[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-sentry-security-review":3,"mdc-2nm2dp-key":35,"related-org-sentry-security-review":2335,"related-repo-sentry-security-review":2505},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":30,"sourceUrl":33,"mdContent":34},"security-review","perform security code reviews","Security code review for vulnerabilities. Use when asked to \"security review\", \"find vulnerabilities\", \"check for security issues\", \"audit security\", \"OWASP review\", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"sentry","Sentry","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fsentry.png","getsentry",[13,17,20],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Code Review","code-review",{"name":21,"slug":22,"type":16},"Code Analysis","code-analysis",861,"https:\u002F\u002Fgithub.com\u002Fgetsentry\u002Fskills","2026-05-15T06:16:37.038545","LICENSE",45,[29],"tag-production",{"repoUrl":24,"stars":23,"forks":27,"topics":31,"description":32},[29],"Agent Skills used by the Sentry team for development.","https:\u002F\u002Fgithub.com\u002Fgetsentry\u002Fskills\u002Ftree\u002FHEAD\u002Fskills\u002Fsecurity-review","---\nname: security-review\ndescription: Security code review for vulnerabilities. Use when asked to \"security review\", \"find vulnerabilities\", \"check for security issues\", \"audit security\", \"OWASP review\", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.\nallowed-tools: Read, Grep, Glob, Bash, Task\nlicense: LICENSE\n---\n\n\u003C!--\nReference material based on OWASP Cheat Sheet Series (CC BY-SA 4.0)\nhttps:\u002F\u002Fcheatsheetseries.owasp.org\u002F\n-->\n\n# Security Review Skill\n\nIdentify exploitable security vulnerabilities in code. Report only **HIGH CONFIDENCE** findings—clear vulnerable patterns with attacker-controlled input.\n\n## Scope: Research vs. Reporting\n\n**CRITICAL DISTINCTION:**\n\n- **Report on**: Only the specific file, diff, or code provided by the user\n- **Research**: The ENTIRE codebase to build confidence before reporting\n\nBefore flagging any issue, you MUST research the codebase to understand:\n- Where does this input actually come from? (Trace data flow)\n- Is there validation\u002Fsanitization elsewhere?\n- How is this configured? (Check settings, config files, middleware)\n- What framework protections exist?\n\n**Do NOT report issues based solely on pattern matching.** Investigate first, then report only what you're confident is exploitable.\n\n## Confidence Levels\n\n| Level | Criteria | Action |\n|-------|----------|--------|\n| **HIGH** | Vulnerable pattern + attacker-controlled input confirmed | **Report** with severity |\n| **MEDIUM** | Vulnerable pattern, input source unclear | **Note** as \"Needs verification\" |\n| **LOW** | Theoretical, best practice, defense-in-depth | **Do not report** |\n\n## Do Not Flag\n\n### General Rules\n- Test files (unless explicitly reviewing test security)\n- Dead code, commented code, documentation strings\n- Patterns using **constants** or **server-controlled configuration**\n- Code paths that require prior authentication to reach (note the auth requirement instead)\n\n### Server-Controlled Values (NOT Attacker-Controlled)\n\nThese are configured by operators, not controlled by attackers:\n\n| Source | Example | Why It's Safe |\n|--------|---------|---------------|\n| Django settings | `settings.API_URL`, `settings.ALLOWED_HOSTS` | Set via config\u002Fenv at deployment |\n| Environment variables | `os.environ.get('DATABASE_URL')` | Deployment configuration |\n| Config files | `config.yaml`, `app.config['KEY']` | Server-side files |\n| Framework constants | `django.conf.settings.*` | Not user-modifiable |\n| Hardcoded values | `BASE_URL = \"https:\u002F\u002Fapi.internal\"` | Compile-time constants |\n\n**SSRF Example - NOT a vulnerability:**\n```python\n# SAFE: URL comes from Django settings (server-controlled)\nresponse = requests.get(f\"{settings.SEER_AUTOFIX_URL}{path}\")\n```\n\n**SSRF Example - IS a vulnerability:**\n```python\n# VULNERABLE: URL comes from request (attacker-controlled)\nresponse = requests.get(request.GET.get('url'))\n```\n\n### Framework-Mitigated Patterns\nCheck language guides before flagging. Common false positives:\n\n| Pattern | Why It's Usually Safe |\n|---------|----------------------|\n| Django `{{ variable }}` | Auto-escaped by default |\n| React `{variable}` | Auto-escaped by default |\n| Vue `{{ variable }}` | Auto-escaped by default |\n| `User.objects.filter(id=input)` | ORM parameterizes queries |\n| `cursor.execute(\"...%s\", (input,))` | Parameterized query |\n| `innerHTML = \"\u003Cb>Loading...\u003C\u002Fb>\"` | Constant string, no user input |\n\n**Only flag these when:**\n- Django: `{{ var|safe }}`, `{% autoescape off %}`, `mark_safe(user_input)`\n- React: `dangerouslySetInnerHTML={{__html: userInput}}`\n- Vue: `v-html=\"userInput\"`\n- ORM: `.raw()`, `.extra()`, `RawSQL()` with string interpolation\n\n## Review Process\n\n### 1. Detect Context\n\nWhat type of code am I reviewing?\n\n| Code Type | Load These References |\n|-----------|----------------------|\n| API endpoints, routes | `authorization.md`, `authentication.md`, `injection.md` |\n| Frontend, templates | `xss.md`, `csrf.md` |\n| File handling, uploads | `file-security.md` |\n| Crypto, secrets, tokens | `cryptography.md`, `data-protection.md` |\n| Data serialization | `deserialization.md` |\n| External requests | `ssrf.md` |\n| Business workflows | `business-logic.md` |\n| GraphQL, REST design | `api-security.md` |\n| Config, headers, CORS | `misconfiguration.md` |\n| CI\u002FCD, dependencies | `supply-chain.md` |\n| Error handling | `error-handling.md` |\n| Audit, logging | `logging.md` |\n\n### 2. Load Language Guide\n\nBased on file extension or imports:\n\n| Indicators | Guide |\n|------------|-------|\n| `.py`, `django`, `flask`, `fastapi` | `languages\u002Fpython.md` |\n| `.js`, `.ts`, `express`, `react`, `vue`, `next` | `languages\u002Fjavascript.md` |\n| `.go`, `go.mod` | `languages\u002Fgo.md` |\n| `.rs`, `Cargo.toml` | `languages\u002Frust.md` |\n| `.java`, `spring`, `@Controller` | `languages\u002Fjava.md` |\n\n### 3. Load Infrastructure Guide (if applicable)\n\n| File Type | Guide |\n|-----------|-------|\n| `Dockerfile`, `.dockerignore` | `infrastructure\u002Fdocker.md` |\n| K8s manifests, Helm charts | `infrastructure\u002Fkubernetes.md` |\n| `.tf`, Terraform | `infrastructure\u002Fterraform.md` |\n| GitHub Actions, `.gitlab-ci.yml` | `infrastructure\u002Fci-cd.md` |\n| AWS\u002FGCP\u002FAzure configs, IAM | `infrastructure\u002Fcloud.md` |\n\n### 4. Research Before Flagging\n\n**For each potential issue, research the codebase to build confidence:**\n\n- Where does this value actually come from? Trace the data flow.\n- Is it configured at deployment (settings, env vars) or from user input?\n- Is there validation, sanitization, or allowlisting elsewhere?\n- What framework protections apply?\n\nOnly report issues where you have HIGH confidence after understanding the broader context.\n\n### 5. Verify Exploitability\n\nFor each potential finding, confirm:\n\n**Is the input attacker-controlled?**\n\n| Attacker-Controlled (Investigate) | Server-Controlled (Usually Safe) |\n|-----------------------------------|----------------------------------|\n| `request.GET`, `request.POST`, `request.args` | `settings.X`, `app.config['X']` |\n| `request.json`, `request.data`, `request.body` | `os.environ.get('X')` |\n| `request.headers` (most headers) | Hardcoded constants |\n| `request.cookies` (unsigned) | Internal service URLs from config |\n| URL path segments: `\u002Fusers\u002F\u003Cid>\u002F` | Database content from admin\u002Fsystem |\n| File uploads (content and names) | Signed session data |\n| Database content from other users | Framework settings |\n| WebSocket messages | |\n\n**Does the framework mitigate this?**\n- Check language guide for auto-escaping, parameterization\n- Check for middleware\u002Fdecorators that sanitize\n\n**Is there validation upstream?**\n- Input validation before this code\n- Sanitization libraries (DOMPurify, bleach, etc.)\n\n### 6. Report HIGH Confidence Only\n\nSkip theoretical issues. Report only what you've confirmed is exploitable after research.\n\n---\n\n## Severity Classification\n\n| Severity | Impact | Examples |\n|----------|--------|----------|\n| **Critical** | Direct exploit, severe impact, no auth required | RCE, SQL injection to data, auth bypass, hardcoded secrets |\n| **High** | Exploitable with conditions, significant impact | Stored XSS, SSRF to metadata, IDOR to sensitive data |\n| **Medium** | Specific conditions required, moderate impact | Reflected XSS, CSRF on state-changing actions, path traversal |\n| **Low** | Defense-in-depth, minimal direct impact | Missing headers, verbose errors, weak algorithms in non-critical context |\n\n---\n\n## Quick Patterns Reference\n\n### Always Flag (Critical)\n```\neval(user_input)           # Any language\nexec(user_input)           # Any language\npickle.loads(user_data)    # Python\nyaml.load(user_data)       # Python (not safe_load)\nunserialize($user_data)    # PHP\ndeserialize(user_data)     # Java ObjectInputStream\nshell=True + user_input    # Python subprocess\nchild_process.exec(user)   # Node.js\n```\n\n### Always Flag (High)\n```\ninnerHTML = userInput              # DOM XSS\ndangerouslySetInnerHTML={user}     # React XSS\nv-html=\"userInput\"                 # Vue XSS\nf\"SELECT * FROM x WHERE {user}\"    # SQL injection\n`SELECT * FROM x WHERE ${user}`    # SQL injection\nos.system(f\"cmd {user_input}\")     # Command injection\n```\n\n### Always Flag (Secrets)\n```\npassword = \"hardcoded\"\napi_key = \"sk-...\"\nAWS_SECRET_ACCESS_KEY = \"...\"\nprivate_key = \"-----BEGIN\"\n```\n\n### Check Context First (MUST Investigate Before Flagging)\n```\n# SSRF - ONLY if URL is from user input, NOT from settings\u002Fconfig\nrequests.get(request.GET['url'])     # FLAG: User-controlled URL\nrequests.get(settings.API_URL)       # SAFE: Server-controlled config\nrequests.get(f\"{settings.BASE}\u002F{x}\") # CHECK: Is 'x' user input?