Application Checks

Six checks examine the HTTP responses and behaviour of your web application.

APP-DEBUG-001 — Debug Mode Disabled

What it checks: Searches the HTTP response body for stack traces, debug toolbar markup, and framework-specific debug markers (Flask Werkzeug debugger, Django debug page, PHP error output).

Why it matters: Debug mode in production exposes internal routes, environment variables, and in Flask’s case an interactive Python console accessible to anyone who triggers an error. Sourcery reports this as one of the most commonly seen misconfigurations in production Flask deployments.

How to fix:

=== “Flask” python # In your application factory or wsgi.py app.config["DEBUG"] = False # Or via environment variable FLASK_DEBUG=0

=== “Django” python # settings.py DEBUG = False ALLOWED_HOSTS = ["your-domain.com"]

=== “PHP” php // php.ini or at runtime ini_set('display_errors', '0'); error_reporting(0);

APP-COOKIE-001 — Secure Cookie Flags

What it checks: Examines Set-Cookie headers for session cookies. All three of Secure, HttpOnly, and SameSite must be present.

Why it matters: Missing HttpOnly allows JavaScript to read the session cookie (XSS attack vector). Missing Secure allows the cookie to be transmitted over HTTP. Missing SameSite enables CSRF attacks.

How to fix:

=== “Flask” python app.config.update( SESSION_COOKIE_SECURE=True, SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE="Lax", )

=== “Django” python SESSION_COOKIE_SECURE = True SESSION_COOKIE_HTTPONLY = True SESSION_COOKIE_SAMESITE = "Lax"

APP-CSRF-001 — CSRF Protection

What it checks: Uses three detection strategies in order:

1. Strategy 1 — Searches response body for form-based CSRF tokens: Django csrfmiddlewaretoken, Flask-WTF csrf_token, Laravel @csrf, Rails authenticity_token
2. Strategy 2 — Checks for CSRF-specific response headers
3. Strategy 3 — Detects XSRF cookies in Set-Cookie headers (Angular, SPA frameworks using double-submit cookie pattern) The check passes if any strategy succeeds.

How to fix:

=== “Flask” python from flask_wtf.csrf import CSRFProtect csrf = CSRFProtect(app)

=== “Django” python # settings.py — ensure this is in MIDDLEWARE "django.middleware.csrf.CsrfViewMiddleware",

=== “Laravel” php // In your Blade template forms <form method="POST"> @csrf ... </form>

=== “Vanilla PHP” php session_start(); if (empty($_SESSION['csrf_token'])) { $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); }

APP-ADMIN-001 — Admin Endpoint Protection

What it checks: Probes ten admin paths:

/admin, /phpmyadmin, /pma, /cpanel, /wp-admin, /wp-login.php, /administrator, /dashboard, /manage, /control

SPA-aware detection: A 200 response with the same body length as the homepage is treated as WARN (likely a login wall or SPA router) rather than FAIL. FAIL is reserved for paths returning genuinely unique content indicating an exposed admin interface.

APP-RATE-001 — Rate Limiting

What it checks: Sends five rapid successive requests to the target URL and checks for a 429 Too Many Requests response.

How to fix:

=== “Flask” ```python from flask_limiter import Limiter from flask_limiter.util import get_remote_address

limiter = Limiter(app, key_func=get_remote_address,
                  default_limits=["100/minute"])
```

=== “nginx” nginx limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s; limit_req zone=api burst=20 nodelay;

APP-PASS-001 — Password Policy

What it checks: Searches the response body for password input fields lacking autocomplete="off", which can cause browsers to store credentials in potentially insecure locations.