Issue Wiki
Security Issues
The cat sniffs out exposed API keys, XSS vulnerabilities, missing CSRF protection, and other security issues.
The cat sniffs out exposed API keys, XSS vulnerabilities, missing CSRF protection, and other security issues hiding in your code.
- Dangerous innerHTML UsageLetting strangers write on your whiteboard — that's what unsanitized innerHTML does. It opens the door to cross-site scripting attacks.
- document.write() UsageRewriting the entire page while someone is reading it — that's what document.write() does. There are much better ways to update the DOM.
- Exposed API KeysWriting your PIN on the back of your debit card — that's what hardcoding API keys in client-side code does. Anyone can see them.
- Exposed Source MapsPublishing the blueprint of your house online — that's what leaving source maps in production does. Attackers can read your entire codebase.
- Insecure API Calls (HTTP)Sending a postcard instead of a sealed letter — that's what HTTP API calls do. Anyone between you and the server can read everything.
- Insecure DependenciesBuilding your house with recalled materials — that's what happens when your npm packages have known vulnerabilities. Audit and update them.
- Sensitive Data in localStorageSticky note with passwords on your monitor — that's what storing secrets in localStorage looks like. Anyone who walks by can read them.
- Missing CSRF ProtectionLeaving your car unlocked with the engine running — that's a form without CSRF protection. Anyone can take it for a ride.
- Unrestricted File UploadA mailbox that accepts packages of any size with no screening — that's file upload without restrictions. Time to add some rules.
Poor Responsive Design
Furniture that doesn't fit through the door — that's your desktop layout crammed onto a mobile screen. Make it adapt properly.
Dangerous innerHTML Usage
Letting strangers write on your whiteboard — that's what unsanitized innerHTML does. It opens the door to cross-site scripting attacks.