# Vulnerability Detection Guide

## Common Vulnerability Types
- Hardcoded credentials: API keys, passwords, tokens in source code
- SQL injection: unsanitized user input in queries
- XSS: unescaped user content in HTML output
- Path traversal: user-controlled file paths without validation

## Detection Patterns
- Search for: password, secret, api_key, token, credential patterns
- Check for: eval(), exec(), os.system() with user input
- Verify: input validation, output encoding, parameterized queries

## Encryption Assessment
- Weak algorithms: MD5, SHA1, DES, RC4
- Missing salt in password hashing
- Hardcoded encryption keys
- Missing TLS/SSL verification

## Reporting Format
- Severity: Critical, High, Medium, Low, Info
- Include: location, description, impact, remediation
- Prioritize by exploitability and business impact
