Every check Loophole runs, explained the way you'd explain it to a friend. Big plain name first — the technical code stays small, for those who want it. All 50 run together in every scan; nothing to select or configure.
The #1 problem in AI-built apps — secrets typed straight into the code.
API keys and tokens typed directly into your files — visible to anyone who ever sees the project.
A real password sitting in a file instead of a private settings area.
The master key file of your server, included in the code folder itself.
Amazon/AWS access keys hardcoded — someone could run up cloud bills in your name.
Random-looking strings that behave exactly like passwords, even if nobody labelled them.
Passwords or tokens written into log files, where they quietly stay forever.
Ways a visitor can steal, change or delete your data through normal-looking forms.
Typed input slips into database commands — the classic way entire customer lists get stolen. Covers JavaScript, Python, Go and PHP.
The same trick aimed at MongoDB-style databases — login forms are the favourite target.
Company directory lookups built from typed input can be twisted to bypass logins.
Code that lets a visitor run things on your site or server they should never touch.
Comments and reviews shown without cleaning, so attackers can hide scripts in them. Four patterns covered.
Visitor input turned into server commands — the attacker ends up driving your machine.
eval() and friends running text as code — if any of that text comes from a visitor, game over.
Your server tricked into calling internal addresses it should never reveal or reach.
A JavaScript flaw where attackers quietly rewrite how your whole app behaves.
Uploaded XML files that make your server hand over its own private files.
A pattern so tangled that one crafted input can freeze your site for everyone.
Anything your app opens, unzips or accepts from a visitor.
Tricks like "../" that let visitors read files outside the folder they were allowed into.
A booby-trapped ZIP that writes files anywhere on your server when opened.
Upload boxes that never check what kind of file arrived — a favourite break-in route.
Saved-data formats (pickle, unserialize) that execute whatever an attacker packed inside.
The quiet switches that decide whether your logins and settings actually protect you.
JWT tokens read but never actually checked — a forged token sails straight in.
Settings that accept unsigned tokens, or secrets so short anyone can guess them.
Authentication shortcuts that look fine and fail quietly under attack.
Without it, a malicious page can make your logged-in visitors act without knowing.
Your app answering data requests from literally any website on the internet.
Links on your own trusted domain that silently bounce visitors to scam sites.
Standard browser protections (CSP, frame guards) simply never switched on.
Developer debug screens still active in the live app — they leak how everything works.
Full technical error messages handed to strangers — a map for attackers.
How passwords are stored and how data travels.
Passwords hashed with MD5 — crackable in seconds with free tools.
SHA-1 is retired for passwords for a reason — nearly as fast to crack as MD5.
Encryption methods from another era, broken by modern computers.
Encryption done with a fixed starting value, or ECB mode that leaks patterns in your data.
TLS verification disabled — your app will happily talk to a fake server.
Old connection protocols (TLS 1.0/1.1) that browsers and attackers both left behind.
"Random" codes and tokens an attacker can guess — session IDs, reset links, OTPs.