Vulnerability Database

Row Level Security (RLS) is disabled on Supabase tables, allowing unauthenticated users to read, insert, update, or delete data directly via the public anon key.

API keys, secrets, or tokens are hardcoded in client-side JavaScript and visible in the browser bundle via DevTools.

Your app does not send a Content-Security-Policy header, leaving it vulnerable to XSS and data injection attacks.

Your app does not include the Strict-Transport-Security header, allowing attackers to downgrade connections from HTTPS to HTTP.

Your app does not send the X-Frame-Options header, making it possible for attackers to embed your site in an iframe and conduct clickjacking attacks.

Admin or management routes are accessible without any authentication check, allowing anyone to access privileged functionality.

Your Razorpay webhook endpoint does not verify the webhook signature, allowing attackers to forge payment events.

Your Stripe webhook endpoint does not verify the Stripe-Signature header, allowing attackers to forge payment events.

Your API responds with Access-Control-Allow-Origin: *, allowing any website to make authenticated requests to your API.

A CNAME record points to an external service that is no longer provisioned, allowing attackers to claim the subdomain and host content under your domain.

User input is concatenated directly into SQL queries without parameterization, allowing attackers to manipulate query logic.

User-controlled data is inserted into the DOM using innerHTML, dangerouslySetInnerHTML, or v-html without sanitization.

API endpoints accept user-supplied IDs without verifying ownership, allowing users to access other users' resources by changing an ID parameter.

Your JWT verification library accepts tokens signed with the 'none' algorithm, allowing attackers to forge valid tokens without knowing the secret.

Sensitive data such as passwords or tokens are transmitted in URL query strings, where they are logged by servers, proxies, and analytics.

Sensitive information such as auth tokens, API keys, or PII is stored in localStorage where it is accessible to any JavaScript running on the page.

Your app accepts a redirect URL parameter and forwards users to it without validation, enabling phishing attacks.

Your state-changing endpoints do not require CSRF tokens, allowing attackers to forge requests on behalf of authenticated users.

LLM-powered endpoints lack rate limiting, allowing attackers to exhaust your API quota and rack up massive bills.

Your AI application does not sanitize user input for prompt injection attacks, allowing users to override system instructions.

Direct or indirect prompt injection vulnerabilities allow attackers to manipulate LLM behavior by injecting malicious instructions into user input or external data.

LLM-generated output is rendered without sanitization, potentially allowing XSS or code execution if the LLM produces malicious output.

Your LLM application leaks system prompts, API keys, database schemas, or other sensitive information in its responses.

Your domain lacks an SPF DNS record, allowing attackers to send forged emails that appear to come from your domain.

Your domain lacks a DMARC policy, meaning receiving mail servers have no guidance on handling unauthenticated emails from your domain.

Your domain lacks DKIM (DomainKeys Identified Mail) signing, meaning outgoing emails cannot be cryptographically verified as authentic.

Your project depends on npm packages with publicly known vulnerabilities (CVEs) that have available fixes.

A Next.js API route exposes sensitive data or functionality without proper authentication or rate limiting.

Debug or development mode is enabled in production, exposing detailed error pages, stack traces, and configuration information.

Your Firebase/Firestore security rules allow read/write access to unauthenticated users, exposing your entire database.