Sanicode Coverage Scorecard

Generated 2026-04-11 13:42 UTC
705
Total Rules
23
Languages
109
CWEs Covered
25/25
CWE Top 25 Hit
CWE Top 25 (2024) Coverage — 100% (25 of 25 CWEs have at least one rule)
100%
Legend:
Implemented (rule IDs shown)
Planned (issue #s shown)
Implemented, with additional rules planned (amber corner)
Not covered
CWE × Language Coverage Matrix
CWE PY BASH C COBOL C++ C# FORT F# GO JAVA JS JUL KOT LUA MAT PERL PHP R RB RUST SCALA SQL TEMPL
CWE Top 25 (2024) — ordered by rank
CWE-787: Out-of-bounds Write SC711 SC813 SC305 SC1404, SC1413, SC1402
CWE-79: XSS SC085, SC086, SC009 SC605, SC606 SC304 SC475, SC414 SC268, SC269, SC205, SC204 SC1012 SC105 SC912, SC907 SC514 SC089, SC088
CWE-89: SQL Injection SC006 SC1707 SC2101 SC602 SC2007, SC2002 SC303 SC403 SC206 SC1509 SC1005 SC103 SC913, SC903 SC503 SC1410 SC1611, SC1609 SC1802, SC1810, SC1811, SC1808, SC1805, SC1804, SC1803, SC1812
CWE-416: Use After Free SC713 SC815
CWE-78: OS Command Injection SC087, SC001, SC002, SC003, SC004 SC1702, SC1709, SC1706, SC1717 SC702, SC701 SC2102, SC2106 SC802, SC801 SC601 SC1102, SC1101 SC2001 SC364, SC301, SC302 SC476, SC402, SC401 SC270, SC203, SC201 SC1310, SC1311, SC1301 SC1501 SC1908, SC1904, SC1901 SC1207, SC1213, SC1201 SC1003, SC1004, SC1013, SC1001 SC101 SC906, SC901 SC502, SC501 SC1401 SC1601
CWE-20: Improper Input Validation SC020 SC714 SC2103 SC816 SC315 SC417 SC216 SC111 SC517
CWE-125: Out-of-bounds Read SC712 SC814
CWE-22: Path Traversal SC010, SC011 SC2109 SC610 SC1103 SC2004 SC309 SC410 SC207 SC1309 SC1507 SC1905 SC1204, SC1212 SC1010 SC107 SC910 SC510 SC1409, SC1405 SC1607
CWE-352: CSRF SC078, SC079, SC018 SC652, SC653, SC614 SC313 SC470, SC471, SC415 SC265, SC266, SC214 SC1513 SC109 SC515 SC1613
CWE-434: Unrestricted Upload SC019 SC615 SC314 SC416 SC215 SC110 SC516
CWE-862: Missing Authorization SC028 SC427 SC223
CWE-476: NULL Pointer Deref SC716 SC818 SC616 SC317 SC419 SC1514
CWE-287: Improper Authentication SC026 SC425 SC221
CWE-190: Integer Overflow SC715 SC817 SC316 SC418
CWE-502: Deserialization SC005, SC008 SC603 SC1106 SC2003 SC308 SC405, SC408 SC212 SC1308 SC1504, SC1503 SC1006 SC104 SC904 SC504, SC505 SC1408 SC1604, SC1603
CWE-77: Command Injection SC021 SC617 SC318 SC420 SC217 SC1515 SC112, SC113 SC518 SC1614
CWE-119: Buffer Overflow SC720 SC822 SC346
CWE-798: Hardcoded Credentials SC012 SC1708 SC2104 SC611 SC1111 SC2009 SC310 SC411 SC208 SC1510 SC1211 SC1011 SC106 SC911 SC511 SC1610 SC1813
CWE-918: SSRF SC015 SC613 SC2005 SC312 SC413 SC211 SC1307 SC1508 SC1206 SC909 SC513 SC1407 SC1608 SC1806
