BETA Shoulder is in beta — Findings may sometimes be wrong. Your feedback shapes what we fix next. Share feedback
Shoulder.dev

Understand what every change actually did to your system.
🔷
TypeScript Security
121 rules
70 CWEs 23 critical

TypeScript Security Vulnerabilities

Shoulder detects 121 security patterns specific to TypeScript applications built with TypeScript.

Framework Coverage

Express 79 rules Fastify 69 rules Nodejs 49 rules Nextjs 33 rules Koa 32 rules Nestjs 30 rules Hapi 25 rules Lambda 6 rules Serverless 6 rules Prisma 5 rules Trpc 5 rules Typeorm 5 rules Typescript 5 rules Graphql 4 rules All 3 rules Next 3 rules Angular 1 rules Tests 1 rules

Vulnerability Categories

CWE-20 7 rules
Improper Input Validation
CWE-200 5 rules
Exposure of Sensitive Information to an Unauthorized Actor
2 critical
CWE-704 5 rules
Incorrect Type Conversion or Cast
CWE-798 5 rules
Use of Hard-coded Credentials
2 critical
CWE-89 4 rules
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
4 critical
CWE-79 3 rules
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
1 critical
CWE-94 3 rules
Improper Control of Generation of Code ('Code Injection')
1 critical
CWE-285 3 rules
Improper Authorization
3 critical
CWE-639 3 rules
Authorization Bypass Through User-Controlled Key
1 critical
CWE-22 2 rules
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
1 critical
CWE-209 2 rules
Generation of Error Message Containing Sensitive Information
CWE-327 2 rules
Use of a Broken or Risky Cryptographic Algorithm
CWE-400 2 rules
Uncontrolled Resource Consumption
CWE-502 2 rules
Deserialization of Untrusted Data
1 critical
CWE-601 2 rules
URL Redirection to Untrusted Site ('Open Redirect')
CWE-770 2 rules
Allocation of Resources Without Limits or Throttling
CWE-915 2 rules
Improperly Controlled Modification of Dynamically-Determined Object Attributes
2 critical
CWE-918 2 rules
Server-Side Request Forgery (SSRF)
CWE-1321 2 rules
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-74 1 rules
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
🔷

Scan your TypeScript project

Run Shoulder CLI to find TypeScript-specific vulnerabilities.

npx @shoulderdev/cli trust . All TypeScript threats