FastAPI / Python security posture
Review linked rules in the directory and use Composer to export guardrails for your IDE. Detailed posture metrics will appear here as the catalog grows.
2 linked rules in the directory.
Top risks for this stack
00 critical05 high
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoSHIGH
Jun 2026
No rule coverage yet — consider contributing a rule.
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on WindowsHIGH
Jun 2026
No rule coverage yet — consider contributing a rule.
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`MEDIUM
Jun 2026
No rule coverage yet — consider contributing a rule.
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksMEDIUM
Jun 2026
Rule coverage exists — verify in Composer export.
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``HIGH
Oct 2025
Rule coverage exists — verify in Composer export.
FastAPI Guard regex bypass — XSS/SQLi through middlewareHIGH
Jul 2025
Rule coverage exists — verify in Composer export.
Starlette has possible denial-of-service vector when parsing large files in multipart formsMEDIUM
Jul 2025
Rule coverage exists — verify in Composer export.
fastapi-guard is vulnerable to ReDoS through inefficient regexHIGH
Jul 2025
Rule coverage exists — verify in Composer export.