Checks · HYG-006

HYG-006 · Open redirect

Why it matters

A redirect that trusts a query parameter can send a person to a lookalike site after they authenticate.

How we detect it

A redirect target comes from the request and is not checked against an allow-list.

How we fix it

Allow only relative paths or known hosts.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-002 · Missing CSP