\n\n# Path traversal - ONLY if path is from user input\nopen(request.GET['file'])            # FLAG: User-controlled path\nopen(settings.LOG_PATH)              # SAFE: Server-controlled config\nopen(f\"{BASE_DIR}\u002F{filename}\")       # CHECK: Is 'filename' user input?\n\n# Open redirect - ONLY if URL is from user input\nredirect(request.GET['next'])        # FLAG: User-controlled redirect\nredirect(settings.LOGIN_URL)         # SAFE: Server-controlled config\n\n# Weak crypto - ONLY if used for security purposes\nhashlib.md5(file_content)            # SAFE: File checksums, caching\nhashlib.md5(password)                # FLAG: Password hashing\nrandom.random()                      # SAFE: Non-security uses (UI, sampling)\nrandom.random() for token            # FLAG: Security tokens need secrets module\n```\n\n---\n\n## Output Format\n\n```markdown\n## Security Review: [File\u002FComponent Name]\n\n### Summary\n- **Findings**: X (Y Critical, Z High, ...)\n- **Risk Level**: Critical\u002FHigh\u002FMedium\u002FLow\n- **Confidence**: High\u002FMixed\n\n### Findings\n\n#### [VULN-001] [Vulnerability Type] (Severity)\n- **Location**: `file.py:123`\n- **Confidence**: High\n- **Issue**: [What the vulnerability is]\n- **Impact**: [What an attacker could do]\n- **Evidence**:\n  ```python\n  [Vulnerable code snippet]\n  ```\n- **Fix**: [How to remediate]\n\n### Needs Verification\n\n#### [VERIFY-001] [Potential Issue]\n- **Location**: `file.py:456`\n- **Question**: [What needs to be verified]\n```\n\nIf no vulnerabilities found, state: \"No high-confidence vulnerabilities identified.\"\n\n---\n\n## Reference Files\n\n### Core Vulnerabilities (`references\u002F`)\n| File | Covers |\n|------|--------|\n| `injection.md` | SQL, NoSQL, OS command, LDAP, template injection |\n| `xss.md` | Reflected, stored, DOM-based XSS |\n| `authorization.md` | Authorization, IDOR, privilege escalation |\n| `authentication.md` | Sessions, credentials, password storage |\n| `cryptography.md` | Algorithms, key management, randomness |\n| `deserialization.md` | Pickle, YAML, Java, PHP deserialization |\n| `file-security.md` | Path traversal, uploads, XXE |\n| `ssrf.md` | Server-side request forgery |\n| `csrf.md` | Cross-site request forgery |\n| `data-protection.md` | Secrets exposure, PII, logging |\n| `api-security.md` | REST, GraphQL, mass assignment |\n| `business-logic.md` | Race conditions, workflow bypass |\n| `modern-threats.md` | Prototype pollution, LLM injection, WebSocket |\n| `misconfiguration.md` | Headers, CORS, debug mode, defaults |\n| `error-handling.md` | Fail-open, information disclosure |\n| `supply-chain.md` | Dependencies, build security |\n| `logging.md` | Audit failures, log injection |\n\n### Language Guides (`languages\u002F`)\n- `python.md` - Django, Flask, FastAPI patterns\n- `javascript.md` - Node, Express, React, Vue, Next.js\n- `go.md` - Go-specific security patterns\n- `rust.md` - Rust unsafe blocks, FFI security\n- `java.md` - Spring, Java EE patterns\n\n### Infrastructure (`infrastructure\u002F`)\n- `docker.md` - Container security\n- `kubernetes.md` - K8s RBAC, secrets, policies\n- `terraform.md` - IaC security\n- `ci-cd.md` - Pipeline security\n- `cloud.md` - AWS\u002FGCP\u002FAzure security\n",{"data":36,"body":38},{"name":4,"description":6,"allowed-tools":37,"license":26},"Read, Grep, Glob, Bash, Task",{"type":39,"children":40},"root",[41,50,64,71,79,104,109,132,142,148,257,263,270,305,311,316,469,477,508,516,539,545,550,677,685,762,768,774,779,1033,1039,1044,1255,1261,1390,1396,1404,1427,1432,1438,1443,1451,1644,1652,1665,1673,1686,1692,1697,1701,1707,1818,1821,1827,1833,1843,1849,1858,1864,1873,1879,1888,1891,1897,2249,2266,2272,2289,2320,2329],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"security-review-skill",[47],{"type":48,"value":49},"text","Security Review Skill",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54,56,62],{"type":48,"value":55},"Identify exploitable security vulnerabilities in code. Report only ",{"type":42,"tag":57,"props":58,"children":59},"strong",{},[60],{"type":48,"value":61},"HIGH CONFIDENCE",{"type":48,"value":63}," findings—clear vulnerable patterns with attacker-controlled input.",{"type":42,"tag":65,"props":66,"children":68},"h2",{"id":67},"scope-research-vs-reporting",[69],{"type":48,"value":70},"Scope: Research vs. Reporting",{"type":42,"tag":51,"props":72,"children":73},{},[74],{"type":42,"tag":57,"props":75,"children":76},{},[77],{"type":48,"value":78},"CRITICAL DISTINCTION:",{"type":42,"tag":80,"props":81,"children":82},"ul",{},[83,94],{"type":42,"tag":84,"props":85,"children":86},"li",{},[87,92],{"type":42,"tag":57,"props":88,"children":89},{},[90],{"type":48,"value":91},"Report on",{"type":48,"value":93},": Only the specific file, diff, or code provided by the user",{"type":42,"tag":84,"props":95,"children":96},{},[97,102],{"type":42,"tag":57,"props":98,"children":99},{},[100],{"type":48,"value":101},"Research",{"type":48,"value":103},": The ENTIRE codebase to build confidence before reporting",{"type":42,"tag":51,"props":105,"children":106},{},[107],{"type":48,"value":108},"Before flagging any issue, you MUST research the codebase to understand:",{"type":42,"tag":80,"props":110,"children":111},{},[112,117,122,127],{"type":42,"tag":84,"props":113,"children":114},{},[115],{"type":48,"value":116},"Where does this input actually come from? (Trace data flow)",{"type":42,"tag":84,"props":118,"children":119},{},[120],{"type":48,"value":121},"Is there validation\u002Fsanitization elsewhere?",{"type":42,"tag":84,"props":123,"children":124},{},[125],{"type":48,"value":126},"How is this configured? (Check settings, config files, middleware)",{"type":42,"tag":84,"props":128,"children":129},{},[130],{"type":48,"value":131},"What framework protections exist?",{"type":42,"tag":51,"props":133,"children":134},{},[135,140],{"type":42,"tag":57,"props":136,"children":137},{},[138],{"type":48,"value":139},"Do NOT report issues based solely on pattern matching.",{"type":48,"value":141}," Investigate first, then report only what you're confident is exploitable.",{"type":42,"tag":65,"props":143,"children":145},{"id":144},"confidence-levels",[146],{"type":48,"value":147},"Confidence Levels",{"type":42,"tag":149,"props":150,"children":151},"table",{},[152,176],{"type":42,"tag":153,"props":154,"children":155},"thead",{},[156],{"type":42,"tag":157,"props":158,"children":159},"tr",{},[160,166,171],{"type":42,"tag":161,"props":162,"children":163},"th",{},[164],{"type":48,"value":165},"Level",{"type":42,"tag":161,"props":167,"children":168},{},[169],{"type":48,"value":170},"Criteria",{"type":42,"tag":161,"props":172,"children":173},{},[174],{"type":48,"value":175},"Action",{"type":42,"tag":177,"props":178,"children":179},"tbody",{},[180,207,233],{"type":42,"tag":157,"props":181,"children":182},{},[183,192,197],{"type":42,"tag":184,"props":185,"children":186},"td",{},[187],{"type":42,"tag":57,"props":188,"children":189},{},[190],{"type":48,"value":191},"HIGH",{"type":42,"tag":184,"props":193,"children":194},{},[195],{"type":48,"value":196},"Vulnerable pattern + attacker-controlled input confirmed",{"type":42,"tag":184,"props":198,"children":199},{},[200,205],{"type":42,"tag":57,"props":201,"children":202},{},[203],{"type":48,"value":204},"Report",{"type":48,"value":206}," with severity",{"type":42,"tag":157,"props":208,"children":209},{},[210,218,223],{"type":42,"tag":184,"props":211,"children":212},{},[213],{"type":42,"tag":57,"props":214,"children":215},{},[216],{"type":48,"value":217},"MEDIUM",{"type":42,"tag":184,"props":219,"children":220},{},[221],{"type":48,"value":222},"Vulnerable pattern, input source unclear",{"type":42,"tag":184,"props":224,"children":225},{},[226,231],{"type":42,"tag":57,"props":227,"children":228},{},[229],{"type":48,"value":230},"Note",{"type":48,"value":232}," as \"Needs verification\"",{"type":42,"tag":157,"props":234,"children":235},{},[236,244,249],{"type":42,"tag":184,"props":237,"children":238},{},[239],{"type":42,"tag":57,"props":240,"children":241},{},[242],{"type":48,"value":243},"LOW",{"type":42,"tag":184,"props":245,"children":246},{},[247],{"type":48,"value":248},"Theoretical, best practice, defense-in-depth",{"type":42,"tag":184,"props":250,"children":251},{},[252],{"type":42,"tag":57,"props":253,"children":254},{},[255],{"type":48,"value":256},"Do not report",{"type":42,"tag":65,"props":258,"children":260},{"id":259},"do-not-flag",[261],{"type":48,"value":262},"Do Not Flag",{"type":42,"tag":264,"props":265,"children":267},"h3",{"id":266},"general-rules",[268],{"type":48,"value":269},"General Rules",{"type":42,"tag":80,"props":271,"children":272},{},[273,278,283,300],{"type":42,"tag":84,"props":274,"children":275},{},[276],{"type":48,"value":277},"Test files (unless explicitly reviewing test security)",{"type":42,"tag":84,"props":279,"children":280},{},[281],{"type":48,"value":282},"Dead code, commented code, documentation strings",{"type":42,"tag":84,"props":284,"children":285},{},[286,288,293,295],{"type":48,"value":287},"Patterns using ",{"type":42,"tag":57,"props":289,"children":290},{},[291],{"type":48,"value":292},"constants",{"type":48,"value":294}," or ",{"type":42,"tag":57,"props":296,"children":297},{},[298],{"type":48,"value":299},"server-controlled configuration",{"type":42,"tag":84,"props":301,"children":302},{},[303],{"type":48,"value":304},"Code paths that require prior authentication to reach (note the auth requirement instead)",{"type":42,"tag":264,"props":306,"children":308},{"id":307},"server-controlled-values-not-attacker-controlled",[309],{"type":48,"value":310},"Server-Controlled Values (NOT Attacker-Controlled)",{"type":42,"tag":51,"props":312,"children":313},{},[314],{"type":48,"value":315},"These are configured by operators, not