Scanner Coverage Reference

Auto-generado por scripts/generate-scanner-doc.mjs. No editar a mano. Ultimo update: 2026-04-28

Scanner de Vibe Coding Eye. Cubre 124 patterns mapeados a CWE y OWASP Top 10 2025 (10/10) + OWASP LLM Top 10 2025 (10/10).

OWASP Top 10 2025 Coverage

OWASP	Categoria	Patterns
A01:2025	Broken Access Control	AUTH-005, AUTH-007, AUTH-008, AUTH-009, AUTH-010, AUTH-014, INJ-007, LOVABLE-001, SUPA-FUNC-001, SUPA-RLS-001, SUPA-RLS-002, SUPA-RLS-003, SUPA-RLS-003, SUPA-RLS-004, SUPA-STORAGE-001
A02:2025	Cryptographic Failures	AUTH-002, AUTH-011, AUTH-012, AUTH-012, BOLT-001, CRYPTO-001, CRYPTO-002, CRYPTO-003, INFRA-002, SEC-KEY-001, SEC-KEY-002, SEC-KEY-003, SEC-KEY-004, SESSION-003, SUPA-SERVICE-001, V0-001
A03:2025	Injection	EMAIL-001, INJ-001, INJ-002, INJ-003, INJ-005, UPLOAD-002, UPLOAD-002, VAL-001, VAL-002, VAL-003, VAL-004, XSS-001
A04:2025	Insecure Design	AI-COST-001, AI-RATELIMIT-001, API-004, API-RATE-002, API-RATE-003, UPLOAD-001, UPLOAD-001
A05:2025	Security Misconfiguration	API-CORS-001, CORS-002, CSP-001, CURSOR-001, SESSION-002, SUPA-VIEW-001, XSS-002
A06:2025	Vulnerable Components	DEP-001, DEP-003, DEP-004, INJ-006
A07:2025	Authentication Failures	API-RATE-001, AUTH-001, AUTH-003, AUTH-006, AUTH-013, SESSION-001, WEBHOOK-002
A08:2025	Data Integrity Failures	INJ-004, RSC-001, SRI-001, WEBHOOK-001, WEBHOOK-003
A09:2025	Logging/Monitoring Failures	API-003, SEC-KEY-005
A10:2025	SSRF	API-SSRF-001

OWASP LLM Top 10 2025 Coverage

Cobertura: 10/10 buckets.

LLM	Categoria	Patterns
LLM01	Prompt Injection	AGENT-DOC-001, AGENT-INST-001, AGENT-INST-002, AI-003, AI-CTX-001, AI-PROMPT-001
LLM02	Sensitive Information Disclosure	AI-PRIVACY-001
LLM03	Supply Chain	AI-PKG-001, AI-SERIAL-001
LLM04	Data and Model Poisoning	AI-RAG-001
LLM05	Improper Output Handling	AI-004, AI-OUTPUT-001
LLM06	Excessive Agency	AGENT-MCP-001, AI-TOOL-001, MCP-001
LLM07	System Prompt Leakage	AI-LEAK-001
LLM08	Vector and Embedding Weaknesses	AI-EMBED-001
LLM09	Misinformation	AI-OVERRELIANCE-001
LLM10	Unbounded Consumption	AI-COST-001, AI-RATELIMIT-001

All Patterns

ai (21)

