Coverage

What yof covers, and what it does not

Class by class: what yof looks for in your code, what the Automated engagement tests on a running app, and what neither of them does.

How to read the table

In code: patterns the rules look for in the files of a linked repository. A rule finds a pattern and does not run the code, so most of these findings need validation.
Live: tests against a running app. The Automated engagement is in development and not on sale, so nothing marked that way is available to customers yet.
Not covered: what neither does. A report never reads as if these were checked.

Class	In code	Live	Not covered
SQL injection	SQL text is built from request input	Text sent to your app is run as part of a database query In development	Input that crosses a function or a file, stored (second-order) injection, and bugs inside an ORM.
NoSQL injection	A database filter takes a value straight from the request	Text sent to your app is run as part of a database query In development	Query languages of other document databases, and languages other than JavaScript and TypeScript.
Command injection	A shell command is built from request input	Text sent to your app is run as a system command In development	Arguments injected into a program that is called without a shell, and other languages.
Template injection	Request input is used as a template	Text sent to your app is run by its page template engine In development	Templates read from a database, and template engines that run in the browser.
Code evaluation	Request input is run as code	No live test	Evaluation through a sandbox object, and other languages.
Cross-site scripting	Request input is written into the page as HTML	Text sent to your app comes back as live page markup In development	Angular and Vue trust bypasses, autoescape settings of server templates, stored scripts, and a proof in a real browser.
Open redirect	A redirect goes wherever the request says	Your site sends visitors on to any address in the link Available today in yof attack	Allow lists that exist and can be bypassed.
Server-side request forgery	The server fetches an address taken from the request	Your server fetches any address a request names In development	DNS rebinding, redirects that lead inside, and whether cloud metadata can be reached.
Cross-site request forgery	Cookie sign-in with no CSRF check in the code A sign-in cookie is set without httpOnly or sameSite	The sign-in cookie is missing a safety flag Available today in yof attack Another website can make a signed-in user change their data In development	Frameworks other than Express-style apps, a check done by a proxy, and whether the browser's own defaults protect the route.
Unsafe object loading	Request input is loaded as an object	Your app hands a request body to an unsafe reader of objects In development	Java ObjectInputStream, .NET BinaryFormatter, and XML external entities.
Weak cryptography	A password or token is hashed with a fast or broken hash A token or code is made with a predictable random function A cryptographic key is written in the code Encryption uses ECB mode Certificate checking is switched off A sign-in token is accepted without checking its signature	Your app accepts a sign-in token it never checked In development Ids or sign-in tokens are easy to guess In development	Key lengths, protocol versions and certificates of the live service, custom cryptography, and side channels.
Passwords in code and config	A password is written in your code or config A default user name and password are written in the code An address in your code has the password inside it	No live test	The git history of files that are gone, whether a password found still works, and one plain word with no digit or symbol.
File uploads	An upload keeps the file name or type the visitor sent The uploads folder is served as web pages	An uploaded file is served back as a page a browser runs In development	What the storage service or CDN does with the file, malware in the upload, and size limits.
Dockerfile	A secret is written into your Dockerfile Your Dockerfile runs a download without checking it Your base image is past its end of life Your container runs the app as root Your container's base image has no fixed version Your container image includes an SSH server Your base image is fixed by tag, not by digest Your Dockerfile installs packages without fixed versions	No live test	Built images and the operating-system packages inside them are not scanned. End of life is known for six official base images only.
docker-compose	A compose service runs with the host's privileges A compose service can control Docker itself A secret is written in your compose file	No live test	The running containers, and env files that are not committed.
Kubernetes manifests	A Kubernetes container runs privileged A Kubernetes workload reaches into its node A secret is written in a Kubernetes manifest A Kubernetes container may run as root A Kubernetes container may gain more privileges A Kubernetes container has no resource limits A Kubernetes image has no fixed version	No live test	The running cluster, Helm templates that are not rendered, RBAC, network and admission policies, and files with YAML anchors.
Terraform	A firewall rule opens an admin port to the whole internet A storage bucket is made public in Terraform Storage or a database is created without encryption A database is reachable from the internet in Terraform A password or key is written in your Terraform files	No live test	The cloud account itself: what is deployed may differ from the files. Values from variables, modules or functions, other providers and other resource types.

Outside every row

Built container images and the operating-system packages inside them are not scanned.
These rules read files. They do not look at the running system: the cluster, the cloud account or how the live app behaves.
Request input is followed inside one function or handler only. A value that passes through another function or file first is not followed.
Languages: the syntax rules read JavaScript and TypeScript. Python has the simple, exact forms. PHP, Ruby, Go, Java, Kotlin and C# have a few single-line forms. Other languages are not read by these rules.

Never covered by automated checks

Flaws in business logic, such as a price or a step a person can skip.
Weaknesses nobody knows about yet (zero-days).
People and processes: phishing, passwords shared by hand, who has access.
Anything outside the scope named in this report, and any change after its date.

This is not a penetration test.

How yof checks