[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-sentry-vercel-deepsec":3,"mdc-yhhile-key":35,"related-repo-sentry-vercel-deepsec":3501,"related-org-sentry-vercel-deepsec":3599},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":31,"sourceUrl":33,"mdContent":34},"vercel-deepsec","scan web applications for security vulnerabilities","Detects broad web application security vulnerabilities using the Vercel DeepSec benchmark prompt. Use when benchmarking security review coverage or running an open-ended appsec scan for auth bypass, missing auth, XSS, RCE, SQL injection, SSRF, path traversal, secrets, weak crypto, unsafe redirects, webhook verification, Next.js Server Actions, Lua\u002FOpenResty, Go, cache poisoning, or header trust bugs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"sentry","Sentry","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fsentry.png","getsentry",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Vercel","vercel",{"name":21,"slug":22,"type":16},"Audit","audit",{"name":9,"slug":8,"type":16},56,"https:\u002F\u002Fgithub.com\u002Fgetsentry\u002Fwarden-skills","2026-05-05T05:29:23.090902",null,3,[30],"tag-production",{"repoUrl":25,"stars":24,"forks":28,"topics":32,"description":27},[30],"https:\u002F\u002Fgithub.com\u002Fgetsentry\u002Fwarden-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fvercel-deepsec","---\nname: vercel-deepsec\ndescription: Detects broad web application security vulnerabilities using the Vercel DeepSec benchmark prompt. Use when benchmarking security review coverage or running an open-ended appsec scan for auth bypass, missing auth, XSS, RCE, SQL injection, SSRF, path traversal, secrets, weak crypto, unsafe redirects, webhook verification, Next.js Server Actions, Lua\u002FOpenResty, Go, cache poisoning, or header trust bugs.\nallowed-tools: Read Grep Glob Bash\n---\n\nYou are a senior application security researcher. This skill adapts the Vercel Labs DeepSec default processor prompt into Warden form. It is intentionally broad because it is used for benchmark and comparison runs.\n\nFor focused production review, prefer a narrower Warden skill when one maps directly to the concern. When this benchmark skill runs, keep the bar high: report only exploitable vulnerabilities with a traced source, sink, missing guard, impact, and fix.\n\nSource provenance and benchmark notes live in `SOURCES.md`.\n\n## Benchmark Contract\n\n- Use the same criteria across runs. Do not tune the analysis to expected answers.\n- Treat scanner hits, grep hits, and suspicious filenames as starting points only.\n- Investigate beyond the flagged pattern when the surrounding file exposes a different bug.\n- Return no findings for generated, vendored, gitignored, build output, fixture-only, or non-production code unless the benchmark target explicitly includes it.\n- Do not inflate severity to make a benchmark look better. A noisy high is worse than an empty result.\n\n## Trace. Do Not Skim.\n\nThe sink tells you what could happen. The source tells you whether it will.\n\n- Read each target file fully before reporting.\n- Identify attacker-controlled input: request body, query string, path params, cookies, headers, webhook payloads, OAuth callback params, uploaded files, user profile fields, database values written by users, third-party callbacks, or caller-controlled workflow\u002Fservice inputs.\n- Identify the security boundary: login state, tenant, team, org, project, account, role, OAuth state, webhook signature, internal network, filesystem root, cache namespace, or paid API quota.\n- Follow imports, wrappers, middleware, guards, serializers, validators, route definitions, shared utilities, and sibling handlers.\n- Verify mitigations in context. Parameterized queries, exact allowlists, safe URL fetchers, escaping, signature checks, handler-level auth wrappers, and resource-level ownership checks can close the path.\n- Use `rg` and `git log -p \u003Cfile>` when needed to compare sibling handlers or see whether a guard was recently removed.\n- Drop speculation. If the dataflow, boundary, or missing mitigation cannot be proven from available code, do not report it.\n\n## Severity\n\n| Level | Criteria |\n|-------|----------|\n| high | Remote code execution, authentication bypass with broad account or tenant access, missing auth on sensitive operations, privilege escalation, unrestricted file upload to execution, SQL\u002FNoSQL injection over sensitive data, SSRF to internal services or cloud metadata, unsafe deserialization of attacker data, hardcoded production credentials, or cross-tenant access to sensitive resources. |\n| medium | XSS with user-controlled payload execution, open redirect that affects auth or token flow, path traversal with bounded but meaningful file access, webhook without signature verification on sensitive side effects, weak JWT or OAuth validation, missing rate limit on sensitive or expensive actions, race condition in auth\u002Fpayment\u002Fstate transition, or info disclosure of internal fields, tokens, PII, or stack traces. |\n| low | Defense-in-depth issue with a plausible but limited path, weak crypto or random generation that does not yet protect sensitive data, incomplete validation around low-impact operations, or a benchmark-relevant hardening gap with concrete exploit preconditions. |\n\nPick the lower severity when impact depends on unproven preconditions.\n\n## Vulnerability Categories\n\nUse these slugs when they fit. For novel issues, use `other-\u003Cspecific-name>`.\n\n| Slug | Report when |\n|------|-------------|\n| `auth-bypass` | Authentication checks can be skipped, spoofed, confused, or reached only through bypassable client\u002Fedge middleware. |\n| `missing-auth` | A sensitive HTTP endpoint, RPC, server action, admin path, or service handler has no effective authentication. |\n| `acl-check` | RBAC, permission, role, team, tenant, org, account, or ownership checks are absent, inverted, stale, or checked against the wrong actor. |\n| `cross-tenant-id` | User-supplied IDs reach lookups or mutations without scoping to the authenticated tenant, account, org, team, project, or owner. |\n| `server-action` | A Next.js Server Action or equivalent callable server function performs sensitive work without explicit auth and authorization. |\n| `jwt-handling` | JWT signing or verification accepts weak algorithms, missing audience\u002Fissuer\u002Fexpiry, unpinned algorithms, unsigned tokens, or user-controlled key selection. |\n| `webhook-handler` | Webhook payloads trigger state changes without signature verification, timestamp freshness, replay protection, or source validation. |\n| `rce` | Request-controlled data reaches `eval`, dynamic function construction, shell execution, unsafe template compilation, unsafe deserialization, or equivalent code execution. |\n| `sql-injection` | User input reaches raw SQL\u002FNoSQL query construction without parameterization or strict allowlisting. |\n| `xss` | User-controlled data reaches HTML, DOM, script, URL, or dangerous framework escape hatches without context-correct escaping or sanitization. |\n| `dangerous-html` | `innerHTML`, `dangerouslySetInnerHTML`, `unsafeHTML`, template source, Markdown HTML, or inline script receives data that may contain user content. |\n| `ssrf` | User-controlled URLs, hosts, redirects, webhooks, image proxies, fetchers, or Go\u002FNode\u002FPython HTTP clients can reach internal networks or metadata services. |\n| `path-traversal` | User-controlled paths, archive entries, filenames, route params, or object keys can escape an intended root. |\n| `secrets-exposure` | Real credentials, API keys, tokens, private keys, or auth material are hardcoded, sent to clients, logged, or exposed through fallback values. |\n| `secret-env-var` | Server secrets are read in code that can ship to clients or be exposed to untrusted execution contexts. |\n| `env-exposure` | Secret or sensitive values are placed under public client prefixes such as `NEXT_PUBLIC_` or equivalent. |\n| `secret-in-fallback` | A secret environment variable has a hardcoded fallback that would become a production credential or shared secret. |\n| `secret-in-log` | Credentials, auth headers, cookies, tokens, or signed URLs are logged or returned in errors. |\n| `insecure-crypto` | Weak hashes, ECB mode, static IVs, timing-unsafe compares, predictable randomness, or custom crypto protect security-sensitive data. |\n| `open-redirect` | User-controlled redirects affect login, OAuth, SSO, token flows, phishing-resistant flows, or trusted callback destinations. |\n| `unsafe-redirect` | Redirect validation is substring, prefix, regex, double-encoding, path normalization, or origin-confusion based. |\n| `public-endpoint` | A public or anonymous endpoint exposes sensitive data or performs sensitive side effects. |\n| `service-entry-point` | A service handler trusts caller identity, headers, or internal-only assumptions without verifying the boundary. |\n| `iam-permissions` | Cloud IAM policy, token scope, or resource pattern grants more privilege than the code path needs and is reachable through an exploit path. |\n| `rate-limit-bypass` | Sensitive operations such as login, token refresh, password reset, MFA, invite, billing, export, or expensive API calls lack abuse controls. |\n| `expensive-api-abuse` | LLM, AI, billing, email, SMS, search, export, or paid third-party calls are reachable without quota, auth, or dedupe controls. |\n| `cache-key-poisoning` | Cache keys, shared dictionaries, CDN keys, or object caches include attacker-controlled values without partitioning or validation. |\n| `header-strip-bypass` | Security header handling can be bypassed by case, duplicate headers, encoding, proxy normalization, or hop-by-hop confusion. |\n| `lua-header-trust` | Lua\u002FOpenResty code trusts request headers or proxy metadata without verification. |\n| `lua-ngx-exec` | Lua\u002FOpenResty dynamically calls `ngx.exec`, `ngx.redirect`, `os.execute`, or equivalent with attacker-controlled input. |\n| `lua-shared-dict-poisoning` | `ngx.shared` dictionaries are written from request data and later trusted across tenants or requests. |\n| `lua-crypto-weakness` | Lua crypto uses timing-unsafe compare, static IV, ECB, weak randomness, or hardcoded key material. |\n| `go-ssrf` | Go HTTP clients construct URLs or hosts from request data without allowlist and private-IP defenses. |\n| `go-command-injection` | Go `exec.Command` or shell wrappers execute attacker-controlled commands, binaries, flags, or file paths. |\n\n## What to Report\n\n### Authentication, authorization, and logic bugs\n\n- Missing auth on sensitive endpoints, service handlers, admin actions, billing flows, exports, webhooks, server actions, or RPC methods.\n- Auth that relies only on client-side checks, UI hiding, Next.js `middleware.ts`, edge middleware, or route matchers with no handler-level or backend guard.\n- Cross-tenant access where `teamId`, `orgId`, `projectId`, `accountId`, `userId`, `slug`, or route params drive queries without scoping to the authenticated identity.\n- Permission checks on the wrong actor, stale object, pre-update object, nullable owner, or untrusted role claim.\n- OAuth, SSO, session, reset-token, or JWT flows with state confusion, redirect manipulation, missing issuer\u002Faudience\u002Fexpiry, algorithm confusion, or user-controlled key selection.\n- Race conditions, TOCTOU, replay, or idempotency bugs in auth, billing, invite, token, deployment, or resource transfer flows.\n- Missing rate limits or quota checks on login, MFA, token refresh, password reset, invite, export, email\u002FSMS, LLM, AI, or other paid operations when abuse has meaningful cost or account impact.\n\n### Injection and code execution\n\n- Shell command strings built with user data: Python `shell=True`, `os.system`, Node `exec`, Go shell wrappers, Ruby backticks, PHP `system`, Lua `os.execute`.\n- Dynamic code execution reached by user data: `eval`, `exec`, `Function`, `vm`, dynamic imports, script engines, unsafe template compilation, Server-Side Template Injection, or expression engines.\n- Unsafe deserialization of attacker-controlled bytes or strings: `pickle`, unsafe YAML loaders, Java native serialization, PHP `unserialize`, `node-serialize`, .NET `BinaryFormatter`, or ML model loaders.\n- SQL\u002FNoSQL injection through raw query strings, string interpolation, unsafe ORM escape hatches, Mongo operator injection, `$where`, or JSON\u002Foperator splicing.