Coverage · public list
Exactly what we look for.And what we don’t.
A public coverage list, so nobody has to guess what a clean scan means. Every row below is a rule the scanner runs today. Live rules are established; Beta rules shipped this release and are still being tuned for false positives.
Last reviewed 2026-10-13. Generated from the scanner’s own coverage list, so this page changes when the rules do.
5 rules
Personal data handling
Names, emails, IDs and request bodies ending up somewhere they shouldn’t: logs, URLs, the browser, error reports.
log.sensitive-datawarningLivepersonal-data.loggedseriousBetapersonal-data.in-urlwarningBetapersonal-data.in-client-storagewarningBetapersonal-data.unredacted-errorwarningBeta2 rules
Tracking and analytics
Personal data handed to analytics or ad tools, and third-party trackers you may not know are there.
personal-data.to-analyticsseriousBetaprovenance.tracking-beaconinfoLive1 rule
Data sent to AI providers
User records sent to an AI model provider as part of a prompt.
personal-data.to-aiseriousBeta4 rules
Secrets and credentials
Keys and passwords committed to the repo, where anyone with the code can use them.
auth.jwt-hardcoded-secretcriticalLivesecret.hardcoded-credentialcriticalLivesecret.env-committedseriousLivedb.plaintext-role-passwordseriousLive6 rules
Open access to data
Data that can be read without logging in, or by the wrong logged-in user.
cors.permissive-credentialsseriousLiveopen-access.public-storageseriousBetaopen-access.firebase-rulesseriousBetaroute.unauthenticatedcriticalLiveroute.admin-exposedcriticalLiveroute.idorseriousLive36 rules
Supporting security checks.
These aren’t privacy leaks on their own, but they are how leaks usually start: injection, weak auth, unsafe crypto. They run on every scan.
Show all 36
code.evalcriticalLivecode.command-injectioncriticalLivecode.sql-injectioncriticalLivecode.nosql-injectionseriousLivecode.prototype-pollutionwarningLivexss.dom-sinkcriticalLivexss.dangerously-set-htmlseriousLivexss.message-listener-uncheckedseriousLivexss.postmessage-wildcardwarningLiveframe.sandbox-escapecriticalLiveauth.jwt-none-algorithmcriticalLiveauth.jwt-decode-unverifiedseriousLiveauth.plaintext-password-comparecriticalLivecrypto.weak-hashseriousLivecrypto.insecure-randomseriousLivecrypto.weak-cipherseriousLivetls.verification-disabledseriousLivenet.insecure-httpwarningLivecookie.insecure-flagsseriousLiveheaders.security-middlewarewarningLiveelectron.node-integrationcriticalLiveelectron.context-isolation-offcriticalLiveelectron.web-security-offcriticalLiveupload.unrestrictedseriousLivepath.traversalcriticalLivessrf.server-side-requestcriticalLiveredirect.openwarningLiveerror.stack-exposedwarningLiveci.pull-request-targetcriticalLiveci.unpinned-actionwarningLivecontainer.root-userseriousLivecontainer.unpinned-basewarningLivedebug.production-sourcemapswarningLivedebug.dev-mode-forcedwarningLiveroute.unvalidated-inputwarningLiveroute.auth-no-rate-limitwarningLiveNot in scope
- Code quality. We don’t grade style, structure or whether your code is “good”.
- Penetration testing. Nobody attacks your running app. We read code; we never run it.
- Runtime monitoring. We don’t watch production traffic or your live database.
- Legal compliance. A clean scan is not a GDPR, CCPA, HIPAA or COPPA opinion, and not legal advice.
Planned · not built yet
- Data map from code. A records-of-processing style map of where personal data flows, generated from the code.
- Pull request comments. Findings posted on the PR that introduced them.
- Evidence export to Vanta and Drata. Send scan results to your compliance platform.
A clean scan means no leaks of the types listed above were found in that scan. It is not a promise that nothing can go wrong. Findings are also mapped to SOC 2 Privacy and Confidentiality criteria and GDPR Art. 25/32 as context for later audits; that mapping is explanatory, not a compliance opinion.
Your first badge is a month away
Find the leak before your users do.