controlled by attackers:",{"type":42,"tag":149,"props":317,"children":318},{},[319,340],{"type":42,"tag":153,"props":320,"children":321},{},[322],{"type":42,"tag":157,"props":323,"children":324},{},[325,330,335],{"type":42,"tag":161,"props":326,"children":327},{},[328],{"type":48,"value":329},"Source",{"type":42,"tag":161,"props":331,"children":332},{},[333],{"type":48,"value":334},"Example",{"type":42,"tag":161,"props":336,"children":337},{},[338],{"type":48,"value":339},"Why It's Safe",{"type":42,"tag":177,"props":341,"children":342},{},[343,374,396,425,447],{"type":42,"tag":157,"props":344,"children":345},{},[346,351,369],{"type":42,"tag":184,"props":347,"children":348},{},[349],{"type":48,"value":350},"Django settings",{"type":42,"tag":184,"props":352,"children":353},{},[354,361,363],{"type":42,"tag":355,"props":356,"children":358},"code",{"className":357},[],[359],{"type":48,"value":360},"settings.API_URL",{"type":48,"value":362},", ",{"type":42,"tag":355,"props":364,"children":366},{"className":365},[],[367],{"type":48,"value":368},"settings.ALLOWED_HOSTS",{"type":42,"tag":184,"props":370,"children":371},{},[372],{"type":48,"value":373},"Set via config\u002Fenv at deployment",{"type":42,"tag":157,"props":375,"children":376},{},[377,382,391],{"type":42,"tag":184,"props":378,"children":379},{},[380],{"type":48,"value":381},"Environment variables",{"type":42,"tag":184,"props":383,"children":384},{},[385],{"type":42,"tag":355,"props":386,"children":388},{"className":387},[],[389],{"type":48,"value":390},"os.environ.get('DATABASE_URL')",{"type":42,"tag":184,"props":392,"children":393},{},[394],{"type":48,"value":395},"Deployment configuration",{"type":42,"tag":157,"props":397,"children":398},{},[399,404,420],{"type":42,"tag":184,"props":400,"children":401},{},[402],{"type":48,"value":403},"Config files",{"type":42,"tag":184,"props":405,"children":406},{},[407,413,414],{"type":42,"tag":355,"props":408,"children":410},{"className":409},[],[411],{"type":48,"value":412},"config.yaml",{"type":48,"value":362},{"type":42,"tag":355,"props":415,"children":417},{"className":416},[],[418],{"type":48,"value":419},"app.config['KEY']",{"type":42,"tag":184,"props":421,"children":422},{},[423],{"type":48,"value":424},"Server-side files",{"type":42,"tag":157,"props":426,"children":427},{},[428,433,442],{"type":42,"tag":184,"props":429,"children":430},{},[431],{"type":48,"value":432},"Framework constants",{"type":42,"tag":184,"props":434,"children":435},{},[436],{"type":42,"tag":355,"props":437,"children":439},{"className":438},[],[440],{"type":48,"value":441},"django.conf.settings.*",{"type":42,"tag":184,"props":443,"children":444},{},[445],{"type":48,"value":446},"Not user-modifiable",{"type":42,"tag":157,"props":448,"children":449},{},[450,455,464],{"type":42,"tag":184,"props":451,"children":452},{},[453],{"type":48,"value":454},"Hardcoded values",{"type":42,"tag":184,"props":456,"children":457},{},[458],{"type":42,"tag":355,"props":459,"children":461},{"className":460},[],[462],{"type":48,"value":463},"BASE_URL = \"https:\u002F\u002Fapi.internal\"",{"type":42,"tag":184,"props":465,"children":466},{},[467],{"type":48,"value":468},"Compile-time constants",{"type":42,"tag":51,"props":470,"children":471},{},[472],{"type":42,"tag":57,"props":473,"children":474},{},[475],{"type":48,"value":476},"SSRF Example - NOT a vulnerability:",{"type":42,"tag":478,"props":479,"children":484},"pre",{"className":480,"code":481,"language":482,"meta":483,"style":483},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# SAFE: URL comes from Django settings (server-controlled)\nresponse = requests.get(f\"{settings.SEER_AUTOFIX_URL}{path}\")\n","python","",[485],{"type":42,"tag":355,"props":486,"children":487},{"__ignoreMap":483},[488,499],{"type":42,"tag":489,"props":490,"children":493},"span",{"class":491,"line":492},"line",1,[494],{"type":42,"tag":489,"props":495,"children":496},{},[497],{"type":48,"value":498},"# SAFE: URL comes from Django settings (server-controlled)\n",{"type":42,"tag":489,"props":500,"children":502},{"class":491,"line":501},2,[503],{"type":42,"tag":489,"props":504,"children":505},{},[506],{"type":48,"value":507},"response = requests.get(f\"{settings.SEER_AUTOFIX_URL}{path}\")\n",{"type":42,"tag":51,"props":509,"children":510},{},[511],{"type":42,"tag":57,"props":512,"children":513},{},[514],{"type":48,"value":515},"SSRF Example - IS a vulnerability:",{"type":42,"tag":478,"props":517,"children":519},{"className":480,"code":518,"language":482,"meta":483,"style":483},"# VULNERABLE: URL comes from request (attacker-controlled)\nresponse = requests.get(request.GET.get('url'))\n",[520],{"type":42,"tag":355,"props":521,"children":522},{"__ignoreMap":483},[523,531],{"type":42,"tag":489,"props":524,"children":525},{"class":491,"line":492},[526],{"type":42,"tag":489,"props":527,"children":528},{},[529],{"type":48,"value":530},"# VULNERABLE: URL comes from request (attacker-controlled)\n",{"type":42,"tag":489,"props":532,"children":533},{"class":491,"line":501},[534],{"type":42,"tag":489,"props":535,"children":536},{},[537],{"type":48,"value":538},"response = requests.get(request.GET.get('url'))\n",{"type":42,"tag":264,"props":540,"children":542},{"id":541},"framework-mitigated-patterns",[543],{"type":48,"value":544},"Framework-Mitigated Patterns",{"type":42,"tag":51,"props":546,"children":547},{},[548],{"type":48,"value":549},"Check language guides before flagging. Common false positives:",{"type":42,"tag":149,"props":551,"children":552},{},[553,569],{"type":42,"tag":153,"props":554,"children":555},{},[556],{"type":42,"tag":157,"props":557,"children":558},{},[559,564],{"type":42,"tag":161,"props":560,"children":561},{},[562],{"type":48,"value":563},"Pattern",{"type":42,"tag":161,"props":565,"children":566},{},[567],{"type":48,"value":568},"Why It's Usually Safe",{"type":42,"tag":177,"props":570,"children":571},{},[572,591,609,626,643,660],{"type":42,"tag":157,"props":573,"children":574},{},[575,586],{"type":42,"tag":184,"props":576,"children":577},{},[578,580],{"type":48,"value":579},"Django ",{"type":42,"tag":355,"props":581,"children":583},{"className":582},[],[584],{"type":48,"value":585},"{{ variable }}",{"type":42,"tag":184,"props":587,"children":588},{},[589],{"type":48,"value":590},"Auto-escaped by default",{"type":42,"tag":157,"props":592,"children":593},{},[594,605],{"type":42,"tag":184,"props":595,"children":596},{},[597,599],{"type":48,"value":598},"React ",{"type":42,"tag":355,"props":600,"children":602},{"className":601},[],[603],{"type":48,"value":604},"{variable}",{"type":42,"tag":184,"props":606,"children":607},{},[608],{"type":48,"value":590},{"type":42,"tag":157,"props":610,"children":611},{},[612,622],{"type":42,"tag":184,"props":613,"children":614},{},[615,617],{"type":48,"value":616},"Vue ",{"type":42,"tag":355,"props":618,"children":620},{"className":619},[],[621],{"type":48,"value":585},{"type":42,"tag":184,"props":623,"children":624},{},[625],{"type":48,"value":590},{"type":42,"tag":157,"props":627,"children":628},{},[629,638],{"type":42,"tag":184,"props":630,"children":631},{},[632],{"type":42,"tag":355,"props":633,"children":635},{"className":634},[],[636],{"type":48,"value":637},"User.objects.filter(id=input)",{"type":42,"tag":184,"props":639,"children":640},{},[641],{"type":48,"value":642},"ORM parameterizes queries",{"type":42,"tag":157,"props":644,"children":645},{},[646,655],{"type":42,"tag":184,"props":647,"children":648},{},[649],{"type":42,"tag":355,"props":650,"children":652},{"className":651},[],[653],{"type":48,"value":654},"cursor.execute(\"...%s\", (input,))",{"type":42,"tag":184,"props":656,"children":657},{},[658],{"type":48,"value":659},"Parameterized query",{"type":42,"tag":157,"props":661,"children":662},{},[663,672],{"type":42,"tag":184,"props":664,"children":665},{},[666],{"type":42,"tag":355,"props":667,"children":669},{"className":668},[],[670],{"type":48,"value":671},"innerHTML = \"\u003Cb>Loading...\u003C\u002Fb>\"",{"type":42,"tag":184,"props":673,"children":674},{},[675],{"type":48,"value":676},"Constant string, no user input",{"type":42,"tag":51,"props":678,"children":679},{},[680],{"type":42,"tag":57,"props":681,"children":682},{},[683],{"type":48,"value":684},"Only flag these when:",{"type":42,"tag":80,"props":686,"children":687},{},[688,713,724,735],{"type":42,"tag":84,"props":689,"children":690},{},[691,693,699,700,706,707],{"type":48,"value":692},"Django: ",{"type":42,"tag":355,"props":694,"children":696},{"className":695},[],[697],{"type":48,"value":698},"{{ var|safe }}",{"type":48,"value":362},{"type":42,"tag":355,"props":701,"children":703},{"className":702},[],[704],{"type":48,"value":705},"{% autoescape off %}",{"type":48,"value":362},{"type":42,"tag":355,"props":708,"children":710},{"className":709},[],[711],{"type":48,"value":712},"mark_safe(user_input)",{"type":42,"tag":84,"props":714,"children":715},{},[716,718],{"type":48,"value":717},"React: ",{"type":42,"tag":355,"props":719,"children":721},{"className":720},[],[722],{"type":48,"value":723},"dangerouslySetInnerHTML={{__html: userInput}}",{"type":42,"tag":84,"props":725,"children":726},{},[727,729],{"type":48,"value":728},"Vue: ",{"type":42,"tag":355,"props":730,"children":732},{"className":731},[],[733],{"type":48,"value":734},"v-html=\"userInput\"",{"type":42,"tag":84,"props":736,"children":737},{},[738,740,746,747,753,754,760],{"type":48,"value":739},"ORM: ",{"type":42,"tag":355,"props":741,"children":743},{"className":742},[],[744],{"type":48,"value":745},".raw()",{"type":48,"value":362},{"type":42,"tag":355,"props":748,"children":750},{"className":749},[],[751],{"type":48,"value":752},".extra()",{"type":48,"value":362},{"type":42,"tag":355,"props":755,"children":757},{"className":756},[],[758],{"type":48,"value":759},"RawSQL()",{"type":48,"value":761}," with string interpolation",{"type":42,"tag":65,"props":763,"children":765},{"id":764},"review-process",[766],{"type":48,"value":767},"Review