# Zennoxa Shield — full reference

> Zennoxa Shield is a developer-first code security scanner. One scan runs multiple layers over your repository: static analysis (SAST), secret detection, dependency, container and infrastructure-as-code checks, and a live-endpoint DAST pre-check, then ranks every finding by real-world risk using reachability analysis and a priority score, so you fix what actually matters first. Connect GitHub, GitLab or Bitbucket. Free during beta.

This file is the expanded companion to https://zennoxa.com/llms.txt. It is generated from the same data files that render zennoxa.com, so every number here matches the live site.

## What it does
- Static analysis (SAST)
- Secret detection
- Dependency scanning
- Container image scanning
- Infrastructure-as-Code (IaC) scanning
- DAST pre-check (live-endpoint security headers, TLS & exposure — not full crawling)
- Reachability analysis: is the vulnerable code actually reachable
- Risk-based priority scoring
- Code quality grade
- GitHub, GitLab & Bitbucket integration (public or private repos)
- CLI and web dashboard

## Capability numbers
- 9 analysis layers run in a single scan (SAST, secrets, dependencies/SCA, containers, IaC, DAST pre-check, license, reachability, code-quality grade)
- 340 detection rules in the engine; the 221 rules below have public documentation pages
- 24 languages scanned (14 with comprehensive rule coverage)
- Dependency scanning: 10 package ecosystems, 18 manifest/lockfile formats
- 27 secret detectors, 25 container-image checks, 16 Infrastructure-as-Code checks

## Measured accuracy (published, reproducible)
We publish our own benchmark results, including the categories we are weak in. Details and methodology: https://zennoxa.com/benchmark — evidence and raw data: https://zennoxa.com/evidence

OWASP Benchmark v1.2 (Java, 2,740 test cases), measured on pinned release v0.3.0:
- Youden's J score: 0.582
- Precision: 92.5%
- Recall: 64%
- CI fails our own build if the score drops below 0.44

Per-category Youden’s J on that benchmark (high to low, including the weak ones):
- weak random: 1.0
- insecure cookie: 1.0
- crypto: 0.808
- hash: 0.69
- XSS: 0.516
- LDAP injection: 0.499
- XPath injection: 0.467
- command injection: 0.451
- path traversal: 0.445
- SQL injection: 0.303 (our current laggard)
- trust boundary: 0.237

Dependency-scanning spot check on a real vulnerable app: 9/9 real CVEs surfaced, 95.5% precision.

## Honest limits
- The scanning engine is rule-based, not AI-generated: findings come from Shield’s own rules. AI is used only to write plain-language explanations and suggested fixes that a human reviews before applying — never to invent findings.
- The DAST layer is a live-endpoint pre-check (security headers, TLS, exposure), not a full crawling DAST.
- Weakest benchmark categories right now: SQL injection and trust boundary (scores above). We publish these instead of hiding them.
- Shield does not resell or expose a third-party CVE vulnerability database.

## Install and run the CLI (no account required)
```
curl -sSL https://zennoxa.com/install | sh
# or: brew install zennoxa/tap/shield
shield scan .
```
- Source of the installer: https://zennoxa.com/install — releases and checksums: https://github.com/Zennoxa/shield/releases
- The CLI runs offline on your machine; scanned code never leaves it.

## Pricing
- Free during beta. The hosted dashboard free plan covers 5 repositories; the CLI is free with no account and no repository cap.

## FAQ
### What is Zennoxa Shield?
Zennoxa Shield is a developer-first code security scanner. One scan runs multiple layers over your repository and ranks every finding by real-world risk so you fix what actually matters first.

### What does Zennoxa Shield scan for?
It runs static analysis (SAST), secret detection, dependency checks, container image scanning, Infrastructure-as-Code (IaC) checks, and a live-endpoint DAST pre-check, all in a single scan.

### How is it different from other security scanners?
Instead of a wall of severity labels, Shield uses reachability analysis and a priority score to rank findings by real-world risk, so the handful that actually matter float to the top.

### Which repositories does it support?
GitHub, GitLab, and Bitbucket, public or private. You can also run scans from the command line.

### How much does Zennoxa Shield cost?
It is free during beta. There is no signup paywall right now.

### Do I need a security team to use it?
No. Shield is built for developers and small teams that do not have a dedicated security team.

## Key pages
- Product overview: https://zennoxa.com/
- Features in depth: https://zennoxa.com/features
- Benchmark methodology and results: https://zennoxa.com/benchmark
- User guide (English and Thai): https://zennoxa.com/guide
- Documentation (dashboard, CLI, API): https://zennoxa.com/docs
- Security research studies: https://zennoxa.com/research (RSS: https://zennoxa.com/research/rss.xml)
- AppSec glossary: https://zennoxa.com/glossary
- Rule catalog: https://zennoxa.com/rules
- Comparisons: https://zennoxa.com/compare

## Documented detection rules (221)

### Ruby (23)
- SHIELD-RUBY-001 — SQL injection via string interpolation in where (critical, CWE-89): https://zennoxa.com/rules/shield-ruby-001
- SHIELD-RUBY-002 — SQL injection via find_by_sql interpolation (critical, CWE-89): https://zennoxa.com/rules/shield-ruby-002
- SHIELD-RUBY-003 — SQL injection via execute interpolation (critical, CWE-89): https://zennoxa.com/rules/shield-ruby-003
- SHIELD-RUBY-004 — Command injection via system or exec with interpolation (critical, CWE-78): https://zennoxa.com/rules/shield-ruby-004
- SHIELD-RUBY-005 — Command injection via backticks or %x with interpolation (critical, CWE-78): https://zennoxa.com/rules/shield-ruby-005
- SHIELD-RUBY-006 — Command injection via Open3 or spawn with variable (high, CWE-78): https://zennoxa.com/rules/shield-ruby-006
- SHIELD-RUBY-007 — Code injection via eval (critical, CWE-95): https://zennoxa.com/rules/shield-ruby-007
- SHIELD-RUBY-008 — Code injection via instance_eval or class_eval (high, CWE-95): https://zennoxa.com/rules/shield-ruby-008
- SHIELD-RUBY-009 — Unsafe method dispatch via send with user input (high, CWE-94): https://zennoxa.com/rules/shield-ruby-009
- SHIELD-RUBY-010 — Mass assignment via permit bang (high, CWE-915): https://zennoxa.com/rules/shield-ruby-010
- SHIELD-RUBY-011 — Mass assignment via update with raw params (high, CWE-915): https://zennoxa.com/rules/shield-ruby-011
- SHIELD-RUBY-012 — Unsafe deserialization via Marshal.load (critical, CWE-502): https://zennoxa.com/rules/shield-ruby-012
- SHIELD-RUBY-013 — Unsafe deserialization via YAML.load or Oj object mode (critical, CWE-502): https://zennoxa.com/rules/shield-ruby-013
- SHIELD-RUBY-014 — SSRF via open-uri or Net::HTTP with variable URL (high, CWE-918): https://zennoxa.com/rules/shield-ruby-014
- SHIELD-RUBY-015 — Path traversal via File or send_file with params (high, CWE-22): https://zennoxa.com/rules/shield-ruby-015
- SHIELD-RUBY-016 — XSS via raw or html_safe on dynamic data (high, CWE-79): https://zennoxa.com/rules/shield-ruby-016
- SHIELD-RUBY-017 — XSS via unescaped ERB output tag (high, CWE-79): https://zennoxa.com/rules/shield-ruby-017
- SHIELD-RUBY-018 — Weak hashing with MD5 or SHA1 (medium, CWE-327): https://zennoxa.com/rules/shield-ruby-018
- SHIELD-RUBY-019 — Hardcoded secret or password (high, CWE-798): https://zennoxa.com/rules/shield-ruby-019
- SHIELD-RUBY-020 — Insecure randomness for tokens (medium, CWE-330): https://zennoxa.com/rules/shield-ruby-020
- SHIELD-RUBY-021 — Open redirect via redirect_to with params (medium, CWE-601): https://zennoxa.com/rules/shield-ruby-021
- SHIELD-RUBY-022 — Remote code execution via constantize with user input (high, CWE-470): https://zennoxa.com/rules/shield-ruby-022
- SHIELD-RUBY-023 — Regex denial of service via interpolated pattern (medium, CWE-1333): https://zennoxa.com/rules/shield-ruby-023

