llms.txt
+200 −200
− - [Free Security Quick Scan](https://vetkit.dev/en/#pricing): Create an account with Google, GitHub, Apple or email, then connect a GitHub repository. Limited to secrets, known dependency vulnerabilities and basic security posture. No AI usage. Paid plans are not yet available for purchase.− - [Checks and limitations](https://vetkit.dev/en/#checks): Five audit suites: security, code quality, sustainability, AI code risks and production readiness. Expanded checks and automation are Full-tier capabilities, not Free Quick Scan features.− - [Security](https://vetkit.dev/en/security/): Read-only repository access, code is never executed, temporary checkouts and redacted secrets.− - [vetkit.android.manifest.allow-backup](https://vetkit.dev/checks/vetkit.android.manifest.allow-backup/): The Android app explicitly enables `android:allowBackup`. App data, including tokens stored in SharedPreferences or databases, can be extracted with adb backup or cloud backup.− - [vetkit.android.manifest.cleartext-traffic](https://vetkit.dev/checks/vetkit.android.manifest.cleartext-traffic/): The Android app allows cleartext HTTP traffic for all domains (`android:usesCleartextTraffic="true"`). Data and session tokens can be read or modified on the network.− - [vetkit.android.manifest.debuggable](https://vetkit.dev/checks/vetkit.android.manifest.debuggable/): The Android manifest hard-codes `android:debuggable="true"`. Release builds become debuggable, so anyone with the device can attach a debugger, read app data and run code in the app's process.− - [vetkit.android.manifest.exported-provider](https://vetkit.dev/checks/vetkit.android.manifest.exported-provider/): An exported Android content provider has no read/write permission. Any installed app can query or modify the data it serves (and use path traversal tricks if it serves files).− - [vetkit.android.manifest.exported-receiver](https://vetkit.dev/checks/vetkit.android.manifest.exported-receiver/): An exported Android broadcast receiver has no `android:permission`. Any installed app can send it intents, including forged system-like broadcasts.− - [vetkit.android.manifest.exported-service](https://vetkit.dev/checks/vetkit.android.manifest.exported-service/): An exported Android service has no `android:permission`. Any installed app can start or bind to it and invoke its functionality.− - [vetkit.android.manifest.shared-user-id](https://vetkit.dev/checks/vetkit.android.manifest.shared-user-id/): The Android app declares `android:sharedUserId`. Apps sharing a user ID share data and permissions, so a weakness in one of them exposes the other; the attribute is deprecated.− - [vetkit.android.manifest.test-only](https://vetkit.dev/checks/vetkit.android.manifest.test-only/): The Android manifest sets `android:testOnly="true"`, a flag meant only for test builds that should not be part of a shipped configuration.− - [vetkit.android.manifest.weak-custom-permission](https://vetkit.dev/checks/vetkit.android.manifest.weak-custom-permission/): A custom Android permission uses the `normal` or `dangerous` protection level (or none, which means normal). Any app can obtain it, so it does not protect the components that require it.− - [vetkit.android.network.cleartext-base-config](https://vetkit.dev/checks/vetkit.android.network.cleartext-base-config/): The Android network security config permits cleartext HTTP for every domain (`<base-config cleartextTrafficPermitted="true">`).− - [vetkit.android.network.user-certificates-trusted](https://vetkit.dev/checks/vetkit.android.network.user-certificates-trusted/): The Android network security config trusts user-installed CA certificates outside `debug-overrides`. Anyone who can get a user to install a certificate can intercept the app's TLS traffic.− - [vetkit.apache.http.trace-enabled](https://vetkit.dev/checks/vetkit.apache.http.trace-enabled/): Apache explicitly enables the HTTP TRACE method (`TraceEnable on`), which echoes request headers (including cookies) back to the client.− - [vetkit.apache.listing.indexes](https://vetkit.dev/checks/vetkit.apache.listing.indexes/): Apache directory listing is enabled (`Options Indexes`). Files in the directory that are not linked anywhere, such as backups or configuration files, can be listed and downloaded.