~/ai/machin-secure · deterministic engine, no LLM in the loop · generated by the calling agent from JSONL output.test/fixtures/vuln.{py,js}) — intentional positives to verify the rule engine fires. No findings in the scanner's own source.| Severity | Rule | Line | Message | CWE | Snippet |
|---|---|---|---|---|---|
| critical | secret-stripe | 6 | Stripe secret key exposed | CWE-798 | API_KEY = "sk_test_1234567890abcdefghijklmnop" |
| high | py-hardcoded-secret | 6 | hardcoded secret in source | CWE-798 | API_KEY = "sk_test_1234567890abcdefghijklmnop" |
| high | py-hardcoded-secret | 7 | hardcoded secret in source | CWE-798 | SECRET_KEY = "hardcoded-super-secret-value" |
| high | config-secret-env-missing | 7 | secret hardcoded instead of read from env | CWE-798 | SECRET_KEY = "hardcoded-super-secret-value" |
| high | py-os-system | 10 | os.system() is command injection prone | CWE-78 | return os.system(cmd) |
| high | py-pickle-load | 13 | pickle deserialization is remote code execution | CWE-502 | return pickle.loads(data) |
| medium | py-yaml-unsafe | 16 | yaml.load without SafeLoader is unsafe | CWE-502 | return yaml.load(s) |
| medium | py-md5-password | 19 | md5 is broken; use bcrypt/argon2 for passwords | CWE-327 | return hashlib.md5(pw.encode()).hexdigest() |
| high | py-eval | 21 | eval() executes arbitrary code | CWE-95 | result = eval(input()) |
| Severity | Rule | Line | Message | CWE | Snippet |
|---|---|---|---|---|---|
| high | js-hardcoded-secret | 4 | hardcoded secret in source | CWE-798 | const api_key = "sk_live_1234567890abcdefghijkl" |
| high | js-hardcoded-secret | 5 | hardcoded secret in source | CWE-798 | const password = "super-secret-password-1234" |
| medium | js-innerhtml-assign | 12 | innerHTML assignment can cause XSS | CWE-79 | document.getElementById('x').innerHTML = html |
| medium | js-console-secret | 15 | secret logged to console | CWE-532 | console.log("token is", token) |
| high | js-verify-false | 17 | TLS certificate verification disabled | CWE-295 | https.get('https://example.com', { rejectUnauthorized: false }) |