Security Review Signals Checked by UCE

Explore 40 deterministic UCE security checks with evidence, severity, confidence, limitations, and remediation guidance.

UCE security findings are static review signals. They can include false positives and are not automatic proof of an exploitable vulnerability or a replacement for professional security testing.

This index contains 40 unique named catalog entries generated directly from the same versioned UCE knowledge used by the analyzer.

secrets (3)

Potential hardcoded credential

A non-placeholder credential-like value is assigned directly in source.

Support: Static analysis only. Evidence: Rule ID: SEC001; Severity: warning; Confidence: medium.

Recommendation: Confirm the value is sensitive, then move real secrets to environment variables or a managed secret store.
Private key material in source

A complete PEM private-key block is embedded in source.

Support: Static analysis only. Evidence: Rule ID: SEC008; Severity: warning; Confidence: medium.

Recommendation: Revoke and remove the key, then load replacement credentials from a secret store.
AWS access key identifier in source

A value matching an AWS access-key identifier is embedded in source.

Support: Static analysis only. Evidence: Rule ID: SEC009; Severity: warning; Confidence: medium.

Recommendation: Revoke the credential and use workload identity or managed secrets.

code-execution (4)

Dynamic code execution

Dynamic JavaScript code execution was detected.

Support: Static analysis only. Evidence: Rule ID: SEC002; Severity: warning; Confidence: medium.

Recommendation: Avoid eval/new Function and use explicit parsing or safe dispatch.
Process execution API requires review

A process execution API is used; arguments may require trust-boundary review.

Support: Static analysis only. Evidence: Rule ID: SEC003; Severity: warning; Confidence: medium.

Recommendation: Use fixed commands, argument arrays, and strict input validation.
Shell execution enabled

A child process is configured to execute through a shell.

Support: Static analysis only. Evidence: Rule ID: SEC011; Severity: warning; Confidence: medium.

Recommendation: Avoid shell mode; pass a fixed executable and validated argument array.
GitHub Actions untrusted script interpolation

Untrusted event data is interpolated directly into a shell command.

Support: Static analysis only. Evidence: Rule ID: SEC036; Severity: warning; Confidence: high.

Recommendation: Pass event data through an environment variable and quote it safely.

injection (2)

Unsafe HTML injection sink

Raw HTML is inserted into a document.

Support: Static analysis only. Evidence: Rule ID: SEC004; Severity: warning; Confidence: high.

Recommendation: Prefer escaped rendering and sanitize HTML that must be accepted.
Potential SQL string interpolation

A database query appears to be built through string interpolation or concatenation.

Support: Static analysis only. Evidence: Rule ID: SEC014; Severity: warning; Confidence: medium.

Recommendation: Use parameterized queries or prepared statements.

transport (3)

Non-HTTPS network endpoint

A non-HTTPS URL appears in a network call or endpoint configuration.

Support: Static analysis only. Evidence: Rule ID: SEC005; Severity: info; Confidence: medium.

Recommendation: Use HTTPS for production traffic and avoid sending secrets over HTTP.
TLS certificate verification disabled

TLS certificate verification is explicitly disabled.

Support: Static analysis only. Evidence: Rule ID: SEC010; Severity: warning; Confidence: medium.

Recommendation: Restore certificate verification and configure the correct trust chain.
TLS disabled in service configuration

TLS appears disabled in a service configuration; confirm its deployment context.

Support: Static analysis only. Evidence: Rule ID: SEC038; Severity: warning; Confidence: medium.

Recommendation: Enable certificate-validated TLS for non-local connections.

access-control (2)

Wildcard CORS policy

CORS appears to allow every origin.

Support: Static analysis only. Evidence: Rule ID: SEC006; Severity: warning; Confidence: high.

Recommendation: Restrict allowed origins to the domains required by the application.
Wildcard postMessage target

A cross-window message is sent to every origin.

Support: Static analysis only. Evidence: Rule ID: SEC013; Severity: warning; Confidence: high.

Recommendation: Specify the exact trusted target origin and validate received message origins.

information-exposure (2)

Debug logging in source

Debug logging may expose sensitive runtime data.

Support: Static analysis only. Evidence: Rule ID: SEC007; Severity: info; Confidence: medium.

Recommendation: Remove sensitive debug logs or gate them behind a development-only logger.
Detailed error exposed to client

An exception stack appears to be included in a client response.

Support: Static analysis only. Evidence: Rule ID: SEC040; Severity: info; Confidence: medium.

Recommendation: Return a stable public error and retain detailed diagnostics only in protected logs.

cryptography (3)

Weak randomness for security-sensitive value

Math.random() appears to generate a security-sensitive value.

Support: Static analysis only. Evidence: Rule ID: SEC012; Severity: warning; Confidence: medium.

Recommendation: Use crypto.getRandomValues() or a platform cryptographic random generator.
Legacy hash usage requires context review

MD5 or SHA-1 usage detected. Review the use: HMAC, non-security checksums and collision-resistant hashing have different requirements.

Support: Static analysis only. Evidence: Rule ID: SEC020; Severity: warning; Confidence: medium.

Recommendation: Determine the hash purpose and data flow. Prefer modern hashes where collision resistance is required; review HMAC protocol compatibility before changing algorithms. Use a password-hashing function for passwords.
Weak password hashing function

A general-purpose hash API appears near password material. Confirm the actual data flow.

Support: Static analysis only. Evidence: Rule ID: SEC028; Severity: warning; Confidence: medium.