### JavaScript / TypeScript (22)
- SHIELD-JS-001 — SQL Injection via string concatenation (critical, CWE-89): https://zennoxa.com/rules/shield-js-001
- SHIELD-JS-002 — SQL Injection via template literal (critical, CWE-89): https://zennoxa.com/rules/shield-js-002
- SHIELD-JS-003 — Cross-Site Scripting (XSS) via innerHTML (high, CWE-79): https://zennoxa.com/rules/shield-js-003
- SHIELD-JS-004 — Cross-Site Scripting (XSS) via document.write (high, CWE-79): https://zennoxa.com/rules/shield-js-004
- SHIELD-JS-005 — Dangerous eval() usage (critical, CWE-95): https://zennoxa.com/rules/shield-js-005
- SHIELD-JS-006 — Dangerous Function() constructor (high, CWE-95): https://zennoxa.com/rules/shield-js-006
- SHIELD-JS-007 — Prototype pollution via merge/assign (high, CWE-1321): https://zennoxa.com/rules/shield-js-007
- SHIELD-JS-008 — Path traversal via user input (high, CWE-22): https://zennoxa.com/rules/shield-js-008
- SHIELD-JS-009 — Command injection via exec/spawn (critical, CWE-78): https://zennoxa.com/rules/shield-js-009
- SHIELD-JS-010 — Insecure random number generation (medium, CWE-338): https://zennoxa.com/rules/shield-js-010
- SHIELD-JS-011 — Hardcoded password or secret (high, CWE-798): https://zennoxa.com/rules/shield-js-011
- SHIELD-JS-012 — Insecure HTTP usage (non-HTTPS) (medium, CWE-319): https://zennoxa.com/rules/shield-js-012
- SHIELD-JS-013 — Open redirect via res.redirect (medium, CWE-601): https://zennoxa.com/rules/shield-js-013
- SHIELD-JS-014 — Disabled TLS/SSL certificate verification (high, CWE-295): https://zennoxa.com/rules/shield-js-014
- SHIELD-JS-015 — Sensitive data in console.log (medium, CWE-532): https://zennoxa.com/rules/shield-js-015
- SHIELD-JS-016 — Server-Side Request Forgery (SSRF) via user-controlled URL (high, CWE-918): https://zennoxa.com/rules/shield-js-016
- SHIELD-JS-017 — Regex Denial of Service (ReDoS) — catastrophic backtracking (medium, CWE-1333): https://zennoxa.com/rules/shield-js-017
- SHIELD-JS-018 — Insecure deserialization (node-serialize) (critical, CWE-502): https://zennoxa.com/rules/shield-js-018
- SHIELD-JS-019 — XML External Entity (XXE) — entity expansion enabled (high, CWE-611): https://zennoxa.com/rules/shield-js-019
- SHIELD-JS-020 — NoSQL injection via user-controlled query object (high, CWE-943): https://zennoxa.com/rules/shield-js-020
- SHIELD-JS-021 — Weak hash (MD5) used for a security value (high, CWE-916): https://zennoxa.com/rules/shield-js-021
- SHIELD-JS-022 — Cookie set without HttpOnly/Secure flags (medium, CWE-1004): https://zennoxa.com/rules/shield-js-022

### C/C++ (21)
- SHIELD-CPP-001 — Unbounded strcpy buffer overflow (high, CWE-120): https://zennoxa.com/rules/shield-cpp-001
- SHIELD-CPP-002 — Unbounded strcat buffer overflow (high, CWE-120): https://zennoxa.com/rules/shield-cpp-002
- SHIELD-CPP-003 — Unbounded sprintf buffer overflow (high, CWE-120): https://zennoxa.com/rules/shield-cpp-003
- SHIELD-CPP-004 — Use of gets is inherently unsafe (critical, CWE-242): https://zennoxa.com/rules/shield-cpp-004
- SHIELD-CPP-005 — Unbounded scanf %s read (high, CWE-120): https://zennoxa.com/rules/shield-cpp-005
- SHIELD-CPP-006 — Non-constant format string (high, CWE-134): https://zennoxa.com/rules/shield-cpp-006
- SHIELD-CPP-007 — Non-constant format string with stream target (high, CWE-134): https://zennoxa.com/rules/shield-cpp-007
- SHIELD-CPP-008 — Command injection via system (critical, CWE-78): https://zennoxa.com/rules/shield-cpp-008
- SHIELD-CPP-009 — Command injection via popen (critical, CWE-78): https://zennoxa.com/rules/shield-cpp-009
- SHIELD-CPP-010 — Exec with untrusted path (high, CWE-78): https://zennoxa.com/rules/shield-cpp-010
- SHIELD-CPP-011 — Integer overflow in malloc size (medium, CWE-190): https://zennoxa.com/rules/shield-cpp-011
- SHIELD-CPP-012 — Dangerous alloca or VLA with variable size (medium, CWE-770): https://zennoxa.com/rules/shield-cpp-012
- SHIELD-CPP-013 — Weak cryptographic primitive (high, CWE-327): https://zennoxa.com/rules/shield-cpp-013
- SHIELD-CPP-014 — Insecure ECB cipher mode (high, CWE-327): https://zennoxa.com/rules/shield-cpp-014
- SHIELD-CPP-015 — Hardcoded credential literal (high, CWE-798): https://zennoxa.com/rules/shield-cpp-015
- SHIELD-CPP-016 — Insecure temporary file creation (medium, CWE-377): https://zennoxa.com/rules/shield-cpp-016
- SHIELD-CPP-017 — File open with untrusted path (medium, CWE-22): https://zennoxa.com/rules/shield-cpp-017
- SHIELD-CPP-018 — TOCTOU race with access then open (medium, CWE-367): https://zennoxa.com/rules/shield-cpp-018
- SHIELD-CPP-019 — memcpy with unchecked length (high, CWE-120): https://zennoxa.com/rules/shield-cpp-019
- SHIELD-CPP-020 — strncpy without null termination (medium, CWE-170): https://zennoxa.com/rules/shield-cpp-020
- SHIELD-CPP-021 — Insecure random for security tokens (high, CWE-338): https://zennoxa.com/rules/shield-cpp-021