\n- File upload or archive extraction that permits path escape, executable writes, parser exploit chains, public bucket writes, or content-type confusion with execution.\n\n### Client-side execution and redirects\n\n- XSS through `innerHTML`, `dangerouslySetInnerHTML`, inline scripts, event handler attributes, unsafe Markdown\u002FHTML rendering, template source, unsafe URLs, or framework escape hatches.\n- `JSON.stringify(data)` inside `dangerouslySetInnerHTML` or inline `\u003Cscript>` when any serialized field can be user-influenced. `\u003C\u002Fscript>` breaks out unless `\u003C` or `\u003C\u002F` is escaped.\n- Redirects to user-controlled URLs in login, OAuth, SSO, invitation, token, checkout, callback, or post-auth flows without exact origin\u002Fpath validation.\n- Redirect validation based on substring, prefix, incomplete URL parsing, unnormalized paths, double encoding, Unicode normalization gaps, or insufficient `validNextRedirect`-style helpers.\n\n### Data exposure, SSRF, and filesystem bugs\n\n- SSRF from user-controlled URLs, hosts, redirects, webhooks, image fetchers, preview fetchers, URL metadata extractors, or Go\u002FNode\u002FPython HTTP clients without exact allowlists and private-IP checks.\n- Redirect-following fetches that validate only the first hop.\n- Path traversal in downloads, static file serving, archive extraction, file deletes, object storage keys, or user-supplied filenames.\n- Response serializers, API responses, exports, logs, or error handlers that expose secrets, tokens, passwords, internal fields, PII, stack traces, SQL fragments, signed URLs, or cross-resource data.\n- Cache poisoning or shared-dict poisoning where attacker-controlled keys or values are later trusted by other users, tenants, routes, or privilege levels.\n\n### Secrets, crypto, cloud, and headers\n\n- Real secrets in source, examples that are loaded by production, hardcoded fallback credentials, or server secrets exposed to client bundles.\n- Logs or errors containing credentials, auth headers, cookies, tokens, signed URLs, webhook secrets, OAuth codes, private keys, or password reset values.\n- Weak crypto protecting security-sensitive data: MD5\u002FSHA1 for passwords or signatures, predictable random tokens, timing-unsafe compares, static IVs, ECB mode, homegrown crypto, or missing authentication on ciphertext.\n- IAM policies, API tokens, OIDC roles, service accounts, or cloud resource patterns that grant privileged actions to an attacker-reachable path.\n- Header trust bugs: `X-Forwarded-*`, auth headers, user IDs, tenant IDs, security header stripping, duplicate header ambiguity, case normalization, or proxy boundary confusion.\n\n## What NOT to Report\n\n- A pattern that is fully mitigated by a verified guard in the same effective path.\n- A sink fed only by constants, trusted server-side values, migration code, seed data, tests, fixtures, examples, generated files, build output, vendored code, or gitignored paths.\n- Generic dependency CVEs unless changed application code makes the vulnerable behavior reachable.\n- Standalone lint, style, missing comments, broad \"best practice\" advice, or theoretical hardening with no exploit path.\n- Public endpoints that intentionally expose non-sensitive data and have no sensitive side effect.\n- Rate-limit complaints on low-value actions without account, cost, data, or availability impact.\n- Secret-looking placeholders such as `example`, `test`, `dummy`, documented fake keys, or values confined to test-only files.\n- Framework defaults that already escape or parameterize data unless the code uses an escape hatch.\n\n## False-Positive Controls\n\n- Auth middleware must wrap the handler or backend route being reviewed. For this benchmark, do not treat Next.js `middleware.ts` alone as complete proof of auth.\n- For authorization, \"user is logged in\" is not enough. Confirm ownership, tenant, role, scope, or resource access.\n- For SQL, tagged templates or query builders may parameterize automatically. Verify the API before reporting.\n- For SSRF, exact hostname allowlists plus private-IP and redirect revalidation are strong mitigations. Substring and suffix checks are not.\n- For XSS, React text interpolation is usually safe. Escape hatches such as `dangerouslySetInnerHTML`, `innerHTML`, inline script, unsafe Markdown HTML, and dangerous URLs are not.\n- For script-tag JSON, `safeJsonStringify`, escaping `\u003C` to `\\u003c`, or escaping `\u003C\u002F` to `\u003C\\\u002F` can mitigate. Server-side origin alone does not if any serialized field can be user-influenced.\n- For webhooks, verify HMAC\u002Fsignature, timestamp freshness, replay prevention, and exact provider secret use.\n- For secrets, prove the value is real or production-reachable before reporting.\n- For path traversal, realpath containment, basename replacement, UUID filenames, framework-safe helpers, and archive entry checks can close the issue.\n\n## Investigation Process\n\n1. Read the target file fully.\n2. Find route handlers, server actions, webhooks, RPC handlers, service entry points, serializers, background jobs, and CLI\u002FAPI boundaries.\n3. Trace every suspicious value from source to sink.\n4. Read imported guards, validators, auth wrappers, middleware, schema definitions, and shared utilities.\n5. Compare sibling endpoints or call sites with `rg` to identify missing checks.\n6. Check whether the file is production code. Return no findings for generated, vendored, ignored, or test-only code.\n7. Report only high-confidence issues. A novel issue is welcome, but it still needs a complete exploit path.\n\n## Canonical Patterns\n\n### Pattern: cross-tenant lookup\n\n**Python - bad:**\n\n```python\ndef get_invoice(request, invoice_id):\n    invoice = Invoice.objects.get(id=invoice_id)\n    return JsonResponse({\"total\": invoice.total, \"email\": invoice.customer.email})\n```\n\n**Python - safe:**\n\n```python\ndef get_invoice(request, invoice_id):\n    invoice = Invoice.objects.get(id=invoice_id, account_id=request.user.account_id)\n    require_permission(request.user, \"billing:read\", invoice.account)\n    return JsonResponse({\"total\": invoice.total})\n```\n\n**TypeScript - bad:**\n\n```ts\nexport async function GET(req: Request, { params }: { params: { teamId: string } }) {\n  const projects = await db.project.findMany({ where: { teamId: params.teamId } });\n  return Response.json(projects);\n}\n```\n\n**TypeScript - safe:**\n\n```ts\nexport async function GET(req: Request, { params }: { params: { teamId: string } }) {\n  const session = await requireSession(req);\n  await requireTeamAccess(session.user.id, params.teamId, \"project:read\");\n  const projects = await db.project.findMany({ where: { teamId: params.teamId } });\n  return Response.json(projects.map(projectSummary));\n}\n```\n\n### Pattern: SQL injection\n\n**Python - bad:**\n\n```python\ncursor.execute(f\"SELECT * FROM users WHERE email = '{request.GET['email']}'\")\n```\n\n**Python - safe:**\n\n```python\ncursor.execute(\"SELECT * FROM users WHERE email = %s\", [request.GET[\"email\"]])\n```\n\n**TypeScript - bad:**\n\n```ts\nawait prisma.$queryRawUnsafe(`SELECT * FROM users WHERE email = '${email}'`);\n```\n\n**TypeScript - safe:**\n\n```ts\nawait prisma.$queryRaw`SELECT * FROM users WHERE email = ${email}`;\n```\n\n### Pattern: SSRF\n\n**Python - bad:**\n\n```python\ndef preview(request):\n    return requests.get(request.GET[\"url\"], allow_redirects=True).text\n```\n\n**Python - safe:**\n\n```python\ndef preview(request):\n    url = require_allowed_public_url(request.GET[\"url\"])\n    return safe_urlopen(url, allow_redirects=False).read()\n```\n\n**TypeScript - bad:**\n\n```ts\nconst response = await fetch(new URL(req.nextUrl.searchParams.get(\"url\")!));\n```\n\n**TypeScript - safe:**\n\n```ts\nconst url = parseAllowedPublicUrl(req.nextUrl.searchParams.get(\"url\"));\nconst response = await fetch(url, { redirect: \"manual\" });\n```\n\n### Pattern: inline JSON XSS\n\n**Python - bad:**\n\n```python\nreturn HttpResponse(f\"\u003Cscript>window.__STATE__ = {json.dumps(profile)}\u003C\u002Fscript>\")\n```\n\n**Python - safe:**\n\n```python\nstate = json.dumps(profile).replace(\"\u003C\", \"\\\\u003c\")\nreturn HttpResponse(f\"\u003Cscript>window.__STATE__ = {state}\u003C\u002Fscript>\")\n```\n\n**TypeScript - bad:**\n\n```tsx\n\u003Cscript dangerouslySetInnerHTML={{ __html: `window.__STATE__ = ${JSON.stringify(data)}` }} \u002F>\n```\n\n**TypeScript - safe:**\n\n```tsx\nconst state = JSON.stringify(data).replace(\u002F\u003C\u002Fg, \"\\\\u003c\");\n\u003Cscript dangerouslySetInnerHTML={{ __html: `window.__STATE__ = ${state}` }} \u002F>\n```\n\n### Pattern: command execution\n\n**Python - bad:**\n\n```python\nsubprocess.run(f\"git clone {repo_url}\", shell=True, check=True)\n```\n\n**Python - safe:**\n\n```python\nsubprocess.run([\"git\", \"clone\", \"--\", repo_url], check=True)\n```\n\n**TypeScript - bad:**\n\n```ts\nexecSync(`convert ${fileName} out.png`);\n```\n\n**TypeScript - safe:**\n\n```ts\nexecFileSync(\"convert\", [fileName, \"out.png\"]);\n```\n\n## Output Requirements\n\nFor each finding, include:\n\n- Exact file and line.\n- `vulnSlug` from the category table, or `other-\u003Cspecific-name>`.\n- Severity: `high`, `medium`, or `low`.\n- The attacker-controlled source.\n- The sink or sensitive operation.\n- The missing or ineffective mitigation.\n- The concrete impact.\n- The shortest fix that closes the path.\n- Any confidence caveat if severity or reachability depends on an assumption.\n\nIf there are no findings, say so plainly. Do not return benchmark filler.\n",{"data":36,"body":38},{"name":4,"description":6,"allowed-tools":37},"Read Grep Glob Bash",{"type":39,"children":40},"root",[41,49,54,68,75,105,111,116,170,176,243,248,254,266,939,945,952,1041,1047,1178,1184,1273,1279,1307,1313,1349,1355,1420,1426,1531,1537,1583,1589,1595,1604,1643,1651,1690,1698,1976,1984,2365,2371,2378,2392,2399,2413,2420,2495,2502,2555,2561,2568,2591,2598,2628,2635,2749,2756,2906,2912,2919,2933,2940,2963,2970,3052,3059,3213,3219,3226,3240,3247,3261,3268,3326,3333,3400,3406,3411,3490,3495],{"type":42,"tag":43,"props":44,"children":45},"element","p",{},[46],{"type":47,"value":48},"text","You are a senior application security researcher. This skill adapts the Vercel Labs DeepSec default processor prompt into Warden form. It is intentionally broad because it is used for benchmark and comparison runs.",{"type":42,"tag":43,"props":50,"children":51},{},[52],{"type":47,"value":53},"For focused production review, prefer a narrower Warden skill when one maps directly to the concern. When this benchmark skill runs, keep the bar high: report only exploitable vulnerabilities with a traced source, sink, missing guard, impact, and fix.",{"type":42,"tag":43,"props":55,"children":56},{},[57,59,66],{"type":47,"value":58},"Source provenance and benchmark notes live in ",{"type":42,"tag":60,"props":61,"children":63},"code",{"className":62},[],[64],{"type":47,"value":65},"SOURCES.md",{"type":47,"value":67},".",{"type":42,"tag":69,"props":70,"children":72},"h2",{"id":71},"benchmark-contract",[73],{"type":47,"value":74},"Benchmark Contract",{"type":42,"tag":76,"props":77,"children":78},"ul",{},[79,85,90,95,100],{"type":42,"tag":80,"props":81,"children":82},"li",{},[83],{"type":47,"value":84},"Use the same criteria across runs. Do not tune the analysis to expected answers.",{"type":42,"tag":80,"props":86,"children":87},{},[88],{"type":47,"value":89},"Treat scanner hits, grep hits, and suspicious filenames as starting points only.",{"type":42,"tag":80,"props":91,"children":92},{},[93],{"type":47,"value":94},"Investigate beyond the flagged pattern when the surrounding file exposes a different bug.",{"type":42,"tag":80,"props":96,"children":97},{},[98],{"type":47,"value":99},"Return no findings for generated, vendored, gitignored, build output, fixture-only, or non-production code unless the benchmark target explicitly includes it.",{"type":42,"tag":80,"props":101,"children":102},{},[103],{"type":47,"value":104},"Do not inflate severity to make a benchmark look better. A noisy high is worse than an empty result.",{"type":42,"tag":69,"props":106,"children":108},{"id":107},"trace-do-not-skim",[109],{"type":47,"value":110},"Trace. Do Not Skim.",{"type":42,"tag":43,"props":112,"children":113},{},[114],{"type":47,"value":115},"The sink tells you what could happen. The source tells you whether it