Missing nonce validation
CriticalAV-EXEC-002Execution authorizationCore pack
What it finds
Absence of `nonce`, `idempotency key`, `x-nonce`, or `requireNonce` patterns.
Why it matters
Without a unique per-request token, a captured request can be replayed to repeat the same action.
How to fix it
Add unique per-request nonce validation; reject any request that reuses a nonce.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- MISSING_NONCE
- How it detects
- Flags a safety control that should be there but is not.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent config or source
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.