### C# (21)
- SHIELD-CSHARP-001 — SQL injection via string concatenation in SqlCommand (critical, CWE-89): https://zennoxa.com/rules/shield-csharp-001
- SHIELD-CSHARP-002 — SQL injection via string.Format or interpolation into query (critical, CWE-89): https://zennoxa.com/rules/shield-csharp-002
- SHIELD-CSHARP-003 — SQL injection via ExecuteReader on interpolated string (critical, CWE-89): https://zennoxa.com/rules/shield-csharp-003
- SHIELD-CSHARP-004 — Command injection via Process.Start with concatenation (critical, CWE-78): https://zennoxa.com/rules/shield-csharp-004
- SHIELD-CSHARP-005 — Command injection via ProcessStartInfo.Arguments from variable (high, CWE-78): https://zennoxa.com/rules/shield-csharp-005
- SHIELD-CSHARP-006 — Insecure deserialization via BinaryFormatter and similar formatters (critical, CWE-502): https://zennoxa.com/rules/shield-csharp-006
- SHIELD-CSHARP-007 — Insecure deserialization via Json.NET TypeNameHandling (critical, CWE-502): https://zennoxa.com/rules/shield-csharp-007
- SHIELD-CSHARP-008 — Insecure deserialization via JavaScriptSerializer SimpleTypeResolver (high, CWE-502): https://zennoxa.com/rules/shield-csharp-008
- SHIELD-CSHARP-009 — XXE via unsafe DtdProcessing or XmlResolver (high, CWE-611): https://zennoxa.com/rules/shield-csharp-009
- SHIELD-CSHARP-010 — XXE via XmlTextReader without resolver hardening (high, CWE-611): https://zennoxa.com/rules/shield-csharp-010
- SHIELD-CSHARP-011 — Weak or broken cryptographic algorithm (high, CWE-327): https://zennoxa.com/rules/shield-csharp-011
- SHIELD-CSHARP-012 — Insecure ECB cipher mode (high, CWE-327): https://zennoxa.com/rules/shield-csharp-012
- SHIELD-CSHARP-013 — Path traversal from request input into file API (high, CWE-22): https://zennoxa.com/rules/shield-csharp-013
- SHIELD-CSHARP-014 — SSRF via request from variable-controlled URL (high, CWE-918): https://zennoxa.com/rules/shield-csharp-014
- SHIELD-CSHARP-015 — Hardcoded credential in source (high, CWE-798): https://zennoxa.com/rules/shield-csharp-015
- SHIELD-CSHARP-016 — Insecure random used for security tokens (medium, CWE-338): https://zennoxa.com/rules/shield-csharp-016
- SHIELD-CSHARP-017 — LDAP injection via DirectorySearcher filter (high, CWE-90): https://zennoxa.com/rules/shield-csharp-017
- SHIELD-CSHARP-018 — Reflected XSS via Response.Write or Html.Raw (high, CWE-79): https://zennoxa.com/rules/shield-csharp-018
- SHIELD-CSHARP-019 — Trust-all TLS certificate validation (high, CWE-295): https://zennoxa.com/rules/shield-csharp-019
- SHIELD-CSHARP-020 — Open redirect from request input (medium, CWE-601): https://zennoxa.com/rules/shield-csharp-020
- SHIELD-CSHARP-021 — Unsafe reflection from user-controlled type name (high, CWE-470): https://zennoxa.com/rules/shield-csharp-021

### Java (18)
- SHIELD-JAVA-001 — SQL Injection via String Concatenation (critical, CWE-89): https://zennoxa.com/rules/shield-java-001
- SHIELD-JAVA-002 — OS Command Injection via Runtime.exec (critical, CWE-78): https://zennoxa.com/rules/shield-java-002
- SHIELD-JAVA-003 — OS Command Injection via ProcessBuilder (critical, CWE-78): https://zennoxa.com/rules/shield-java-003
- SHIELD-JAVA-004 — Insecure Java Deserialization (critical, CWE-502): https://zennoxa.com/rules/shield-java-004
- SHIELD-JAVA-005 — Insecure Deserialization via XMLDecoder (critical, CWE-502): https://zennoxa.com/rules/shield-java-005
- SHIELD-JAVA-006 — XXE via DocumentBuilderFactory (high, CWE-611): https://zennoxa.com/rules/shield-java-006
- SHIELD-JAVA-007 — XXE via SAXParserFactory (high, CWE-611): https://zennoxa.com/rules/shield-java-007
- SHIELD-JAVA-008 — Weak Cipher Algorithm (high, CWE-327): https://zennoxa.com/rules/shield-java-008
- SHIELD-JAVA-009 — Weak Hash Algorithm (medium, CWE-328): https://zennoxa.com/rules/shield-java-009
- SHIELD-JAVA-010 — Hardcoded Credentials (high, CWE-798): https://zennoxa.com/rules/shield-java-010
- SHIELD-JAVA-011 — Path Traversal via File Construction (high, CWE-22): https://zennoxa.com/rules/shield-java-011
- SHIELD-JAVA-012 — SSRF via URL openConnection (high, CWE-918): https://zennoxa.com/rules/shield-java-012
- SHIELD-JAVA-013 — LDAP Injection via Concatenated Filter (high, CWE-90): https://zennoxa.com/rules/shield-java-013
- SHIELD-JAVA-014 — Trust-All TLS HostnameVerifier (critical, CWE-295): https://zennoxa.com/rules/shield-java-014
- SHIELD-JAVA-015 — Insecure Randomness for Security Tokens (medium, CWE-330): https://zennoxa.com/rules/shield-java-015
- SHIELD-JAVA-016 — Unsafe Reflection via Class.forName with Variable (high, CWE-470): https://zennoxa.com/rules/shield-java-016
- SHIELD-JAVA-017 — SpEL or OGNL Expression Injection (critical, CWE-917): https://zennoxa.com/rules/shield-java-017
- SHIELD-JAVA-018 — Log4Shell JNDI Lookup Injection (critical, CWE-917): https://zennoxa.com/rules/shield-java-018

### Kotlin (18)
- SHIELD-KOTLIN-001 — SQL injection via string interpolation in rawQuery/execSQL (critical, CWE-89): https://zennoxa.com/rules/shield-kotlin-001
- SHIELD-KOTLIN-002 — SQL injection via string concatenation in query APIs (critical, CWE-89): https://zennoxa.com/rules/shield-kotlin-002
- SHIELD-KOTLIN-003 — Command injection via Runtime.exec with variable (critical, CWE-78): https://zennoxa.com/rules/shield-kotlin-003
- SHIELD-KOTLIN-004 — Command injection via ProcessBuilder with variable (critical, CWE-78): https://zennoxa.com/rules/shield-kotlin-004
- SHIELD-KOTLIN-005 — WebView addJavascriptInterface exposes native code to JS (high, CWE-749): https://zennoxa.com/rules/shield-kotlin-005
- SHIELD-KOTLIN-006 — JavaScript injection via WebView loadUrl/evaluateJavascript (high, CWE-79): https://zennoxa.com/rules/shield-kotlin-006
- SHIELD-KOTLIN-007 — Insecure deserialization via ObjectInputStream.readObject (critical, CWE-502): https://zennoxa.com/rules/shield-kotlin-007
- SHIELD-KOTLIN-008 — Weak or ECB-mode cipher via Cipher.getInstance (high, CWE-327): https://zennoxa.com/rules/shield-kotlin-008
- SHIELD-KOTLIN-009 — Weak hash algorithm via MessageDigest.getInstance (medium, CWE-327): https://zennoxa.com/rules/shield-kotlin-009
- SHIELD-KOTLIN-010 — Hardcoded secret in source (high, CWE-798): https://zennoxa.com/rules/shield-kotlin-010
- SHIELD-KOTLIN-011 — Path traversal via File/FileInputStream with request input (high, CWE-22): https://zennoxa.com/rules/shield-kotlin-011
- SHIELD-KOTLIN-012 — SSRF via URL(variable).openConnection (high, CWE-918): https://zennoxa.com/rules/shield-kotlin-012
- SHIELD-KOTLIN-013 — Insecure random used for security tokens (medium, CWE-338): https://zennoxa.com/rules/shield-kotlin-013
- SHIELD-KOTLIN-014 — Trust-all TrustManager or HostnameVerifier disables TLS validation (critical, CWE-295): https://zennoxa.com/rules/shield-kotlin-014
- SHIELD-KOTLIN-015 — World-readable or world-writable file mode (high, CWE-732): https://zennoxa.com/rules/shield-kotlin-015
- SHIELD-KOTLIN-016 — Sensitive data logged via Log statements (medium, CWE-532): https://zennoxa.com/rules/shield-kotlin-016
- SHIELD-KOTLIN-017 — Password stored in plaintext SharedPreferences (high, CWE-312): https://zennoxa.com/rules/shield-kotlin-017
- SHIELD-KOTLIN-018 — WebView JavaScript enabled with file access (high, CWE-749): https://zennoxa.com/rules/shield-kotlin-018