− - [vetkit.apache.tls.legacy-protocols](https://vetkit.dev/checks/vetkit.apache.tls.legacy-protocols/): Apache enables an obsolete SSL/TLS protocol version (SSLv2, SSLv3, TLSv1 or TLSv1.1) in `SSLProtocol`. These versions are deprecated by RFC 8996.− - [vetkit.apache.tls.weak-ciphers](https://vetkit.dev/checks/vetkit.apache.tls.weak-ciphers/): Apache enables a broken cipher suite (RC4, DES/3DES, NULL, EXPORT, LOW, MD5 or anonymous key exchange) in `SSLCipherSuite`.− - [vetkit.aspnet.appsettings.detailed-errors](https://vetkit.dev/checks/vetkit.aspnet.appsettings.detailed-errors/): An ASP.NET Core settings file that is not Development-only enables `DetailedErrors`. Blazor and the host then send exception details to the browser.− - [vetkit.aspnet.config.custom-errors-off](https://vetkit.dev/checks/vetkit.aspnet.config.custom-errors-off/): ASP.NET custom errors are switched off (`<customErrors mode="Off">`). Remote users see full exception details and stack traces.− - [vetkit.aspnet.config.debug-compilation](https://vetkit.dev/checks/vetkit.aspnet.config.debug-compilation/): ASP.NET compiles the application in debug mode (`<compilation debug="true">`). Debug builds disable optimisations and request timeouts and can expose detailed error information.− - [vetkit.aspnet.config.directory-browsing](https://vetkit.dev/checks/vetkit.aspnet.config.directory-browsing/): IIS directory browsing is enabled (`<directoryBrowse enabled="true">`). Unlinked files in the site directory can be listed and downloaded.− - [vetkit.aspnet.config.remote-trace](https://vetkit.dev/checks/vetkit.aspnet.config.remote-trace/): ASP.NET tracing is enabled for remote clients (`<trace enabled="true" localOnly="false">`). trace.axd then shows request details, headers, cookies and session state to anyone.− - [vetkit.aspnet.config.request-validation-off](https://vetkit.dev/checks/vetkit.aspnet.config.request-validation-off/): ASP.NET request validation is disabled for the whole application (`validateRequest="false"`). Script and markup in request input is no longer rejected before it reaches pages.− - [vetkit.aspnet.config.viewstate-mac-off](https://vetkit.dev/checks/vetkit.aspnet.config.viewstate-mac-off/): ASP.NET ViewState MAC validation is disabled (`enableViewStateMac="false"`). Attackers can tamper with ViewState and, through deserialization, execute code on the server.− - [vetkit.c.command-injection.input-to-shell](https://vetkit.dev/checks/vetkit.c.command-injection.input-to-shell/): A command line built from program arguments, environment variables or received data is run through the shell (command injection).− - [vetkit.c.crypto.ecb-mode](https://vetkit.dev/checks/vetkit.c.crypto.ecb-mode/): AES is used in ECB mode; equal plaintext blocks produce equal ciphertext blocks, which leaks data patterns.− - [vetkit.c.crypto.insecure-random](https://vetkit.dev/checks/vetkit.c.crypto.insecure-random/): A key, token, salt or nonce is generated with rand() / random() or RAND_pseudo_bytes, which are not cryptographically secure.− - [vetkit.c.crypto.weak-cipher](https://vetkit.dev/checks/vetkit.c.crypto.weak-cipher/): DES, 3DES, RC4, RC2 or Blowfish is used; these ciphers are broken or have a 64-bit block size.− - [vetkit.c.crypto.weak-password-hash](https://vetkit.dev/checks/vetkit.c.crypto.weak-password-hash/): A password or secret is hashed with MD5 / SHA-1, which can be brute-forced quickly.− - [vetkit.c.crypto.weak-signature-hash](https://vetkit.dev/checks/vetkit.c.crypto.weak-signature-hash/): A signature or certificate is created or verified over an MD5 / SHA-1 digest, which is not collision resistant.− - [vetkit.c.format-string.non-literal-format](https://vetkit.dev/checks/vetkit.c.format-string.non-literal-format/): A printf-family function receives a non-constant string as its format and no further arguments; `%n` / `%s` in that string read or write arbitrary memory.− - [vetkit.c.memory.double-free](https://vetkit.dev/checks/vetkit.c.memory.double-free/): The same pointer is passed to free() a second time without being reassigned in between (double free).− - [vetkit.c.memory.gets](https://vetkit.dev/checks/vetkit.c.memory.gets/): gets() reads a line without any length limit; every call can overflow the destination buffer.