security-review
Audited by Runlayer on Mar 2, 2026
Malicious tool definition detected
Description: checksum entry.checksum = hashlib.sha256( f"{prev_checksum}{entry.timestamp}{entry.event_type}".encode() ).hexdigest() db.session.add(entry) db.session.commit() return entry # No delete method - audit logs are immutable ``` ### Retention Requirements ```python # Configure retention based on compliance requirements LOG_RETENTION = { 'security_events': 365, # 1 year 'authentication': 90, # 90 days 'access_logs': 30, # 30 days 'debug_logs': 7, # 7 days 'audit_trail': 2555, # 7 years (c
Malicious tool definition detected
Malicious tool definition detected
Description: grep -i "url" # Potential SSRF sinks grep -rn "curl_exec\|file_get_contents\|fopen\|readfile" --include="*.php" # Missing validation grep -rn "requests\.get(url\|fetch(url" --include="*.py" --include="*.js" ``` --- ## Testing Checklist - [ ] User-controlled URLs validated against allowlist - [ ] Internal IP ranges blocked (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) - [ ] Cloud metadata IPs blocked (169.254.169.254) - [ ] IPv6 internal addresses blocked - [ ] URL redirec
Tool passed security scan
Malicious tool definition detected
Description: = 'no-store' response.headers['X-Content-Type-Options'] = 'nosniff' response.headers['X-Frame-Options'] = 'DENY' response.headers['Content-Security-Policy'] = "default-src 'none'" return response ``` --- ## CORS Configuration ```python # VULNERABLE: Allow all origins CORS(app, origins='*') # VULNERABLE: Reflect origin header @app.after_request def add_cors(response): response.headers['Access-Control-Allow-Origin'] = request.headers.get('Origin') return response # SAFE: Explicit allo
Tool passed security scan
Malicious tool definition detected
Description: [ ] Internal packages use scoped names or claimed on public registries - [ ] CI/CD actions pinned to commit hashes - [ ] Secrets not hardcoded in CI/CD configs - [ ] Package integrity verified (checksums/signatures) - [ ] Pre/post install scripts reviewed - [ ] Private registry credentials not in code - [ ] SBOM generated for production dependencies --- ## References - [OWASP Dependency Check](https://owasp.org/www-project-dependency-check/) - [SLSA Framework](https://slsa.dev/) - [
Tool passed security scan
Malicious tool definition detected
Description: if transfer.amount > MAX_SINGLE_TRANSFER: errors.append("Exceeds single transfer limit") # Check daily limits daily_total = get_daily_transfer_total(transfer.from_account) if daily_total + transfer.amount > DAILY_LIMIT: errors.append("Exceeds daily transfer limit") # Check velocity (unusual number of transfers) recent_count = get_recent_transfer_count(transfer.from_account, hours=1) if recent_count > MAX_TRANSFERS_PER_HOUR: errors.append("Too many transfers in short period") # Check
Malicious tool definition detected
Description: with credentials) - [ ] Token not exposed in URL/logs - [ ] GET requests never change state --- ## References - [OWASP CSRF Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) - [CWE-352: Cross-Site Request Forgery](https://cwe.mitre.org/data/definitions/352.html) - [Fetch Metadata Headers](https://web.dev/fetch-metadata/) - [SameSite Cookies Explained](https://web.dev/samesite-cookies-explained/)
Malicious tool definition detected
Description: responses filtered to necessary fields only - [ ] Server headers don't reveal technology stack - [ ] Sensitive pages have no-cache headers - [ ] Data retention policies implemented - [ ] Secure deletion procedures for sensitive files - [ ] Debug mode disabled in production --- ## References - [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) - [OWASP Error Handling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Error_Ha
Tool passed security scan
Malicious tool definition detected
Description: --include="*.py" --include="*.js" | grep -i password grep -rn "hashlib\\.md5\|hashlib\\.sha" --include="*.py" # Predictable session IDs grep -rn "uuid1\|time\\(\\).*session\|user.*id.*session" --include="*.py" # Missing cookie security grep -rn "Set-Cookie" --include="*.py" --include="*.js" | grep -v -i "secure\|httponly" # Error message leakage grep -rn "not found\|invalid password\|does not exist" --include="*.py" --include="*.js" # Session handling grep -rn "session\\.regenerate\
Tool passed security scan
Malicious tool definition detected
SOURCE: {source} UNTRUSTED CONTENT START {content} UNTRUSTED CONTENT END Extract key facts from the above content.""" response = llm.complete(prompt) # Additional validation for external content if references_system(response): return "Unable to process content safely" return response ``` --- ## Cross-Site WebSocket Hijacking (CSWSH) ```python # VULNERABLE: No origin validation @app.websocket('/ws') async def websocket_handler(websocket): async for message in websocket: await process_message(mess
Tool passed security scan
Malicious tool definition detected
Description: os.chmod(path, stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP) # 640 # Directories: accessible by app def secure_directory_permissions(path): os.chmod(path, stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP) # 750 # Sensitive files: only owner def sensitive_file_permissions(path): os.chmod(path, stat.S_IRUSR | stat.S_IWUSR) # 600 ``` ### Temporary Files ```python import tempfile import os # VULNERABLE: Predictable temp file with open('/tmp/myapp_temp.txt', 'w') as f: f.write(sensitive_data) #
Tool passed security scan
Malicious tool definition detected
User.query.get(user_id) # May behave unexpectedly # SAFE: Explicit type conversion user_id = int(data['id']) ``` ### Race Conditions ```python # VULNERABLE: TOCTOU if user.balance >= amount: # Another request could modify balance here user.balance -= amount # SAFE: Atomic operation User.query.filter(User.id == user_id, User.balance >= amount).update( {User.balance: User.balance - amount} ) ``` --- ## Grep Patterns ```bash # Django unsafe patterns grep -rn "mark_safe\||safe\|autoescape off\|\.raw
Malicious tool definition detected
(Check settings, config files, middleware) - What framework protections exist? **Do NOT report issues based solely on pattern matching.** Investigate first, then report only what you're confident is exploitable.
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan
Passed Files (3)Click to expand
Tool passed security scan
Tool passed security scan
Tool passed security scan