### PHP (18)
- SHIELD-PHP-001 — SQL injection via string concatenation or interpolation (critical, CWE-89): https://zennoxa.com/rules/shield-php-001
- SHIELD-PHP-002 — SQL injection via mysql_query with user input (critical, CWE-89): https://zennoxa.com/rules/shield-php-002
- SHIELD-PHP-003 — OS command injection via shell execution functions (critical, CWE-78): https://zennoxa.com/rules/shield-php-003
- SHIELD-PHP-004 — Command injection via backtick shell operator (critical, CWE-78): https://zennoxa.com/rules/shield-php-004
- SHIELD-PHP-005 — Code injection via eval or assert on variables (critical, CWE-95): https://zennoxa.com/rules/shield-php-005
- SHIELD-PHP-006 — Code injection via preg_replace /e modifier (critical, CWE-95): https://zennoxa.com/rules/shield-php-006
- SHIELD-PHP-007 — File inclusion (LFI/RFI) via dynamic path (critical, CWE-98): https://zennoxa.com/rules/shield-php-007
- SHIELD-PHP-008 — Reflected XSS via echo of request data (high, CWE-79): https://zennoxa.com/rules/shield-php-008
- SHIELD-PHP-009 — Unsafe deserialization of user input (critical, CWE-502): https://zennoxa.com/rules/shield-php-009
- SHIELD-PHP-010 — Path traversal via file read with request data (high, CWE-22): https://zennoxa.com/rules/shield-php-010
- SHIELD-PHP-011 — Server-side request forgery via dynamic URL (high, CWE-918): https://zennoxa.com/rules/shield-php-011
- SHIELD-PHP-012 — Weak hashing algorithm for passwords (high, CWE-916): https://zennoxa.com/rules/shield-php-012
- SHIELD-PHP-013 — Insecure legacy encryption (mcrypt DES/ECB) (high, CWE-327): https://zennoxa.com/rules/shield-php-013
- SHIELD-PHP-014 — Hardcoded credentials in source (high, CWE-798): https://zennoxa.com/rules/shield-php-014
- SHIELD-PHP-015 — Insecure randomness for security tokens (medium, CWE-338): https://zennoxa.com/rules/shield-php-015
- SHIELD-PHP-016 — Type juggling in loose comparison of hashes (high, CWE-697): https://zennoxa.com/rules/shield-php-016
- SHIELD-PHP-017 — HTTP header injection via dynamic header value (medium, CWE-113): https://zennoxa.com/rules/shield-php-017
- SHIELD-PHP-018 — Variable overwrite via extract on request data (high, CWE-621): https://zennoxa.com/rules/shield-php-018

### Python (17)
- SHIELD-PY-001 — SQL Injection via string formatting (critical, CWE-89): https://zennoxa.com/rules/shield-py-001
- SHIELD-PY-002 — SQL Injection via f-string interpolation (critical, CWE-89): https://zennoxa.com/rules/shield-py-002
- SHIELD-PY-003 — Dangerous pickle deserialization (critical, CWE-502): https://zennoxa.com/rules/shield-py-003
- SHIELD-PY-004 — Dangerous exec() usage (critical, CWE-95): https://zennoxa.com/rules/shield-py-004
- SHIELD-PY-005 — Shell injection via os.system (critical, CWE-78): https://zennoxa.com/rules/shield-py-005
- SHIELD-PY-006 — Shell injection via subprocess with shell=True (high, CWE-78): https://zennoxa.com/rules/shield-py-006
- SHIELD-PY-007 — Server-Side Request Forgery (SSRF) via requests with user input (high, CWE-918): https://zennoxa.com/rules/shield-py-007
- SHIELD-PY-008 — Insecure use of eval() (critical, CWE-95): https://zennoxa.com/rules/shield-py-008
- SHIELD-PY-009 — Path traversal via open() (high, CWE-22): https://zennoxa.com/rules/shield-py-009
- SHIELD-PY-010 — Weak MD5 or SHA1 hash usage (medium, CWE-327): https://zennoxa.com/rules/shield-py-010
- SHIELD-PY-011 — Hardcoded password or secret (high, CWE-798): https://zennoxa.com/rules/shield-py-011
- SHIELD-PY-012 — Flask debug mode enabled (high, CWE-94): https://zennoxa.com/rules/shield-py-012
- SHIELD-PY-013 — YAML deserialization with yaml.load (unsafe) (high, CWE-502): https://zennoxa.com/rules/shield-py-013
- SHIELD-PY-014 — Insecure random number for security purposes (medium, CWE-338): https://zennoxa.com/rules/shield-py-014
- SHIELD-PY-015 — XML External Entity (XXE) injection (high, CWE-611): https://zennoxa.com/rules/shield-py-015
- SHIELD-PY-016 — Insecure deserialization with marshal (high, CWE-502): https://zennoxa.com/rules/shield-py-016
- SHIELD-PY-017 — Timing attack in string comparison (medium, CWE-208): https://zennoxa.com/rules/shield-py-017

### Swift (17)
- SHIELD-SWIFT-001 — SQL injection via string interpolation (critical, CWE-89): https://zennoxa.com/rules/shield-swift-001
- SHIELD-SWIFT-002 — SQL injection via string concatenation (critical, CWE-89): https://zennoxa.com/rules/shield-swift-002
- SHIELD-SWIFT-003 — Command injection via Process arguments (critical, CWE-78): https://zennoxa.com/rules/shield-swift-003
- SHIELD-SWIFT-004 — Command injection via system call (critical, CWE-78): https://zennoxa.com/rules/shield-swift-004
- SHIELD-SWIFT-005 — WebView JavaScript injection (high, CWE-79): https://zennoxa.com/rules/shield-swift-005
- SHIELD-SWIFT-006 — WebView HTML injection via loadHTMLString (high, CWE-79): https://zennoxa.com/rules/shield-swift-006
- SHIELD-SWIFT-007 — Weak hash for password (high, CWE-327): https://zennoxa.com/rules/shield-swift-007
- SHIELD-SWIFT-008 — Insecure DES or ECB cipher (high, CWE-327): https://zennoxa.com/rules/shield-swift-008
- SHIELD-SWIFT-009 — Hardcoded secret in source (high, CWE-798): https://zennoxa.com/rules/shield-swift-009
- SHIELD-SWIFT-010 — Insecure TLS trust bypass (critical, CWE-295): https://zennoxa.com/rules/shield-swift-010
- SHIELD-SWIFT-011 — Arbitrary insecure HTTP loads allowed (high, CWE-319): https://zennoxa.com/rules/shield-swift-011
- SHIELD-SWIFT-012 — Sensitive data stored in UserDefaults (high, CWE-922): https://zennoxa.com/rules/shield-swift-012
- SHIELD-SWIFT-013 — Path traversal via file read (high, CWE-22): https://zennoxa.com/rules/shield-swift-013
- SHIELD-SWIFT-014 — SSRF via dynamic URL request (high, CWE-918): https://zennoxa.com/rules/shield-swift-014
- SHIELD-SWIFT-015 — Insecure random for security token (high, CWE-338): https://zennoxa.com/rules/shield-swift-015
- SHIELD-SWIFT-016 — Sensitive data copied to pasteboard (medium, CWE-200): https://zennoxa.com/rules/shield-swift-016
- SHIELD-SWIFT-017 — Keychain item without access control (medium, CWE-311): https://zennoxa.com/rules/shield-swift-017

