Description

A static code analysis detector that identifies security vulnerabilities by analyzing the source code structure and data flow. It examines code patterns, variable usage, and function calls to detect potential security issues.

Detection Strategy

• Search through source code to identify potentially vulnerable function calls or code patterns

• Analyze variable declarations and assignments to track how data flows through the code

• Check if variables or expressions contain potentially dangerous values or patterns

• Report vulnerabilities when dangerous patterns are found in security-sensitive contexts like authentication or data handling

• Monitor function parameters and return values to identify potentially unsafe data usage

Vulnerable code example

<?php
// Example of insecure debug configuration

// VULNERABLE: Debug mode enabled in production - can expose sensitive info
Configure::write('debug', 2);

// Another insecure way to enable debugging
define('WP_DEBUG', true);...

✅ Secure code example

<?php
// Set debug mode based on environment
if (getenv('APP_ENV') === 'development') {
    // Debug enabled only in development environment
    Configure::write('debug', 2);
    define('WP_DEBUG', true);
} else {
    // Production environment - disable debug output for security...