− - [vetkit.c.memory.input-into-fixed-buffer](https://vetkit.dev/checks/vetkit.c.memory.input-into-fixed-buffer/): A command-line argument or environment variable is copied into a buffer with strcpy / strcat / sprintf, which does not check the destination size.− - [vetkit.c.memory.return-local-address](https://vetkit.dev/checks/vetkit.c.memory.return-local-address/): A function returns the address of one of its own stack variables; the memory is invalid as soon as the function returns.− - [vetkit.c.memory.scanf-unbounded-string](https://vetkit.dev/checks/vetkit.c.memory.scanf-unbounded-string/): A scanf-family call reads a string with %s or %[ and no field width, so long input overflows the buffer.− - [vetkit.c.memory.unbounded-string-copy](https://vetkit.dev/checks/vetkit.c.memory.unbounded-string-copy/): strcpy / strcat / sprintf("%s") copies a non-constant string without a destination size, a common source of buffer overflows.− - [vetkit.c.memory.use-after-free](https://vetkit.dev/checks/vetkit.c.memory.use-after-free/): A pointer is dereferenced after it was passed to free() and before it is reassigned (use after free).− - [vetkit.c.permissions.world-writable](https://vetkit.dev/checks/vetkit.c.permissions.world-writable/): A file or directory is made writable by every local user (mode with the other-write bit set).+ - [Free Security Quick Scan](https://vetkit.dev/en/#pricing): Create an account with Google, GitHub, Apple or email, then connect a GitHub, GitLab.com or Bitbucket Cloud repository. Limited to secrets, known dependency vulnerabilities and basic security posture. No AI usage. There are no plans or tiers: every account gets every feature, and full scans and DAST report uploads use credits.+ - [Checks and limitations](https://vetkit.dev/en/#checks): Five scored audit suites: security, code quality, sustainability, AI code risks and production readiness, plus opt-in, unscored Privacy & Data Protection (beta) and Git history suites. Expanded checks, AI review and automatic scans run as full scans that use credits; they are not part of Free Quick Scan.+ - [Watch AI coding agents with Agent Watch](https://vetkit.dev/en/docs/agent-watch/): Pair the desktop app, read agent alerts and session attestations, and understand what is uploaded.+ - [Agent Watch ile yapay zekâ kodlama ajanlarını izleyin](https://vetkit.dev/tr/docs/agent-watch/): Masaüstü uygulamasını eşleyin, ajan uyarılarını ve oturum beyanlarını okuyun, nelerin yüklendiğini anlayın.+ - [KI-Coding-Agenten mit Agent Watch beobachten](https://vetkit.dev/de/docs/agent-watch/): Koppeln Sie die Desktop-App, lesen Sie Agentenwarnungen und Sitzungsbestätigungen und verstehen Sie, was hochgeladen wird.+ - [Observe agentes de programación con IA con Agent Watch](https://vetkit.dev/es/docs/agent-watch/): Empareje la app de escritorio, lea alertas de agentes y declaraciones de sesión, y entienda qué se sube.+ - [Surveiller les agents de codage IA avec Agent Watch](https://vetkit.dev/fr/docs/agent-watch/): Associez l’application de bureau, lisez les alertes d’agents et les attestations de session, et comprenez ce qui est envoyé.+ - [Osserva gli agenti di programmazione IA con Agent Watch](https://vetkit.dev/it/docs/agent-watch/): Associa l’app desktop, leggi gli avvisi degli agenti e le attestazioni di sessione e capisci cosa viene caricato.+ - [Observe agentes de programação com IA com o Agent Watch](https://vetkit.dev/pt/docs/agent-watch/): Pareie o app de desktop, leia alertas de agentes e atestados de sessão e entenda o que é enviado.+ - [Наблюдайте за ИИ-агентами для кода с Agent Watch](https://vetkit.dev/ru/docs/agent-watch/): Свяжите приложение для компьютера, читайте оповещения агентов и подтверждения сеансов и поймите, что передаётся.+ - [راقب وكلاء البرمجة بالذكاء الاصطناعي مع Agent Watch](https://vetkit.dev/ar/docs/agent-watch/): اقرن تطبيق سطح المكتب، واقرأ تنبيهات الوكلاء وإقرارات الجلسات، وافهم ما يُرفع.+ - [About vetkit](https://vetkit.dev/about/): What vetkit is, how audits and published content are produced, and contact addresses.+ - [Security](https://vetkit.dev/en/security/): Read-only audit access, code is never executed, temporary checkouts and redacted secrets.