### Rust (15)
- SHIELD-RUST-001 — SQL injection via format! in query (critical, CWE-89): https://zennoxa.com/rules/shield-rust-001
- SHIELD-RUST-002 — SQL injection via diesel sql_query with format! (critical, CWE-89): https://zennoxa.com/rules/shield-rust-002
- SHIELD-RUST-003 — SQL injection via string concatenation (high, CWE-89): https://zennoxa.com/rules/shield-rust-003
- SHIELD-RUST-004 — Command injection via interpolated argument (critical, CWE-78): https://zennoxa.com/rules/shield-rust-004
- SHIELD-RUST-005 — Command execution via shell interpreter (critical, CWE-78): https://zennoxa.com/rules/shield-rust-005
- SHIELD-RUST-006 — Unsafe block requires review (medium, CWE-119): https://zennoxa.com/rules/shield-rust-006
- SHIELD-RUST-007 — Insecure deserialization of untrusted bytes (medium, CWE-502): https://zennoxa.com/rules/shield-rust-007
- SHIELD-RUST-008 — Weak cryptographic hash (high, CWE-327): https://zennoxa.com/rules/shield-rust-008
- SHIELD-RUST-009 — Hardcoded credential (high, CWE-798): https://zennoxa.com/rules/shield-rust-009
- SHIELD-RUST-010 — Insecure randomness for security value (medium, CWE-338): https://zennoxa.com/rules/shield-rust-010
- SHIELD-RUST-011 — SSRF via user-controlled request URL (high, CWE-918): https://zennoxa.com/rules/shield-rust-011
- SHIELD-RUST-012 — Path traversal via user-controlled file path (high, CWE-22): https://zennoxa.com/rules/shield-rust-012
- SHIELD-RUST-013 — TLS certificate verification disabled (critical, CWE-295): https://zennoxa.com/rules/shield-rust-013
- SHIELD-RUST-014 — Potential integer overflow in allocation size (low, CWE-190): https://zennoxa.com/rules/shield-rust-014
- SHIELD-RUST-015 — SQL statement built with format! (high, CWE-89): https://zennoxa.com/rules/shield-rust-015

### Dart (14)
- SHIELD-DART-001 — SQL injection via raw query interpolation (critical, CWE-89): https://zennoxa.com/rules/shield-dart-001
- SHIELD-DART-002 — Command injection via shell process execution (critical, CWE-78): https://zennoxa.com/rules/shield-dart-002
- SHIELD-DART-003 — Command injection via interpolated process arguments (high, CWE-78): https://zennoxa.com/rules/shield-dart-003
- SHIELD-DART-004 — WebView JavaScript injection (high, CWE-79): https://zennoxa.com/rules/shield-dart-004
- SHIELD-DART-005 — Insecure certificate validation bypass (critical, CWE-295): https://zennoxa.com/rules/shield-dart-005
- SHIELD-DART-006 — Insecure cleartext HTTP endpoint (medium, CWE-319): https://zennoxa.com/rules/shield-dart-006
- SHIELD-DART-007 — Weak cryptographic hash (high, CWE-327): https://zennoxa.com/rules/shield-dart-007
- SHIELD-DART-008 — Hardcoded secret credential (high, CWE-798): https://zennoxa.com/rules/shield-dart-008
- SHIELD-DART-009 — Sensitive data in insecure storage (high, CWE-312): https://zennoxa.com/rules/shield-dart-009
- SHIELD-DART-010 — Path traversal via unsanitized file path (high, CWE-22): https://zennoxa.com/rules/shield-dart-010
- SHIELD-DART-011 — SSRF via user-controlled request URL (high, CWE-918): https://zennoxa.com/rules/shield-dart-011
- SHIELD-DART-012 — Insecure random for security tokens (medium, CWE-338): https://zennoxa.com/rules/shield-dart-012
- SHIELD-DART-013 — Sensitive data logged to console (medium, CWE-532): https://zennoxa.com/rules/shield-dart-013
- SHIELD-DART-014 — WebView with unrestricted JavaScript mode (high, CWE-749): https://zennoxa.com/rules/shield-dart-014

### Go (12)
- SHIELD-GO-001 — SQL Injection via string formatting (critical, CWE-89): https://zennoxa.com/rules/shield-go-001
- SHIELD-GO-002 — SQL Injection via string concatenation (critical, CWE-89): https://zennoxa.com/rules/shield-go-002
- SHIELD-GO-003 — Weak cryptographic hash (MD5) (high, CWE-327): https://zennoxa.com/rules/shield-go-003
- SHIELD-GO-004 — Weak cryptographic hash (SHA1) (high, CWE-327): https://zennoxa.com/rules/shield-go-004
- SHIELD-GO-005 — Insecure random number generation via math/rand (medium, CWE-338): https://zennoxa.com/rules/shield-go-005
- SHIELD-GO-006 — Path traversal via user-controlled filepath (high, CWE-22): https://zennoxa.com/rules/shield-go-006
- SHIELD-GO-007 — Command injection via exec.Command with user input (critical, CWE-78): https://zennoxa.com/rules/shield-go-007
- SHIELD-GO-008 — TLS InsecureSkipVerify enabled (high, CWE-295): https://zennoxa.com/rules/shield-go-008
- SHIELD-GO-009 — Hardcoded password or secret (high, CWE-798): https://zennoxa.com/rules/shield-go-009
- SHIELD-GO-010 — Server-Side Request Forgery via http.Get with user input (high, CWE-918): https://zennoxa.com/rules/shield-go-010
- SHIELD-GO-011 — Open redirect via http.Redirect with user input (medium, CWE-601): https://zennoxa.com/rules/shield-go-011
- SHIELD-GO-012 — Use of deprecated ioutil package (low, CWE-477): https://zennoxa.com/rules/shield-go-012

### General (3)
- SHIELD-GEN-001 — Hardcoded IP address (medium, CWE-284): https://zennoxa.com/rules/shield-gen-001
- SHIELD-GEN-002 — Security-sensitive TODO/FIXME comment (low, CWE-1068): https://zennoxa.com/rules/shield-gen-002
- SHIELD-GEN-010 — Disabled SSL/TLS verify in curl command (medium, CWE-295): https://zennoxa.com/rules/shield-gen-010

### CI/CD (2)
- SHIELD-CI-001 — GitHub Actions dependency pinned to a mutable tag (high, CWE-1357): https://zennoxa.com/rules/shield-ci-001
- SHIELD-CI-002 — GitHub Actions script injection via untrusted event input (high, CWE-94): https://zennoxa.com/rules/shield-ci-002

