After analyzing thousands of codebases, here are the most common security issues we find — ranked by frequency.
1. Hardcoded Secrets (73% of repos)
API keys, database passwords, and JWT secrets committed directly to source code.
Quick fix: Use environment variables and .env files (gitignored). Set up git pre-commit hooks with tools like git-secrets.
2. Missing Input Validation (68%)
User input goes directly to database queries, file operations, or shell commands without any validation.
Quick fix: Validate ALL inputs at the boundary. Use schema validation (Zod, Joi, Pydantic) and parameterized queries.
3. Broken Access Control / IDOR (54%)
Users can access other users' data by changing an ID in the URL.
Quick fix: Always check resource ownership: WHERE id = ? AND user_id = ?
4. No Rate Limiting (61%)
Login endpoints, API routes, and password reset flows without any rate limiting.
Quick fix: Use slowapi (Python), express-rate-limit (Node.js), or your CDN's rate limiting.
5. Sequential IDs Exposed (47%)
Sequential IDs in URLs make it trivial to enumerate resources.
Quick fix: Use UUIDs for public-facing IDs. Keep sequential IDs for internal use only.
6. Missing Security Headers (82%)
No CSP, no X-Frame-Options, no Strict-Transport-Security.
Quick fix: Add security headers via middleware or CDN config. Test at securityheaders.com.
7. SQL Injection (31%)
Still prevalent in PHP and Python codebases that use string formatting for queries.
Quick fix: Use parameterized queries or an ORM. Never concatenate user input into SQL.
# ❌ Vulnerable
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
# ✅ Safe
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
8. Weak Cryptography (39%)
MD5 or SHA1 for password hashing, weak encryption algorithms.
Quick fix: bcrypt/argon2 for passwords, AES-256-GCM for encryption.
9. Verbose Error Messages (56%)
Stack traces and internal paths exposed to users in production.
Quick fix: Catch all errors at the boundary, log internally, return generic messages to users.
10. Outdated Dependencies (44%)
Known CVEs in npm packages, pip requirements, or Composer dependencies.
Quick fix: Enable Dependabot/Renovate, run npm audit in CI, update regularly.
How to check your code automatically
I built SANGKUR to detect all 10 of these issues automatically. It uses a 5-engine pipeline:
- Pattern matching (540+ rules)
- Taint analysis (tracks user input → dangerous sinks)
- AST analysis (understands code structure)
- Cross-file data flow
- AI analysis with CVSS scoring
It's free to try — 30 scans/month, no credit card. Supports 23+ languages.
Try it: sangkur.com
What security issues do you see most often in code reviews? Let me know in the comments 👇
Top comments (0)