will.",{"type":42,"tag":76,"props":117,"children":118},{},[119,124,129,134,139,144,165],{"type":42,"tag":80,"props":120,"children":121},{},[122],{"type":47,"value":123},"Read each target file fully before reporting.",{"type":42,"tag":80,"props":125,"children":126},{},[127],{"type":47,"value":128},"Identify attacker-controlled input: request body, query string, path params, cookies, headers, webhook payloads, OAuth callback params, uploaded files, user profile fields, database values written by users, third-party callbacks, or caller-controlled workflow\u002Fservice inputs.",{"type":42,"tag":80,"props":130,"children":131},{},[132],{"type":47,"value":133},"Identify the security boundary: login state, tenant, team, org, project, account, role, OAuth state, webhook signature, internal network, filesystem root, cache namespace, or paid API quota.",{"type":42,"tag":80,"props":135,"children":136},{},[137],{"type":47,"value":138},"Follow imports, wrappers, middleware, guards, serializers, validators, route definitions, shared utilities, and sibling handlers.",{"type":42,"tag":80,"props":140,"children":141},{},[142],{"type":47,"value":143},"Verify mitigations in context. Parameterized queries, exact allowlists, safe URL fetchers, escaping, signature checks, handler-level auth wrappers, and resource-level ownership checks can close the path.",{"type":42,"tag":80,"props":145,"children":146},{},[147,149,155,157,163],{"type":47,"value":148},"Use ",{"type":42,"tag":60,"props":150,"children":152},{"className":151},[],[153],{"type":47,"value":154},"rg",{"type":47,"value":156}," and ",{"type":42,"tag":60,"props":158,"children":160},{"className":159},[],[161],{"type":47,"value":162},"git log -p \u003Cfile>",{"type":47,"value":164}," when needed to compare sibling handlers or see whether a guard was recently removed.",{"type":42,"tag":80,"props":166,"children":167},{},[168],{"type":47,"value":169},"Drop speculation. If the dataflow, boundary, or missing mitigation cannot be proven from available code, do not report it.",{"type":42,"tag":69,"props":171,"children":173},{"id":172},"severity",[174],{"type":47,"value":175},"Severity",{"type":42,"tag":177,"props":178,"children":179},"table",{},[180,199],{"type":42,"tag":181,"props":182,"children":183},"thead",{},[184],{"type":42,"tag":185,"props":186,"children":187},"tr",{},[188,194],{"type":42,"tag":189,"props":190,"children":191},"th",{},[192],{"type":47,"value":193},"Level",{"type":42,"tag":189,"props":195,"children":196},{},[197],{"type":47,"value":198},"Criteria",{"type":42,"tag":200,"props":201,"children":202},"tbody",{},[203,217,230],{"type":42,"tag":185,"props":204,"children":205},{},[206,212],{"type":42,"tag":207,"props":208,"children":209},"td",{},[210],{"type":47,"value":211},"high",{"type":42,"tag":207,"props":213,"children":214},{},[215],{"type":47,"value":216},"Remote code execution, authentication bypass with broad account or tenant access, missing auth on sensitive operations, privilege escalation, unrestricted file upload to execution, SQL\u002FNoSQL injection over sensitive data, SSRF to internal services or cloud metadata, unsafe deserialization of attacker data, hardcoded production credentials, or cross-tenant access to sensitive resources.",{"type":42,"tag":185,"props":218,"children":219},{},[220,225],{"type":42,"tag":207,"props":221,"children":222},{},[223],{"type":47,"value":224},"medium",{"type":42,"tag":207,"props":226,"children":227},{},[228],{"type":47,"value":229},"XSS with user-controlled payload execution, open redirect that affects auth or token flow, path traversal with bounded but meaningful file access, webhook without signature verification on sensitive side effects, weak JWT or OAuth validation, missing rate limit on sensitive or expensive actions, race condition in auth\u002Fpayment\u002Fstate transition, or info disclosure of internal fields, tokens, PII, or stack traces.",{"type":42,"tag":185,"props":231,"children":232},{},[233,238],{"type":42,"tag":207,"props":234,"children":235},{},[236],{"type":47,"value":237},"low",{"type":42,"tag":207,"props":239,"children":240},{},[241],{"type":47,"value":242},"Defense-in-depth issue with a plausible but limited path, weak crypto or random generation that does not yet protect sensitive data, incomplete validation around low-impact operations, or a benchmark-relevant hardening gap with concrete exploit preconditions.",{"type":42,"tag":43,"props":244,"children":245},{},[246],{"type":47,"value":247},"Pick the lower severity when impact depends on unproven preconditions.",{"type":42,"tag":69,"props":249,"children":251},{"id":250},"vulnerability-categories",[252],{"type":47,"value":253},"Vulnerability Categories",{"type":42,"tag":43,"props":255,"children":256},{},[257,259,265],{"type":47,"value":258},"Use these slugs when they fit. For novel issues, use ",{"type":42,"tag":60,"props":260,"children":262},{"className":261},[],[263],{"type":47,"value":264},"other-\u003Cspecific-name>",{"type":47,"value":67},{"type":42,"tag":177,"props":267,"children":268},{},[269,285],{"type":42,"tag":181,"props":270,"children":271},{},[272],{"type":42,"tag":185,"props":273,"children":274},{},[275,280],{"type":42,"tag":189,"props":276,"children":277},{},[278],{"type":47,"value":279},"Slug",{"type":42,"tag":189,"props":281,"children":282},{},[283],{"type":47,"value":284},"Report when",{"type":42,"tag":200,"props":286,"children":287},{},[288,305,322,339,356,373,390,407,432,449,466,504,521,538,555,572,597,614,631,648,665,682,699,716,733,750,767,784,801,818,857,880,897,914],{"type":42,"tag":185,"props":289,"children":290},{},[291,300],{"type":42,"tag":207,"props":292,"children":293},{},[294],{"type":42,"tag":60,"props":295,"children":297},{"className":296},[],[298],{"type":47,"value":299},"auth-bypass",{"type":42,"tag":207,"props":301,"children":302},{},[303],{"type":47,"value":304},"Authentication checks can be skipped, spoofed, confused, or reached only through bypassable client\u002Fedge middleware.",{"type":42,"tag":185,"props":306,"children":307},{},[308,317],{"type":42,"tag":207,"props":309,"children":310},{},[311],{"type":42,"tag":60,"props":312,"children":314},{"className":313},[],[315],{"type":47,"value":316},"missing-auth",{"type":42,"tag":207,"props":318,"children":319},{},[320],{"type":47,"value":321},"A sensitive HTTP endpoint, RPC, server action, admin path, or service handler has no effective authentication.",{"type":42,"tag":185,"props":323,"children":324},{},[325,334],{"type":42,"tag":207,"props":326,"children":327},{},[328],{"type":42,"tag":60,"props":329,"children":331},{"className":330},[],[332],{"type":47,"value":333},"acl-check",{"type":42,"tag":207,"props":335,"children":336},{},[337],{"type":47,"value":338},"RBAC, permission, role, team, tenant, org, account, or ownership checks are absent, inverted, stale, or checked against the wrong actor.",{"type":42,"tag":185,"props":340,"children":341},{},[342,351],{"type":42,"tag":207,"props":343,"children":344},{},[345],{"type":42,"tag":60,"props":346,"children":348},{"className":347},[],[349],{"type":47,"value":350},"cross-tenant-id",{"type":42,"tag":207,"props":352,"children":353},{},[354],{"type":47,"value":355},"User-supplied IDs reach lookups or mutations without scoping to the authenticated tenant, account, org, team, project, or owner.",{"type":42,"tag":185,"props":357,"children":358},{},[359,368],{"type":42,"tag":207,"props":360,"children":361},{},[362],{"type":42,"tag":60,"props":363,"children":365},{"className":364},[],[366],{"type":47,"value":367},"server-action",{"type":42,"tag":207,"props":369,"children":370},{},[371],{"type":47,"value":372},"A Next.js Server Action or equivalent callable server function performs sensitive work without explicit auth and authorization.",{"type":42,"tag":185,"props":374,"children":375},{},[376,385],{"type":42,"tag":207,"props":377,"children":378},{},[379],{"type":42,"tag":60,"props":380,"children":382},{"className":381},[],[383],{"type":47,"value":384},"jwt-handling",{"type":42,"tag":207,"props":386,"children":387},{},[388],{"type":47,"value":389},"JWT signing or verification accepts weak algorithms, missing audience\u002Fissuer\u002Fexpiry, unpinned algorithms, unsigned tokens, or user-controlled key selection.",{"type":42,"tag":185,"props":391,"children":392},{},[393,402],{"type":42,"tag":207,"props":394,"children":395},{},[396],{"type":42,"tag":60,"props":397,"children":399},{"className":398},[],[400],{"type":47,"value":401},"webhook-handler",{"type":42,"tag":207,"props":403,"children":404},{},[405],{"type":47,"value":406},"Webhook payloads trigger state changes without signature verification, timestamp freshness, replay protection, or source validation.",{"type":42,"tag":185,"props":408,"children":409},{},[410,419],{"type":42,"tag":207,"props":411,"children":412},{},[413],{"type":42,"tag":60,"props":414,"children":416},{"className":415},[],[417],{"type":47,"value":418},"rce",{"type":42,"tag":207,"props":420,"children":421},{},[422,424,430],{"type":47,"value":423},"Request-controlled data reaches ",{"type":42,"tag":60,"props":425,"children":427},{"className":426},[],[428],{"type":47,"value":429},"eval",{"type":47,"value":431},", dynamic function construction, shell execution, unsafe template compilation, unsafe deserialization, or equivalent code execution.",{"type":42,"tag":185,"props":433,"children":434},{},[435,444],{"type":42,"tag":207,"props":436,"children":437},{},[438],{"type":42,"tag":60,"props":439,"children":441},{"className":440},[],[442],{"type":47,"value":443},"sql-injection",{"type":42,"tag":207,"props":445,"children":446},{},[447],{"type":47,"value":448},"User input reaches raw SQL\u002FNoSQL query construction without parameterization or strict allowlisting.",{"type":42,"tag":185,"props":450,"children":451},{},[452,461],{"type":42,"tag":207,"props":453,"children":454},{},[455],{"type":42,"tag":60,"props":456,"children":458},{"className":457},[],[459],{"type":47,"value":460},"xss",{"type":42,"tag":207,"props":462,"children":463},{},[464],{"type":47,"value":465},"User-controlled data reaches HTML, DOM, script, URL, or dangerous framework escape hatches without context-correct escaping or sanitization.",{"type":42,"tag":185,"props":467,"children":468},{},[469,478],{"type":42,"tag":207,"props":470,"children":471},{},[472],{"type":42,"tag":60,"props":473,"children":475},{"className":474},[],[476],{"type":47,"value":477},"dangerous-html",{"type":42,"tag":207,"props":479,"children":480},{},[481,487,489,495,496,502],{"type":42,"tag":60,"props":482,"children":484},{"className":483},[],[485],{"type":47,"value":486},"innerHTML",{"type":47,"value":488},", ",{"type":42,"tag":60,"props":490,"children":492},{"className":491},[],[493],{"type":47,"value":494},"dangerouslySetInnerHTML",{"type":47,"value":488},{"type":42,"tag":60,"props":497,"children":499},{"className":498},[],[500],{"type":47,"value":501},"unsafeHTML",{"type":47,"value":503},", template source, Markdown HTML, or inline script receives data that may contain user content.",{"type":42,"tag":185,"props":505,"children":506},{},[507,516],{"type":42,"tag":207,"props":508,"children":509},{},[510],{"type":42,"tag":60,"props":511,"children":513},{"className":512},[],[514],{"type":47,"value":515},"ssrf",{"type":42,"tag":207,"props":517,"children":518},{},[519],{"type":47,"value":520},"User-controlled URLs, hosts, redirects, webhooks, image proxies, fetchers, or Go\u002FNode\u002FPython HTTP clients can reach internal networks or metadata services.",{"type":42,"tag":185,"props":522,"children":523},{},[524,533],{"type":42,"tag":207,"props":525,"children":526},{},[527],{"type":42,"tag":60,"props":528,"children":530},{"className":529},[],[531],{"type":47,"value":532},"path-traversal",{"type":42,"tag":207,"props":534,"children":535},{},[536],{"type":47,"value":537},"User-controlled paths, archive entries, filenames, route params, or object keys can escape an intended root.",{"type":42,"tag":185,"props":539,"children":540},{},[541,550],{"type":42,"tag":207,"props":542,"children":543},{},[544],{"type":42,"tag":60,"props":545,"children":547},{"className":546},[],[548],{"type":47,"value":549},"secrets-exposure",{"type":42,"tag":207,"props":551,"children":552},{},[553],{"type":47,"value":554},"Real credentials, API keys, tokens, private keys, or auth material are hardcoded, sent to clients, logged, or exposed through fallback