Docs/What we scan

What we scan

Exactly which vulnerability categories ShadowOps checks â€” and which ones it doesn't. Every scan report includes this list so you always know what was and wasn't covered.

What we check

Category	CWE	What we look for	Confidence
Secrets & API keys	CWE-798	Hardcoded tokens, passwords, and API keys in source â€” OpenAI, Stripe, AWS, database URLs, and generic high-entropy strings.	High
Broken authentication	CWE-287	Missing auth middleware on routes, JWT weaknesses (none algorithm, weak secrets, no expiry), insecure session cookies.	High
SQL injection	CWE-89	Unsanitized user input reaching raw SQL queries. One of the most common AI codegen mistakes.	High
Cross-site scripting (XSS)	CWE-79	Unsafe HTML rendering patterns â€” dangerouslySetInnerHTML, innerHTML assignment, template injection.	Medium
CORS misconfiguration	CWE-942	Wildcard origins with credentials, overly permissive CORS policies that expose private APIs.	High
Sensitive data exposure	CWE-200	Stack traces in production responses, debug endpoints left enabled, verbose error messages leaking internals.	Medium
Cryptography weaknesses	CWE-327	MD5/SHA1 for password hashing, weak random number generation for security-sensitive values.	High
SSRF	CWE-918	User-controlled URLs passed to fetch/requests without validation, internal network request patterns.	Medium
Dependency vulnerabilities	CWE-1104	Known vulnerable packages in package.json and requirements.txt via version range analysis.	High

Confidence tiers:

HighPattern reliably indicates a real vulnerability in AI-generated code.

MediumPattern is suspicious but may be a false positive in some contexts.

LowWorth investigating but treat as a hint, not a confirmed finding.

What we don't check

“No findings” means we didn't detect anything in the areas above â€” not that your app has no vulnerabilities. The areas below require dynamic analysis, manual review, or infrastructure access that a static scanner can't provide.

â€“Business logic vulnerabilities
â€“Runtime behaviour and race conditions
â€“Infrastructure & cloud misconfiguration (IAM, S3 policies)
â€“Network-level vulnerabilities
â€“Client-side JavaScript execution context
â€“Mobile application security
â€“Authentication flows that require live execution

Supported languages

JavaScriptTypeScriptPythonHTMLCSSJSON / YAML config

Want broader coverage?

Join the Pro waitlist at shadowops.in/#notify â€” Pro will add deeper Semgrep rulesets, dependency CVE matching, and infrastructure-as-code scanning.