> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vidocsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance Issues

> Security weaknesses and misconfigurations detected by Vidoc

Compliance issues are security weaknesses that may not be directly exploitable but weaken your security posture and violate security best practices.

## Secrets & Credentials

### Hardcoded Secrets (hardcoded-secrets)

**Severity:** High

Credentials, API keys, or tokens embedded in source code.

```javascript theme={null}
// Vulnerable
const apiKey = "sk-1234567890abcdef";
const dbPassword = "supersecret123";

// Fixed - use environment variables
const apiKey = process.env.API_KEY;
const dbPassword = process.env.DB_PASSWORD;
```

**Risk:** Credential exposure if code is leaked or shared.

**Detection:** Vidoc identifies patterns matching:

* API keys (AWS, GCP, Stripe, etc.)
* Database credentials
* JWT secrets
* OAuth tokens
* Private keys

## Cryptography

### Weak Cryptography (weak-cryptography)

**Severity:** Medium

Use of deprecated or weak cryptographic algorithms.

```javascript theme={null}
// Vulnerable
crypto.createHash('md5').update(data).digest();
crypto.createCipheriv('des', key, iv);

// Fixed
crypto.createHash('sha256').update(data).digest();
crypto.createCipheriv('aes-256-gcm', key, iv);
```

**Weak algorithms:**

* MD5, SHA1 (for security purposes)
* DES, 3DES, RC4
* RSA keys \< 2048 bits
* ECDSA keys \< 256 bits

***

### Weak Randomness (weak-randomness)

**Severity:** Medium

Using non-cryptographic random number generators for security purposes.

```javascript theme={null}
// Vulnerable
const token = Math.random().toString(36);

// Fixed
const token = crypto.randomBytes(32).toString('hex');
```

**Risk:** Predictable values can be guessed by attackers.

## Transport Security

### Insecure Transport (insecure-transport)

**Severity:** Medium

Data transmitted without encryption.

```javascript theme={null}
// Vulnerable
const url = 'http://api.example.com/data';

// Fixed
const url = 'https://api.example.com/data';
```

**Issues detected:**

* HTTP URLs for sensitive data
* Disabled SSL/TLS verification
* Weak TLS versions (TLS 1.0, 1.1)
* Missing HSTS headers

## Information Disclosure

### Information Disclosure (information-disclosure)

**Severity:** Medium

Code that may expose sensitive information.

```javascript theme={null}
// Vulnerable - detailed error messages
app.use((err, req, res, next) => {
  res.status(500).json({ error: err.stack });
});

// Fixed
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({ error: 'Internal server error' });
});
```

**Types:**

* Stack traces in responses
* Debug information in production
* Verbose error messages
* Internal paths exposed
* Version information disclosure

## Configuration

### Misconfiguration (misconfiguration)

**Severity:** Varies

Insecure default settings or missing security configurations.

**Examples:**

* Debug mode in production
* Default credentials
* Excessive permissions
* Missing security headers
* Disabled security features

```javascript theme={null}
// Vulnerable
app.use(cors()); // Allows all origins

// Fixed
app.use(cors({
  origin: ['https://example.com'],
  credentials: true
}));
```

***

### Excessive Privileges (excessive-privileges)

**Severity:** Medium

Code running with more permissions than necessary.

**Examples:**

* Running as root/admin unnecessarily
* Overly broad IAM policies
* File permissions too permissive

## Supply Chain

### Supply Chain Risk (supply-chain-risk)

**Severity:** Varies

Risks from third-party dependencies.

**Detection includes:**

* Known vulnerable packages
* Typosquatting package names
* Packages with known malicious versions
* Outdated dependencies with security patches

**Mitigation:**

* Keep dependencies updated
* Use lockfiles
* Review new dependencies
* Use security scanning for packages

## Timing & Side Channels

### Timing Side Channel (timing-side-channel)

**Severity:** Low

Code vulnerable to timing attacks.

```javascript theme={null}
// Vulnerable - timing attack on password comparison
if (password === storedPassword) { /* ... */ }

// Fixed - constant-time comparison
crypto.timingSafeEqual(
  Buffer.from(password),
  Buffer.from(storedPassword)
);
```

**Risk:** Attackers can deduce secrets by measuring response times.

## Memory Safety

### Memory Safety (memory-safety)

**Severity:** High

Memory-related vulnerabilities in languages like C/C++.

**Types:**

* Buffer overflows
* Use-after-free
* Double-free
* Memory leaks with sensitive data

## Summary Table

| Category               | Typical Severity | Key Risk                 |
| ---------------------- | ---------------- | ------------------------ |
| Hardcoded Secrets      | High             | Credential exposure      |
| Weak Cryptography      | Medium           | Broken encryption        |
| Weak Randomness        | Medium           | Predictable values       |
| Insecure Transport     | Medium           | Data interception        |
| Information Disclosure | Medium           | Data leakage             |
| Misconfiguration       | Varies           | Security bypass          |
| Supply Chain Risk      | Varies           | Compromised dependencies |
| Timing Side Channel    | Low              | Secret disclosure        |

## Related Pages

<CardGroup cols={2}>
  <Card title="Attack Vulnerabilities" icon="skull" href="/security/attack-vulnerabilities">
    Exploitable threats
  </Card>

  <Card title="Security Overview" icon="shield" href="/security/overview">
    All categories
  </Card>

  <Card title="Issues" icon="bug" href="/dashboard/issues">
    View findings
  </Card>

  <Card title="How It Works" icon="lightbulb" href="/how-it-works">
    Detection explained
  </Card>
</CardGroup>