Process",{"type":42,"tag":264,"props":769,"children":771},{"id":770},"_1-detect-context",[772],{"type":48,"value":773},"1. Detect Context",{"type":42,"tag":51,"props":775,"children":776},{},[777],{"type":48,"value":778},"What type of code am I reviewing?",{"type":42,"tag":149,"props":780,"children":781},{},[782,798],{"type":42,"tag":153,"props":783,"children":784},{},[785],{"type":42,"tag":157,"props":786,"children":787},{},[788,793],{"type":42,"tag":161,"props":789,"children":790},{},[791],{"type":48,"value":792},"Code Type",{"type":42,"tag":161,"props":794,"children":795},{},[796],{"type":48,"value":797},"Load These References",{"type":42,"tag":177,"props":799,"children":800},{},[801,832,856,873,897,914,931,948,965,982,999,1016],{"type":42,"tag":157,"props":802,"children":803},{},[804,809],{"type":42,"tag":184,"props":805,"children":806},{},[807],{"type":48,"value":808},"API endpoints, routes",{"type":42,"tag":184,"props":810,"children":811},{},[812,818,819,825,826],{"type":42,"tag":355,"props":813,"children":815},{"className":814},[],[816],{"type":48,"value":817},"authorization.md",{"type":48,"value":362},{"type":42,"tag":355,"props":820,"children":822},{"className":821},[],[823],{"type":48,"value":824},"authentication.md",{"type":48,"value":362},{"type":42,"tag":355,"props":827,"children":829},{"className":828},[],[830],{"type":48,"value":831},"injection.md",{"type":42,"tag":157,"props":833,"children":834},{},[835,840],{"type":42,"tag":184,"props":836,"children":837},{},[838],{"type":48,"value":839},"Frontend, templates",{"type":42,"tag":184,"props":841,"children":842},{},[843,849,850],{"type":42,"tag":355,"props":844,"children":846},{"className":845},[],[847],{"type":48,"value":848},"xss.md",{"type":48,"value":362},{"type":42,"tag":355,"props":851,"children":853},{"className":852},[],[854],{"type":48,"value":855},"csrf.md",{"type":42,"tag":157,"props":857,"children":858},{},[859,864],{"type":42,"tag":184,"props":860,"children":861},{},[862],{"type":48,"value":863},"File handling, uploads",{"type":42,"tag":184,"props":865,"children":866},{},[867],{"type":42,"tag":355,"props":868,"children":870},{"className":869},[],[871],{"type":48,"value":872},"file-security.md",{"type":42,"tag":157,"props":874,"children":875},{},[876,881],{"type":42,"tag":184,"props":877,"children":878},{},[879],{"type":48,"value":880},"Crypto, secrets, tokens",{"type":42,"tag":184,"props":882,"children":883},{},[884,890,891],{"type":42,"tag":355,"props":885,"children":887},{"className":886},[],[888],{"type":48,"value":889},"cryptography.md",{"type":48,"value":362},{"type":42,"tag":355,"props":892,"children":894},{"className":893},[],[895],{"type":48,"value":896},"data-protection.md",{"type":42,"tag":157,"props":898,"children":899},{},[900,905],{"type":42,"tag":184,"props":901,"children":902},{},[903],{"type":48,"value":904},"Data serialization",{"type":42,"tag":184,"props":906,"children":907},{},[908],{"type":42,"tag":355,"props":909,"children":911},{"className":910},[],[912],{"type":48,"value":913},"deserialization.md",{"type":42,"tag":157,"props":915,"children":916},{},[917,922],{"type":42,"tag":184,"props":918,"children":919},{},[920],{"type":48,"value":921},"External requests",{"type":42,"tag":184,"props":923,"children":924},{},[925],{"type":42,"tag":355,"props":926,"children":928},{"className":927},[],[929],{"type":48,"value":930},"ssrf.md",{"type":42,"tag":157,"props":932,"children":933},{},[934,939],{"type":42,"tag":184,"props":935,"children":936},{},[937],{"type":48,"value":938},"Business workflows",{"type":42,"tag":184,"props":940,"children":941},{},[942],{"type":42,"tag":355,"props":943,"children":945},{"className":944},[],[946],{"type":48,"value":947},"business-logic.md",{"type":42,"tag":157,"props":949,"children":950},{},[951,956],{"type":42,"tag":184,"props":952,"children":953},{},[954],{"type":48,"value":955},"GraphQL, REST design",{"type":42,"tag":184,"props":957,"children":958},{},[959],{"type":42,"tag":355,"props":960,"children":962},{"className":961},[],[963],{"type":48,"value":964},"api-security.md",{"type":42,"tag":157,"props":966,"children":967},{},[968,973],{"type":42,"tag":184,"props":969,"children":970},{},[971],{"type":48,"value":972},"Config, headers, CORS",{"type":42,"tag":184,"props":974,"children":975},{},[976],{"type":42,"tag":355,"props":977,"children":979},{"className":978},[],[980],{"type":48,"value":981},"misconfiguration.md",{"type":42,"tag":157,"props":983,"children":984},{},[985,990],{"type":42,"tag":184,"props":986,"children":987},{},[988],{"type":48,"value":989},"CI\u002FCD, dependencies",{"type":42,"tag":184,"props":991,"children":992},{},[993],{"type":42,"tag":355,"props":994,"children":996},{"className":995},[],[997],{"type":48,"value":998},"supply-chain.md",{"type":42,"tag":157,"props":1000,"children":1001},{},[1002,1007],{"type":42,"tag":184,"props":1003,"children":1004},{},[1005],{"type":48,"value":1006},"Error handling",{"type":42,"tag":184,"props":1008,"children":1009},{},[1010],{"type":42,"tag":355,"props":1011,"children":1013},{"className":1012},[],[1014],{"type":48,"value":1015},"error-handling.md",{"type":42,"tag":157,"props":1017,"children":1018},{},[1019,1024],{"type":42,"tag":184,"props":1020,"children":1021},{},[1022],{"type":48,"value":1023},"Audit, logging",{"type":42,"tag":184,"props":1025,"children":1026},{},[1027],{"type":42,"tag":355,"props":1028,"children":1030},{"className":1029},[],[1031],{"type":48,"value":1032},"logging.md",{"type":42,"tag":264,"props":1034,"children":1036},{"id":1035},"_2-load-language-guide",[1037],{"type":48,"value":1038},"2. Load Language Guide",{"type":42,"tag":51,"props":1040,"children":1041},{},[1042],{"type":48,"value":1043},"Based on file extension or imports:",{"type":42,"tag":149,"props":1045,"children":1046},{},[1047,1063],{"type":42,"tag":153,"props":1048,"children":1049},{},[1050],{"type":42,"tag":157,"props":1051,"children":1052},{},[1053,1058],{"type":42,"tag":161,"props":1054,"children":1055},{},[1056],{"type":48,"value":1057},"Indicators",{"type":42,"tag":161,"props":1059,"children":1060},{},[1061],{"type":48,"value":1062},"Guide",{"type":42,"tag":177,"props":1064,"children":1065},{},[1066,1108,1164,1192,1220],{"type":42,"tag":157,"props":1067,"children":1068},{},[1069,1099],{"type":42,"tag":184,"props":1070,"children":1071},{},[1072,1078,1079,1085,1086,1092,1093],{"type":42,"tag":355,"props":1073,"children":1075},{"className":1074},[],[1076],{"type":48,"value":1077},".py",{"type":48,"value":362},{"type":42,"tag":355,"props":1080,"children":1082},{"className":1081},[],[1083],{"type":48,"value":1084},"django",{"type":48,"value":362},{"type":42,"tag":355,"props":1087,"children":1089},{"className":1088},[],[1090],{"type":48,"value":1091},"flask",{"type":48,"value":362},{"type":42,"tag":355,"props":1094,"children":1096},{"className":1095},[],[1097],{"type":48,"value":1098},"fastapi",{"type":42,"tag":184,"props":1100,"children":1101},{},[1102],{"type":42,"tag":355,"props":1103,"children":1105},{"className":1104},[],[1106],{"type":48,"value":1107},"languages\u002Fpython.md",{"type":42,"tag":157,"props":1109,"children":1110},{},[1111,1155],{"type":42,"tag":184,"props":1112,"children":1113},{},[1114,1120,1121,1127,1128,1134,1135,1141,1142,1148,1149],{"type":42,"tag":355,"props":1115,"children":1117},{"className":1116},[],[1118],{"type":48,"value":1119},".js",{"type":48,"value":362},{"type":42,"tag":355,"props":1122,"children":1124},{"className":1123},[],[1125],{"type":48,"value":1126},".ts",{"type":48,"value":362},{"type":42,"tag":355,"props":1129,"children":1131},{"className":1130},[],[1132],{"type":48,"value":1133},"express",{"type":48,"value":362},{"type":42,"tag":355,"props":1136,"children":1138},{"className":1137},[],[1139],{"type":48,"value":1140},"react",{"type":48,"value":362},{"type":42,"tag":355,"props":1143,"children":1145},{"className":1144},[],[1146],{"type":48,"value":1147},"vue",{"type":48,"value":362},{"type":42,"tag":355,"props":1150,"children":1152},{"className":1151},[],[1153],{"type":48,"value":1154},"next",{"type":42,"tag":184,"props":1156,"children":1157},{},[1158],{"type":42,"tag":355,"props":1159,"children":1161},{"className":1160},[],[1162],{"type":48,"value":1163},"languages\u002Fjavascript.md",{"type":42,"tag":157,"props":1165,"children":1166},{},[1167,1183],{"type":42,"tag":184,"props":1168,"children":1169},{},[1170,1176,1177],{"type":42,"tag":355,"props":1171,"children":1173},{"className":1172},[],[1174],{"type":48,"value":1175},".go",{"type":48,"value":362},{"type":42,"tag":355,"props":1178,"children":1180},{"className":1179},[],[1181],{"type":48,"value":1182},"go.mod",{"type":42,"tag":184,"props":1184,"children":1185},{},[1186],{"type":42,"tag":355,"props":1187,"children":1189},{"className":1188},[],[1190],{"type":48,"value":1191},"languages\u002Fgo.md",{"type":42,"tag":157,"props":1193,"children":1194},{},[1195,1211],{"type":42,"tag":184,"props":1196,"children":1197},{},[1198,1204,1205],{"type":42,"tag":355,"props":1199,"children":1201},{"className":1200},[],[1202],{"type":48,"value":1203},".rs",{"type":48,"value":362},{"type":42,"tag":355,"props":1206,"children":1208},{"className":1207},[],[1209],{"type":48,"value":1210},"Cargo.toml",{"type":42,"tag":184,"props":1212,"children":1213},{},[1214],{"type":42,"tag":355,"props":1215,"children":1217},{"className":1216},[],[1218],{"type":48,"value":1219},"languages\u002Frust.md",{"type":42,"tag":157,"props":1221,"children":1222},{},[1223,1246],{"type":42,"tag":184,"props":1224,"children":1225},{},[1226,1232,1233,1239,1240],{"type":42,"tag":355,"props":1227,"children":1229},{"className":1228},[],[1230],{"type":48,"value":1231},".java",{"type":48,"value":362},{"type":42,"tag":355,"props":1234,"children":1236},{"className":1235},[],[1237],{"type":48,"value":1238},"spring",{"type":48,"value":362},{"type":42,"tag":355,"props":1241,"children":1243},{"className":1242},[],[1244],{"type":48,"value":1245},"@Controller",{"type":42,"tag":184,"props":1247,"children":1248},{},[1249],{"type":42,"tag":355,"props":1250,"children":1252},{"className":1251},[],[1253],{"type":48,"value":1254},"languages\u002Fjava.md",{"type":42,"tag":264,"props":1256,"children":1258},{"id":1257},"_3-load-infrastructure-guide-if-applicable",[1259],{"type":48,"value":1260},"3. Load