CWE-306: Missing Authentication SC025 SC424 SC220
CWE-362: Race Condition SC061 SC723 SC826 SC1114 SC348 SC456
CWE-269: Improper Privilege Mgmt SC027 SC426 SC222
CWE-94: Code Injection SC007 SC1710, SC1703, SC1701 SC604 SC2006 SC306 SC406, SC407 SC202 SC1302, SC1306, SC1303 SC1502, SC1505 SC1903, SC1902, SC1906 SC1202, SC1203, SC1205 SC1007, SC1002 SC102 SC902, SC905 SC508, SC506, SC507 SC1602, SC1605
CWE-863: Incorrect Authorization SC029 SC428 SC224
Other CWEs — sorted by ID
CWE-59: Symlink Following SC063 SC1722 SC724 SC827 SC350 SC548
CWE-88: Unknown SC034 SC1719 SC325 SC433 SC229 SC1015 SC120 SC525
CWE-90: LDAP Injection SC022 SC607 SC319 SC421
CWE-91: Unknown SC035 SC623 SC326 SC434 SC230 SC121 SC526
CWE-93: Unknown SC032 SC621 SC323 SC431 SC227 SC118 SC523
CWE-113: Unknown SC033 SC622 SC324 SC432 SC228 SC119 SC524
CWE-120: Buffer Copy Overflow SC709, SC703, SC704 SC2107 SC809, SC803, SC804 SC1112
CWE-122: Unknown SC721 SC823
CWE-134: Format String SC706 SC806 SC1113 SC338 SC1016 SC135
CWE-200: Information Exposure SC024 SC618 SC320 SC423 SC219 SC1907 SC115 SC520 SC1807
CWE-201: Sensitive Info in Response SC068 SC645 SC355 SC461 SC256 SC148 SC551
CWE-203: Unknown SC072 SC648 SC358 SC465 SC260 SC151 SC553
CWE-209: Error Detail Exposure SC062 SC641 SC349 SC457 SC252 SC145 SC547
CWE-213: Object Dump Exposure SC069 SC462 SC257
CWE-215: Unknown SC077
CWE-242: Dangerous Functions SC049 SC705 SC805 SC339 SC1305, SC1312 SC136 SC1403
CWE-248: Uncaught Exception SC1411
CWE-250: Unnecessary Privileges SC065 SC1723 SC725 SC828 SC352 SC550
CWE-252: Unchecked Return Value SC2105
CWE-266: Incorrect Privilege Assignment SC066 SC643 SC459 SC254 SC147
CWE-276: Incorrect Default Permissions SC057 SC1704 SC717 SC819 SC344 SC453 SC143 SC545
CWE-295: Cert Validation SC017 SC656 SC363 SC474 SC267
CWE-311: Unknown SC2110
CWE-312: Unknown SC040 SC628 SC331 SC439 SC235 SC126 SC531
CWE-319: Unknown SC054 SC638 SC342 SC451 SC248 SC141 SC542
CWE-321: Unknown SC1711
CWE-326: Unknown SC051, SC082 SC635, SC655 SC340, SC362 SC448 SC245 SC138 SC539
CWE-327: Weak Crypto SC083, SC013 SC654, SC612 SC2008 SC311 SC472, SC412 SC209 SC108 SC512
CWE-328: Unknown SC052 SC636 SC341 SC449 SC246 SC139 SC540
CWE-329: Unknown SC053 SC637 SC450 SC247 SC140 SC541
CWE-330: Insufficient Randomness SC014 SC632 SC335 SC443 SC210 SC130 SC535
CWE-338: Weak PRNG SC708 SC808 SC1105 SC1009 SC908
CWE-345: Unknown SC2111
CWE-346: Unknown SC055 SC639 SC343 SC452 SC249 SC142 SC543
CWE-347: Unknown SC056 SC250 SC544