## Glossary (60 terms)
- Broken Access Control: Broken Access Control is a vulnerability where an application fails to properly enforce what an authenticated user is allowed to do or see, letting attackers access other users' data, perform privileged actions, or bypass permission checks they should not be able to reach. (https://zennoxa.com/glossary/broken-access-control)
- Buffer Overflow: A buffer overflow is a memory-safety vulnerability where a program writes more data into a fixed-size buffer than it can hold, overwriting adjacent memory and potentially corrupting data, crashing the application, or letting an attacker execute arbitrary code. (https://zennoxa.com/glossary/buffer-overflow)
- Build Provenance: Build provenance is verifiable, tamper-evident metadata that records how a software artifact was produced, including its source inputs, build steps, and build environment, so consumers can confirm an artifact's origin and integrity. (https://zennoxa.com/glossary/build-provenance)
- CI/CD Security: CI/CD security is the practice of protecting the continuous integration and delivery pipeline and embedding automated security checks — such as SAST, dependency scanning, and secret detection — into it, so that both the pipeline and the code it ships stay secure. (https://zennoxa.com/glossary/ci-cd-security)
- CISA KEV (Known Exploited Vulnerabilities Catalog): CISA KEV (Known Exploited Vulnerabilities Catalog) is an authoritative, regularly updated list maintained by the U.S. cybersecurity agency CISA of CVEs that have confirmed evidence of active exploitation in the wild. (https://zennoxa.com/glossary/cisa-kev)
- Code Security Scanner: A code security scanner is a tool that automatically inspects a codebase and its dependencies for security vulnerabilities, exposed secrets, and misconfigurations, integrating into developer workflows and CI to catch issues before code reaches production. (https://zennoxa.com/glossary/code-security-scanner)
- Code Signing: Code signing is the practice of using a cryptographic digital signature to prove the author or publisher of software and to verify that the code has not been altered since it was signed. (https://zennoxa.com/glossary/code-signing)
- Command Injection: Command injection is a vulnerability where an attacker supplies input that gets executed as an operating-system command by the application, letting them run arbitrary commands on the host. It occurs when untrusted input is passed into a shell or command call without strict validation. (https://zennoxa.com/glossary/command-injection)
- Container Scanning: Container scanning is a method that inspects container images layer by layer to inventory installed OS packages and application dependencies, matching them against vulnerability databases and checking for misconfigurations, outdated base images, and embedded secrets. (https://zennoxa.com/glossary/container-scanning)
- Copyleft: Copyleft is a category of open source licensing that requires anyone who distributes a modified or derivative version of the software to release it under the same license terms, keeping the code and its derivatives freely available. (https://zennoxa.com/glossary/copyleft)
- Cross-Site Request Forgery (CSRF): Cross-Site Request Forgery (CSRF) is a web vulnerability that tricks an authenticated user's browser into sending an unwanted state-changing request to a site where they are logged in, letting an attacker perform actions as that user without knowing their credentials. (https://zennoxa.com/glossary/cross-site-request-forgery)
- Cross-Site Scripting (XSS): Cross-site scripting (XSS) is a vulnerability where an attacker injects malicious scripts into a web page that then execute in other users' browsers, letting them steal sessions, credentials, or perform actions as the victim. It happens when untrusted input is rendered into a page without proper encoding. (https://zennoxa.com/glossary/cross-site-scripting)
- CVE (Common Vulnerabilities and Exposures): CVE (Common Vulnerabilities and Exposures) is a public catalog of unique identifiers, formatted like CVE-2024-12345, assigned to individually disclosed security flaws in software and hardware so that everyone can refer to the same vulnerability unambiguously. (https://zennoxa.com/glossary/cve)
- CVSS (Common Vulnerability Scoring System): CVSS (Common Vulnerability Scoring System) is an open standard that rates the severity of a security vulnerability on a 0-10 scale, using characteristics like attack vector, complexity, required privileges, and impact to confidentiality, integrity, and availability. (https://zennoxa.com/glossary/cvss)
- CWE (Common Weakness Enumeration): CWE (Common Weakness Enumeration) is a community-developed, MITRE-maintained catalog of software and hardware weakness types, each with a unique identifier like CWE-79, that gives the industry a common language for classifying the root causes of vulnerabilities. (https://zennoxa.com/glossary/cwe)
- DAST (Dynamic Application Security Testing): DAST (Dynamic Application Security Testing) is a black-box method that tests a running application from the outside by sending crafted inputs and observing responses, uncovering vulnerabilities such as injection, authentication flaws, and misconfigurations without access to the source code. (https://zennoxa.com/glossary/dast)
- Data-Flow Analysis: Data-flow analysis is a static analysis technique that tracks how values move and are transformed through a program — from where they are defined to where they are used — enabling tools to reason about program behavior without executing the code. (https://zennoxa.com/glossary/data-flow-analysis)
- Dependency Confusion: Dependency confusion is a supply chain attack where an attacker publishes a malicious package to a public registry using the same name as an organization's private internal package, tricking the build system into installing the attacker's version instead. (https://zennoxa.com/glossary/dependency-confusion)
- Dependency Scanning: Dependency scanning is a method that examines a project's direct and transitive third-party libraries, resolving their exact versions and checking them against known-vulnerability databases to flag insecure dependencies and recommend safe upgrades. (https://zennoxa.com/glossary/dependency-scanning)
- EPSS (Exploit Prediction Scoring System): EPSS (Exploit Prediction Scoring System) is a data-driven model that estimates the probability, from 0 to 1, that a given vulnerability will be exploited in the wild within the next 30 days, helping teams prioritize the flaws most likely to be attacked. (https://zennoxa.com/glossary/epss)
- False-Positive Rate: False-positive rate is the proportion of a security tool's findings that turn out not to be real issues; in scanning, a false positive is an alert flagged as a vulnerability that, on inspection, is not actually exploitable or valid. (https://zennoxa.com/glossary/false-positive-rate)
- Hardcoded Secret: A hardcoded secret is a credential such as a password, API key, token, or private key written directly into source code or configuration and committed to a repository, where anyone with read access to the code — or its git history — can retrieve and abuse it. (https://zennoxa.com/glossary/hardcoded-secret)
- IaC Scanning (Infrastructure as Code Scanning): IaC scanning is a method that statically analyzes infrastructure-as-code files, such as Terraform, CloudFormation, Kubernetes, and Dockerfiles, to catch insecure configurations like public storage, open ports, or missing encryption before the infrastructure is provisioned. (https://zennoxa.com/glossary/iac-scanning)
- IAST (Interactive Application Security Testing): IAST (Interactive Application Security Testing) is a grey-box method that instruments a running application from the inside to observe code execution, data flow, and configuration in real time, confirming vulnerabilities with low false positives as the app is exercised by tests or traffic. (https://zennoxa.com/glossary/iast)
- Insecure Deserialization: Insecure deserialization is a vulnerability where an application deserializes untrusted data into objects, letting an attacker tamper with the serialized payload to alter application logic or trigger remote code execution. It occurs when serialized input from an untrusted source is reconstructed without integrity checks. (https://zennoxa.com/glossary/insecure-deserialization)
- Insecure Direct Object Reference (IDOR): Insecure Direct Object Reference (IDOR) is an access-control flaw where an application exposes a reference to an internal object — such as a record ID in a URL or API request — and fails to verify the requester is authorized for it, letting attackers access other users' data by changing the identifier. (https://zennoxa.com/glossary/insecure-direct-object-reference)
- LDAP Injection: LDAP injection is a vulnerability where an attacker inserts crafted characters into an LDAP directory query, altering its logic to bypass authentication or read unauthorized directory entries. It occurs when untrusted input is placed into an LDAP filter without proper escaping. (https://zennoxa.com/glossary/ldap-injection)
- License Compliance: License compliance is the process of identifying the open source and third-party licenses used by a software project's dependencies and ensuring the project meets each license's obligations, such as attribution or source disclosure. (https://zennoxa.com/glossary/license-compliance)
- Malicious Package: A malicious package is a software library published to a package registry that intentionally contains harmful code, designed to compromise developers or applications that install it as a dependency. (https://zennoxa.com/glossary/malicious-package)
- Open Redirect: Open redirect is a vulnerability where an application redirects users to a URL taken from untrusted input, letting an attacker send victims to a malicious site while starting from a trusted domain. It occurs when a redirect destination is not validated against an allowlist. (https://zennoxa.com/glossary/open-redirect)