+ - [Android allowBackup=true exposes app data to backups](https://vetkit.dev/checks/vetkit.android.manifest.allow-backup/) (`vetkit.android.manifest.allow-backup`): The Android app explicitly enables `android:allowBackup`. App data, including tokens stored in SharedPreferences or databases, can be extracted with adb backup or cloud backup.+ - [Android usesCleartextTraffic=true allows cleartext HTTP](https://vetkit.dev/checks/vetkit.android.manifest.cleartext-traffic/) (`vetkit.android.manifest.cleartext-traffic`): The Android app allows cleartext HTTP traffic for all domains (`android:usesCleartextTraffic="true"`). Data and session tokens can be read or modified on the network.+ - [Android manifest debuggable=true in release builds](https://vetkit.dev/checks/vetkit.android.manifest.debuggable/) (`vetkit.android.manifest.debuggable`): The Android manifest hard-codes `android:debuggable="true"`. Release builds become debuggable, so anyone with the device can attach a debugger, read app data and run code in the app's process.+ - [Android exported ContentProvider without permission](https://vetkit.dev/checks/vetkit.android.manifest.exported-provider/) (`vetkit.android.manifest.exported-provider`): An exported Android content provider has no read/write permission. Any installed app can query or modify the data it serves (and use path traversal tricks if it serves files).+ - [Android exported BroadcastReceiver without permission](https://vetkit.dev/checks/vetkit.android.manifest.exported-receiver/) (`vetkit.android.manifest.exported-receiver`): An exported Android broadcast receiver has no `android:permission`. Any installed app can send it intents, including forged system-like broadcasts.+ - [Android exported Service without android:permission](https://vetkit.dev/checks/vetkit.android.manifest.exported-service/) (`vetkit.android.manifest.exported-service`): An exported Android service has no `android:permission`. Any installed app can start or bind to it and invoke its functionality.+ - [Android sharedUserId shares data between apps](https://vetkit.dev/checks/vetkit.android.manifest.shared-user-id/) (`vetkit.android.manifest.shared-user-id`): The Android app declares `android:sharedUserId`. Apps sharing a user ID share data and permissions, so a weakness in one of them exposes the other; the attribute is deprecated.+ - [Android testOnly=true set in the app manifest](https://vetkit.dev/checks/vetkit.android.manifest.test-only/) (`vetkit.android.manifest.test-only`): The Android manifest sets `android:testOnly="true"`, a flag meant only for test builds that should not be part of a shipped configuration.+ - [Android custom permission with normal protectionLevel](https://vetkit.dev/checks/vetkit.android.manifest.weak-custom-permission/) (`vetkit.android.manifest.weak-custom-permission`): A custom Android permission uses the `normal` or `dangerous` protection level (or none, which means normal). Any app can obtain it, so it does not protect the components that require it.+ - [Android network security config cleartextTrafficPermitted](https://vetkit.dev/checks/vetkit.android.network.cleartext-base-config/) (`vetkit.android.network.cleartext-base-config`): The Android network security config permits cleartext HTTP for every domain (`<base-config cleartextTrafficPermitted="true">`).+ - [Android network security config trusts user CA certificates](https://vetkit.dev/checks/vetkit.android.network.user-certificates-trusted/) (`vetkit.android.network.user-certificates-trusted`): The Android network security config trusts user-installed CA certificates outside `debug-overrides`. Anyone who can get a user to install a certificate can intercept the app's TLS traffic.+ - [Apache TraceEnable on exposes HTTP TRACE method](https://vetkit.dev/checks/vetkit.apache.http.trace-enabled/) (`vetkit.apache.http.trace-enabled`): Apache explicitly enables the HTTP TRACE method (`TraceEnable on`), which echoes request headers (including cookies) back to the client.+ - [Apache Options Indexes enables directory listing](https://vetkit.dev/checks/vetkit.apache.listing.indexes/) (`vetkit.apache.listing.indexes`): Apache directory listing is enabled (`Options Indexes`). Files in the directory that are not linked anywhere, such as backups or configuration files, can be listed and downloaded.