Security Scanning Rules
SecureOdoo scans custom modules only. Odoo core and Enterprise modules are skipped.
| Rule | Severity | What it finds |
|---|---|---|
| SQL Injection | Critical | String formatting or concatenation in cr.execute() |
| Unsafe Code Execution | Critical | eval(), exec(), os.system() and subprocess with shell=True |
| Hardcoded Secrets | High | Passwords, API keys and tokens written into the source code |
| XSS Risk | High | Unsafe Markup() use and raw output in QWeb templates |
| Missing CSRF Protection | High | HTTP controllers with CSRF protection turned off |
| Missing Access Control Rules | High | Models without access rights |
| sudo() Misuse | Medium | Writes that bypass access rights with sudo() |
| Personal Data Exposure | Medium | Personal data fields without access groups |
| Sensitive Data in Logs | Medium | Passwords or tokens passed to logging calls |
| NIS2 Audit Trail | Medium | Custom models without a change history |