Critical
Injection Flaws
SQL, NoSQL, OS command and LDAP injection vulnerabilities. Identifies parameterised query violations and generates safe alternatives with full test coverage.
Critical
Authentication & Session Failures
Weak credential handling, session fixation, insecure token storage and missing MFA enforcement. Includes JWT misconfiguration (alg:none, weak secrets).
High
Insecure Deserialization
Detects unsafe pickle, YAML and XML deserialization patterns. Particularly relevant for financial data pipelines using Python's pickle for model serialization.
High
Secret & Credential Leaks
Scans for hardcoded API keys, database credentials, private keys and tokens in source code, config files and git history. Generates Secrets Manager migration code.
Medium
Vulnerable Dependencies (CVE)
Cross-references all dependencies against the NVD CVE database. Identifies exploitable vulnerabilities and generates updated requirements with compatible pinned versions.
Medium
Security Misconfiguration
CORS misconfigurations, missing security headers, verbose error messages, debug endpoints and overly permissive IAM policies in infrastructure code (CDK/Terraform).
Medium
Broken Access Control
Missing authorisation checks, insecure direct object references and privilege escalation vectors. Identifies missing role enforcement in FastAPI/Django/Spring routes.
Low
Compliance Gaps (FCA / MiFID II)
Regulatory-specific checks: missing audit logging for MiFID II order records, inadequate data retention controls and FCA algorithm documentation requirements.