+ - [Apache SSLProtocol enables SSLv3, TLSv1 or TLSv1.1](https://vetkit.dev/checks/vetkit.apache.tls.legacy-protocols/) (`vetkit.apache.tls.legacy-protocols`): Apache enables an obsolete SSL/TLS protocol version (SSLv2, SSLv3, TLSv1 or TLSv1.1) in `SSLProtocol`. These versions are deprecated by RFC 8996.+ - [Apache SSLCipherSuite enables weak ciphers (RC4, 3DES)](https://vetkit.dev/checks/vetkit.apache.tls.weak-ciphers/) (`vetkit.apache.tls.weak-ciphers`): Apache enables a broken cipher suite (RC4, DES/3DES, NULL, EXPORT, LOW, MD5 or anonymous key exchange) in `SSLCipherSuite`.+ - [ASP.NET Core DetailedErrors enabled outside Development](https://vetkit.dev/checks/vetkit.aspnet.appsettings.detailed-errors/) (`vetkit.aspnet.appsettings.detailed-errors`): An ASP.NET Core settings file that is not Development-only enables `DetailedErrors`. Blazor and the host then send exception details to the browser.+ - [ASP.NET customErrors mode=Off shows stack traces](https://vetkit.dev/checks/vetkit.aspnet.config.custom-errors-off/) (`vetkit.aspnet.config.custom-errors-off`): ASP.NET custom errors are switched off (`<customErrors mode="Off">`). Remote users see full exception details and stack traces.+ - [ASP.NET compilation debug=true in web.config](https://vetkit.dev/checks/vetkit.aspnet.config.debug-compilation/) (`vetkit.aspnet.config.debug-compilation`): ASP.NET compiles the application in debug mode (`<compilation debug="true">`). Debug builds disable optimisations and request timeouts and can expose detailed error information.+ - [IIS directoryBrowse enabled=true lists site files](https://vetkit.dev/checks/vetkit.aspnet.config.directory-browsing/) (`vetkit.aspnet.config.directory-browsing`): IIS directory browsing is enabled (`<directoryBrowse enabled="true">`). Unlinked files in the site directory can be listed and downloaded.+ - [ASP.NET trace enabled with localOnly=false (trace.axd)](https://vetkit.dev/checks/vetkit.aspnet.config.remote-trace/) (`vetkit.aspnet.config.remote-trace`): ASP.NET tracing is enabled for remote clients (`<trace enabled="true" localOnly="false">`). trace.axd then shows request details, headers, cookies and session state to anyone.+ - [ASP.NET validateRequest=false disables request validation](https://vetkit.dev/checks/vetkit.aspnet.config.request-validation-off/) (`vetkit.aspnet.config.request-validation-off`): ASP.NET request validation is disabled for the whole application (`validateRequest="false"`). Script and markup in request input is no longer rejected before it reaches pages.+ - [ASP.NET enableViewStateMac=false allows ViewState tampering](https://vetkit.dev/checks/vetkit.aspnet.config.viewstate-mac-off/) (`vetkit.aspnet.config.viewstate-mac-off`): ASP.NET ViewState MAC validation is disabled (`enableViewStateMac="false"`). Attackers can tamper with ViewState and, through deserialization, execute code on the server.+ - [C command injection: program input passed to system()](https://vetkit.dev/checks/vetkit.c.command-injection.input-to-shell/) (`vetkit.c.command-injection.input-to-shell`): A command line built from program arguments, environment variables or received data is run through the shell (command injection).+ - [C AES ECB mode leaks plaintext patterns](https://vetkit.dev/checks/vetkit.c.crypto.ecb-mode/) (`vetkit.c.crypto.ecb-mode`): AES is used in ECB mode; equal plaintext blocks produce equal ciphertext blocks, which leaks data patterns.+ - [C rand() or random() used for keys, tokens and nonces](https://vetkit.dev/checks/vetkit.c.crypto.insecure-random/) (`vetkit.c.crypto.insecure-random`): A key, token, salt or nonce is generated with rand() / random() or RAND_pseudo_bytes, which are not cryptographically secure.+ - [C weak cipher: DES, 3DES, RC4, RC2 or Blowfish](https://vetkit.dev/checks/vetkit.c.crypto.weak-cipher/) (`vetkit.c.crypto.weak-cipher`): DES, 3DES, RC4, RC2 or Blowfish is used; these ciphers are broken or have a 64-bit block size.+ - [C password hashed with MD5 or SHA-1](https://vetkit.dev/checks/vetkit.c.crypto.weak-password-hash/) (`vetkit.c.crypto.weak-password-hash`): A password or secret is hashed with MD5 / SHA-1, which can be brute-forced quickly.
Showing the first 40 of each.