---
# System prepended metadata

title: Untitled

---

## A08 – Software and Data Integrity Failures

### CWE-345 Insufficient Verification of Data Authenticity

Not relevant since we communicate with API over HTTPS

### CWE-353 Missing Support for Integrity Check

Not relevant since we don't use custom transimission protocol. We always use HTTPS

### CWE-426 Untrusted Search Path

Not relevant since we use a CDN

### CWE-494 Download of Code Without Integrity Check

We use a lot of code from npm and we don't audit it directly. We rely on Github/Dependabot 
to notify us if there is security vulnerability discovered in any package.

### CWE-502 Deserialization of Untrusted Data

Not relevant since we only deserialize data from trusted source like API, Google, Firebase.

### CWE-565 Reliance on Cookies without Validation and Integrity Checking

Not relevant. We don't use cookies but we use tokens which are random string and their association 
with a specific user can't be modified. We trust that API always makes the necessary checks

### CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision

Not relevant. We don't use cookies but we use tokens which are random string and their association 
with a specific user can't be modified. We trust that API always makes the necessary checks

### CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Similar to CEW-494, we execute a lot of code from npm libraries. But we rely on Github/Dependabot 
to notify us if there is security vulnerability discovered in any package.

### CWE-830 Inclusion of Web Functionality from an Untrusted Source

We include 3rd party scripts, but they are all from trusted sources like GA, Stripe.

### CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

All input recieved by web application is sanitized and there is sensitive information held 
by the web application.