CodeSent Rules - Comprehensive API Security & Static Analysis

Critical ServiceCallout Step FlowCallout SpikeArrest

Name	Severity	Scopes	Tags	Links
Connection to the system is not encrypted	Critical	ServiceCallout MessageLogging Target	Data in Transit	CWE-319
JWT/JWS is decoded but not verified in the same flow phase	Critical	Step	Authentication & Authorisation	CWE-347
Lack of certificate validation	Critical	ServiceCallout MessageLogging Target	Data in Transit	CWE-295
Request content is stringified	Critical	Step	Data Validation DoS Protection	CWE-20
Sensitive information is in the source code	Critical	Step	Data at Rest	CWE-256 CWE-312