ID	Severity	Confidence	CWE	OWASP	Name
AGENT-DOC-001	medium	-	-	LLM01:2025 Prompt Injection (Indirect via Docs)	README/docs con combinacion sospechosa de markers + invisibles/secret refs
AGENT-INST-001	critical	-	-	LLM01:2025 Prompt Injection (Agent Instruction File)	Agent instruction file con markers de prompt injection
AGENT-INST-002	high	-	-	LLM01:2025 Prompt Injection (Hidden Characters)	Agent instruction file con caracteres invisibles
AGENT-MCP-001	high	-	-	LLM06:2025 Excessive Agency (MCP Config)	MCP server config con command/url no allowlisted
AI-003	high	medium	CWE-94	LLM01:2025	Posible prompt injection — user input en system prompt
AI-004	high	high	CWE-79	LLM05:2025 Improper Output Handling	Output de LLM renderizado como HTML sin sanitizar
AI-COST-001	medium	high	CWE-400	A04:2025	Llamada LLM sin max_tokens
AI-CTX-001	high	-	-	LLM01:2025 Prompt Injection (Indirect)	Indirect Prompt Injection: content externo al LLM sin sanitize
AI-EMBED-001	medium	-	-	LLM08:2025 Vector and Embedding Weaknesses	Embedding endpoint publico sin auth/rate-limit
AI-LEAK-001	medium	-	-	LLM07:2025 System Prompt Leakage	System prompt con secretos / instrucciones sensibles hardcoded
AI-OUTPUT-001	high	-	-	LLM05:2025 Improper Output Handling	LLM output renderizado como HTML sin sanitize
AI-OVERRELIANCE-001	medium	-	-	LLM09:2025 Misinformation	LLM response usada como fuente de verdad sin verification
AI-PI-001	critical	-	-	-	User input en system prompt
AI-PI-002	high	-	-	-	Output LLM renderizado como HTML sin sanitizar
AI-PRIVACY-001	high	-	-	LLM02:2025 Sensitive Information Disclosure	LLM/agent expone datos sensibles sin scope o redaction
AI-PROMPT-001	high	-	-	LLM01:2025 Prompt Injection	Prompt Injection: user input directo al LLM sin filtrado
AI-RAG-001	high	-	-	LLM04:2025 Data and Model Poisoning	Vector DB upsert con user content sin moderation (RAG poisoning)
AI-RATELIMIT-001	high	medium	CWE-770	A04:2025	LLM endpoint sin rate-limit ni auth gate (DoW vector)
AI-SERIAL-001	critical	-	-	LLM03:2025 Supply Chain	LangChain loads() con content potencialmente untrusted (CVE-2025-68664)
AI-TOOL-001	high	-	-	LLM06:2025 Excessive Agency	Tool handler con operacion destructiva sin confirmacion
MCP-001	critical	-	-	LLM06:2025 Excessive Agency (MCP Tool Poisoning)	MCP tool con directiva oculta en description

api (9)

ID	Severity	Confidence	CWE	OWASP	Name
API-003	medium	medium	CWE-209	A09:2025	Error leakage: route handler devuelve err.message o stack
API-SSRF-001	high	medium	CWE-918	A10:2025	Fetch con URL de usuario sin validar hostname
CHECKOUT-001	critical	-	-	-	Checkout endpoint con amount / price_id desde el cliente
CI-001	critical	-	-	-	GitHub Actions: script injection via untrusted ${{ github.event.* }}
CI-003	critical	-	-	-	GitHub Actions: pullrequesttarget + checkout PR HEAD (RCE)
REDIRECT-001	high	-	-	-	Open Redirect: redirect a URL derivada de request
WEBHOOK-001	critical	high	CWE-345	A08:2025	Webhook de pago/proveedor sin verificacion HMAC
WEBHOOK-002	high	medium	CWE-294	A07:2025	Webhook handler sin proteccion de replay (idempotency)
WEBHOOK-003	medium	medium	CWE-345	A08:2025	Webhook payment handler sin reconciliacion de sku/amount

auth (23)

ID	Severity	Confidence	CWE	OWASP	Name
API-AUTH-001	high	-	-	-	Server Action sin check de auth
AUTH-001	high	high	CWE-287	A07:2025	Password reset filtra existencia de email
AUTH-002	medium	medium	CWE-522	A02:2025	Session tokens en localStorage
AUTH-003	high	medium	CWE-287	A07:2025	Proteccion de rutas solo client-side
AUTH-005	critical	high	CWE-306	A01:2025	Server Action / Route handler sin verificacion de auth en mutacion
AUTH-006	high	high	CWE-287	A07:2025	Auth client-side basado en localStorage
AUTH-007	high	medium	CWE-639	A01:2025	Server Action con ID del cliente sin check de ownership
AUTH-008	critical	high	CWE-290	A01:2025	Next.js vulnerable a CVE-2025-29927 (middleware bypass)
AUTH-009	high	high	CWE-807	A01:2025	searchParams usado para decision de auth
AUTH-010	medium	medium	CWE-601	A01:2025	Open redirect via URL parameter
AUTH-011	critical	high	CWE-327	A02:2025	JWT verify sin whitelisting de algoritmos
AUTH-012	high	medium	CWE-208	A02:2025	jwt.decode() sin jwt.verify() previo
AUTH-012	medium	medium	CWE-208	A02:2025	Comparacion de secret con === (timing attack)
AUTH-013	high	high	CWE-613	A07:2025	JWT firmado sin exp / expiresIn
AUTH-014	high	medium	CWE-601	A01:2025	OAuth callback redirige a URL sin validar
BOLA-001	critical	-	-	-	BOLA / IDOR: route accepts object ID without ownership check
CI-005	high	-	-	-	GitHub Actions: permissions write-all (excesivo)
CSRF-001	medium	-	-	-	Express con sessions sin CSRF protection
RSC-001	critical	high	CWE-502	A08:2025	React/Next.js vulnerable a RSC deserialization RCE (CVE-2025-55182)
SESSION-001	high	high	CWE-1004	A07:2025	Session / auth cookie sin httpOnly
SESSION-002	medium	high	CWE-614	A05:2025	Cookie con flags inseguros (sameSite:none sin secure, o secure:false)
SESSION-003	high	high	CWE-922	A02:2025	JWT guardado en cookie sin httpOnly o en localStorage
SESSION-004	medium	-	-	-	Express res.cookie() sin secure / httpOnly flags

