Serverless & Cloud
Function timeout abuse, over-privileged roles, env vars in logs, shared /tmp state, and cold start state leaks in serverless environments.
5 vulnerabilities
Function Timeout Abuse
mediumServerless functions without a configured timeout can be kept running indefinitely by malicious or malformed requests, draining your budget.
Over-privileged IAM Roles
mediumGiving serverless functions or services more IAM permissions than they need turns a minor breach into a full account compromise.
Environment Variables in Logs
highLogging process.env dumps all your secrets — API keys, database passwords, signing keys — directly into your log system.
Shared /tmp State
mediumServerless functions reuse execution environments between invocations, so sensitive files written to /tmp can be read by later requests from different users.
Cold Start State Leak
mediumGlobal variables in serverless functions persist across invocations in the same execution environment, leaking user data between requests.