// Methodology · full pattern list

What Clira scans for.

This is the complete, published list of all 67 deterministic patterns Clira runs on every scan — no black box, no "proprietary heuristics" hand-waving. The same patterns run every time, so results are reproducible. Pattern names below are taken verbatim from the scanner source. This is static repository analysis: it reads your code, it does not execute it, and it is not an exploit test.

67 patterns 5 categories 8 languages 34 critical 20 high 12 medium 1 low

Secrets

29 patterns

Hardcoded credentials committed to the repository — live API keys, private keys, tokens, and connection strings for Stripe, AWS, GCP, OpenAI, Anthropic, Slack, and more. The single most common way AI-built apps get owned.

  • Stripe live secret keycritical
  • Stripe test secret keymedium
  • Private SSH/RSA keycritical
  • GitHub personal access tokencritical
  • Google API keyhigh
  • Database connection string with credentialscritical
  • LLM API key in sourcecritical
  • OpenAI-style API key (sk- prefix)critical
  • Anthropic API key (sk-ant- prefix)critical
  • AWS STS temporary access keycritical
  • AWS access key IDcritical
  • AWS secret access keycritical
  • AWS session tokenhigh
  • GCP service account key JSONcritical
  • Slack token (xox*-)critical
  • SendGrid API keycritical
  • Twilio Account SIDhigh
  • Twilio auth tokencritical
  • Mailgun API keycritical
  • npm automation tokencritical
  • PyPI API tokencritical
  • GitLab personal access tokencritical
  • JWT token in sourcehigh
  • JWT alg:none vulnerabilitycritical
  • OAuth2 client secretcritical
  • Heroku API keycritical
  • Cloudflare API keycritical
  • Discord bot/user tokencritical
  • Telegram bot tokencritical

Auth gaps

4 patterns

Routes and data queries that ship without enforced authentication — unprotected API and admin endpoints, and Supabase/PostgreSQL Row Level Security that is disabled or unverified.

  • API/admin route — verify auth decorator presenthigh
  • Express/Flask API route — verify auth middlewarehigh
  • Row Level Security (RLS) explicitly disabledcritical
  • Supabase query — verify RLS policy existsmedium

Config

4 patterns

Production misconfiguration — wide-open CORS, debug mode left on, hardcoded session and JWT secrets, and dev-only URLs that leak into production builds.

  • CORS configured to allow all originshigh
  • Debug mode enabledmedium
  • Hardcoded session/JWT secrethigh
  • localhost URL in source (may indicate dev-only config)low

Dependencies & code execution

21 patterns

Dangerous calls and injection sinks across JavaScript/TypeScript, Python, Go, Ruby, PHP, Java, and Rust — eval/exec, shell command execution, SQL built by string concatenation, IDOR, path traversal, and RCE-grade file inclusion.

  • Use of eval() detectedcritical
  • Use of exec()/eval() detectedhigh
  • Shell command execution from codemedium
  • Go: command execution via os/execmedium
  • Go: API/admin route — verify auth middlewarehigh
  • Go: SQL query built with string formattinghigh
  • Go: JWT operations — verify signing algorithmmedium
  • Ruby: command execution with interpolationhigh
  • Rails: verify auth before_action covers all actionsmedium
  • Rails: potential IDOR via direct params lookuphigh
  • Rails: render/send_file with user params — path traversal riskhigh
  • PHP: dangerous function callcritical
  • PHP: SQL injection via superglobalscritical
  • PHP: file inclusion via user input — RCEcritical
  • Java: Runtime.exec command executionmedium
  • Java: SQL Statement with string concatenationhigh
  • Java: Spring endpoint — verify auth annotationmedium
  • Rust: std::process::Command — verify input sanitizationmedium
  • Hardcoded credential variablehigh
  • .env file committed to repositorycritical
  • AWS credential in sourcecritical

AI/behavioral patterns

9 patterns

Mistakes that AI coding assistants (Cursor, Copilot, Lovable, Bolt, v0) produce at high rates and that generic SAST tools and human reviewers routinely miss — auth theater, env-or-literal secret fallbacks, and security controls left as TODO comments.

  • AI pattern: env-or-literal secret fallbackcritical
  • AI pattern: auth theater (placeholder identity)critical
  • AI pattern: MD5/SHA1 used for passwordshigh
  • AI pattern: Prisma $queryRaw with interpolationcritical
  • AI pattern: wildcard CORShigh
  • AI pattern: security control left as TODOmedium
  • AI pattern: empty catch swallows errorsmedium
  • AI pattern: dangerouslySetInnerHTML on dynamic datahigh
  • AI pattern: UUID used as a security tokenhigh
How the scan works, honestly: every pattern above is a deterministic check — the same input produces the same findings, every run. Test directories, fixtures, and vendored code are excluded to cut false positives. Matched secrets are redacted before they ever appear in a report. On top of this deterministic layer, optional external scanners (gitleaks, semgrep) can add findings, and an LLM synthesizes the report — but it is only allowed to describe findings the scanners produced, never to invent its own. Static analysis has limits: it cannot prove exploitability, and it does not test your running infrastructure.

Run all 67 against your repo.

One scan · auto-fix what we can · a GO / HARDEN / STOP verdict you can show your users.

Launch Clearance · $149