cors (2)

ID	Severity	Confidence	CWE	OWASP	Name
API-CORS-001	high	medium	CWE-942	A05:2025	CORS con wildcard *
CORS-002	critical	high	CWE-942	A05:2025	CORS: wildcard origin + credentials true

deps (8)

ID	Severity	Confidence	CWE	OWASP	Name
AI-PKG-001	high	-	-	LLM03:2025 Supply Chain	Paquete con nombre halucinado / slopsquatting-prone
CI-004	medium	-	-	-	GitHub Actions: third-party action sin SHA pin
DEP-001	medium	high	CWE-1104	A06:2025	Paquetes abandonados o deprecados
DEP-002	low	-	-	-	Paquetes declarados pero no usados
DEP-003	medium	high	CWE-1104	A06:2025	Deps de generador desactualizadas
DEP-004	critical	high	CWE-1104	A06:2025	Dependencia con CVE publico reciente
DEP-CVE-001	high	-	-	-	Dependencia con CVE publicado
DEP-PI-001	high	-	-	-	package.json postinstall script con comandos sospechosos

infra (4)

ID	Severity	Confidence	CWE	OWASP	Name
CI-006	low	-	-	-	GitHub Actions: deprecated set-output / save-state
CSP-001	medium	high	CWE-79	A05:2025	CSP con unsafe-inline o unsafe-eval
INFRA-002	high	high	CWE-798	A02:2025	NEXTPUBLIC en vars sensibles
SRI-001	medium	medium	CWE-353	A08:2025	Script externo sin Subresource Integrity (SRI)

input-validation (26)

ID	Severity	Confidence	CWE	OWASP	Name
EMAIL-001	high	medium	CWE-93	A03:2025	Email header injection: user input en From/Subject/To
INJ-001	critical	high	CWE-78	A03:2025	Command injection: child_process.exec/execSync con user input
INJ-002	high	high	CWE-22	A03:2025	Path traversal: fs.readFile / writeFile con user-input path
INJ-003	critical	high	CWE-95	A03:2025	eval / Function constructor con user input
INJ-004	high	medium	CWE-1321	A08:2025	Posible prototype pollution: Object.assign/_.merge con user object
INJ-005	critical	high	CWE-943	A03:2025	NoSQL injection: Mongo query con objeto del body
INJ-006	high	medium	CWE-1333	A06:2025	ReDoS: new RegExp(userInput) o RegExp con template literal
INJ-007	high	high	CWE-915	A01:2025	Mass assignment: ORM update con body sin validar
INJ-008	medium	-	-	-	ReDoS: regex con backtracking exponencial
TAINT-EXEC-001	critical	-	-	-	Command injection (taint-based, shell exec with user input)
TAINT-PT-001	high	-	-	-	Path traversal (taint-based, fs read/write con user input)
TAINT-SQL-001	critical	-	-	-	SQL injection (taint-based, inter-step via variables)
TAINT-XSS-001	high	-	-	-	Reflected XSS (taint-based, res.send con user input via variables)
UPLOAD-001	high	medium	CWE-434	A04:2025	File upload sin validación de tipo / tamaño
UPLOAD-001	medium	medium	CWE-434	A04:2025	Upload endpoint sin validacion de tipo o tamano
UPLOAD-002	high	medium	CWE-79	A03:2025	Upload filename del cliente sin sanitizar (path traversal / overwrite)
UPLOAD-002	high	medium	CWE-79	A03:2025	Upload acepta SVG sin sanitize
VAL-001	medium	low	CWE-20	A03:2025	API routes sin validacion Zod
VAL-002	medium	low	CWE-20	A03:2025	Campos sin limite de longitud
VAL-003	high	high	CWE-79	A03:2025	dangerouslySetInnerHTML con valor dinamico
VAL-004	critical	high	CWE-89	A03:2025	SQL injection: raw query con template literal sin tagged helper
VAL-005	medium	-	-	-	Request body con type cast sin runtime validation (zod/yup)
XSS-001	high	high	CWE-79	A03:2025	react-markdown + rehype-raw sin rehype-sanitize
XSS-002	low	low	CWE-1022	A05:2025	target=
XSS-003	high	-	-	-	DOM XSS clasico: innerHTML / document.write / insertAdjacentHTML
XSS-004	high	-	-	-	Reflected XSS en Express res.send/res.render