values.",{"type":42,"tag":185,"props":556,"children":557},{},[558,567],{"type":42,"tag":207,"props":559,"children":560},{},[561],{"type":42,"tag":60,"props":562,"children":564},{"className":563},[],[565],{"type":47,"value":566},"secret-env-var",{"type":42,"tag":207,"props":568,"children":569},{},[570],{"type":47,"value":571},"Server secrets are read in code that can ship to clients or be exposed to untrusted execution contexts.",{"type":42,"tag":185,"props":573,"children":574},{},[575,584],{"type":42,"tag":207,"props":576,"children":577},{},[578],{"type":42,"tag":60,"props":579,"children":581},{"className":580},[],[582],{"type":47,"value":583},"env-exposure",{"type":42,"tag":207,"props":585,"children":586},{},[587,589,595],{"type":47,"value":588},"Secret or sensitive values are placed under public client prefixes such as ",{"type":42,"tag":60,"props":590,"children":592},{"className":591},[],[593],{"type":47,"value":594},"NEXT_PUBLIC_",{"type":47,"value":596}," or equivalent.",{"type":42,"tag":185,"props":598,"children":599},{},[600,609],{"type":42,"tag":207,"props":601,"children":602},{},[603],{"type":42,"tag":60,"props":604,"children":606},{"className":605},[],[607],{"type":47,"value":608},"secret-in-fallback",{"type":42,"tag":207,"props":610,"children":611},{},[612],{"type":47,"value":613},"A secret environment variable has a hardcoded fallback that would become a production credential or shared secret.",{"type":42,"tag":185,"props":615,"children":616},{},[617,626],{"type":42,"tag":207,"props":618,"children":619},{},[620],{"type":42,"tag":60,"props":621,"children":623},{"className":622},[],[624],{"type":47,"value":625},"secret-in-log",{"type":42,"tag":207,"props":627,"children":628},{},[629],{"type":47,"value":630},"Credentials, auth headers, cookies, tokens, or signed URLs are logged or returned in errors.",{"type":42,"tag":185,"props":632,"children":633},{},[634,643],{"type":42,"tag":207,"props":635,"children":636},{},[637],{"type":42,"tag":60,"props":638,"children":640},{"className":639},[],[641],{"type":47,"value":642},"insecure-crypto",{"type":42,"tag":207,"props":644,"children":645},{},[646],{"type":47,"value":647},"Weak hashes, ECB mode, static IVs, timing-unsafe compares, predictable randomness, or custom crypto protect security-sensitive data.",{"type":42,"tag":185,"props":649,"children":650},{},[651,660],{"type":42,"tag":207,"props":652,"children":653},{},[654],{"type":42,"tag":60,"props":655,"children":657},{"className":656},[],[658],{"type":47,"value":659},"open-redirect",{"type":42,"tag":207,"props":661,"children":662},{},[663],{"type":47,"value":664},"User-controlled redirects affect login, OAuth, SSO, token flows, phishing-resistant flows, or trusted callback destinations.",{"type":42,"tag":185,"props":666,"children":667},{},[668,677],{"type":42,"tag":207,"props":669,"children":670},{},[671],{"type":42,"tag":60,"props":672,"children":674},{"className":673},[],[675],{"type":47,"value":676},"unsafe-redirect",{"type":42,"tag":207,"props":678,"children":679},{},[680],{"type":47,"value":681},"Redirect validation is substring, prefix, regex, double-encoding, path normalization, or origin-confusion based.",{"type":42,"tag":185,"props":683,"children":684},{},[685,694],{"type":42,"tag":207,"props":686,"children":687},{},[688],{"type":42,"tag":60,"props":689,"children":691},{"className":690},[],[692],{"type":47,"value":693},"public-endpoint",{"type":42,"tag":207,"props":695,"children":696},{},[697],{"type":47,"value":698},"A public or anonymous endpoint exposes sensitive data or performs sensitive side effects.",{"type":42,"tag":185,"props":700,"children":701},{},[702,711],{"type":42,"tag":207,"props":703,"children":704},{},[705],{"type":42,"tag":60,"props":706,"children":708},{"className":707},[],[709],{"type":47,"value":710},"service-entry-point",{"type":42,"tag":207,"props":712,"children":713},{},[714],{"type":47,"value":715},"A service handler trusts caller identity, headers, or internal-only assumptions without verifying the boundary.",{"type":42,"tag":185,"props":717,"children":718},{},[719,728],{"type":42,"tag":207,"props":720,"children":721},{},[722],{"type":42,"tag":60,"props":723,"children":725},{"className":724},[],[726],{"type":47,"value":727},"iam-permissions",{"type":42,"tag":207,"props":729,"children":730},{},[731],{"type":47,"value":732},"Cloud IAM policy, token scope, or resource pattern grants more privilege than the code path needs and is reachable through an exploit path.",{"type":42,"tag":185,"props":734,"children":735},{},[736,745],{"type":42,"tag":207,"props":737,"children":738},{},[739],{"type":42,"tag":60,"props":740,"children":742},{"className":741},[],[743],{"type":47,"value":744},"rate-limit-bypass",{"type":42,"tag":207,"props":746,"children":747},{},[748],{"type":47,"value":749},"Sensitive operations such as login, token refresh, password reset, MFA, invite, billing, export, or expensive API calls lack abuse controls.",{"type":42,"tag":185,"props":751,"children":752},{},[753,762],{"type":42,"tag":207,"props":754,"children":755},{},[756],{"type":42,"tag":60,"props":757,"children":759},{"className":758},[],[760],{"type":47,"value":761},"expensive-api-abuse",{"type":42,"tag":207,"props":763,"children":764},{},[765],{"type":47,"value":766},"LLM, AI, billing, email, SMS, search, export, or paid third-party calls are reachable without quota, auth, or dedupe controls.",{"type":42,"tag":185,"props":768,"children":769},{},[770,779],{"type":42,"tag":207,"props":771,"children":772},{},[773],{"type":42,"tag":60,"props":774,"children":776},{"className":775},[],[777],{"type":47,"value":778},"cache-key-poisoning",{"type":42,"tag":207,"props":780,"children":781},{},[782],{"type":47,"value":783},"Cache keys, shared dictionaries, CDN keys, or object caches include attacker-controlled values without partitioning or validation.",{"type":42,"tag":185,"props":785,"children":786},{},[787,796],{"type":42,"tag":207,"props":788,"children":789},{},[790],{"type":42,"tag":60,"props":791,"children":793},{"className":792},[],[794],{"type":47,"value":795},"header-strip-bypass",{"type":42,"tag":207,"props":797,"children":798},{},[799],{"type":47,"value":800},"Security header handling can be bypassed by case, duplicate headers, encoding, proxy normalization, or hop-by-hop confusion.",{"type":42,"tag":185,"props":802,"children":803},{},[804,813],{"type":42,"tag":207,"props":805,"children":806},{},[807],{"type":42,"tag":60,"props":808,"children":810},{"className":809},[],[811],{"type":47,"value":812},"lua-header-trust",{"type":42,"tag":207,"props":814,"children":815},{},[816],{"type":47,"value":817},"Lua\u002FOpenResty code trusts request headers or proxy metadata without verification.",{"type":42,"tag":185,"props":819,"children":820},{},[821,830],{"type":42,"tag":207,"props":822,"children":823},{},[824],{"type":42,"tag":60,"props":825,"children":827},{"className":826},[],[828],{"type":47,"value":829},"lua-ngx-exec",{"type":42,"tag":207,"props":831,"children":832},{},[833,835,841,842,848,849,855],{"type":47,"value":834},"Lua\u002FOpenResty dynamically calls ",{"type":42,"tag":60,"props":836,"children":838},{"className":837},[],[839],{"type":47,"value":840},"ngx.exec",{"type":47,"value":488},{"type":42,"tag":60,"props":843,"children":845},{"className":844},[],[846],{"type":47,"value":847},"ngx.redirect",{"type":47,"value":488},{"type":42,"tag":60,"props":850,"children":852},{"className":851},[],[853],{"type":47,"value":854},"os.execute",{"type":47,"value":856},", or equivalent with attacker-controlled input.",{"type":42,"tag":185,"props":858,"children":859},{},[860,869],{"type":42,"tag":207,"props":861,"children":862},{},[863],{"type":42,"tag":60,"props":864,"children":866},{"className":865},[],[867],{"type":47,"value":868},"lua-shared-dict-poisoning",{"type":42,"tag":207,"props":870,"children":871},{},[872,878],{"type":42,"tag":60,"props":873,"children":875},{"className":874},[],[876],{"type":47,"value":877},"ngx.shared",{"type":47,"value":879}," dictionaries are written from request data and later trusted across tenants or requests.",{"type":42,"tag":185,"props":881,"children":882},{},[883,892],{"type":42,"tag":207,"props":884,"children":885},{},[886],{"type":42,"tag":60,"props":887,"children":889},{"className":888},[],[890],{"type":47,"value":891},"lua-crypto-weakness",{"type":42,"tag":207,"props":893,"children":894},{},[895],{"type":47,"value":896},"Lua crypto uses timing-unsafe compare, static IV, ECB, weak randomness, or hardcoded key material.",{"type":42,"tag":185,"props":898,"children":899},{},[900,909],{"type":42,"tag":207,"props":901,"children":902},{},[903],{"type":42,"tag":60,"props":904,"children":906},{"className":905},[],[907],{"type":47,"value":908},"go-ssrf",{"type":42,"tag":207,"props":910,"children":911},{},[912],{"type":47,"value":913},"Go HTTP clients construct URLs or hosts from request data without allowlist and private-IP defenses.",{"type":42,"tag":185,"props":915,"children":916},{},[917,926],{"type":42,"tag":207,"props":918,"children":919},{},[920],{"type":42,"tag":60,"props":921,"children":923},{"className":922},[],[924],{"type":47,"value":925},"go-command-injection",{"type":42,"tag":207,"props":927,"children":928},{},[929,931,937],{"type":47,"value":930},"Go ",{"type":42,"tag":60,"props":932,"children":934},{"className":933},[],[935],{"type":47,"value":936},"exec.Command",{"type":47,"value":938}," or shell wrappers execute attacker-controlled commands, binaries, flags, or file paths.",{"type":42,"tag":69,"props":940,"children":942},{"id":941},"what-to-report",[943],{"type":47,"value":944},"What to Report",{"type":42,"tag":946,"props":947,"children":949},"h3",{"id":948},"authentication-authorization-and-logic-bugs",[950],{"type":47,"value":951},"Authentication, authorization, and logic bugs",{"type":42,"tag":76,"props":953,"children":954},{},[955,960,973,1021,1026,1031,1036],{"type":42,"tag":80,"props":956,"children":957},{},[958],{"type":47,"value":959},"Missing auth on sensitive endpoints, service handlers, admin actions, billing flows, exports, webhooks, server actions, or RPC methods.",{"type":42,"tag":80,"props":961,"children":962},{},[963,965,971],{"type":47,"value":964},"Auth that relies only on client-side checks, UI hiding, Next.js ",{"type":42,"tag":60,"props":966,"children":968},{"className":967},[],[969],{"type":47,"value":970},"middleware.ts",{"type":47,"value":972},", edge middleware, or route matchers with no handler-level or backend guard.",{"type":42,"tag":80,"props":974,"children":975},{},[976,978,984,985,991,992,998,999,1005,1006,1012,1013,1019],{"type":47,"value":977},"Cross-tenant access where ",{"type":42,"tag":60,"props":979,"children":981},{"className":980},[],[982],{"type":47,"value":983},"teamId",{"type":47,"value":488},{"type":42,"tag":60,"props":986,"children":988},{"className":987},[],[989],{"type":47,"value":990},"orgId",{"type":47,"value":488},{"type":42,"tag":60,"props":993,"children":995},{"className":994},[],[996],{"type":47,"value":997},"projectId",{"type":47,"value":488},{"type":42,"tag":60,"props":1000,"children":1002},{"className":1001},[],[1003],{"type":47,"value":1004},"accountId",{"type":47,"value":488},{"type":42,"tag":60,"props":1007,"children":1009},{"className":1008},[],[1010],{"type":47,"value":1011},"userId",{"type":47,"value":488},{"type":42,"tag":60,"props":1014,"children":1016},{"className":1015},[],[1017],{"type":47,"value":1018},"slug",{"type":47,"value":1020},", or route params drive queries without scoping to the authenticated identity.",{"type":42,"tag":80,"props":1022,"children":1023},{},[1024],{"type":47,"value":1025},"Permission checks on the wrong actor, stale object, pre-update object, nullable owner, or untrusted role claim.",{"type":42,"tag":80,"props":1027,"children":1028},{},[1029],{"type":47,"value":1030},"OAuth, SSO, session, reset-token, or JWT flows with state confusion, redirect manipulation, missing issuer\u002Faudience\u002Fexpiry, algorithm confusion, or user-controlled key selection.",{"type":42,"tag":80,"props":1032,"children":1033},{},[1034],{"type":47,"value":1035},"Race conditions, TOCTOU, replay, or idempotency bugs in auth, billing, invite, token, deployment, or resource transfer flows.",{"type":42,"tag":80,"props":1037,"children":1038},{},[1039],{"type":47,"value":1040},"Missing rate limits or quota checks on login, MFA, token refresh, password reset, invite, export, email\u002FSMS, LLM, AI, or other paid operations when abuse has meaningful cost or account impact.",{"type":42,"tag":946,"props":1042,"children":1044},{"id":1043},"injection-and-code-execution",[1045],{"type":47,"value":1046},"Injection and code