- OWASP Benchmark: The OWASP Benchmark is a free, open test suite of thousands of deliberately vulnerable and safe code samples used to measure how accurately a static application security testing tool detects real vulnerabilities while avoiding false positives. (https://zennoxa.com/glossary/owasp-benchmark)
- OWASP Top 10: The OWASP Top 10 is a periodically updated awareness document from the Open Worldwide Application Security Project that ranks the ten most critical web application security risks, such as broken access control, injection, and cryptographic failures, to guide developers and security teams. (https://zennoxa.com/glossary/owasp-top-10)
- Path Traversal: Path traversal is a vulnerability where an attacker manipulates a file path (often using ../ sequences) to access files outside the intended directory, exposing configuration, source code, or credentials. It occurs when untrusted input is used to build a filesystem path without proper validation. (https://zennoxa.com/glossary/path-traversal)
- Precision and Recall: Precision and recall are two complementary accuracy metrics for detection tools: precision is the share of reported findings that are correct (true positives over all reported), and recall is the share of all real issues that were found (true positives over all actual issues). (https://zennoxa.com/glossary/precision-and-recall)
- Priority Engine: The Priority Engine is Zennoxa Shield's risk-scoring approach that combines four public signals into a single 0-100 score using the formula CVSS·0.30 + EPSS·0.30 + KEV·0.25 + reachability·0.15, so developers can rank findings by real risk rather than raw severity alone. (https://zennoxa.com/glossary/priority-engine)
- Prototype Pollution: Prototype pollution is a JavaScript vulnerability where an attacker injects properties into a base object's prototype (such as via __proto__), causing those properties to appear on all objects at runtime and leading to denial of service, property tampering, or in some cases remote code execution. (https://zennoxa.com/glossary/prototype-pollution)
- Quality Gate: A quality gate is an automated pass/fail checkpoint in a CI/CD pipeline that enforces code-quality standards — such as test coverage, code smells, duplication, and security findings — and blocks changes that fall below the agreed threshold. (https://zennoxa.com/glossary/quality-gate)
- Reachability Analysis: Reachability analysis is a technique that determines whether the vulnerable code inside a dependency or codebase can actually be invoked along an executable path from your application, so teams can distinguish exploitable flaws from ones that are present but never reached. (https://zennoxa.com/glossary/reachability-analysis)
- Regular Expression Denial of Service (ReDoS): Regular Expression Denial of Service (ReDoS) is a vulnerability where a poorly written regular expression takes exponential time to evaluate certain inputs, allowing an attacker to send a short crafted string that consumes CPU for seconds or minutes and stalls or crashes the service. (https://zennoxa.com/glossary/regular-expression-dos)
- Remediation: Remediation is the process of resolving a security vulnerability by eliminating its root cause — for example upgrading a vulnerable dependency, patching flawed code, or fixing a misconfiguration — so the weakness can no longer be exploited. (https://zennoxa.com/glossary/remediation)
- Risk-Based Prioritization: Risk-based prioritization is the practice of ranking security findings by their actual risk — combining severity with exploit likelihood, confirmed exploitation, and exposure — rather than by severity alone, so teams remediate the vulnerabilities most likely to cause real harm first. (https://zennoxa.com/glossary/risk-based-prioritization)
- SAST (Static Application Security Testing): SAST (Static Application Security Testing) is a white-box method that analyzes an application's source code, bytecode, or binaries without running it, tracing how untrusted data flows through the program to find vulnerabilities like SQL injection and cross-site scripting early in development. (https://zennoxa.com/glossary/sast)
- SBOM (Software Bill of Materials): An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of every component, library, and dependency in a piece of software, typically in a standard format like SPDX or CycloneDX, enabling teams to track what they ship and respond quickly to new vulnerabilities. (https://zennoxa.com/glossary/sbom)
- SCA (Software Composition Analysis): SCA (Software Composition Analysis) is a method that inventories the open-source and third-party components in a codebase and matches them against known-vulnerability databases like the NVD and license data, flagging risky or non-compliant dependencies developers rely on. (https://zennoxa.com/glossary/sca)
- Secret Scanning: Secret scanning is a method that inspects source code, configuration, and commit history for exposed credentials such as API keys, tokens, passwords, and private keys, alerting developers so leaked secrets can be revoked before attackers exploit them. (https://zennoxa.com/glossary/secret-scanning)
- Security Debt: Security debt is the accumulated backlog of known but unresolved security issues — unpatched vulnerabilities, risky dependencies, and deferred fixes — that a team carries over time, increasing risk the longer it goes unaddressed. (https://zennoxa.com/glossary/security-debt)
- Security Gate: A security gate is an automated checkpoint in a CI/CD pipeline that evaluates code, dependencies, and configuration against security policy and blocks a build or merge when findings exceed defined thresholds, such as any critical vulnerability. (https://zennoxa.com/glossary/security-gate)
- Server-Side Request Forgery (SSRF): Server-side request forgery (SSRF) is a vulnerability where an attacker tricks a server into making HTTP or network requests to attacker-chosen destinations, reaching internal services, cloud metadata endpoints, or other systems behind the firewall. It occurs when user-supplied URLs are fetched without validation. (https://zennoxa.com/glossary/server-side-request-forgery)
- Shift Left: Shift left is the DevSecOps practice of moving security testing and quality checks earlier in the software development lifecycle — into coding, code review, and CI — so defects are found and fixed before they reach production. (https://zennoxa.com/glossary/shift-left)
- SLSA (Supply-chain Levels for Software Artifacts): SLSA (Supply-chain Levels for Software Artifacts) is an open security framework that defines a graded set of levels for hardening the software build and release process, using verifiable provenance to protect artifacts from tampering between source and consumer. (https://zennoxa.com/glossary/slsa)
- Software Composition Analysis (SCA): Software Composition Analysis (SCA) is the practice of identifying the open source and third-party components in a codebase and analyzing them for known vulnerabilities, license obligations, and supply chain risks. (https://zennoxa.com/glossary/software-composition-analysis)
- Software Supply Chain Security: Software supply chain security is the practice of protecting every component, dependency, tool, and process used to build and deliver software — from third-party libraries to the build pipeline — so that malicious or vulnerable code cannot be introduced along the way. (https://zennoxa.com/glossary/software-supply-chain-security)
- SQL Injection: SQL injection is a vulnerability where an attacker inserts malicious SQL fragments into an application's database query, letting them read, modify, or delete data they shouldn't be able to access. It occurs when untrusted input is concatenated directly into a query instead of being parameterized. (https://zennoxa.com/glossary/sql-injection)
- Taint Analysis: Taint analysis is a security technique that tracks untrusted 'tainted' data from where it enters a program (a source, such as user input) to sensitive operations (a sink, such as a database query), flagging a vulnerability when tainted data reaches a sink without proper sanitization. (https://zennoxa.com/glossary/taint-analysis)
- Typosquatting: Typosquatting is a supply chain attack where an attacker publishes a malicious package under a name that closely misspells or mimics a popular legitimate package, so developers who make a typo or copy a wrong name install the malicious version. (https://zennoxa.com/glossary/typosquatting)
- Use-After-Free: Use-after-free is a memory-safety vulnerability where a program continues to use a pointer to memory that has already been freed, causing crashes, data corruption, or — when an attacker controls the reallocated memory — code execution. (https://zennoxa.com/glossary/use-after-free)
- Vulnerability Triage: Vulnerability triage is the process of reviewing security findings to determine which are genuine, how severe they are, and which to fix first — filtering out false positives and ranking real issues by exploitability, reachability, and business impact. (https://zennoxa.com/glossary/vulnerability-triage)
- Weak Cryptography: Weak cryptography is the use of broken, outdated, or misconfigured cryptographic algorithms and practices — such as MD5, SHA-1, DES, small keys, or hardcoded keys — that fail to adequately protect data, letting attackers decrypt, forge, or crack values that were assumed to be secure. (https://zennoxa.com/glossary/weak-cryptography)
- XML External Entity (XXE): XML external entity (XXE) is a vulnerability where an XML parser processes attacker-defined external entities, letting an attacker read local files, reach internal systems, or cause denial of service. It occurs when XML input from an untrusted source is parsed with external entity resolution enabled. (https://zennoxa.com/glossary/xml-external-entity)
- XPath Injection: XPath injection is a vulnerability where an attacker inserts crafted input into an XPath query used to navigate XML data, altering the query to bypass authentication or extract unauthorized nodes. It occurs when untrusted input is concatenated into an XPath expression without proper handling. (https://zennoxa.com/glossary/xpath-injection)

