Security & Architecture Rules Catalog

Sign In
CRITICALSEC-SQLI-001 • CWE-89

SQL Injection Vulnerability

Dynamic SQL query built with unescaped string concatenation or formatting allows arbitrary query execution.

Recommended Fix:Use parameterized queries, prepared statements, or ORM parameter binding instead of string concatenation.
Effort: 20 minutesSECURITY
HIGHSEC-XSS-001 • CWE-79

Cross-Site Scripting (XSS)

Unsanitized user-controlled input rendered directly into the DOM or HTML response allows script injection.

Recommended Fix:Sanitize HTML with DOMPurify, use framework-native text interpolation, or encode output before rendering.
Effort: 15 minutesSECURITY
CRITICALSEC-SECRET-001 • CWE-798

Hardcoded Secret / Credential Leak

High-entropy credential, API token, private key, or password found hardcoded in source files.

Recommended Fix:Store sensitive secrets in environment variables or cloud secret managers (e.g. AWS Secrets Manager, HashiCorp Vault).
Effort: 10 minutesSECURITY
CRITICALSEC-CMDI-001 • CWE-78

Command Injection Vulnerability

Operating system command executed using dynamic string concatenation with untrusted input.

Recommended Fix:Use command execution APIs with explicit argument arrays (e.g. execFile or subprocess with shell=False) without invoking shell interpreters.
Effort: 30 minutesSECURITY
HIGHSEC-SSRF-001 • CWE-918

Server-Side Request Forgery (SSRF)

Server makes an outbound HTTP request using a user-supplied target address without strict whitelist validation.

Recommended Fix:Validate and whitelist target hosts, block internal loopback/private CIDR ranges, and avoid following redirects to private addresses.
Effort: 25 minutesSECURITY
HIGHSEC-PATH-001 • CWE-22

Path Traversal Vulnerability

File system operations performed using unsanitized user-provided file paths containing directory traversal characters.

Recommended Fix:Use path normalization (e.g. path.resolve), ensure resolved path starts with intended root prefix, or use an identifier lookup table.
Effort: 15 minutesSECURITY
MEDIUMSEC-CRYPTO-001 • CWE-327

Use of Broken or Weak Cryptographic Algorithm

Cryptographic operations using broken algorithms like MD5, SHA-1, DES, or predictable pseudo-random number generators.

Recommended Fix:Use modern cryptographic hashing (SHA-256 / SHA-3) for integrity, and Argon2id or bcrypt for password storage.
Effort: 20 minutesSECURITY
CRITICALSEC-DESER-001 • CWE-502

Unsafe Object Deserialization

Deserializing untrusted data with unrestricted object instantiation mechanisms like Python pickle, Java ObjectInputStream, or PHP unserialize.

Recommended Fix:Use safe data exchange formats such as JSON or Protocol Buffers, or cryptographically sign and verify payloads before deserialization.
Effort: 40 minutesSECURITY
HIGHQUAL-GODCLASS-001 • CWE-1061

God Class Anti-Pattern

Class exceeds excessive line count (>500 LOC) and handles too many distinct responsibilities.

Recommended Fix:Refactor into smaller, focused domain classes or service delegates following SRP and composition.
Effort: 2 hoursCODE_QUALITY
MEDIUMQUAL-LONGMETHOD-001 • CWE-1061

Excessive Method Length

Method or function exceeds recommended maximum length (>60 lines).

Recommended Fix:Extract sub-operations into private helper methods with descriptive names.
Effort: 30 minutesCODE_QUALITY
MEDIUMQUAL-DEEPNEST-001

Deep Control Flow Nesting

Block nesting depth exceeds 4 levels of nested if/for/while statements.

Recommended Fix:Apply guard clauses, early returns, or extract inner logic into smaller functions.
Effort: 20 minutesCOMPLEXITY
LOWQUAL-DEADCODE-001 • CWE-561

Unreachable or Dead Code Detected

Code blocks following return/throw statements or unused private functions that can never be executed.

Recommended Fix:Remove unused code blocks and unreferenced symbols.
Effort: 10 minutesCODE_QUALITY
HIGHPERF-NPLUS1-001

N+1 Database Query Pattern in Loop

Database query executed inside a loop over a collection of records.

Recommended Fix:Use eager loading (e.g. `include`, `select_related`, `joinFetch`) or batch query IDs using `WHERE id IN (...)`.
Effort: 30 minutesPERFORMANCE
HIGHPERF-SYNCIO-001

Blocking Synchronous I/O in Async Context

Synchronous file/network operations (e.g. `fs.readFileSync`, `time.sleep`) executed on an async event loop.

Recommended Fix:Replace synchronous APIs with non-blocking async/await equivalents (e.g. `fs.promises.readFile`).
Effort: 15 minutesPERFORMANCE
HIGHARCH-CIRCULAR-001

Circular Module Dependency

Modules import each other directly or transitively in a closed dependency loop.

Recommended Fix:Extract shared interfaces/types or data models into a separate common module or apply dependency inversion.
Effort: 45 minutesARCHITECTURE
HIGHDOCK-ROOT-001 • CWE-250

Container Runs as Root User

Dockerfile does not specify a non-root USER directive.

Recommended Fix:Add a dedicated unprivileged user and switch to it using `USER <username>` before the entrypoint.
Effort: 10 minutesDOCKER
CRITICALK8S-PRIVILEGED-001

Kubernetes Pod Configured in Privileged Mode

Container securityContext has `privileged: true`.

Recommended Fix:Set `privileged: false` and grant only specific required Linux capabilities (e.g. `NET_BIND_SERVICE`).
Effort: 15 minutesKUBERNETES