execution",{"type":42,"tag":76,"props":1048,"children":1049},{},[1050,1092,1124,1160,1173],{"type":42,"tag":80,"props":1051,"children":1052},{},[1053,1055,1061,1062,1068,1070,1076,1078,1084,1086,1091],{"type":47,"value":1054},"Shell command strings built with user data: Python ",{"type":42,"tag":60,"props":1056,"children":1058},{"className":1057},[],[1059],{"type":47,"value":1060},"shell=True",{"type":47,"value":488},{"type":42,"tag":60,"props":1063,"children":1065},{"className":1064},[],[1066],{"type":47,"value":1067},"os.system",{"type":47,"value":1069},", Node ",{"type":42,"tag":60,"props":1071,"children":1073},{"className":1072},[],[1074],{"type":47,"value":1075},"exec",{"type":47,"value":1077},", Go shell wrappers, Ruby backticks, PHP ",{"type":42,"tag":60,"props":1079,"children":1081},{"className":1080},[],[1082],{"type":47,"value":1083},"system",{"type":47,"value":1085},", Lua ",{"type":42,"tag":60,"props":1087,"children":1089},{"className":1088},[],[1090],{"type":47,"value":854},{"type":47,"value":67},{"type":42,"tag":80,"props":1093,"children":1094},{},[1095,1097,1102,1103,1108,1109,1115,1116,1122],{"type":47,"value":1096},"Dynamic code execution reached by user data: ",{"type":42,"tag":60,"props":1098,"children":1100},{"className":1099},[],[1101],{"type":47,"value":429},{"type":47,"value":488},{"type":42,"tag":60,"props":1104,"children":1106},{"className":1105},[],[1107],{"type":47,"value":1075},{"type":47,"value":488},{"type":42,"tag":60,"props":1110,"children":1112},{"className":1111},[],[1113],{"type":47,"value":1114},"Function",{"type":47,"value":488},{"type":42,"tag":60,"props":1117,"children":1119},{"className":1118},[],[1120],{"type":47,"value":1121},"vm",{"type":47,"value":1123},", dynamic imports, script engines, unsafe template compilation, Server-Side Template Injection, or expression engines.",{"type":42,"tag":80,"props":1125,"children":1126},{},[1127,1129,1135,1137,1143,1144,1150,1152,1158],{"type":47,"value":1128},"Unsafe deserialization of attacker-controlled bytes or strings: ",{"type":42,"tag":60,"props":1130,"children":1132},{"className":1131},[],[1133],{"type":47,"value":1134},"pickle",{"type":47,"value":1136},", unsafe YAML loaders, Java native serialization, PHP ",{"type":42,"tag":60,"props":1138,"children":1140},{"className":1139},[],[1141],{"type":47,"value":1142},"unserialize",{"type":47,"value":488},{"type":42,"tag":60,"props":1145,"children":1147},{"className":1146},[],[1148],{"type":47,"value":1149},"node-serialize",{"type":47,"value":1151},", .NET ",{"type":42,"tag":60,"props":1153,"children":1155},{"className":1154},[],[1156],{"type":47,"value":1157},"BinaryFormatter",{"type":47,"value":1159},", or ML model loaders.",{"type":42,"tag":80,"props":1161,"children":1162},{},[1163,1165,1171],{"type":47,"value":1164},"SQL\u002FNoSQL injection through raw query strings, string interpolation, unsafe ORM escape hatches, Mongo operator injection, ",{"type":42,"tag":60,"props":1166,"children":1168},{"className":1167},[],[1169],{"type":47,"value":1170},"$where",{"type":47,"value":1172},", or JSON\u002Foperator splicing.",{"type":42,"tag":80,"props":1174,"children":1175},{},[1176],{"type":47,"value":1177},"File upload or archive extraction that permits path escape, executable writes, parser exploit chains, public bucket writes, or content-type confusion with execution.",{"type":42,"tag":946,"props":1179,"children":1181},{"id":1180},"client-side-execution-and-redirects",[1182],{"type":47,"value":1183},"Client-side execution and redirects",{"type":42,"tag":76,"props":1185,"children":1186},{},[1187,1205,1255,1260],{"type":42,"tag":80,"props":1188,"children":1189},{},[1190,1192,1197,1198,1203],{"type":47,"value":1191},"XSS through ",{"type":42,"tag":60,"props":1193,"children":1195},{"className":1194},[],[1196],{"type":47,"value":486},{"type":47,"value":488},{"type":42,"tag":60,"props":1199,"children":1201},{"className":1200},[],[1202],{"type":47,"value":494},{"type":47,"value":1204},", inline scripts, event handler attributes, unsafe Markdown\u002FHTML rendering, template source, unsafe URLs, or framework escape hatches.",{"type":42,"tag":80,"props":1206,"children":1207},{},[1208,1214,1216,1221,1223,1229,1231,1237,1239,1245,1247,1253],{"type":42,"tag":60,"props":1209,"children":1211},{"className":1210},[],[1212],{"type":47,"value":1213},"JSON.stringify(data)",{"type":47,"value":1215}," inside ",{"type":42,"tag":60,"props":1217,"children":1219},{"className":1218},[],[1220],{"type":47,"value":494},{"type":47,"value":1222}," or inline ",{"type":42,"tag":60,"props":1224,"children":1226},{"className":1225},[],[1227],{"type":47,"value":1228},"\u003Cscript>",{"type":47,"value":1230}," when any serialized field can be user-influenced. ",{"type":42,"tag":60,"props":1232,"children":1234},{"className":1233},[],[1235],{"type":47,"value":1236},"\u003C\u002Fscript>",{"type":47,"value":1238}," breaks out unless ",{"type":42,"tag":60,"props":1240,"children":1242},{"className":1241},[],[1243],{"type":47,"value":1244},"\u003C",{"type":47,"value":1246}," or ",{"type":42,"tag":60,"props":1248,"children":1250},{"className":1249},[],[1251],{"type":47,"value":1252},"\u003C\u002F",{"type":47,"value":1254}," is escaped.",{"type":42,"tag":80,"props":1256,"children":1257},{},[1258],{"type":47,"value":1259},"Redirects to user-controlled URLs in login, OAuth, SSO, invitation, token, checkout, callback, or post-auth flows without exact origin\u002Fpath validation.",{"type":42,"tag":80,"props":1261,"children":1262},{},[1263,1265,1271],{"type":47,"value":1264},"Redirect validation based on substring, prefix, incomplete URL parsing, unnormalized paths, double encoding, Unicode normalization gaps, or insufficient ",{"type":42,"tag":60,"props":1266,"children":1268},{"className":1267},[],[1269],{"type":47,"value":1270},"validNextRedirect",{"type":47,"value":1272},"-style helpers.",{"type":42,"tag":946,"props":1274,"children":1276},{"id":1275},"data-exposure-ssrf-and-filesystem-bugs",[1277],{"type":47,"value":1278},"Data exposure, SSRF, and filesystem bugs",{"type":42,"tag":76,"props":1280,"children":1281},{},[1282,1287,1292,1297,1302],{"type":42,"tag":80,"props":1283,"children":1284},{},[1285],{"type":47,"value":1286},"SSRF from user-controlled URLs, hosts, redirects, webhooks, image fetchers, preview fetchers, URL metadata extractors, or Go\u002FNode\u002FPython HTTP clients without exact allowlists and private-IP checks.",{"type":42,"tag":80,"props":1288,"children":1289},{},[1290],{"type":47,"value":1291},"Redirect-following fetches that validate only the first hop.",{"type":42,"tag":80,"props":1293,"children":1294},{},[1295],{"type":47,"value":1296},"Path traversal in downloads, static file serving, archive extraction, file deletes, object storage keys, or user-supplied filenames.",{"type":42,"tag":80,"props":1298,"children":1299},{},[1300],{"type":47,"value":1301},"Response serializers, API responses, exports, logs, or error handlers that expose secrets, tokens, passwords, internal fields, PII, stack traces, SQL fragments, signed URLs, or cross-resource data.",{"type":42,"tag":80,"props":1303,"children":1304},{},[1305],{"type":47,"value":1306},"Cache poisoning or shared-dict poisoning where attacker-controlled keys or values are later trusted by other users, tenants, routes, or privilege levels.",{"type":42,"tag":946,"props":1308,"children":1310},{"id":1309},"secrets-crypto-cloud-and-headers",[1311],{"type":47,"value":1312},"Secrets, crypto, cloud, and headers",{"type":42,"tag":76,"props":1314,"children":1315},{},[1316,1321,1326,1331,1336],{"type":42,"tag":80,"props":1317,"children":1318},{},[1319],{"type":47,"value":1320},"Real secrets in source, examples that are loaded by production, hardcoded fallback credentials, or server secrets exposed to client bundles.",{"type":42,"tag":80,"props":1322,"children":1323},{},[1324],{"type":47,"value":1325},"Logs or errors containing credentials, auth headers, cookies, tokens, signed URLs, webhook secrets, OAuth codes, private keys, or password reset values.",{"type":42,"tag":80,"props":1327,"children":1328},{},[1329],{"type":47,"value":1330},"Weak crypto protecting security-sensitive data: MD5\u002FSHA1 for passwords or signatures, predictable random tokens, timing-unsafe compares, static IVs, ECB mode, homegrown crypto, or missing authentication on ciphertext.",{"type":42,"tag":80,"props":1332,"children":1333},{},[1334],{"type":47,"value":1335},"IAM policies, API tokens, OIDC roles, service accounts, or cloud resource patterns that grant privileged actions to an attacker-reachable path.",{"type":42,"tag":80,"props":1337,"children":1338},{},[1339,1341,1347],{"type":47,"value":1340},"Header trust bugs: ",{"type":42,"tag":60,"props":1342,"children":1344},{"className":1343},[],[1345],{"type":47,"value":1346},"X-Forwarded-*",{"type":47,"value":1348},", auth headers, user IDs, tenant IDs, security header stripping, duplicate header ambiguity, case normalization, or proxy boundary confusion.",{"type":42,"tag":69,"props":1350,"children":1352},{"id":1351},"what-not-to-report",[1353],{"type":47,"value":1354},"What NOT to Report",{"type":42,"tag":76,"props":1356,"children":1357},{},[1358,1363,1368,1373,1378,1383,1388,1415],{"type":42,"tag":80,"props":1359,"children":1360},{},[1361],{"type":47,"value":1362},"A pattern that is fully mitigated by a verified guard in the same effective path.",{"type":42,"tag":80,"props":1364,"children":1365},{},[1366],{"type":47,"value":1367},"A sink fed only by constants, trusted server-side values, migration code, seed data, tests, fixtures, examples, generated files, build output, vendored code, or gitignored paths.",{"type":42,"tag":80,"props":1369,"children":1370},{},[1371],{"type":47,"value":1372},"Generic dependency CVEs unless changed application code makes the vulnerable behavior reachable.",{"type":42,"tag":80,"props":1374,"children":1375},{},[1376],{"type":47,"value":1377},"Standalone lint, style, missing comments, broad \"best practice\" advice, or theoretical hardening with no exploit path.",{"type":42,"tag":80,"props":1379,"children":1380},{},[1381],{"type":47,"value":1382},"Public endpoints that intentionally expose non-sensitive data and have no sensitive side effect.",{"type":42,"tag":80,"props":1384,"children":1385},{},[1386],{"type":47,"value":1387},"Rate-limit complaints on low-value actions without account, cost, data, or availability impact.",{"type":42,"tag":80,"props":1389,"children":1390},{},[1391,1393,1399,1400,1406,1407,1413],{"type":47,"value":1392},"Secret-looking placeholders such as ",{"type":42,"tag":60,"props":1394,"children":1396},{"className":1395},[],[1397],{"type":47,"value":1398},"example",{"type":47,"value":488},{"type":42,"tag":60,"props":1401,"children":1403},{"className":1402},[],[1404],{"type":47,"value":1405},"test",{"type":47,"value":488},{"type":42,"tag":60,"props":1408,"children":1410},{"className":1409},[],[1411],{"type":47,"value":1412},"dummy",{"type":47,"value":1414},", documented fake keys, or values confined to test-only files.",{"type":42,"tag":80,"props":1416,"children":1417},{},[1418],{"type":47,"value":1419},"Framework defaults that already escape or parameterize data unless the code uses an escape hatch.",{"type":42,"tag":69,"props":1421,"children":1423},{"id":1422},"false-positive-controls",[1424],{"type":47,"value":1425},"False-Positive Controls",{"type":42,"tag":76,"props":1427,"children":1428},{},[1429,1441,1446,1451,1456,1474,1516,1521,1526],{"type":42,"tag":80,"props":1430,"children":1431},{},[1432,1434,1439],{"type":47,"value":1433},"Auth middleware must wrap the handler or backend route being reviewed. For this benchmark, do not treat Next.js ",{"type":42,"tag":60,"props":1435,"children":1437},{"className":1436},[],[1438],{"type":47,"value":970},{"type":47,"value":1440}," alone as complete proof of auth.",{"type":42,"tag":80,"props":1442,"children":1443},{},[1444],{"type":47,"value":1445},"For authorization, \"user is logged in\" is not enough. Confirm ownership, tenant, role, scope, or resource access.",{"type":42,"tag":80,"props":1447,"children":1448},{},[1449],{"type":47,"value":1450},"For SQL, tagged templates or query builders may parameterize automatically. Verify the API before reporting.",{"type":42,"tag":80,"props":1452,"children":1453},{},[1454],{"type":47,"value":1455},"For SSRF, exact hostname allowlists plus private-IP and redirect revalidation are strong mitigations. Substring and suffix checks are not.",{"type":42,"tag":80,"props":1457,"children":1458},{},[1459,1461,1466,1467,1472],{"type":47,"value":1460},"For