Compliance Issues

Compliance issues are security weaknesses that may not be directly exploitable but weaken your security posture and violate security best practices.

Secrets & Credentials

Hardcoded Secrets (hardcoded-secrets)

Severity: High Credentials, API keys, or tokens embedded in source code.

// Vulnerable
const apiKey = "sk-1234567890abcdef";
const dbPassword = "supersecret123";

// Fixed - use environment variables
const apiKey = process.env.API_KEY;
const dbPassword = process.env.DB_PASSWORD;

Risk: Credential exposure if code is leaked or shared. Detection: Vidoc identifies patterns matching:

API keys (AWS, GCP, Stripe, etc.)
Database credentials
JWT secrets
OAuth tokens
Private keys

Cryptography

Weak Cryptography (weak-cryptography)

Severity: Medium Use of deprecated or weak cryptographic algorithms.

// Vulnerable
crypto.createHash('md5').update(data).digest();
crypto.createCipheriv('des', key, iv);

// Fixed
crypto.createHash('sha256').update(data).digest();
crypto.createCipheriv('aes-256-gcm', key, iv);

Weak algorithms:

MD5, SHA1 (for security purposes)
DES, 3DES, RC4
RSA keys < 2048 bits
ECDSA keys < 256 bits

Weak Randomness (weak-randomness)

Severity: Medium Using non-cryptographic random number generators for security purposes.

// Vulnerable
const token = Math.random().toString(36);

// Fixed
const token = crypto.randomBytes(32).toString('hex');

Risk: Predictable values can be guessed by attackers.

Transport Security

Insecure Transport (insecure-transport)

Severity: Medium Data transmitted without encryption.

// Vulnerable
const url = 'http://api.example.com/data';

// Fixed
const url = 'https://api.example.com/data';

Issues detected:

HTTP URLs for sensitive data
Disabled SSL/TLS verification
Weak TLS versions (TLS 1.0, 1.1)
Missing HSTS headers

Information Disclosure

Information Disclosure (information-disclosure)

Severity: Medium Code that may expose sensitive information.

// Vulnerable - detailed error messages
app.use((err, req, res, next) => {
  res.status(500).json({ error: err.stack });
});

// Fixed
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({ error: 'Internal server error' });
});

Types:

Stack traces in responses
Debug information in production
Verbose error messages
Internal paths exposed
Version information disclosure

Configuration

Misconfiguration (misconfiguration)

Severity: Varies Insecure default settings or missing security configurations. Examples:

Debug mode in production
Default credentials
Excessive permissions
Missing security headers
Disabled security features

// Vulnerable
app.use(cors()); // Allows all origins

// Fixed
app.use(cors({
  origin: ['https://example.com'],
  credentials: true
}));

Excessive Privileges (excessive-privileges)

Severity: Medium Code running with more permissions than necessary. Examples:

Running as root/admin unnecessarily
Overly broad IAM policies
File permissions too permissive

Supply Chain

Supply Chain Risk (supply-chain-risk)

Severity: Varies Risks from third-party dependencies. Detection includes:

Known vulnerable packages
Typosquatting package names
Packages with known malicious versions
Outdated dependencies with security patches

Mitigation:

Keep dependencies updated
Use lockfiles
Review new dependencies
Use security scanning for packages

Timing & Side Channels

Timing Side Channel (timing-side-channel)

Severity: Low Code vulnerable to timing attacks.

// Vulnerable - timing attack on password comparison
if (password === storedPassword) { /* ... */ }

// Fixed - constant-time comparison
crypto.timingSafeEqual(
  Buffer.from(password),
  Buffer.from(storedPassword)
);

Risk: Attackers can deduce secrets by measuring response times.

Memory Safety

Memory Safety (memory-safety)

Severity: High Memory-related vulnerabilities in languages like C/C++. Types:

Buffer overflows
Use-after-free
Double-free
Memory leaks with sensitive data

Summary Table

Category	Typical Severity	Key Risk
Hardcoded Secrets	High	Credential exposure
Weak Cryptography	Medium	Broken encryption
Weak Randomness	Medium	Predictable values
Insecure Transport	Medium	Data interception
Information Disclosure	Medium	Data leakage
Misconfiguration	Varies	Security bypass
Supply Chain Risk	Varies	Compromised dependencies
Timing Side Channel	Low	Secret disclosure

Attack Vulnerabilities

Exploitable threats

Security Overview

All categories

Issues

View findings

How It Works

Detection explained

Get Started

Dashboard

GitHub Integration

CLI

Security Categories

Settings

API Reference

Other Integrations

Compliance Issues

Secrets & Credentials

Hardcoded Secrets (hardcoded-secrets)

Cryptography

Weak Cryptography (weak-cryptography)

Weak Randomness (weak-randomness)

Transport Security

Insecure Transport (insecure-transport)

Information Disclosure

Information Disclosure (information-disclosure)

Configuration

Misconfiguration (misconfiguration)

Excessive Privileges (excessive-privileges)

Supply Chain

Supply Chain Risk (supply-chain-risk)

Timing & Side Channels

Timing Side Channel (timing-side-channel)

Memory Safety

Memory Safety (memory-safety)

Summary Table

Attack Vulnerabilities

Security Overview

Issues

How It Works

​Secrets & Credentials

​Hardcoded Secrets (hardcoded-secrets)

​Cryptography

​Weak Cryptography (weak-cryptography)

​Weak Randomness (weak-randomness)

​Transport Security

​Insecure Transport (insecure-transport)

​Information Disclosure

​Information Disclosure (information-disclosure)

​Configuration

​Misconfiguration (misconfiguration)

​Excessive Privileges (excessive-privileges)

​Supply Chain

​Supply Chain Risk (supply-chain-risk)

​Timing & Side Channels

​Timing Side Channel (timing-side-channel)

​Memory Safety

​Memory Safety (memory-safety)

​Summary Table

​Related Pages

Attack Vulnerabilities

Security Overview

Issues

How It Works

Secrets & Credentials

Hardcoded Secrets (hardcoded-secrets)

Cryptography

Weak Cryptography (weak-cryptography)

Weak Randomness (weak-randomness)

Transport Security

Insecure Transport (insecure-transport)

Information Disclosure

Information Disclosure (information-disclosure)

Configuration

Misconfiguration (misconfiguration)

Excessive Privileges (excessive-privileges)

Supply Chain

Supply Chain Risk (supply-chain-risk)

Timing & Side Channels

Timing Side Channel (timing-side-channel)

Memory Safety

Memory Safety (memory-safety)

Summary Table

Related Pages