BETA Shoulder is in beta — Findings may sometimes be wrong. Your feedback shapes what we fix next. Share feedback
Shoulder.dev

Understand what every change actually did to your system.
🟨
JavaScript Security
116 rules
67 CWEs 23 critical

JavaScript Security Vulnerabilities

Shoulder detects 116 security patterns specific to JavaScript applications built with JavaScript.

Framework Coverage

Express 77 rules Fastify 67 rules Nodejs 52 rules Nextjs 33 rules Koa 33 rules Hapi 26 rules Nestjs 26 rules Lambda 6 rules Serverless 6 rules Prisma 5 rules Trpc 5 rules Typeorm 5 rules Graphql 4 rules All 3 rules Angular 1 rules Tests 1 rules

Vulnerability Categories

CWE-20 7 rules
Improper Input Validation
CWE-200 5 rules
Exposure of Sensitive Information to an Unauthorized Actor
2 critical
CWE-798 5 rules
Use of Hard-coded Credentials
2 critical
CWE-89 4 rules
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
4 critical
CWE-79 3 rules
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
1 critical
CWE-285 3 rules
Improper Authorization
3 critical
CWE-639 3 rules
Authorization Bypass Through User-Controlled Key
1 critical
CWE-22 2 rules
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
1 critical
CWE-94 2 rules
Improper Control of Generation of Code ('Code Injection')
1 critical
CWE-117 2 rules
Improper Output Neutralization for Logs
CWE-209 2 rules
Generation of Error Message Containing Sensitive Information
CWE-327 2 rules
Use of a Broken or Risky Cryptographic Algorithm
CWE-400 2 rules
Uncontrolled Resource Consumption
CWE-502 2 rules
Deserialization of Untrusted Data
1 critical
CWE-601 2 rules
URL Redirection to Untrusted Site ('Open Redirect')
CWE-770 2 rules
Allocation of Resources Without Limits or Throttling
CWE-915 2 rules
Improperly Controlled Modification of Dynamically-Determined Object Attributes
2 critical
CWE-918 2 rules
Server-Side Request Forgery (SSRF)
CWE-1104 2 rules
Use of Unmaintained Third Party Components
CWE-1321 2 rules
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
🟨

Scan your JavaScript project

Run Shoulder CLI to find JavaScript-specific vulnerabilities.

npx @shoulderdev/cli trust . All JavaScript threats