Infrastructure Guide (if applicable)",{"type":42,"tag":149,"props":1262,"children":1263},{},[1264,1279],{"type":42,"tag":153,"props":1265,"children":1266},{},[1267],{"type":42,"tag":157,"props":1268,"children":1269},{},[1270,1275],{"type":42,"tag":161,"props":1271,"children":1272},{},[1273],{"type":48,"value":1274},"File Type",{"type":42,"tag":161,"props":1276,"children":1277},{},[1278],{"type":48,"value":1062},{"type":42,"tag":177,"props":1280,"children":1281},{},[1282,1310,1327,1350,1373],{"type":42,"tag":157,"props":1283,"children":1284},{},[1285,1301],{"type":42,"tag":184,"props":1286,"children":1287},{},[1288,1294,1295],{"type":42,"tag":355,"props":1289,"children":1291},{"className":1290},[],[1292],{"type":48,"value":1293},"Dockerfile",{"type":48,"value":362},{"type":42,"tag":355,"props":1296,"children":1298},{"className":1297},[],[1299],{"type":48,"value":1300},".dockerignore",{"type":42,"tag":184,"props":1302,"children":1303},{},[1304],{"type":42,"tag":355,"props":1305,"children":1307},{"className":1306},[],[1308],{"type":48,"value":1309},"infrastructure\u002Fdocker.md",{"type":42,"tag":157,"props":1311,"children":1312},{},[1313,1318],{"type":42,"tag":184,"props":1314,"children":1315},{},[1316],{"type":48,"value":1317},"K8s manifests, Helm charts",{"type":42,"tag":184,"props":1319,"children":1320},{},[1321],{"type":42,"tag":355,"props":1322,"children":1324},{"className":1323},[],[1325],{"type":48,"value":1326},"infrastructure\u002Fkubernetes.md",{"type":42,"tag":157,"props":1328,"children":1329},{},[1330,1341],{"type":42,"tag":184,"props":1331,"children":1332},{},[1333,1339],{"type":42,"tag":355,"props":1334,"children":1336},{"className":1335},[],[1337],{"type":48,"value":1338},".tf",{"type":48,"value":1340},", Terraform",{"type":42,"tag":184,"props":1342,"children":1343},{},[1344],{"type":42,"tag":355,"props":1345,"children":1347},{"className":1346},[],[1348],{"type":48,"value":1349},"infrastructure\u002Fterraform.md",{"type":42,"tag":157,"props":1351,"children":1352},{},[1353,1364],{"type":42,"tag":184,"props":1354,"children":1355},{},[1356,1358],{"type":48,"value":1357},"GitHub Actions, ",{"type":42,"tag":355,"props":1359,"children":1361},{"className":1360},[],[1362],{"type":48,"value":1363},".gitlab-ci.yml",{"type":42,"tag":184,"props":1365,"children":1366},{},[1367],{"type":42,"tag":355,"props":1368,"children":1370},{"className":1369},[],[1371],{"type":48,"value":1372},"infrastructure\u002Fci-cd.md",{"type":42,"tag":157,"props":1374,"children":1375},{},[1376,1381],{"type":42,"tag":184,"props":1377,"children":1378},{},[1379],{"type":48,"value":1380},"AWS\u002FGCP\u002FAzure configs, IAM",{"type":42,"tag":184,"props":1382,"children":1383},{},[1384],{"type":42,"tag":355,"props":1385,"children":1387},{"className":1386},[],[1388],{"type":48,"value":1389},"infrastructure\u002Fcloud.md",{"type":42,"tag":264,"props":1391,"children":1393},{"id":1392},"_4-research-before-flagging",[1394],{"type":48,"value":1395},"4. Research Before Flagging",{"type":42,"tag":51,"props":1397,"children":1398},{},[1399],{"type":42,"tag":57,"props":1400,"children":1401},{},[1402],{"type":48,"value":1403},"For each potential issue, research the codebase to build confidence:",{"type":42,"tag":80,"props":1405,"children":1406},{},[1407,1412,1417,1422],{"type":42,"tag":84,"props":1408,"children":1409},{},[1410],{"type":48,"value":1411},"Where does this value actually come from? Trace the data flow.",{"type":42,"tag":84,"props":1413,"children":1414},{},[1415],{"type":48,"value":1416},"Is it configured at deployment (settings, env vars) or from user input?",{"type":42,"tag":84,"props":1418,"children":1419},{},[1420],{"type":48,"value":1421},"Is there validation, sanitization, or allowlisting elsewhere?",{"type":42,"tag":84,"props":1423,"children":1424},{},[1425],{"type":48,"value":1426},"What framework protections apply?",{"type":42,"tag":51,"props":1428,"children":1429},{},[1430],{"type":48,"value":1431},"Only report issues where you have HIGH confidence after understanding the broader context.",{"type":42,"tag":264,"props":1433,"children":1435},{"id":1434},"_5-verify-exploitability",[1436],{"type":48,"value":1437},"5. Verify Exploitability",{"type":42,"tag":51,"props":1439,"children":1440},{},[1441],{"type":48,"value":1442},"For each potential finding, confirm:",{"type":42,"tag":51,"props":1444,"children":1445},{},[1446],{"type":42,"tag":57,"props":1447,"children":1448},{},[1449],{"type":48,"value":1450},"Is the input attacker-controlled?",{"type":42,"tag":149,"props":1452,"children":1453},{},[1454,1470],{"type":42,"tag":153,"props":1455,"children":1456},{},[1457],{"type":42,"tag":157,"props":1458,"children":1459},{},[1460,1465],{"type":42,"tag":161,"props":1461,"children":1462},{},[1463],{"type":48,"value":1464},"Attacker-Controlled (Investigate)",{"type":42,"tag":161,"props":1466,"children":1467},{},[1468],{"type":48,"value":1469},"Server-Controlled (Usually Safe)",{"type":42,"tag":177,"props":1471,"children":1472},{},[1473,1515,1550,1569,1588,1607,1620,1633],{"type":42,"tag":157,"props":1474,"children":1475},{},[1476,1499],{"type":42,"tag":184,"props":1477,"children":1478},{},[1479,1485,1486,1492,1493],{"type":42,"tag":355,"props":1480,"children":1482},{"className":1481},[],[1483],{"type":48,"value":1484},"request.GET",{"type":48,"value":362},{"type":42,"tag":355,"props":1487,"children":1489},{"className":1488},[],[1490],{"type":48,"value":1491},"request.POST",{"type":48,"value":362},{"type":42,"tag":355,"props":1494,"children":1496},{"className":1495},[],[1497],{"type":48,"value":1498},"request.args",{"type":42,"tag":184,"props":1500,"children":1501},{},[1502,1508,1509],{"type":42,"tag":355,"props":1503,"children":1505},{"className":1504},[],[1506],{"type":48,"value":1507},"settings.X",{"type":48,"value":362},{"type":42,"tag":355,"props":1510,"children":1512},{"className":1511},[],[1513],{"type":48,"value":1514},"app.config['X']",{"type":42,"tag":157,"props":1516,"children":1517},{},[1518,1541],{"type":42,"tag":184,"props":1519,"children":1520},{},[1521,1527,1528,1534,1535],{"type":42,"tag":355,"props":1522,"children":1524},{"className":1523},[],[1525],{"type":48,"value":1526},"request.json",{"type":48,"value":362},{"type":42,"tag":355,"props":1529,"children":1531},{"className":1530},[],[1532],{"type":48,"value":1533},"request.data",{"type":48,"value":362},{"type":42,"tag":355,"props":1536,"children":1538},{"className":1537},[],[1539],{"type":48,"value":1540},"request.body",{"type":42,"tag":184,"props":1542,"children":1543},{},[1544],{"type":42,"tag":355,"props":1545,"children":1547},{"className":1546},[],[1548],{"type":48,"value":1549},"os.environ.get('X')",{"type":42,"tag":157,"props":1551,"children":1552},{},[1553,1564],{"type":42,"tag":184,"props":1554,"children":1555},{},[1556,1562],{"type":42,"tag":355,"props":1557,"children":1559},{"className":1558},[],[1560],{"type":48,"value":1561},"request.headers",{"type":48,"value":1563}," (most headers)",{"type":42,"tag":184,"props":1565,"children":1566},{},[1567],{"type":48,"value":1568},"Hardcoded constants",{"type":42,"tag":157,"props":1570,"children":1571},{},[1572,1583],{"type":42,"tag":184,"props":1573,"children":1574},{},[1575,1581],{"type":42,"tag":355,"props":1576,"children":1578},{"className":1577},[],[1579],{"type":48,"value":1580},"request.cookies",{"type":48,"value":1582}," (unsigned)",{"type":42,"tag":184,"props":1584,"children":1585},{},[1586],{"type":48,"value":1587},"Internal service URLs from config",{"type":42,"tag":157,"props":1589,"children":1590},{},[1591,1602],{"type":42,"tag":184,"props":1592,"children":1593},{},[1594,1596],{"type":48,"value":1595},"URL path segments: ",{"type":42,"tag":355,"props":1597,"children":1599},{"className":1598},[],[1600],{"type":48,"value":1601},"\u002Fusers\u002F\u003Cid>\u002F",{"type":42,"tag":184,"props":1603,"children":1604},{},[1605],{"type":48,"value":1606},"Database content from admin\u002Fsystem",{"type":42,"tag":157,"props":1608,"children":1609},{},[1610,1615],{"type":42,"tag":184,"props":1611,"children":1612},{},[1613],{"type":48,"value":1614},"File uploads (content and names)",{"type":42,"tag":184,"props":1616,"children":1617},{},[1618],{"type":48,"value":1619},"Signed session data",{"type":42,"tag":157,"props":1621,"children":1622},{},[1623,1628],{"type":42,"tag":184,"props":1624,"children":1625},{},[1626],{"type":48,"value":1627},"Database content from other users",{"type":42,"tag":184,"props":1629,"children":1630},{},[1631],{"type":48,"value":1632},"Framework settings",{"type":42,"tag":157,"props":1634,"children":1635},{},[1636,1641],{"type":42,"tag":184,"props":1637,"children":1638},{},[1639],{"type":48,"value":1640},"WebSocket messages",{"type":42,"tag":184,"props":1642,"children":1643},{},[],{"type":42,"tag":51,"props":1645,"children":1646},{},[1647],{"type":42,"tag":57,"props":1648,"children":1649},{},[1650],{"type":48,"value":1651},"Does the framework mitigate this?",{"type":42,"tag":80,"props":1653,"children":1654},{},[1655,1660],{"type":42,"tag":84,"props":1656,"children":1657},{},[1658],{"type":48,"value":1659},"Check language guide for auto-escaping, parameterization",{"type":42,"tag":84,"props":1661,"children":1662},{},[1663],{"type":48,"value":1664},"Check for middleware\u002Fdecorators that sanitize",{"type":42,"tag":51,"props":1666,"children":1667},{},[1668],{"type":42,"tag":57,"props":1669,"children":1670},{},[1671],{"type":48,"value":1672},"Is there validation upstream?",{"type":42,"tag":80,"props":1674,"children":1675},{},[1676,1681],{"type":42,"tag":84,"props":1677,"children":1678},{},[1679],{"type":48,"value":1680},"Input validation before this code",{"type":42,"tag":84,"props":1682,"children":1683},{},[1684],{"type":48,"value":1685},"Sanitization