Recommendation: If this hashes a password, use Argon2id, scrypt, or bcrypt with an appropriate work factor.

deserialization (5)

Python pickle deserialization requires trust review

A pickle deserialization call was detected. This pattern alone does not establish untrusted input or bypassed integrity verification.

Support: Static analysis only. Evidence: Rule ID: SEC015; Severity: warning; Confidence: medium.

Recommendation: Do not deserialize untrusted pickle data; use a constrained data format.
Potentially unsafe YAML loading

YAML is loaded without an evident safe loader.

Support: Static analysis only. Evidence: Rule ID: SEC016; Severity: warning; Confidence: medium.

Recommendation: Use yaml.safe_load() or explicitly select SafeLoader.
PHP object deserialization

PHP object deserialization requires strict trust-boundary review.

Support: Static analysis only. Evidence: Rule ID: SEC017; Severity: warning; Confidence: medium.

Recommendation: Avoid unserialize() for untrusted input and prefer JSON with schema validation.
BinaryFormatter usage

BinaryFormatter is an unsafe legacy deserialization API.

Support: Static analysis only. Evidence: Rule ID: SEC018; Severity: warning; Confidence: medium.

Recommendation: Replace BinaryFormatter with a safe, constrained serializer.
Java native object deserialization

Native Java object deserialization requires strict input controls.

Support: Static analysis only. Evidence: Rule ID: SEC019; Severity: warning; Confidence: medium.

Recommendation: Avoid deserializing untrusted objects; use allowlists and safer data formats.

path-traversal (2)

Potential path traversal input

A filesystem API appears to receive request-derived input.

Support: Static analysis only. Evidence: Rule ID: SEC021; Severity: warning; Confidence: medium.

Recommendation: Resolve against an allowlisted base directory and reject paths that escape it.
Predictable temporary file path requires review

A fixed or concatenated temporary path was found; actual creation mode and trust boundary were not established.

Support: Static analysis only. Evidence: Rule ID: SEC039; Severity: info; Confidence: low.

Recommendation: Review creation flags and ownership; use a secure random temporary-file API with exclusive creation where needed.

request-forgery (1)

Potential server-side request forgery

An outbound request target appears to originate from request input.

Support: Static analysis only. Evidence: Rule ID: SEC022; Severity: warning; Confidence: medium.

Recommendation: Allowlist protocols and destinations, block private networks, and validate redirects.

authentication (5)

JWT signature verification disabled

JWT signature verification appears disabled or the none algorithm is accepted.

Support: Static analysis only. Evidence: Rule ID: SEC023; Severity: warning; Confidence: medium.

Recommendation: Require signature verification and an explicit allowlist of strong algorithms.
JWT decoded without evident verification

A JWT-specific decode operation was found without local evidence of signature verification.

Support: Static analysis only. Evidence: Rule ID: SEC024; Severity: warning; Confidence: medium.

Recommendation: Use a verification API before trusting claims.
Cookie missing secure attributes

A cookie definition lacks evident Secure or HttpOnly attributes.

Support: Static analysis only. Evidence: Rule ID: SEC025; Severity: warning; Confidence: medium.

Recommendation: Set Secure, HttpOnly, and an appropriate SameSite policy for session cookies.
Password compared as plain text

Password material appears to be compared directly.

Support: Static analysis only. Evidence: Rule ID: SEC027; Severity: warning; Confidence: medium.

Recommendation: Compare a slow password hash with a constant-time library.
Session cookie over insecure transport

Session or cookie configuration explicitly disables Secure.

Support: Static analysis only. Evidence: Rule ID: SEC029; Severity: warning; Confidence: high.

Recommendation: Enable Secure in production and terminate traffic over HTTPS.

authorization (3)

Permissive authorization fallback

An authorization decision appears to default to allow.

Support: Static analysis only. Evidence: Rule ID: SEC026; Severity: warning; Confidence: medium.

Recommendation: Use deny-by-default authorization and test missing-identity cases.
Cloud IAM wildcard permission

A cloud policy grants wildcard action or resource scope.

Support: Static analysis only. Evidence: Rule ID: SEC035; Severity: warning; Confidence: high.

Recommendation: Apply least privilege with explicit actions and resources.
GitHub Actions write-all permission

The workflow grants write access to all token scopes.

Support: Static analysis only. Evidence: Rule ID: SEC037; Severity: warning; Confidence: high.

Recommendation: Declare the minimum read/write permissions required per job.

configuration (5)

CSRF protection explicitly disabled

CSRF protection appears explicitly disabled.

Support: Static analysis only. Evidence: Rule ID: SEC030; Severity: warning; Confidence: high.

Recommendation: Enable anti-CSRF controls for cookie-authenticated state changes.
Docker container runs as root

The container explicitly selects the root user.

Support: Static analysis only. Evidence: Rule ID: SEC031; Severity: warning; Confidence: medium.

Recommendation: Create and run as a dedicated non-root user.
Privileged container requested

A container is configured in privileged mode.

Support: Static analysis only. Evidence: Rule ID: SEC032; Severity: warning; Confidence: medium.

Recommendation: Remove privileged mode and grant only the required capabilities.
Kubernetes hostPath mount

A Kubernetes workload mounts a host filesystem path.

Support: Static analysis only. Evidence: Rule ID: SEC033; Severity: warning; Confidence: high.

Recommendation: Avoid hostPath or restrict it to a narrow read-only path.
Kubernetes service account token mounted

A pod explicitly mounts its service-account token.

Support: Static analysis only. Evidence: Rule ID: SEC034; Severity: info; Confidence: medium.

Recommendation: Disable token mounting unless the workload calls the Kubernetes API.

Analyze a project with UCE