rate-limit (4)

ID	Severity	Confidence	CWE	OWASP	Name
API-004	high	high	CWE-400	A04:2025	GraphQL endpoint sin depth/complexity limit
API-RATE-001	high	medium	CWE-307	A07:2025	Endpoints auth sin rate limiting
API-RATE-002	high	high	CWE-400	A04:2025	Endpoints IA sin cost cap
API-RATE-003	high	high	CWE-770	A04:2025	Rate limiter in-memory en codigo serverless (bypass trivial)

rls (12)

ID	Severity	Confidence	CWE	OWASP	Name
LOVABLE-001	critical	high	CWE-284	A01:2025	Lovable: migracion con CREATE TABLE sin ENABLE ROW LEVEL SECURITY
STORAGE-001	high	-	-	-	Supabase Storage bucket sin policies definidas
STORAGE-002	critical	-	-	-	Bucket público con nombre/uso de PII
SUPA-FUNC-001	high	high	CWE-732	A01:2025	Postgres function security definer sin revoke explicito
SUPA-RLS-001	critical	high	CWE-284	A01:2025	RLS desactivado en tabla con datos
SUPA-RLS-002	critical	high	CWE-284	A01:2025	Policy RLS con using (true)
SUPA-RLS-003	high	high	CWE-284	A01:2025	Tabla con user_id sin policy que lo referencia
SUPA-RLS-003	critical	high	CWE-284	A01:2025	RLS policy universalmente permisiva
SUPA-RLS-004	critical	high	CWE-269	A01:2025	RLS update policy sobre tabla con columna privilegiada (role/admin/plan)
SUPA-SERVICE-001	critical	high	CWE-522	A02:2025	Supabase client con service_role sin server-only
SUPA-STORAGE-001	high	medium	CWE-284	A01:2025	Supabase storage bucket sin policies explicitas
SUPA-VIEW-001	high	high	CWE-732	A05:2025	View publica sin security_invoker: bypass de RLS

secrets (15)

ID	Severity	Confidence	CWE	OWASP	Name
BOLT-001	high	medium	CWE-798	A02:2025	Bolt: API key inline en componente Vite + cliente
CI-002	high	-	-	-	GitHub Actions: secret echo to logs
CLIENT-ENV-001	high	-	-	-	process.env en componente cliente
CRYPTO-001	high	medium	CWE-338	A02:2025	Math.random() usado en contexto de seguridad
CRYPTO-002	high	high	CWE-327	A02:2025	MD5 o SHA1 usado para hashing
CRYPTO-003	critical	high	CWE-798	A02:2025	Secret / JWT_SECRET hardcodeado con valor trivial
CURSOR-001	high	medium	CWE-1188	A05:2025	Cursor: placeholder de secret dejado sin reemplazar
LOG-PII-001	medium	-	-	-	console.log/error de objetos con PII / auth state
SEC-KEY-001	critical	high	CWE-798	A02:2025	service_role de Supabase en codigo cliente
SEC-KEY-002	critical	medium	CWE-522	A02:2025	API key de proveedor IA expuesta client-side
SEC-KEY-003	high	high	CWE-312	A02:2025	Probable secret en archivos versionados
SEC-KEY-004	high	high	CWE-798	A02:2025	Valor con forma de API key asignado a NEXTPUBLIC
SEC-KEY-005	high	medium	CWE-598	A09:2025	API key / token pasado como query param en URL
SECRET-GIT-001	critical	-	-	-	Secretos en historia git (committed + revertidos)
V0-001	high	high	CWE-798	A02:2025	v0: API key hardcodeada en Client Component