libraries (DOMPurify, bleach, etc.)",{"type":42,"tag":264,"props":1687,"children":1689},{"id":1688},"_6-report-high-confidence-only",[1690],{"type":48,"value":1691},"6. Report HIGH Confidence Only",{"type":42,"tag":51,"props":1693,"children":1694},{},[1695],{"type":48,"value":1696},"Skip theoretical issues. Report only what you've confirmed is exploitable after research.",{"type":42,"tag":1698,"props":1699,"children":1700},"hr",{},[],{"type":42,"tag":65,"props":1702,"children":1704},{"id":1703},"severity-classification",[1705],{"type":48,"value":1706},"Severity Classification",{"type":42,"tag":149,"props":1708,"children":1709},{},[1710,1731],{"type":42,"tag":153,"props":1711,"children":1712},{},[1713],{"type":42,"tag":157,"props":1714,"children":1715},{},[1716,1721,1726],{"type":42,"tag":161,"props":1717,"children":1718},{},[1719],{"type":48,"value":1720},"Severity",{"type":42,"tag":161,"props":1722,"children":1723},{},[1724],{"type":48,"value":1725},"Impact",{"type":42,"tag":161,"props":1727,"children":1728},{},[1729],{"type":48,"value":1730},"Examples",{"type":42,"tag":177,"props":1732,"children":1733},{},[1734,1755,1776,1797],{"type":42,"tag":157,"props":1735,"children":1736},{},[1737,1745,1750],{"type":42,"tag":184,"props":1738,"children":1739},{},[1740],{"type":42,"tag":57,"props":1741,"children":1742},{},[1743],{"type":48,"value":1744},"Critical",{"type":42,"tag":184,"props":1746,"children":1747},{},[1748],{"type":48,"value":1749},"Direct exploit, severe impact, no auth required",{"type":42,"tag":184,"props":1751,"children":1752},{},[1753],{"type":48,"value":1754},"RCE, SQL injection to data, auth bypass, hardcoded secrets",{"type":42,"tag":157,"props":1756,"children":1757},{},[1758,1766,1771],{"type":42,"tag":184,"props":1759,"children":1760},{},[1761],{"type":42,"tag":57,"props":1762,"children":1763},{},[1764],{"type":48,"value":1765},"High",{"type":42,"tag":184,"props":1767,"children":1768},{},[1769],{"type":48,"value":1770},"Exploitable with conditions, significant impact",{"type":42,"tag":184,"props":1772,"children":1773},{},[1774],{"type":48,"value":1775},"Stored XSS, SSRF to metadata, IDOR to sensitive data",{"type":42,"tag":157,"props":1777,"children":1778},{},[1779,1787,1792],{"type":42,"tag":184,"props":1780,"children":1781},{},[1782],{"type":42,"tag":57,"props":1783,"children":1784},{},[1785],{"type":48,"value":1786},"Medium",{"type":42,"tag":184,"props":1788,"children":1789},{},[1790],{"type":48,"value":1791},"Specific conditions required, moderate impact",{"type":42,"tag":184,"props":1793,"children":1794},{},[1795],{"type":48,"value":1796},"Reflected XSS, CSRF on state-changing actions, path traversal",{"type":42,"tag":157,"props":1798,"children":1799},{},[1800,1808,1813],{"type":42,"tag":184,"props":1801,"children":1802},{},[1803],{"type":42,"tag":57,"props":1804,"children":1805},{},[1806],{"type":48,"value":1807},"Low",{"type":42,"tag":184,"props":1809,"children":1810},{},[1811],{"type":48,"value":1812},"Defense-in-depth, minimal direct impact",{"type":42,"tag":184,"props":1814,"children":1815},{},[1816],{"type":48,"value":1817},"Missing headers, verbose errors, weak algorithms in non-critical context",{"type":42,"tag":1698,"props":1819,"children":1820},{},[],{"type":42,"tag":65,"props":1822,"children":1824},{"id":1823},"quick-patterns-reference",[1825],{"type":48,"value":1826},"Quick Patterns Reference",{"type":42,"tag":264,"props":1828,"children":1830},{"id":1829},"always-flag-critical",[1831],{"type":48,"value":1832},"Always Flag (Critical)",{"type":42,"tag":478,"props":1834,"children":1838},{"className":1835,"code":1837,"language":48},[1836],"language-text","eval(user_input)           # Any language\nexec(user_input)           # Any language\npickle.loads(user_data)    # Python\nyaml.load(user_data)       # Python (not safe_load)\nunserialize($user_data)    # PHP\ndeserialize(user_data)     # Java ObjectInputStream\nshell=True + user_input    # Python subprocess\nchild_process.exec(user)   # Node.js\n",[1839],{"type":42,"tag":355,"props":1840,"children":1841},{"__ignoreMap":483},[1842],{"type":48,"value":1837},{"type":42,"tag":264,"props":1844,"children":1846},{"id":1845},"always-flag-high",[1847],{"type":48,"value":1848},"Always Flag (High)",{"type":42,"tag":478,"props":1850,"children":1853},{"className":1851,"code":1852,"language":48},[1836],"innerHTML = userInput              # DOM XSS\ndangerouslySetInnerHTML={user}     # React XSS\nv-html=\"userInput\"                 # Vue XSS\nf\"SELECT * FROM x WHERE {user}\"    # SQL injection\n`SELECT * FROM x WHERE ${user}`    # SQL injection\nos.system(f\"cmd {user_input}\")     # Command injection\n",[1854],{"type":42,"tag":355,"props":1855,"children":1856},{"__ignoreMap":483},[1857],{"type":48,"value":1852},{"type":42,"tag":264,"props":1859,"children":1861},{"id":1860},"always-flag-secrets",[1862],{"type":48,"value":1863},"Always Flag (Secrets)",{"type":42,"tag":478,"props":1865,"children":1868},{"className":1866,"code":1867,"language":48},[1836],"password = \"hardcoded\"\napi_key = \"sk-...\"\nAWS_SECRET_ACCESS_KEY = \"...\"\nprivate_key = \"-----BEGIN\"\n",[1869],{"type":42,"tag":355,"props":1870,"children":1871},{"__ignoreMap":483},[1872],{"type":48,"value":1867},{"type":42,"tag":264,"props":1874,"children":1876},{"id":1875},"check-context-first-must-investigate-before-flagging",[1877],{"type":48,"value":1878},"Check Context First (MUST Investigate Before Flagging)",{"type":42,"tag":478,"props":1880,"children":1883},{"className":1881,"code":1882,"language":48},[1836],"# SSRF - ONLY if URL is from user input, NOT from settings\u002Fconfig\nrequests.get(request.GET['url'])     # FLAG: User-controlled URL\nrequests.get(settings.API_URL)       # SAFE: Server-controlled config\nrequests.get(f\"{settings.BASE}\u002F{x}\") # CHECK: Is 'x' user input?\n\n# Path traversal - ONLY if path is from user input\nopen(request.GET['file'])            # FLAG: User-controlled path\nopen(settings.LOG_PATH)              # SAFE: Server-controlled config\nopen(f\"{BASE_DIR}\u002F{filename}\")       # CHECK: Is 'filename' user input?\n\n# Open redirect - ONLY if URL is from user input\nredirect(request.GET['next'])        # FLAG: User-controlled redirect\nredirect(settings.LOGIN_URL)         # SAFE: Server-controlled config\n\n# Weak crypto - ONLY if used for security purposes\nhashlib.md5(file_content)            # SAFE: File checksums, caching\nhashlib.md5(password)                # FLAG: Password hashing\nrandom.random()                      # SAFE: Non-security uses (UI, sampling)\nrandom.random() for token            # FLAG: Security tokens need secrets module\n",[1884],{"type":42,"tag":355,"props":1885,"children":1886},{"__ignoreMap":483},[1887],{"type":48,"value":1882},{"type":42,"tag":1698,"props":1889,"children":1890},{},[],{"type":42,"tag":65,"props":1892,"children":1894},{"id":1893},"output-format",[1895],{"type":48,"value":1896},"Output Format",{"type":42,"tag":478,"props":1898,"children":1902},{"className":1899,"code":1900,"language":1901,"meta":483,"style":483},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","## Security Review: [File\u002FComponent Name]\n\n### Summary\n- **Findings**: X (Y Critical, Z High, ...)\n- **Risk Level**: Critical\u002FHigh\u002FMedium\u002FLow\n- **Confidence**: High\u002FMixed\n\n### Findings\n\n#### [VULN-001] [Vulnerability Type] (Severity)\n- **Location**: `file.py:123`\n- **Confidence**: High\n- **Issue**: [What the vulnerability is]\n- **Impact**: [What an attacker could do]\n- **Evidence**:\n  ```python\n  [Vulnerable code snippet]\n","markdown",[1903],{"type":42,"tag":355,"props":1904,"children":1905},{"__ignoreMap":483},[1906,1921,1930,1944,1976,2002,2028,2036,2049,2057,2082,2123,2148,2174,2199,2225,2240],{"type":42,"tag":489,"props":1907,"children":1908},{"class":491,"line":492},[1909,1915],{"type":42,"tag":489,"props":1910,"children":1912},{"style":1911},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1913],{"type":48,"value":1914},"## ",{"type":42,"tag":489,"props":1916,"children":1918},{"style":1917},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1919],{"type":48,"value":1920},"Security Review: [File\u002FComponent Name]\n",{"type":42,"tag":489,"props":1922,"children":1923},{"class":491,"line":501},[1924],{"type":42,"tag":489,"props":1925,"children":1927},{"emptyLinePlaceholder":1926},true,[1928],{"type":48,"value":1929},"\n",{"type":42,"tag":489,"props":1931,"children":1933},{"class":491,"line":1932},3,[1934,1939],{"type":42,"tag":489,"props":1935,"children":1936},{"style":1911},[1937],{"type":48,"value":1938},"### ",{"type":42,"tag":489,"props":1940,"children":1941},{"style":1917},[1942],{"type":48,"value":1943},"Summary\n",{"type":42,"tag":489,"props":1945,"children":1947},{"class":491,"line":1946},4,[1948,1953,1959,1965,1970],{"type":42,"tag":489,"props":1949,"children":1950},{"style":1911},[1951],{"type":48,"value":1952},"-",{"type":42,"tag":489,"props":1954,"children":1956},{"style":1955},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[1957],{"type":48,"value":1958}," **",{"type":42,"tag":489,"props":1960,"children":1962},{"style":1961},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[1963],{"type":48,"value":1964},"Findings",{"type":42,"tag":489,"props":1966,"children":1967},{"style":1955},[1968],{"type":48,"value":1969},"**",{"type":42,"tag":489,"props":1971,"children":1973},{"style":1972},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1974],{"type":48,"value":1975},": X (Y Critical, Z High, ...)