XSS, React text interpolation is usually safe. Escape hatches such as ",{"type":42,"tag":60,"props":1462,"children":1464},{"className":1463},[],[1465],{"type":47,"value":494},{"type":47,"value":488},{"type":42,"tag":60,"props":1468,"children":1470},{"className":1469},[],[1471],{"type":47,"value":486},{"type":47,"value":1473},", inline script, unsafe Markdown HTML, and dangerous URLs are not.",{"type":42,"tag":80,"props":1475,"children":1476},{},[1477,1479,1485,1487,1492,1494,1500,1502,1507,1508,1514],{"type":47,"value":1478},"For script-tag JSON, ",{"type":42,"tag":60,"props":1480,"children":1482},{"className":1481},[],[1483],{"type":47,"value":1484},"safeJsonStringify",{"type":47,"value":1486},", escaping ",{"type":42,"tag":60,"props":1488,"children":1490},{"className":1489},[],[1491],{"type":47,"value":1244},{"type":47,"value":1493}," to ",{"type":42,"tag":60,"props":1495,"children":1497},{"className":1496},[],[1498],{"type":47,"value":1499},"\\u003c",{"type":47,"value":1501},", or escaping ",{"type":42,"tag":60,"props":1503,"children":1505},{"className":1504},[],[1506],{"type":47,"value":1252},{"type":47,"value":1493},{"type":42,"tag":60,"props":1509,"children":1511},{"className":1510},[],[1512],{"type":47,"value":1513},"\u003C\\\u002F",{"type":47,"value":1515}," can mitigate. Server-side origin alone does not if any serialized field can be user-influenced.",{"type":42,"tag":80,"props":1517,"children":1518},{},[1519],{"type":47,"value":1520},"For webhooks, verify HMAC\u002Fsignature, timestamp freshness, replay prevention, and exact provider secret use.",{"type":42,"tag":80,"props":1522,"children":1523},{},[1524],{"type":47,"value":1525},"For secrets, prove the value is real or production-reachable before reporting.",{"type":42,"tag":80,"props":1527,"children":1528},{},[1529],{"type":47,"value":1530},"For path traversal, realpath containment, basename replacement, UUID filenames, framework-safe helpers, and archive entry checks can close the issue.",{"type":42,"tag":69,"props":1532,"children":1534},{"id":1533},"investigation-process",[1535],{"type":47,"value":1536},"Investigation Process",{"type":42,"tag":1538,"props":1539,"children":1540},"ol",{},[1541,1546,1551,1556,1561,1573,1578],{"type":42,"tag":80,"props":1542,"children":1543},{},[1544],{"type":47,"value":1545},"Read the target file fully.",{"type":42,"tag":80,"props":1547,"children":1548},{},[1549],{"type":47,"value":1550},"Find route handlers, server actions, webhooks, RPC handlers, service entry points, serializers, background jobs, and CLI\u002FAPI boundaries.",{"type":42,"tag":80,"props":1552,"children":1553},{},[1554],{"type":47,"value":1555},"Trace every suspicious value from source to sink.",{"type":42,"tag":80,"props":1557,"children":1558},{},[1559],{"type":47,"value":1560},"Read imported guards, validators, auth wrappers, middleware, schema definitions, and shared utilities.",{"type":42,"tag":80,"props":1562,"children":1563},{},[1564,1566,1571],{"type":47,"value":1565},"Compare sibling endpoints or call sites with ",{"type":42,"tag":60,"props":1567,"children":1569},{"className":1568},[],[1570],{"type":47,"value":154},{"type":47,"value":1572}," to identify missing checks.",{"type":42,"tag":80,"props":1574,"children":1575},{},[1576],{"type":47,"value":1577},"Check whether the file is production code. Return no findings for generated, vendored, ignored, or test-only code.",{"type":42,"tag":80,"props":1579,"children":1580},{},[1581],{"type":47,"value":1582},"Report only high-confidence issues. A novel issue is welcome, but it still needs a complete exploit path.",{"type":42,"tag":69,"props":1584,"children":1586},{"id":1585},"canonical-patterns",[1587],{"type":47,"value":1588},"Canonical Patterns",{"type":42,"tag":946,"props":1590,"children":1592},{"id":1591},"pattern-cross-tenant-lookup",[1593],{"type":47,"value":1594},"Pattern: cross-tenant lookup",{"type":42,"tag":43,"props":1596,"children":1597},{},[1598],{"type":42,"tag":1599,"props":1600,"children":1601},"strong",{},[1602],{"type":47,"value":1603},"Python - bad:",{"type":42,"tag":1605,"props":1606,"children":1611},"pre",{"className":1607,"code":1608,"language":1609,"meta":1610,"style":1610},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","def get_invoice(request, invoice_id):\n    invoice = Invoice.objects.get(id=invoice_id)\n    return JsonResponse({\"total\": invoice.total, \"email\": invoice.customer.email})\n","python","",[1612],{"type":42,"tag":60,"props":1613,"children":1614},{"__ignoreMap":1610},[1615,1626,1635],{"type":42,"tag":1616,"props":1617,"children":1620},"span",{"class":1618,"line":1619},"line",1,[1621],{"type":42,"tag":1616,"props":1622,"children":1623},{},[1624],{"type":47,"value":1625},"def get_invoice(request, invoice_id):\n",{"type":42,"tag":1616,"props":1627,"children":1629},{"class":1618,"line":1628},2,[1630],{"type":42,"tag":1616,"props":1631,"children":1632},{},[1633],{"type":47,"value":1634},"    invoice = Invoice.objects.get(id=invoice_id)\n",{"type":42,"tag":1616,"props":1636,"children":1637},{"class":1618,"line":28},[1638],{"type":42,"tag":1616,"props":1639,"children":1640},{},[1641],{"type":47,"value":1642},"    return JsonResponse({\"total\": invoice.total, \"email\": invoice.customer.email})\n",{"type":42,"tag":43,"props":1644,"children":1645},{},[1646],{"type":42,"tag":1599,"props":1647,"children":1648},{},[1649],{"type":47,"value":1650},"Python - safe:",{"type":42,"tag":1605,"props":1652,"children":1654},{"className":1607,"code":1653,"language":1609,"meta":1610,"style":1610},"def get_invoice(request, invoice_id):\n    invoice = Invoice.objects.get(id=invoice_id, account_id=request.user.account_id)\n    require_permission(request.user, \"billing:read\", invoice.account)\n    return JsonResponse({\"total\": invoice.total})\n",[1655],{"type":42,"tag":60,"props":1656,"children":1657},{"__ignoreMap":1610},[1658,1665,1673,1681],{"type":42,"tag":1616,"props":1659,"children":1660},{"class":1618,"line":1619},[1661],{"type":42,"tag":1616,"props":1662,"children":1663},{},[1664],{"type":47,"value":1625},{"type":42,"tag":1616,"props":1666,"children":1667},{"class":1618,"line":1628},[1668],{"type":42,"tag":1616,"props":1669,"children":1670},{},[1671],{"type":47,"value":1672},"    invoice = Invoice.objects.get(id=invoice_id, account_id=request.user.account_id)\n",{"type":42,"tag":1616,"props":1674,"children":1675},{"class":1618,"line":28},[1676],{"type":42,"tag":1616,"props":1677,"children":1678},{},[1679],{"type":47,"value":1680},"    require_permission(request.user, \"billing:read\", invoice.account)\n",{"type":42,"tag":1616,"props":1682,"children":1684},{"class":1618,"line":1683},4,[1685],{"type":42,"tag":1616,"props":1686,"children":1687},{},[1688],{"type":47,"value":1689},"    return JsonResponse({\"total\": invoice.total})\n",{"type":42,"tag":43,"props":1691,"children":1692},{},[1693],{"type":42,"tag":1599,"props":1694,"children":1695},{},[1696],{"type":47,"value":1697},"TypeScript - bad:",{"type":42,"tag":1605,"props":1699,"children":1703},{"className":1700,"code":1701,"language":1702,"meta":1610,"style":1610},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","export async function GET(req: Request, { params }: { params: { teamId: string } }) {\n  const projects = await db.project.findMany({ where: { teamId: params.teamId } });\n  return Response.json(projects);\n}\n","ts",[1704],{"type":42,"tag":60,"props":1705,"children":1706},{"__ignoreMap":1610},[1707,1822,1929,1968],{"type":42,"tag":1616,"props":1708,"children":1709},{"class":1618,"line":1619},[1710,1716,1722,1727,1733,1739,1745,1750,1756,1761,1766,1771,1776,1780,1785,1789,1793,1798,1802,1807,1812,1817],{"type":42,"tag":1616,"props":1711,"children":1713},{"style":1712},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1714],{"type":47,"value":1715},"export",{"type":42,"tag":1616,"props":1717,"children":1719},{"style":1718},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[1720],{"type":47,"value":1721}," async",{"type":42,"tag":1616,"props":1723,"children":1724},{"style":1718},[1725],{"type":47,"value":1726}," function",{"type":42,"tag":1616,"props":1728,"children":1730},{"style":1729},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1731],{"type":47,"value":1732}," GET",{"type":42,"tag":1616,"props":1734,"children":1736},{"style":1735},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1737],{"type":47,"value":1738},"(",{"type":42,"tag":1616,"props":1740,"children":1742},{"style":1741},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic",[1743],{"type":47,"value":1744},"req",{"type":42,"tag":1616,"props":1746,"children":1747},{"style":1735},[1748],{"type":47,"value":1749},":",{"type":42,"tag":1616,"props":1751,"children":1753},{"style":1752},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1754],{"type":47,"value":1755}," Request",{"type":42,"tag":1616,"props":1757,"children":1758},{"style":1735},[1759],{"type":47,"value":1760},",",{"type":42,"tag":1616,"props":1762,"children":1763},{"style":1735},[1764],{"type":47,"value":1765}," {",{"type":42,"tag":1616,"props":1767,"children":1768},{"style":1741},[1769],{"type":47,"value":1770}," params",{"type":42,"tag":1616,"props":1772,"children":1773},{"style":1735},[1774],{"type":47,"value":1775}," }:",{"type":42,"tag":1616,"props":1777,"children":1778},{"style":1735},[1779],{"type":47,"value":1765},{"type":42,"tag":1616,"props":1781,"children":1783},{"style":1782},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[1784],{"type":47,"value":1770},{"type":42,"tag":1616,"props":1786,"children":1787},{"style":1735},[1788],{"type":47,"value":1749},{"type":42,"tag":1616,"props":1790,"children":1791},{"style":1735},[1792],{"type":47,"value":1765},{"type":42,"tag":1616,"props":1794,"children":1795},{"style":1782},[1796],{"type":47,"value":1797}," teamId",{"type":42,"tag":1616,"props":1799,"children":1800},{"style":1735},[1801],{"type":47,"value":1749},{"type":42,"tag":1616,"props":1803,"children":1804},{"style":1752},[1805],{"type":47,"value":1806}," string",{"type":42,"tag":1616,"props":1808,"children":1809},{"style":1735},[1810],{"type":47,"value":1811}," }",{"type":42,"tag":1616,"props":1813,"children":1814},{"style":1735},[1815],{"type":47,"value":1816}," })",{"type":42,"tag":1616,"props":1818,"children":1819},{"style":1735},[1820],{"type":47,"value":1821}," {\n",{"type":42,"tag":1616,"props":1823,"children":1824},{"class":1618,"line":1628},[1825,1830,1836,1841,1846,1851,1855,1860,1864,1869,1873,1878,1883,1887,1891,1895,1899,1903,1907,1911,1915,1919,1924],{"type":42,"tag":1616,"props":1826,"children":1827},{"style":1718},[1828],{"type":47,"value":1829},"  const",{"type":42,"tag":1616,"props":1831,"children":1833},{"style":1832},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1834],{"type":47,"value":1835}," projects",{"type":42,"tag":1616,"props":1837,"children":1838},{"style":1735},[1839],{"type":47,"value":1840}," =",{"type":42,"tag":1616,"props":1842,"children":1843},{"style":1712},[1844],{"type":47,"value":1845}," await",{"type":42,"tag":1616,"props":1847,"children":1848},{"style":1832},[1849],{"type":47,"value":1850}," db",{"type":42,"tag":1616,"props":1852,"children":1853},{"style":1735},[1854],{"type":47,"value":67},{"type":42,"tag":1616,"props":1856,"children":1857},{"style":1832},[1858],{"type":47,"value":1859},"project",{"type":42,"tag":1616,"props":1861,"children":1862},{"style":1735},[1863],{"type":47,"value":67},{"type":42,"tag":1616,"props":1865,"children":1866},{"style":1729},[1867],{"type":47,"value":1868},"findMany",{"type":42,"tag":1616,"props":1870,"children":1871},{"style":1782},[1872],{"type":47,"value":1738},{"type":42,"tag":1616,"props":1874,"children":1875},{"style":1735},[1876],{"type":47,"value":1877},"{",{"type":42,"tag":1616,"props":1879,"children":1880},{"style":1782},[1881],{"type":47,"value":1882}," where",{"type":42,"tag":1616,"props":1884,"children":1885},{"style":1735},[1886],{"type":47,"value":1749},{"type":42,"tag":1616,"props":1888,"children":1889},{"style":1735},[1890],{"type":47,"value":1765},{"type":42,"tag":1616,"props":1892,"children":1893},{"style":1782},[1894],{"type":47,"value":1797},{"type":42,"tag":1616,"props":1896,"children":1897},{"style":1735},[1898],{"type":47,"value":1749},{"type":42,"tag":1616,"props":1900,"children":1901},{"style":1832},[1902],{"type":47,"value":1770},{"type":42,"tag":1616,"props":1904,"children":1905},{"style":1735},[1906],{"type":47,"value":67},{"type":42,"tag":1616,"props":1908,"children":1909},{"style":1832},[1910],{"type":47,"value":983},{"type":42,"tag":1616,"props":1912,"children":1913},{"style":1735},[1914],{"type":47,"value":1811},{"type":42,"tag":1616,"props":1916,"children":1917},{"style":1735},[1918],{"type":47,"value":1811},{"type":42,"tag":1616,"props":1920,"children":1921},{"style":1782},[1922],{"type":47,"value":1923},")",{"type":42,"tag":1616,"props":1925,"children":1926},{"style":1735},[1927],{"type":47,"value":1928},";\n",{"type":42,"tag":1616,"props":1930,"children":1931},{"class":1618,"line":28},[1932,1937,1942,1946,1951,1955,1960,1964],{"type":42,"tag":1616,"props":1933,"children":1934},{"style":1712},[1935],{"type":47,"value":1936},"  