Security categories - Vidoc

Each finding has one category. Each category has a risk type. The web app shows the category name. The ID is the value that Vidoc stores.

Risk types

Risk type	Filter name in the web app	What it means	PR comments
Attack	Attack risk	An attacker can use the issue directly, for example to run code, read data, or get access.	Yes
Compliance	Data & Compliance	A weak practice more than a direct attack, for example weak cryptography, hardcoded secrets, or sensitive data in logs.	No
Other	Shown only in All issues	Issues that are not in the attack or compliance groups.	Yes

Vidoc does not write pull request (PR) comments for compliance findings. These findings show in the web app. For the other rules about which findings go to the PR, refer to How Vidoc works.

Attack categories

Category	ID	Description
XSS	`xss`	Cross-site scripting. Untrusted input goes into a web page without correct encoding, and the browser runs it as script.
SQL Injection	`sqli`	Untrusted input changes the structure of a SQL query.
NoSQL Injection	`nosql-injection`	Untrusted input changes a query or an operator of a NoSQL database.
Command Injection	`command-injection`	Untrusted input goes into an operating system command.
RCE	`rce`	Remote code execution. An attacker can run code on the server.
Code Evaluation	`code-evaluation`	Untrusted input goes into a function that evaluates code, for example `eval`.
SSTI	`ssti`	Server-side template injection. Untrusted input goes into a template that the server renders.
XXE	`xxe`	XML external entity. The XML parser processes external entities from untrusted XML.
Header Injection	`header-injection`	Untrusted input goes into HTTP headers, for example with new-line characters.
Log Injection	`log-injection`	Untrusted input can add or change log entries.
Path Injection	`path-injection`	Untrusted input controls a file path or a file name that the code uses.
Regex Injection	`regex-injection`	Untrusted input goes into a regular expression.
Path Traversal	`path-traversal`	Untrusted input can get to files outside the intended directory, for example with `../`.
SSRF	`ssrf`	Server-side request forgery. An attacker can make the server send requests to an address that the attacker selects.
Open Redirect	`open-redirect`	An attacker can send users to an external address through a redirect in the application.
Prototype Pollution	`prototype-pollution`	Untrusted input changes the prototype of JavaScript objects.
Insecure Deserialization	`insecure-deserialization`	The application deserializes untrusted data in an unsafe way.
File Upload	`unrestricted-file-upload`	The application accepts uploaded files without correct checks of type, name, size, or location.
IDOR	`idor`	Insecure direct object reference. A user can get to the objects of other users by a change of an identifier.
Broken Access Control	`broken-access-control`	A missing or incorrect authorization check lets a user do an action without permission.
Broken Authentication	`broken-authentication`	A defect in sign-in, credentials, or tokens lets an attacker get access as another user.
CSRF	`csrf`	Cross-site request forgery. Another site can make the browser of a user send a request that changes state.
Session Fixation	`session-fixation`	An attacker can set the session identifier of a user before the user signs in.
PostMessage Misuse	`postmessage-misuse`	Browser `postMessage` communication without a correct check of the origin or of the data.
Information Disclosure	`information-disclosure`	The application shows internal or sensitive data to users who must not see it.
Timing Attack	`timing-side-channel`	An attacker can get secret data from differences in response time.
Race Condition	`race-condition`	Concurrent operations give an unsafe result, for example a check that is not valid at the time of use.
Memory Safety	`memory-safety`	Memory defects, for example buffer overflows or use after free.
DoS	`dos`	Denial of service. An attacker can make the application slow or stop it.

Compliance categories

Category	ID	Description
`sensitive-data-logging` ¹	`sensitive-data-logging`	The application writes sensitive data to logs, for example passwords, tokens, or personal data.
Weak Cryptography	`weak-cryptography`	The application uses weak or obsolete algorithms, modes, or key sizes.
Weak Randomness	`weak-randomness`	The application uses a random number generator that is not cryptographically secure for security values.
Insecure Transport	`insecure-transport`	Data goes over a connection without encryption, or the application does not check certificates.
Hardcoded Secrets	`hardcoded-secrets`	Passwords, keys, or tokens are in the source code.
Supply Chain	`supply-chain-risk`	Risks from how the project gets and uses third-party code, for example unpinned or untrusted sources.
Misconfiguration	`misconfiguration`	Unsafe settings in the application, the framework, or the infrastructure code.

¹ Sensitive data logging. The web app shows the ID of this category.

Other categories

Category	ID	Description
Excessive Privileges	`excessive-privileges`	A component, a role, or a token has more permissions than it needs.
Other	`unknown`	The issue does not match one of the categories above.

Vidoc does not do software composition analysis (SCA). It does not compare the versions of your third-party libraries with vulnerability databases.