\n",{"type":42,"tag":489,"props":1977,"children":1979},{"class":491,"line":1978},5,[1980,1984,1988,1993,1997],{"type":42,"tag":489,"props":1981,"children":1982},{"style":1911},[1983],{"type":48,"value":1952},{"type":42,"tag":489,"props":1985,"children":1986},{"style":1955},[1987],{"type":48,"value":1958},{"type":42,"tag":489,"props":1989,"children":1990},{"style":1961},[1991],{"type":48,"value":1992},"Risk Level",{"type":42,"tag":489,"props":1994,"children":1995},{"style":1955},[1996],{"type":48,"value":1969},{"type":42,"tag":489,"props":1998,"children":1999},{"style":1972},[2000],{"type":48,"value":2001},": Critical\u002FHigh\u002FMedium\u002FLow\n",{"type":42,"tag":489,"props":2003,"children":2005},{"class":491,"line":2004},6,[2006,2010,2014,2019,2023],{"type":42,"tag":489,"props":2007,"children":2008},{"style":1911},[2009],{"type":48,"value":1952},{"type":42,"tag":489,"props":2011,"children":2012},{"style":1955},[2013],{"type":48,"value":1958},{"type":42,"tag":489,"props":2015,"children":2016},{"style":1961},[2017],{"type":48,"value":2018},"Confidence",{"type":42,"tag":489,"props":2020,"children":2021},{"style":1955},[2022],{"type":48,"value":1969},{"type":42,"tag":489,"props":2024,"children":2025},{"style":1972},[2026],{"type":48,"value":2027},": High\u002FMixed\n",{"type":42,"tag":489,"props":2029,"children":2031},{"class":491,"line":2030},7,[2032],{"type":42,"tag":489,"props":2033,"children":2034},{"emptyLinePlaceholder":1926},[2035],{"type":48,"value":1929},{"type":42,"tag":489,"props":2037,"children":2039},{"class":491,"line":2038},8,[2040,2044],{"type":42,"tag":489,"props":2041,"children":2042},{"style":1911},[2043],{"type":48,"value":1938},{"type":42,"tag":489,"props":2045,"children":2046},{"style":1917},[2047],{"type":48,"value":2048},"Findings\n",{"type":42,"tag":489,"props":2050,"children":2052},{"class":491,"line":2051},9,[2053],{"type":42,"tag":489,"props":2054,"children":2055},{"emptyLinePlaceholder":1926},[2056],{"type":48,"value":1929},{"type":42,"tag":489,"props":2058,"children":2060},{"class":491,"line":2059},10,[2061,2066,2072,2077],{"type":42,"tag":489,"props":2062,"children":2063},{"style":1911},[2064],{"type":48,"value":2065},"#### [",{"type":42,"tag":489,"props":2067,"children":2069},{"style":2068},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[2070],{"type":48,"value":2071},"VULN-001",{"type":42,"tag":489,"props":2073,"children":2074},{"style":1911},[2075],{"type":48,"value":2076},"]",{"type":42,"tag":489,"props":2078,"children":2079},{"style":1917},[2080],{"type":48,"value":2081}," [Vulnerability Type] (Severity)\n",{"type":42,"tag":489,"props":2083,"children":2085},{"class":491,"line":2084},11,[2086,2090,2094,2099,2103,2108,2113,2118],{"type":42,"tag":489,"props":2087,"children":2088},{"style":1911},[2089],{"type":48,"value":1952},{"type":42,"tag":489,"props":2091,"children":2092},{"style":1955},[2093],{"type":48,"value":1958},{"type":42,"tag":489,"props":2095,"children":2096},{"style":1961},[2097],{"type":48,"value":2098},"Location",{"type":42,"tag":489,"props":2100,"children":2101},{"style":1955},[2102],{"type":48,"value":1969},{"type":42,"tag":489,"props":2104,"children":2105},{"style":1972},[2106],{"type":48,"value":2107},": ",{"type":42,"tag":489,"props":2109,"children":2110},{"style":1911},[2111],{"type":48,"value":2112},"`",{"type":42,"tag":489,"props":2114,"children":2115},{"style":2068},[2116],{"type":48,"value":2117},"file.py:123",{"type":42,"tag":489,"props":2119,"children":2120},{"style":1911},[2121],{"type":48,"value":2122},"`\n",{"type":42,"tag":489,"props":2124,"children":2126},{"class":491,"line":2125},12,[2127,2131,2135,2139,2143],{"type":42,"tag":489,"props":2128,"children":2129},{"style":1911},[2130],{"type":48,"value":1952},{"type":42,"tag":489,"props":2132,"children":2133},{"style":1955},[2134],{"type":48,"value":1958},{"type":42,"tag":489,"props":2136,"children":2137},{"style":1961},[2138],{"type":48,"value":2018},{"type":42,"tag":489,"props":2140,"children":2141},{"style":1955},[2142],{"type":48,"value":1969},{"type":42,"tag":489,"props":2144,"children":2145},{"style":1972},[2146],{"type":48,"value":2147},": High\n",{"type":42,"tag":489,"props":2149,"children":2151},{"class":491,"line":2150},13,[2152,2156,2160,2165,2169],{"type":42,"tag":489,"props":2153,"children":2154},{"style":1911},[2155],{"type":48,"value":1952},{"type":42,"tag":489,"props":2157,"children":2158},{"style":1955},[2159],{"type":48,"value":1958},{"type":42,"tag":489,"props":2161,"children":2162},{"style":1961},[2163],{"type":48,"value":2164},"Issue",{"type":42,"tag":489,"props":2166,"children":2167},{"style":1955},[2168],{"type":48,"value":1969},{"type":42,"tag":489,"props":2170,"children":2171},{"style":1972},[2172],{"type":48,"value":2173},": [What the vulnerability is]\n",{"type":42,"tag":489,"props":2175,"children":2177},{"class":491,"line":2176},14,[2178,2182,2186,2190,2194],{"type":42,"tag":489,"props":2179,"children":2180},{"style":1911},[2181],{"type":48,"value":1952},{"type":42,"tag":489,"props":2183,"children":2184},{"style":1955},[2185],{"type":48,"value":1958},{"type":42,"tag":489,"props":2187,"children":2188},{"style":1961},[2189],{"type":48,"value":1725},{"type":42,"tag":489,"props":2191,"children":2192},{"style":1955},[2193],{"type":48,"value":1969},{"type":42,"tag":489,"props":2195,"children":2196},{"style":1972},[2197],{"type":48,"value":2198},": [What an attacker could do]\n",{"type":42,"tag":489,"props":2200,"children":2202},{"class":491,"line":2201},15,[2203,2207,2211,2216,2220],{"type":42,"tag":489,"props":2204,"children":2205},{"style":1911},[2206],{"type":48,"value":1952},{"type":42,"tag":489,"props":2208,"children":2209},{"style":1955},[2210],{"type":48,"value":1958},{"type":42,"tag":489,"props":2212,"children":2213},{"style":1961},[2214],{"type":48,"value":2215},"Evidence",{"type":42,"tag":489,"props":2217,"children":2218},{"style":1955},[2219],{"type":48,"value":1969},{"type":42,"tag":489,"props":2221,"children":2222},{"style":1972},[2223],{"type":48,"value":2224},":\n",{"type":42,"tag":489,"props":2226,"children":2228},{"class":491,"line":2227},16,[2229,2234],{"type":42,"tag":489,"props":2230,"children":2231},{"style":2068},[2232],{"type":48,"value":2233},"  ```",{"type":42,"tag":489,"props":2235,"children":2237},{"style":2236},"--shiki-light:#90A4AE90;--shiki-default:#EEFFFF90;--shiki-dark:#BABED890",[2238],{"type":48,"value":2239},"python\n",{"type":42,"tag":489,"props":2241,"children":2243},{"class":491,"line":2242},17,[2244],{"type":42,"tag":489,"props":2245,"children":2246},{"style":2236},[2247],{"type":48,"value":2248},"  [Vulnerable code snippet]\n",{"type":42,"tag":80,"props":2250,"children":2251},{},[2252],{"type":42,"tag":84,"props":2253,"children":2254},{},[2255,2260,2261],{"type":42,"tag":57,"props":2256,"children":2257},{},[2258],{"type":48,"value":2259},"Fix",{"type":48,"value":2107},{"type":42,"tag":489,"props":2262,"children":2263},{},[2264],{"type":48,"value":2265},"How to remediate",{"type":42,"tag":264,"props":2267,"children":2269},{"id":2268},"needs-verification",[2270],{"type":48,"value":2271},"Needs Verification",{"type":42,"tag":2273,"props":2274,"children":2276},"h4",{"id":2275},"verify-001-potential-issue",[2277,2282,2284],{"type":42,"tag":489,"props":2278,"children":2279},{},[2280],{"type":48,"value":2281},"VERIFY-001",{"type":48,"value":2283}," ",{"type":42,"tag":489,"props":2285,"children":2286},{},[2287],{"type":48,"value":2288},"Potential Issue",{"type":42,"tag":80,"props":2290,"children":2291},{},[2292,2306],{"type":42,"tag":84,"props":2293,"children":2294},{},[2295,2299,2300],{"type":42,"tag":57,"props":2296,"children":2297},{},[2298],{"type":48,"value":2098},{"type":48,"value":2107},{"type":42,"tag":355,"props":2301,"children":2303},{"className":2302},[],[2304],{"type":48,"value":2305},"file.py:456",{"type":42,"tag":84,"props":2307,"children":2308},{},[2309,2314,2315],{"type":42,"tag":57,"props":2310,"children":2311},{},[2312],{"type":48,"value":2313},"Question",{"type":48,"value":2107},{"type":42,"tag":489,"props":2316,"children":2317},{},[2318],{"type":48,"value":2319},"What needs to be verified",{"type":42,"tag":478,"props":2321,"children":2324},{"className":2322,"code":2323,"language":48},[1836],"\nIf no vulnerabilities found, state: \"No high-confidence vulnerabilities identified.\"\n\n---\n\n## Reference Files\n\n### Core Vulnerabilities (`references\u002F`)\n| File | Covers |\n|------|--------|\n| `injection.md` | SQL, NoSQL, OS command, LDAP, template injection |\n| `xss.md` | Reflected, stored, DOM-based XSS |\n| `authorization.md` | Authorization, IDOR, privilege escalation |\n| `authentication.md` | Sessions, credentials, password storage |\n| `cryptography.md` | Algorithms, key management, randomness |\n| `deserialization.md` | Pickle, YAML, Java, PHP deserialization |\n| `file-security.md` | Path traversal, uploads, XXE |\n| `ssrf.md` | Server-side request forgery |\n| `csrf.md` | Cross-site request forgery |\n| `data-protection.md` | Secrets exposure, PII, logging |\n| `api-security.md` | REST, GraphQL, mass assignment |\n| `business-logic.md` | Race conditions, workflow bypass |\n| `modern-threats.md` | Prototype pollution, LLM injection, WebSocket |\n| `misconfiguration.md` | Headers, CORS, debug mode, defaults |\n| `error-handling.md` | Fail-open, information disclosure |\n| `supply-chain.md` | Dependencies, build security |\n| `logging.md` | Audit failures, log injection |\n\n### Language Guides (`languages\u002F`)\n- `python.md` - Django, Flask, FastAPI patterns\n- `javascript.md` - Node, Express, React, Vue, Next.js\n- `go.md` - Go-specific security patterns\n- `rust.md` - Rust unsafe blocks, FFI security\n- `java.md` - Spring, Java EE patterns\n\n### Infrastructure (`infrastructure\u002F`)\n- `docker.md` - Container security\n- `kubernetes.md` - K8s RBAC, secrets, policies\n- `terraform.md` - IaC security\n- `ci-cd.md` - Pipeline security\n- `cloud.md` - AWS\u002FGCP\u002FAzure security\n",[2325],{"type":42,"tag":355,"props":2326,"children":2327},{"__ignoreMap":483},[2328],{"type":48,"value":2323},{"type":42,"tag":2330,"props":2331,"children":2332},"style",{},[2333],{"type":48,"value":2334},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2336,"total":2504},[2337,2362,2376,2389,2403,2420,2434,2446,2454,2465,2475,2491],{"slug":2338,"name":2338,"fn":2339,"description":2340,"org":2341,"tags":2342,"stars":2359,"repoUrl":2360,"updatedAt":2361},"xcodebuildmcp","build and test Apple apps with XcodeBuildMCP","Official skill for XcodeBuildMCP. Use when doing iOS\u002FmacOS\u002FwatchOS\u002FtvOS\u002FvisionOS work (build, test, run, debug, log, UI automation).