return",{"type":42,"tag":1616,"props":1938,"children":1939},{"style":1832},[1940],{"type":47,"value":1941}," Response",{"type":42,"tag":1616,"props":1943,"children":1944},{"style":1735},[1945],{"type":47,"value":67},{"type":42,"tag":1616,"props":1947,"children":1948},{"style":1729},[1949],{"type":47,"value":1950},"json",{"type":42,"tag":1616,"props":1952,"children":1953},{"style":1782},[1954],{"type":47,"value":1738},{"type":42,"tag":1616,"props":1956,"children":1957},{"style":1832},[1958],{"type":47,"value":1959},"projects",{"type":42,"tag":1616,"props":1961,"children":1962},{"style":1782},[1963],{"type":47,"value":1923},{"type":42,"tag":1616,"props":1965,"children":1966},{"style":1735},[1967],{"type":47,"value":1928},{"type":42,"tag":1616,"props":1969,"children":1970},{"class":1618,"line":1683},[1971],{"type":42,"tag":1616,"props":1972,"children":1973},{"style":1735},[1974],{"type":47,"value":1975},"}\n",{"type":42,"tag":43,"props":1977,"children":1978},{},[1979],{"type":42,"tag":1599,"props":1980,"children":1981},{},[1982],{"type":47,"value":1983},"TypeScript - safe:",{"type":42,"tag":1605,"props":1985,"children":1987},{"className":1700,"code":1986,"language":1702,"meta":1610,"style":1610},"export async function GET(req: Request, { params }: { params: { teamId: string } }) {\n  const session = await requireSession(req);\n  await requireTeamAccess(session.user.id, params.teamId, \"project:read\");\n  const projects = await db.project.findMany({ where: { teamId: params.teamId } });\n  return Response.json(projects.map(projectSummary));\n}\n",[1988],{"type":42,"tag":60,"props":1989,"children":1990},{"__ignoreMap":1610},[1991,2082,2123,2207,2302,2357],{"type":42,"tag":1616,"props":1992,"children":1993},{"class":1618,"line":1619},[1994,1998,2002,2006,2010,2014,2018,2022,2026,2030,2034,2038,2042,2046,2050,2054,2058,2062,2066,2070,2074,2078],{"type":42,"tag":1616,"props":1995,"children":1996},{"style":1712},[1997],{"type":47,"value":1715},{"type":42,"tag":1616,"props":1999,"children":2000},{"style":1718},[2001],{"type":47,"value":1721},{"type":42,"tag":1616,"props":2003,"children":2004},{"style":1718},[2005],{"type":47,"value":1726},{"type":42,"tag":1616,"props":2007,"children":2008},{"style":1729},[2009],{"type":47,"value":1732},{"type":42,"tag":1616,"props":2011,"children":2012},{"style":1735},[2013],{"type":47,"value":1738},{"type":42,"tag":1616,"props":2015,"children":2016},{"style":1741},[2017],{"type":47,"value":1744},{"type":42,"tag":1616,"props":2019,"children":2020},{"style":1735},[2021],{"type":47,"value":1749},{"type":42,"tag":1616,"props":2023,"children":2024},{"style":1752},[2025],{"type":47,"value":1755},{"type":42,"tag":1616,"props":2027,"children":2028},{"style":1735},[2029],{"type":47,"value":1760},{"type":42,"tag":1616,"props":2031,"children":2032},{"style":1735},[2033],{"type":47,"value":1765},{"type":42,"tag":1616,"props":2035,"children":2036},{"style":1741},[2037],{"type":47,"value":1770},{"type":42,"tag":1616,"props":2039,"children":2040},{"style":1735},[2041],{"type":47,"value":1775},{"type":42,"tag":1616,"props":2043,"children":2044},{"style":1735},[2045],{"type":47,"value":1765},{"type":42,"tag":1616,"props":2047,"children":2048},{"style":1782},[2049],{"type":47,"value":1770},{"type":42,"tag":1616,"props":2051,"children":2052},{"style":1735},[2053],{"type":47,"value":1749},{"type":42,"tag":1616,"props":2055,"children":2056},{"style":1735},[2057],{"type":47,"value":1765},{"type":42,"tag":1616,"props":2059,"children":2060},{"style":1782},[2061],{"type":47,"value":1797},{"type":42,"tag":1616,"props":2063,"children":2064},{"style":1735},[2065],{"type":47,"value":1749},{"type":42,"tag":1616,"props":2067,"children":2068},{"style":1752},[2069],{"type":47,"value":1806},{"type":42,"tag":1616,"props":2071,"children":2072},{"style":1735},[2073],{"type":47,"value":1811},{"type":42,"tag":1616,"props":2075,"children":2076},{"style":1735},[2077],{"type":47,"value":1816},{"type":42,"tag":1616,"props":2079,"children":2080},{"style":1735},[2081],{"type":47,"value":1821},{"type":42,"tag":1616,"props":2083,"children":2084},{"class":1618,"line":1628},[2085,2089,2094,2098,2102,2107,2111,2115,2119],{"type":42,"tag":1616,"props":2086,"children":2087},{"style":1718},[2088],{"type":47,"value":1829},{"type":42,"tag":1616,"props":2090,"children":2091},{"style":1832},[2092],{"type":47,"value":2093}," session",{"type":42,"tag":1616,"props":2095,"children":2096},{"style":1735},[2097],{"type":47,"value":1840},{"type":42,"tag":1616,"props":2099,"children":2100},{"style":1712},[2101],{"type":47,"value":1845},{"type":42,"tag":1616,"props":2103,"children":2104},{"style":1729},[2105],{"type":47,"value":2106}," requireSession",{"type":42,"tag":1616,"props":2108,"children":2109},{"style":1782},[2110],{"type":47,"value":1738},{"type":42,"tag":1616,"props":2112,"children":2113},{"style":1832},[2114],{"type":47,"value":1744},{"type":42,"tag":1616,"props":2116,"children":2117},{"style":1782},[2118],{"type":47,"value":1923},{"type":42,"tag":1616,"props":2120,"children":2121},{"style":1735},[2122],{"type":47,"value":1928},{"type":42,"tag":1616,"props":2124,"children":2125},{"class":1618,"line":28},[2126,2131,2136,2140,2145,2149,2154,2158,2163,2167,2171,2175,2179,2183,2188,2194,2199,2203],{"type":42,"tag":1616,"props":2127,"children":2128},{"style":1712},[2129],{"type":47,"value":2130},"  await",{"type":42,"tag":1616,"props":2132,"children":2133},{"style":1729},[2134],{"type":47,"value":2135}," requireTeamAccess",{"type":42,"tag":1616,"props":2137,"children":2138},{"style":1782},[2139],{"type":47,"value":1738},{"type":42,"tag":1616,"props":2141,"children":2142},{"style":1832},[2143],{"type":47,"value":2144},"session",{"type":42,"tag":1616,"props":2146,"children":2147},{"style":1735},[2148],{"type":47,"value":67},{"type":42,"tag":1616,"props":2150,"children":2151},{"style":1832},[2152],{"type":47,"value":2153},"user",{"type":42,"tag":1616,"props":2155,"children":2156},{"style":1735},[2157],{"type":47,"value":67},{"type":42,"tag":1616,"props":2159,"children":2160},{"style":1832},[2161],{"type":47,"value":2162},"id",{"type":42,"tag":1616,"props":2164,"children":2165},{"style":1735},[2166],{"type":47,"value":1760},{"type":42,"tag":1616,"props":2168,"children":2169},{"style":1832},[2170],{"type":47,"value":1770},{"type":42,"tag":1616,"props":2172,"children":2173},{"style":1735},[2174],{"type":47,"value":67},{"type":42,"tag":1616,"props":2176,"children":2177},{"style":1832},[2178],{"type":47,"value":983},{"type":42,"tag":1616,"props":2180,"children":2181},{"style":1735},[2182],{"type":47,"value":1760},{"type":42,"tag":1616,"props":2184,"children":2185},{"style":1735},[2186],{"type":47,"value":2187}," \"",{"type":42,"tag":1616,"props":2189,"children":2191},{"style":2190},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[2192],{"type":47,"value":2193},"project:read",{"type":42,"tag":1616,"props":2195,"children":2196},{"style":1735},[2197],{"type":47,"value":2198},"\"",{"type":42,"tag":1616,"props":2200,"children":2201},{"style":1782},[2202],{"type":47,"value":1923},{"type":42,"tag":1616,"props":2204,"children":2205},{"style":1735},[2206],{"type":47,"value":1928},{"type":42,"tag":1616,"props":2208,"children":2209},{"class":1618,"line":1683},[2210,2214,2218,2222,2226,2230,2234,2238,2242,2246,2250,2254,2258,2262,2266,2270,2274,2278,2282,2286,2290,2294,2298],{"type":42,"tag":1616,"props":2211,"children":2212},{"style":1718},[2213],{"type":47,"value":1829},{"type":42,"tag":1616,"props":2215,"children":2216},{"style":1832},[2217],{"type":47,"value":1835},{"type":42,"tag":1616,"props":2219,"children":2220},{"style":1735},[2221],{"type":47,"value":1840},{"type":42,"tag":1616,"props":2223,"children":2224},{"style":1712},[2225],{"type":47,"value":1845},{"type":42,"tag":1616,"props":2227,"children":2228},{"style":1832},[2229],{"type":47,"value":1850},{"type":42,"tag":1616,"props":2231,"children":2232},{"style":1735},[2233],{"type":47,"value":67},{"type":42,"tag":1616,"props":2235,"children":2236},{"style":1832},[2237],{"type":47,"value":1859},{"type":42,"tag":1616,"props":2239,"children":2240},{"style":1735},[2241],{"type":47,"value":67},{"type":42,"tag":1616,"props":2243,"children":2244},{"style":1729},[2245],{"type":47,"value":1868},{"type":42,"tag":1616,"props":2247,"children":2248},{"style":1782},[2249],{"type":47,"value":1738},{"type":42,"tag":1616,"props":2251,"children":2252},{"style":1735},[2253],{"type":47,"value":1877},{"type":42,"tag":1616,"props":2255,"children":2256},{"style":1782},[2257],{"type":47,"value":1882},{"type":42,"tag":1616,"props":2259,"children":2260},{"style":1735},[2261],{"type":47,"value":1749},{"type":42,"tag":1616,"props":2263,"children":2264},{"style":1735},[2265],{"type":47,"value":1765},{"type":42,"tag":1616,"props":2267,"children":2268},{"style":1782},[2269],{"type":47,"value":1797},{"type":42,"tag":1616,"props":2271,"children":2272},{"style":1735},[2273],{"type":47,"value":1749},{"type":42,"tag":1616,"props":2275,"children":2276},{"style":1832},[2277],{"type":47,"value":1770},{"type":42,"tag":1616,"props":2279,"children":2280},{"style":1735},[2281],{"type":47,"value":67},{"type":42,"tag":1616,"props":2283,"children":2284},{"style":1832},[2285],{"type":47,"value":983},{"type":42,"tag":1616,"props":2287,"children":2288},{"style":1735},[2289],{"type":47,"value":1811},{"type":42,"tag":1616,"props":2291,"children":2292},{"style":1735},[2293],{"type":47,"value":1811},{"type":42,"tag":1616,"props":2295,"children":2296},{"style":1782},[2297],{"type":47,"value":1923},{"type":42,"tag":1616,"props":2299,"children":2300},{"style":1735},[2301],{"type":47,"value":1928},{"type":42,"tag":1616,"props":2303,"children":2305},{"class":1618,"line":2304},5,[2306,2310,2314,2318,2322,2326,2330,2334,2339,2343,2348,2353],{"type":42,"tag":1616,"props":2307,"children":2308},{"style":1712},[2309],{"type":47,"value":1936},{"type":42,"tag":1616,"props":2311,"children":2312},{"style":1832},[2313],{"type":47,"value":1941},{"type":42,"tag":1616,"props":2315,"children":2316},{"style":1735},[2317],{"type":47,"value":67},{"type":42,"tag":1616,"props":2319,"children":2320},{"style":1729},[2321],{"type":47,"value":1950},{"type":42,"tag":1616,"props":2323,"children":2324},{"style":1782},[2325],{"type":47,"value":1738},{"type":42,"tag":1616,"props":2327,"children":2328},{"style":1832},[2329],{"type":47,"value":1959},{"type":42,"tag":1616,"props":2331,"children":2332},{"style":1735},[2333],{"type":47,"value":67},{"type":42,"tag":1616,"props":2335,"children":2336},{"style":1729},[2337],{"type":47,"value":2338},"map",{"type":42,"tag":1616,"props":2340,"children":2341},{"style":1782},[2342],{"type":47,"value":1738},{"type":42,"tag":1616,"props":2344,"children":2345},{"style":1832},[2346],{"type":47,"value":2347},"projectSummary",{"type":42,"tag":1616,"props":2349,"children":2350},{"style":1782},[2351],{"type":47,"value":2352},"))",{"type":42,"tag":1616,"props":2354,"children":2355},{"style":1735},[2356],{"type":47,"value":1928},{"type":42,"tag":1616,"props":2358,"children":2360},{"class":1618,"line":2359},6,[2361],{"type":42,"tag":1616,"props":2362,"children":2363},{"style":1735},[2364],{"type":47,"value":1975},{"type":42,"tag":946,"props":2366,"children":2368},{"id":2367},"pattern-sql-injection",[2369],{"type":47,"value":2370},"Pattern: SQL injection",{"type":42,"tag":43,"props":2372,"children":2373},{},[2374],{"type":42,"tag":1599,"props":2375,"children":2376},{},[2377],{"type":47,"value":1603},{"type":42,"tag":1605,"props":2379,"children":2381},{"className":1607,"code":2380,"language":1609,"meta":1610,"style":1610},"cursor.execute(f\"SELECT * FROM users WHERE email = '{request.GET['email']}'\")\n",[2382],{"type":42,"tag":60,"props":2383,"children":2384},{"__ignoreMap":1610},[2385],{"type":42,"tag":1616,"props":2386,"children":2387},{"class":1618,"line":1619},[2388],{"type":42,"tag":1616,"props":2389,"children":2390},{},[2391],{"type":47,"value":2380},{"type":42,"tag":43,"props":2393,"children":2394},{},[2395],{"type":42,"tag":1599,"props":2396,"children":2397},{},[2398],{"type":47,"value":1650},{"type":42,"tag":1605,"props":2400,"children":2402},{"className":1607,"code":2401,"language":1609,"meta":1610,"style":1610},"cursor.execute(\"SELECT * FROM users WHERE email = %s\", [request.GET[\"email\"]])\n",[2403],{"type":42,"tag":60,"props":2404,"children":2405},{"__ignoreMap":1610},[2406],{"type":42,"tag":1616,"props":2407,"children":2408},{"class":1618,"line":1619},[2409],{"type":42,"tag":1616,"props":2410,"children":2411},{},[2412],{"type":47,"value":2401},{"type":42,"tag":43,"props":2414,"children":2415},{},[2416],{"type":42,"tag":1599,"props":2417,"children":2418},{},[2419],{"type":47,"value":1697},{"type":42,"tag":1605,"props":2421,"children":2423},{"className":1700,"code":2422,"language":1702,"meta":1610,"style":1610},"await prisma.