Security checks

Every check
RepoFort runs.

RepoFort currently runs 57 security checks across your GitHub repository and deployed site, covering secrets, authentication, injection attacks, HTTP headers, and more. Open any rule to see why it matters and how to fix it.

Severity

Scan type

Secrets & Credentials

Credentials and sensitive values committed to code or exposed to the browser.

10 rules

Authentication

13 rules

Authorization & Data Access

Who may read or change which records: ownership checks, IDOR and row-level security.

4 rules

API & Input Handling

CORS, CSRF, rate limiting, and unsafe handling of request input such as path traversal and command injection.

9 rules

Frontend Security

Client-side injection risks including XSS and dynamic code execution.

2 rules

Database Queries

SQL injection and raw query patterns that bypass parameterization.

2 rules

Configuration

Cookie flags, error handling, HTTPS redirects and other server hardening.

8 rules

HTTP Security Headers

Browser security headers such as CSP, HSTS and clickjacking protection, plus headers that disclose your stack.

9 rules

How this page stays current

This page is built from the same rule catalog the scanner uses, and the in-app Security Guide renders the exact same list, so both always show the same checks, categories and count. Adding a rule updates this page, the guide, and every count on the next deploy. Detection patterns and payloads are deliberately not published here.

Run all 57 checks
against your repo.

Free tier · No install required · Results in under 60 seconds.

Scan your project →Back to home

Every checkRepoFort runs.