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2343,2346,2349,2352,2353,2356],{"name":2344,"slug":2345,"type":16},"Debugging","debugging",{"name":2347,"slug":2348,"type":16},"iOS","ios",{"name":2350,"slug":2351,"type":16},"macOS","macos",{"name":9,"slug":8,"type":16},{"name":2354,"slug":2355,"type":16},"Testing","testing",{"name":2357,"slug":2358,"type":16},"Xcode","xcode",6176,"https:\u002F\u002Fgithub.com\u002Fgetsentry\u002FXcodeBuildMCP","2026-04-06T18:13:34.8719",{"slug":2363,"name":2363,"fn":2364,"description":2365,"org":2366,"tags":2367,"stars":2359,"repoUrl":2360,"updatedAt":2375},"xcodebuildmcp-cli","build and test Apple apps via CLI","Official skill for the XcodeBuildMCP CLI. Use when doing iOS\u002FmacOS\u002FwatchOS\u002FtvOS\u002FvisionOS work (build, test, run, debug, log, UI automation).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2368,2371,2372,2373,2374],{"name":2369,"slug":2370,"type":16},"CLI","cli",{"name":2347,"slug":2348,"type":16},{"name":2350,"slug":2351,"type":16},{"name":2354,"slug":2355,"type":16},{"name":2357,"slug":2358,"type":16},"2026-04-06T18:13:36.13414",{"slug":2377,"name":2377,"fn":2378,"description":2379,"org":2380,"tags":2381,"stars":23,"repoUrl":24,"updatedAt":2388},"agents-md","maintain project instruction files","Creates and maintains concise AGENTS.md and CLAUDE.md project instruction files. Use when asked to create AGENTS.md, update AGENTS.md, maintain agent docs, set up CLAUDE.md, document repository agent conventions, or keep coding-agent instructions minimal and reference-backed.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2382,2385],{"name":2383,"slug":2384,"type":16},"Documentation","documentation",{"name":2386,"slug":2387,"type":16},"Engineering","engineering","2026-05-15T06:16:29.695991",{"slug":2390,"name":2390,"fn":2391,"description":2392,"org":2393,"tags":2394,"stars":23,"repoUrl":24,"updatedAt":2402},"blog-writing-guide","write and review engineering blog posts","Write, review, and improve blog posts for the Sentry engineering blog following Sentry's specific writing standards, voice, and quality bar. Use this skill whenever someone asks to write a blog post, draft a technical article, review blog content, improve a draft, write a product announcement, create an engineering deep-dive, or produce any written content destined for the Sentry blog or developer audience. Also trigger when the user mentions \"blog post,\" \"blog draft,\" \"write-up,\" \"announcement post,\" \"engineering post,\" \"deep dive,\" \"postmortem,\" or asks for help with technical writing for Sentry. Even if the user just says \"help me write about [feature\u002Ftopic]\" — if it sounds like it could become a Sentry blog post, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2395,2398,2399],{"name":2396,"slug":2397,"type":16},"Communications","communications",{"name":9,"slug":8,"type":16},{"name":2400,"slug":2401,"type":16},"Technical Writing","technical-writing","2026-05-15T06:16:33.38217",{"slug":2404,"name":2404,"fn":2405,"description":2406,"org":2407,"tags":2408,"stars":23,"repoUrl":24,"updatedAt":2419},"brand-guidelines","write copy following Sentry brand guidelines","Write copy following Sentry brand guidelines. Use when writing UI text, error messages, empty states, onboarding flows, 404 pages, documentation, marketing copy, or any user-facing content. Covers both Plain Speech (default) and Sentry Voice tones.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2409,2412,2415,2416],{"name":2410,"slug":2411,"type":16},"Branding","branding",{"name":2413,"slug":2414,"type":16},"Content Creation","content-creation",{"name":9,"slug":8,"type":16},{"name":2417,"slug":2418,"type":16},"UX Copy","ux-copy","2026-05-15T06:16:22.395707",{"slug":2421,"name":2421,"fn":2422,"description":2423,"org":2424,"tags":2425,"stars":23,"repoUrl":24,"updatedAt":2433},"claude-settings-audit","generate Claude Code settings permissions","Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2426,2429,2432],{"name":2427,"slug":2428,"type":16},"Claude Code","claude-code",{"name":2430,"slug":2431,"type":16},"Configuration","configuration",{"name":14,"slug":15,"type":16},"2026-05-15T06:16:44.335977",{"slug":19,"name":19,"fn":2435,"description":2436,"org":2437,"tags":2438,"stars":23,"repoUrl":24,"updatedAt":2445},"perform code reviews for Sentry projects","Perform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2439,2440,2441,2444],{"name":18,"slug":19,"type":16},{"name":2386,"slug":2387,"type":16},{"name":2442,"slug":2443,"type":16},"Performance","performance",{"name":14,"slug":15,"type":16},"2026-05-15T06:16:35.824864",{"slug":2447,"name":2447,"fn":2448,"description":2449,"org":2450,"tags":2451,"stars":23,"repoUrl":24,"updatedAt":2453},"code-simplifier","simplify and refine source code","Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Use when asked to \"simplify code\", \"clean up code\", \"refactor for clarity\", \"improve readability\", or review recently modified code for elegance. Focuses on project-specific best practices.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2452],{"name":21,"slug":22,"type":16},"2026-05-15T06:16:32.127981",{"slug":2455,"name":2455,"fn":2456,"description":2457,"org":2458,"tags":2459,"stars":23,"repoUrl":24,"updatedAt":2464},"commit","create commits with Sentry conventions","Use for every request to commit changes or draft a commit message. Creates Sentry-style conventional commits with issue references.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2460,2463],{"name":2461,"slug":2462,"type":16},"Git","git",{"name":9,"slug":8,"type":16},"2026-07-18T05:15:10.723937",{"slug":2466,"name":2466,"fn":2467,"description":2468,"org":2469,"tags":2470,"stars":23,"repoUrl":24,"updatedAt":2474},"create-branch","create git branches for Sentry workflows","Create a git branch following Sentry naming conventions. Use when asked to \"create a branch\", \"new branch\", \"start a branch\", \"make a branch\", \"switch to a new branch\", or when starting new work on the default branch.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2471,2472,2473],{"name":2386,"slug":2387,"type":16},{"name":2461,"slug":2462,"type":16},{"name":9,"slug":8,"type":16},"2026-05-15T06:16:39.458431",{"slug":2476,"name":2476,"fn":2477,"description":2478,"org":2479,"tags":2480,"stars":23,"repoUrl":24,"updatedAt":2490},"django-access-review","review Django access control and IDOR","Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python\u002FDjango code handling user authorization. Trigger keywords: \"IDOR\", \"access control\", \"authorization\", \"Django permissions\", \"object permissions\", \"tenant isolation\", \"broken access\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2481,2484,2485,2487,2489],{"name":2482,"slug":2483,"type":16},"Access Control","access-control",{"name":21,"slug":22,"type":16},{"name":2486,"slug":1084,"type":16},"Django",{"name":2488,"slug":482,"type":16},"Python",{"name":14,"slug":15,"type":16},"2026-05-15T06:16:43.098698",{"slug":2492,"name":2492,"fn":2493,"description":2494,"org":2495,"tags":2496,"stars":23,"repoUrl":24,"updatedAt":2503},"django-perf-review","review and optimize Django performance","Django performance code review. Use when asked to \"review Django performance\", \"find N+1 queries\", \"optimize Django\", \"check queryset performance\", \"database performance\", \"Django ORM issues\", or audit Django code for performance problems.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2497,2498,2501,2502],{"name":18,"slug":19,"type":16},{"name":2499,"slug":2500,"type":16},"Database","database",{"name":2486,"slug":1084,"type":16},{"name":2442,"slug":2443,"type":16},"2026-05-15T06:16:24.832813",88,{"items":2506,"total":2547},[2507,2512,2518,2525,2531,2538,2542],{"slug":2377,"name":2377,"fn":2378,"description":2379,"org":2508,"tags":2509,"stars":23,"repoUrl":24,"updatedAt":2388},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2510,2511],{"name":2383,"slug":2384,"type":16},{"name":2386,"slug":2387,"type":16},{"slug":2390,"name":2390,"fn":2391,"description":2392,"org":2513,"tags":2514,"stars":23,"repoUrl":24,"updatedAt":2402},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2515,2516,2517],{"name":2396,"slug":2397,"type":16},{"name":9,"slug":8,"type":16},{"name":2400,"slug":2401,"type":16},{"slug":2404,"name":2404,"fn":2405,"description":2406,"org":2519,"tags":2520,"stars":23,"repoUrl":24,"updatedAt":2419},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2521,2522,2523,2524],{"name":2410,"slug":2411,"type":16},{"name":2413,"slug":2414,"type":16},{"name":9,"slug":8,"type":16},{"name":2417,"slug":2418,"type":16},{"slug":2421,"name":2421,"fn":2422,"description":2423,"org":2526,"tags":2527,"stars":23,"repoUrl":24,"updatedAt":2433},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2528,2529,2530],{"name":2427,"slug":2428,"type":16},{"name":2430,"slug":2431,"type":16},{"name":14,"slug":15,"type":16},{"slug":19,"name":19,"fn":2435,"description":2436,"org":2532,"tags":2533,"stars":23,"repoUrl":24,"updatedAt":2445},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2534,2535,2536,2537],{"name":18,"slug":19,"type":16},{"name":2386,"slug":2387,"type":16},{"name":2442,"slug":2443,"type":16},{"name":14,"slug":15,"type":16},{"slug":2447,"name":2447,"fn":2448,"description":2449,"org":2539,"tags":2540,"stars":23,"repoUrl":24,"updatedAt":2453},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2541],{"name":21,"slug":22,"type":16},{"slug":2455,"name":2455,"fn":2456,"description":2457,"org":2543,"tags":2544,"stars":23,"repoUrl":24,"updatedAt":2464},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2545,2546],{"name":2461,"slug":2462,"type":16},{"name":9,"slug":8,"type":16},28]