gRPC client and server connections in Go enable data tampering
Decompression of untrusted data without size limits
Insecure validation and lack of restrictions enable cross-site request forgery
Unsynchronized concurrent access to shared data
Plain HTTP traffic enables eavesdropping and tampering
Improper Neutralization of Special Elements used in an SQL Command
Use of weak RSA key generation function
Loop pointers exported directly can cause unintended behavior
User input used unsanitized in outbound requests
Unprotected sensitive data in network services and client alerts
Integer overflow from improper input validation in conversions
Missing pagination in paginated API calls
Use of insecure cryptography
Disabled or incorrectly used protection mechanism can lead to security vulnerabilities
Dereferencing a nil pointer can lead to unexpected nil pointer exceptions.
Insecure temporary file creation
XXE vulnerability from XML
Overly permissive file permissions
Inconsistent variable assignment from multiple sources
Code injection from untrusted input
Improper authentication from insufficient identity verification
File path compatibility with different systems path separators risks from path.Join
Path traversal from untrusted input
Identified the presence of stack traces within HTTP response, posing a potential security risk if deployed in a user-facing manner in a production environment.
Redundant true/false conditions in if statements