What Aasim Guard checks
40+ checks across source code, dependencies, and configuration.
Static analysis (SAST)
Run on every scan, on every plan — from your GitHub repo, uploaded folder, or the CLI.
Hardcoded secretsCritical
API keys, passwords, and tokens committed directly into source or .env files pushed to GitHub.
SQL injectionCritical
Unparameterized queries that let attackers read, modify, or delete your entire database.
Missing authenticationCritical
Admin routes and API endpoints accessible without any auth check.
No rate limitingHigh
Login endpoints and APIs with no throttling, trivial to brute force or spam.
CORS wildcardHigh
Access-Control-Allow-Origin set to *. Any site can call your API as your user.
XSS vulnerabilitiesHigh
User input rendered directly into the DOM without sanitization.
Plaintext sensitive dataHigh
ID numbers, bank accounts, and passwords stored unencrypted in your database.
Vulnerable dependenciesHigh
npm/pip packages with known CVEs and available public exploits.
Missing security headersMedium
No CSP, X-Frame-Options, or HSTS, browser protections your app isn't using.
Exposed .env filesMedium
.env committed to your repo or publicly reachable via your web server.
HTTP instead of HTTPSMedium
API calls, redirects, or cookies that transmit data unencrypted.
Weak JWT configMedium
Short secrets, no expiry, or algorithm set to none, tokens that are trivial to forge.