CWE-359: PII Exposure in Logs SC064 SC642 SC351 SC458 SC253 SC146 SC549
CWE-367: TOCTOU Race SC1712
CWE-377: Insecure Temp File SC048 SC1705 SC707 SC807 SC447 SC134 SC538
CWE-384: Unknown SC042 SC630 SC333 SC441 SC237 SC128 SC533
CWE-390: Unknown SC059 SC719 SC821 SC640 SC345 SC454 SC251 SC144 SC546
CWE-401: Memory Leak SC811 SC1412
CWE-404: Resource Shutdown SC1511
CWE-425: Forced Browsing SC644 SC353
CWE-426: Untrusted Search Path SC1209
CWE-427: Unknown SC060 SC1721 SC722 SC825 SC347 SC455
CWE-444: Unknown SC076 SC469
CWE-451: Unknown SC264
CWE-457: Uninitialized Variable SC1115
CWE-459: Unknown SC1713
CWE-470: Unknown SC2011
CWE-474: Use of Obsolete Function SC1109
CWE-494: Download w/o Verification SC1714
CWE-501: Unknown SC073 SC649 SC359 SC466 SC261 SC152 SC554
CWE-522: Unknown SC039 SC627 SC330 SC438 SC234 SC125 SC530
CWE-532: Log Injection SC030 SC1718 SC2108 SC619 SC321 SC429 SC225 SC1516 SC116 SC521 SC1414 SC1615
CWE-552: Files/Dirs Accessible SC1809
CWE-598: Sensitive GET Parameters SC070 SC646 SC356 SC463 SC258 SC149 SC552
CWE-601: Unknown SC031 SC620 SC322 SC430 SC226 SC1517 SC117 SC522
CWE-610: Unknown SC074 SC650 SC360 SC467 SC262 SC153 SC555
CWE-611: XXE SC016 SC608 SC2010 SC409 SC239 SC1518 SC131 SC536 SC1616
CWE-613: Unknown SC043 SC631 SC334 SC442 SC238 SC129 SC534
CWE-614: Unknown SC041 SC629 SC332 SC440 SC236 SC127 SC532
CWE-639: IDOR SC071 SC647 SC357 SC464 SC259 SC150
CWE-643: Unknown SC036 SC624 SC327 SC435 SC231 SC122 SC527
CWE-668: Resource Exposure SC067 SC1724 SC354 SC460 SC255
CWE-704: Unknown SC1512
CWE-732: Incorrect Permission Assignment SC058 SC1715 SC718 SC820
CWE-754: Improper Exception Handling SC1716 SC307 SC1612
CWE-760: Unknown SC084 SC473
CWE-770: Allocation w/o Limits SC047 SC710 SC810 SC634 SC1104 SC337 SC446 SC243
CWE-776: Unknown SC037 SC625 SC328 SC436 SC232 SC123 SC528
CWE-829: Untrusted Functionality Inclusion SC046 SC1720 SC633 SC1107 SC445 SC242 SC1304 SC1910, SC1911 SC1208 SC133 SC1406
CWE-843: Type Confusion SC812, SC824 SC1108 SC1912 SC1415
CWE-913: Collection Modification SC050 SC244 SC1909 SC1008 SC137
CWE-915: Mass Assignment SC044 SC444 SC240 SC132 SC509
CWE-916: Unknown SC038 SC626 SC329 SC437 SC233 SC124 SC529
CWE-917: Expression Language Injection SC045 SC336 SC404 SC241 SC1506 SC537 SC1606
CWE-1021: Unknown SC075 SC651 SC361 SC468 SC263 SC154 SC556
CWE-1321: Prototype Pollution SC213 SC1801
CWE-1333: ReDoS SC023 SC609 SC422 SC218 SC1519 SC1014 SC114 SC519 SC1617
Open Coverage Issues
Issue Title CWEs Languages
Sanicode — generated 2026-04-11 13:42 UTC