Patterns with Authoritative References

AI-003 — Posible prompt injection — user input en system prompt

• OWASP LLM Top 10 — Prompt Injection

AI-COST-001 — Llamada LLM sin max_tokens

• OWASP LLM10 Unbounded Consumption

AI-RATELIMIT-001 — LLM endpoint sin rate-limit ni auth gate (DoW vector)

• OWASP LLM10 Unbounded Consumption

API-SSRF-001 — Fetch con URL de usuario sin validar hostname

• OWASP SSRF Prevention

AUTH-001 — Password reset filtra existencia de email

• OWASP Broken Authentication

AUTH-005 — Server Action / Route handler sin verificacion de auth en mutacion

• Next.js Data Security — Server Actions

AUTH-006 — Auth client-side basado en localStorage

• CVE-2025-48757 Lovable RLS

AUTH-007 — Server Action con ID del cliente sin check de ownership

• OWASP IDOR Prevention

AUTH-008 — Next.js vulnerable a CVE-2025-29927 (middleware bypass)

• CVE-2025-29927 Next.js Middleware Bypass

AUTH-010 — Open redirect via URL parameter

• OWASP Unvalidated Redirects

AUTH-011 — JWT verify sin whitelisting de algoritmos

• jsonwebtoken Advisory GHSA-qwph-4952-7xr6

AUTH-012 — jwt.decode() sin jwt.verify() previo

• Timing attacks — Node.js crypto.timingSafeEqual

AUTH-012 — Comparacion de secret con === (timing attack)

• Timing attacks — Node.js crypto.timingSafeEqual

CRYPTO-001 — Math.random() usado en contexto de seguridad

• OWASP Cryptographic Failures

CSP-001 — CSP con unsafe-inline o unsafe-eval

• Next.js CSP guide

INJ-004 — Posible prototype pollution: Object.assign/_.merge con user object

• CVE-2019-10744 lodash

LOVABLE-001 — Lovable: migracion con CREATE TABLE sin ENABLE ROW LEVEL SECURITY

• CVE-2025-48757 Lovable

RSC-001 — React/Next.js vulnerable a RSC deserialization RCE (CVE-2025-55182)

• CVE-2025-55182

SEC-KEY-003 — Probable secret en archivos versionados

• OWASP — Secret Management

SESSION-003 — JWT guardado en cookie sin httpOnly o en localStorage

• OWASP — JWT Storage

SRI-001 — Script externo sin Subresource Integrity (SRI)

• MDN SRI

SUPA-FUNC-001 — Postgres function security definer sin revoke explicito

• Postgres — SECURITY DEFINER best practices

SUPA-RLS-001 — RLS desactivado en tabla con datos

• Supabase RLS docs

SUPA-RLS-004 — RLS update policy sobre tabla con columna privilegiada (role/admin/plan)

• OWASP Improper Privilege Management

SUPA-SERVICE-001 — Supabase client con service_role sin server-only

• Supabase servicerole safety

SUPA-VIEW-001 — View publica sin security_invoker: bypass de RLS

• Postgres — SECURITY INVOKER on views

VAL-003 — dangerouslySetInnerHTML con valor dinamico

• OWASP XSS Prevention

VAL-004 — SQL injection: raw query con template literal sin tagged helper

• Prisma $queryRaw docs

Categorias CWE cubiertas

• CWE-1004
• CWE-1022
• CWE-1104
• CWE-1188
• CWE-1321
• CWE-1333
• CWE-20
• CWE-208
• CWE-209
• CWE-22
• CWE-269
• CWE-284
• CWE-287
• CWE-290
• CWE-294
• CWE-306
• CWE-307
• CWE-312
• CWE-327
• CWE-338
• CWE-345
• CWE-353
• CWE-400
• CWE-434
• CWE-502
• CWE-522
• CWE-598
• CWE-601
• CWE-613
• CWE-614
• CWE-639
• CWE-732
• CWE-770
• CWE-78
• CWE-79
• CWE-798
• CWE-807
• CWE-89
• CWE-915
• CWE-918
• CWE-922
• CWE-93
• CWE-94
• CWE-942
• CWE-943
• CWE-95