## Research studies (13)
- Two years after npm shipped build provenance, 78% of a typical dependency tree still doesn't use it (2026-08-25) — We resolved the dependency tree of 34 of the most-used npm packages (484 packages) and measured two supply-chain signals against the public npm registry: under 1% run install scripts, but only 21.5% publish build provenance — 78.5% ship with no verifiable link from the package you install back to the source and CI that built it. Every number is reproducible from the published scripts. (https://zennoxa.com/research/npm-provenance-census-2026)
- Advisory Growth vs. Tooling Coverage: The Capacity Gap Is a Flow, Not Just a Stock (2026-07-28) — We bucketed every OSV.dev advisory by its record-publication year for 11 package ecosystems and overlaid the count of catalogued open-source security tools per language. Known-vulnerability advisories entering the public record grew 2.3x-6.6x over five years for most ecosystems, and recent years add hundreds to thousands per ecosystem against 2-13 open-source tools — up to 157 new advisories per tool per year for Rust. A reproducible measure of whether tooling capacity keeps pace with advisory inflow. (https://zennoxa.com/research/advisory-growth-vs-tooling-coverage-2026)
- The Version-Drift Problem: Is a Published SAST 'Accuracy' Score Even Reproducible? (2026-07-28) — A single accuracy number on the OWASP Benchmark moves measurably from provenance alone — which benchmark version (v1.1 = 21,041 cases vs v1.2 = 2,740), which CWE subset was averaged, and how findings are matched. Computed live from the v1.2 ground truth: the official macro-average weights the smallest category 14.4x differently from a case-weighted average, and a fixed reference detector's headline swings 54.5 points from subset choice alone. A score with none of that pinned is not independently reproducible. (https://zennoxa.com/research/sast-benchmark-version-drift-2026)
- The SCA Coverage Gap: Where Dependency-Vulnerability Volume Piles Up vs. Where Open-Source Tooling Is Thin (2026-07-28) — We counted every advisory in OSV.dev's public per-ecosystem archives and joined it to the open-source, security-tagged scanners in the analysis-tools.dev catalog. Advisory volume and open-source tool availability are only weakly aligned: Rust (crates.io) carries 2,663 real advisories against 2 catalogued open-source tools, while Dart (Pub) and Elixir (Hex) have advisory volume but zero. A reproducible map of the 'SCA deserts.' (https://zennoxa.com/research/sca-coverage-gap-2026)
- From Weakness to Weaponized: the CWE Classes Attackers Actually Exploit (2026-07-27) — Most disclosed vulnerabilities are never exploited — so which weakness classes are over-represented among the ones that are? We compared each CWE's share of the CISA KEV catalog to its prevalence across all 370,431 CVEs. Type Confusion is 20.5× over-represented among known-exploited bugs; Deserialization 14.5×; OS Command Injection 7.4×. A reproducible exploitation-lift ranking. (https://zennoxa.com/research/exploited-cwe-classes-2026)
- Exploited, but Not 'Critical': What a Single-Signal Queue Buries (2026-07-27) — Start from ground truth — the 1,653 vulnerabilities CISA records as exploited in the wild — and watch each single-signal triage queue bury a different slice. 71.1% of known-exploited CVEs are not rated CVSS Critical; 23.8% carry an EPSS probability below 0.10. Neither severity nor probability alone surfaces all of them. A reproducible cross-section of the KEV catalog. (https://zennoxa.com/research/kev-cross-section-2026)
- The Backlog Economics of 'Criticals First': 8.7 Evidence-Free Bugs per Real One (2026-07-27) — If you work CVSS-Critical vulnerabilities strictly worst-first, how much of that queue carries any exploitation evidence? Of 30,409 Critical CVEs, only 3,124 (10.3%) are in CISA KEV or score EPSS ≥ 0.10. The other 89.7% have no public exploitation signal — 8.7 evidence-free Criticals for every one with evidence. A reproducible look at the cost of severity-only triage. (https://zennoxa.com/research/severity-backlog-economics-2026)
- Nine in Ten 'Critical' CVEs Show No Sign Anyone Is Exploiting Them (2026-07-27) — We joined three free public datasets — NVD CVSS scores, FIRST EPSS probabilities, and the CISA KEV catalog — on CVE ID. Of 30,409 CVEs rated CVSS 9.0+ ('Critical'), 89.7% carry an EPSS exploitation probability below 0.10 and are absent from the KEV catalog. A reproducible measure of how much of a severity-first queue is urgent by label but by no exploitation signal. (https://zennoxa.com/research/severity-illusion-critical-cves-2026)
- State of Open-Source SAST 2026: 755 tools, but only 42 open-source security scanners (2026-07-22) — We parsed the public analysis-tools.dev catalog of 755 static-analysis tools. 86% are open source — but only 42 are open-source SAST (security) scanners, and 21 languages with an active linting ecosystem have zero open-source security scanner at all. A reproducible census of where open-source SAST exists, and where it doesn't. (https://zennoxa.com/research/state-of-oss-sast-2026)
- Do popular projects pin their base images? We checked 25 (2026-07-21) — Popular projects SHA-pin their GitHub Actions two-thirds of the time — but pin their Docker base images to an immutable digest only 7.6% of the time. Same supply-chain idea, a fraction of the adoption. Reproducible data across 25 repos. (https://zennoxa.com/research/base-image-pinning-2026)
- Do popular container images drop root? We checked 25 projects (2026-07-21) — Half of the primary Dockerfiles in 25 popular infra and app projects don't set an explicit non-root USER in their final stage. A fair, caveated look at what static analysis can and can't tell you about container privilege. (https://zennoxa.com/research/container-root-user-2026)
- State of GitHub Actions Pinning 2026: we checked 30 popular repos (2026-07-21) — Across 30 popular public repositories, 1 in 3 GitHub Action references still points at a mutable tag instead of a pinned commit — the exact pattern behind the tj-actions/changed-files and reviewdog compromises. Reproducible data. (https://zennoxa.com/research/github-actions-pinning-2026)
- Where static analysis is easy vs hard: a walk through 2,740 OWASP tests (2026-07-21) — The OWASP Benchmark's 2,740 labelled cases show a clear pattern: SAST nails pattern-local bugs (weak crypto at 100% precision) and struggles with anything that needs dataflow (SQL injection at 39% recall). Here's the whole scorecard — including where our own engine scores zero. (https://zennoxa.com/research/owasp-benchmark-deepdive-2026)

## Comparisons
Factual, balanced comparison pages citing our published benchmark:
- Zennoxa Shield vs Snyk: https://zennoxa.com/compare/snyk
- Zennoxa Shield vs SonarQube: https://zennoxa.com/compare/sonarqube
- Zennoxa Shield vs Semgrep: https://zennoxa.com/compare/semgrep
- Zennoxa Shield vs Trivy: https://zennoxa.com/compare/trivy
- Zennoxa Shield vs Aikido Security: https://zennoxa.com/compare/aikido

## Entity
- Organization: Zennoxa (https://zennoxa.com)
- GitHub: https://github.com/Zennoxa — public CLI repo: https://github.com/Zennoxa/shield
- Contact / feedback: https://zennoxa.com/feedback