$queryRawUnsafe(`SELECT * FROM users WHERE email = '${email}'`);\n",[2424],{"type":42,"tag":60,"props":2425,"children":2426},{"__ignoreMap":1610},[2427],{"type":42,"tag":1616,"props":2428,"children":2429},{"class":1618,"line":1619},[2430,2435,2440,2444,2449,2453,2458,2463,2468,2473,2478,2483,2487,2491],{"type":42,"tag":1616,"props":2431,"children":2432},{"style":1712},[2433],{"type":47,"value":2434},"await",{"type":42,"tag":1616,"props":2436,"children":2437},{"style":1832},[2438],{"type":47,"value":2439}," prisma",{"type":42,"tag":1616,"props":2441,"children":2442},{"style":1735},[2443],{"type":47,"value":67},{"type":42,"tag":1616,"props":2445,"children":2446},{"style":1729},[2447],{"type":47,"value":2448},"$queryRawUnsafe",{"type":42,"tag":1616,"props":2450,"children":2451},{"style":1832},[2452],{"type":47,"value":1738},{"type":42,"tag":1616,"props":2454,"children":2455},{"style":1735},[2456],{"type":47,"value":2457},"`",{"type":42,"tag":1616,"props":2459,"children":2460},{"style":2190},[2461],{"type":47,"value":2462},"SELECT * FROM users WHERE email = '",{"type":42,"tag":1616,"props":2464,"children":2465},{"style":1735},[2466],{"type":47,"value":2467},"${",{"type":42,"tag":1616,"props":2469,"children":2470},{"style":1832},[2471],{"type":47,"value":2472},"email",{"type":42,"tag":1616,"props":2474,"children":2475},{"style":1735},[2476],{"type":47,"value":2477},"}",{"type":42,"tag":1616,"props":2479,"children":2480},{"style":2190},[2481],{"type":47,"value":2482},"'",{"type":42,"tag":1616,"props":2484,"children":2485},{"style":1735},[2486],{"type":47,"value":2457},{"type":42,"tag":1616,"props":2488,"children":2489},{"style":1832},[2490],{"type":47,"value":1923},{"type":42,"tag":1616,"props":2492,"children":2493},{"style":1735},[2494],{"type":47,"value":1928},{"type":42,"tag":43,"props":2496,"children":2497},{},[2498],{"type":42,"tag":1599,"props":2499,"children":2500},{},[2501],{"type":47,"value":1983},{"type":42,"tag":1605,"props":2503,"children":2505},{"className":1700,"code":2504,"language":1702,"meta":1610,"style":1610},"await prisma.$queryRaw`SELECT * FROM users WHERE email = ${email}`;\n",[2506],{"type":42,"tag":60,"props":2507,"children":2508},{"__ignoreMap":1610},[2509],{"type":42,"tag":1616,"props":2510,"children":2511},{"class":1618,"line":1619},[2512,2516,2520,2524,2529,2533,2538,2542,2546,2551],{"type":42,"tag":1616,"props":2513,"children":2514},{"style":1712},[2515],{"type":47,"value":2434},{"type":42,"tag":1616,"props":2517,"children":2518},{"style":1832},[2519],{"type":47,"value":2439},{"type":42,"tag":1616,"props":2521,"children":2522},{"style":1735},[2523],{"type":47,"value":67},{"type":42,"tag":1616,"props":2525,"children":2526},{"style":1729},[2527],{"type":47,"value":2528},"$queryRaw",{"type":42,"tag":1616,"props":2530,"children":2531},{"style":1735},[2532],{"type":47,"value":2457},{"type":42,"tag":1616,"props":2534,"children":2535},{"style":2190},[2536],{"type":47,"value":2537},"SELECT * FROM users WHERE email = ",{"type":42,"tag":1616,"props":2539,"children":2540},{"style":1735},[2541],{"type":47,"value":2467},{"type":42,"tag":1616,"props":2543,"children":2544},{"style":1832},[2545],{"type":47,"value":2472},{"type":42,"tag":1616,"props":2547,"children":2548},{"style":1735},[2549],{"type":47,"value":2550},"}`",{"type":42,"tag":1616,"props":2552,"children":2553},{"style":1735},[2554],{"type":47,"value":1928},{"type":42,"tag":946,"props":2556,"children":2558},{"id":2557},"pattern-ssrf",[2559],{"type":47,"value":2560},"Pattern: SSRF",{"type":42,"tag":43,"props":2562,"children":2563},{},[2564],{"type":42,"tag":1599,"props":2565,"children":2566},{},[2567],{"type":47,"value":1603},{"type":42,"tag":1605,"props":2569,"children":2571},{"className":1607,"code":2570,"language":1609,"meta":1610,"style":1610},"def preview(request):\n    return requests.get(request.GET[\"url\"], allow_redirects=True).text\n",[2572],{"type":42,"tag":60,"props":2573,"children":2574},{"__ignoreMap":1610},[2575,2583],{"type":42,"tag":1616,"props":2576,"children":2577},{"class":1618,"line":1619},[2578],{"type":42,"tag":1616,"props":2579,"children":2580},{},[2581],{"type":47,"value":2582},"def preview(request):\n",{"type":42,"tag":1616,"props":2584,"children":2585},{"class":1618,"line":1628},[2586],{"type":42,"tag":1616,"props":2587,"children":2588},{},[2589],{"type":47,"value":2590},"    return requests.get(request.GET[\"url\"], allow_redirects=True).text\n",{"type":42,"tag":43,"props":2592,"children":2593},{},[2594],{"type":42,"tag":1599,"props":2595,"children":2596},{},[2597],{"type":47,"value":1650},{"type":42,"tag":1605,"props":2599,"children":2601},{"className":1607,"code":2600,"language":1609,"meta":1610,"style":1610},"def preview(request):\n    url = require_allowed_public_url(request.GET[\"url\"])\n    return safe_urlopen(url, allow_redirects=False).read()\n",[2602],{"type":42,"tag":60,"props":2603,"children":2604},{"__ignoreMap":1610},[2605,2612,2620],{"type":42,"tag":1616,"props":2606,"children":2607},{"class":1618,"line":1619},[2608],{"type":42,"tag":1616,"props":2609,"children":2610},{},[2611],{"type":47,"value":2582},{"type":42,"tag":1616,"props":2613,"children":2614},{"class":1618,"line":1628},[2615],{"type":42,"tag":1616,"props":2616,"children":2617},{},[2618],{"type":47,"value":2619},"    url = require_allowed_public_url(request.GET[\"url\"])\n",{"type":42,"tag":1616,"props":2621,"children":2622},{"class":1618,"line":28},[2623],{"type":42,"tag":1616,"props":2624,"children":2625},{},[2626],{"type":47,"value":2627},"    return safe_urlopen(url, allow_redirects=False).read()\n",{"type":42,"tag":43,"props":2629,"children":2630},{},[2631],{"type":42,"tag":1599,"props":2632,"children":2633},{},[2634],{"type":47,"value":1697},{"type":42,"tag":1605,"props":2636,"children":2638},{"className":1700,"code":2637,"language":1702,"meta":1610,"style":1610},"const response = await fetch(new URL(req.nextUrl.searchParams.get(\"url\")!));\n",[2639],{"type":42,"tag":60,"props":2640,"children":2641},{"__ignoreMap":1610},[2642],{"type":42,"tag":1616,"props":2643,"children":2644},{"class":1618,"line":1619},[2645,2650,2655,2660,2664,2669,2673,2678,2683,2688,2692,2697,2701,2706,2710,2715,2719,2723,2728,2732,2736,2741,2745],{"type":42,"tag":1616,"props":2646,"children":2647},{"style":1718},[2648],{"type":47,"value":2649},"const",{"type":42,"tag":1616,"props":2651,"children":2652},{"style":1832},[2653],{"type":47,"value":2654}," response ",{"type":42,"tag":1616,"props":2656,"children":2657},{"style":1735},[2658],{"type":47,"value":2659},"=",{"type":42,"tag":1616,"props":2661,"children":2662},{"style":1712},[2663],{"type":47,"value":1845},{"type":42,"tag":1616,"props":2665,"children":2666},{"style":1729},[2667],{"type":47,"value":2668}," fetch",{"type":42,"tag":1616,"props":2670,"children":2671},{"style":1832},[2672],{"type":47,"value":1738},{"type":42,"tag":1616,"props":2674,"children":2675},{"style":1735},[2676],{"type":47,"value":2677},"new",{"type":42,"tag":1616,"props":2679,"children":2680},{"style":1729},[2681],{"type":47,"value":2682}," URL",{"type":42,"tag":1616,"props":2684,"children":2685},{"style":1832},[2686],{"type":47,"value":2687},"(req",{"type":42,"tag":1616,"props":2689,"children":2690},{"style":1735},[2691],{"type":47,"value":67},{"type":42,"tag":1616,"props":2693,"children":2694},{"style":1832},[2695],{"type":47,"value":2696},"nextUrl",{"type":42,"tag":1616,"props":2698,"children":2699},{"style":1735},[2700],{"type":47,"value":67},{"type":42,"tag":1616,"props":2702,"children":2703},{"style":1832},[2704],{"type":47,"value":2705},"searchParams",{"type":42,"tag":1616,"props":2707,"children":2708},{"style":1735},[2709],{"type":47,"value":67},{"type":42,"tag":1616,"props":2711,"children":2712},{"style":1729},[2713],{"type":47,"value":2714},"get",{"type":42,"tag":1616,"props":2716,"children":2717},{"style":1832},[2718],{"type":47,"value":1738},{"type":42,"tag":1616,"props":2720,"children":2721},{"style":1735},[2722],{"type":47,"value":2198},{"type":42,"tag":1616,"props":2724,"children":2725},{"style":2190},[2726],{"type":47,"value":2727},"url",{"type":42,"tag":1616,"props":2729,"children":2730},{"style":1735},[2731],{"type":47,"value":2198},{"type":42,"tag":1616,"props":2733,"children":2734},{"style":1832},[2735],{"type":47,"value":1923},{"type":42,"tag":1616,"props":2737,"children":2738},{"style":1735},[2739],{"type":47,"value":2740},"!",{"type":42,"tag":1616,"props":2742,"children":2743},{"style":1832},[2744],{"type":47,"value":2352},{"type":42,"tag":1616,"props":2746,"children":2747},{"style":1735},[2748],{"type":47,"value":1928},{"type":42,"tag":43,"props":2750,"children":2751},{},[2752],{"type":42,"tag":1599,"props":2753,"children":2754},{},[2755],{"type":47,"value":1983},{"type":42,"tag":1605,"props":2757,"children":2759},{"className":1700,"code":2758,"language":1702,"meta":1610,"style":1610},"const url = parseAllowedPublicUrl(req.nextUrl.searchParams.get(\"url\"));\nconst response = await fetch(url, { redirect: \"manual\" });\n",[2760],{"type":42,"tag":60,"props":2761,"children":2762},{"__ignoreMap":1610},[2763,2836],{"type":42,"tag":1616,"props":2764,"children":2765},{"class":1618,"line":1619},[2766,2770,2775,2779,2784,2788,2792,2796,2800,2804,2808,2812,2816,2820,2824,2828,2832],{"type":42,"tag":1616,"props":2767,"children":2768},{"style":1718},[2769],{"type":47,"value":2649},{"type":42,"tag":1616,"props":2771,"children":2772},{"style":1832},[2773],{"type":47,"value":2774}," url ",{"type":42,"tag":1616,"props":2776,"children":2777},{"style":1735},[2778],{"type":47,"value":2659},{"type":42,"tag":1616,"props":2780,"children":2781},{"style":1729},[2782],{"type":47,"value":2783}," parseAllowedPublicUrl",{"type":42,"tag":1616,"props":2785,"children":2786},{"style":1832},[2787],{"type":47,"value":2687},{"type":42,"tag":1616,"props":2789,"children":2790},{"style":1735},[2791],{"type":47,"value":67},{"type":42,"tag":1616,"props":2793,"children":2794},{"style":1832},[2795],{"type":47,"value":2696},{"type":42,"tag":1616,"props":2797,"children":2798},{"style":1735},[2799],{"type":47,"value":67},{"type":42,"tag":1616,"props":2801,"children":2802},{"style":1832},[2803],{"type":47,"value":2705},{"type":42,"tag":1616,"props":2805,"children":2806},{"style":1735},[2807],{"type":47,"value":67},{"type":42,"tag":1616,"props":2809,"children":2810},{"style":1729},[2811],{"type":47,"value":2714},{"type":42,"tag":1616,"props":2813,"children":2814},{"style":1832},[2815],{"type":47,"value":1738},{"type":42,"tag":1616,"props":2817,"children":2818},{"style":1735},[2819],{"type":47,"value":2198},{"type":42,"tag":1616,"props":2821,"children":2822},{"style":2190},[2823],{"type":47,"value":2727},{"type":42,"tag":1616,"props":2825,"children":2826},{"style":1735},[2827],{"type":47,"value":2198},{"type":42,"tag":1616,"props":2829,"children":2830},{"style":1832},[2831],{"type":47,"value":2352},{"type":42,"tag":1616,"props":2833,"children":2834},{"style":1735},[2835],{"type":47,"value":1928},{"type":42,"tag":1616,"props":2837,"children":2838},{"class":1618,"line":1628},[2839,2843,2847,2851,2855,2859,2864,2868,2872,2877,2881,2885,2890,2894,2898,2902],{"type":42,"tag":1616,"props":2840,"children":2841},{"style":1718},[2842],{"type":47,"value":2649},{"type":42,"tag":1616,"props":2844,"children":2845},{"style":1832},[2846],{"type":47,"value":2654},{"type":42,"tag":1616,"props":2848,"children":2849},{"style":1735},[2850],{"type":47,"value":2659},{"type":42,"tag":1616,"props":2852,"children":2853},{"style":1712},[2854],{"type":47,"value":1845},{"type":42,"tag":1616,"props":2856,"children":2857},{"style":1729},[2858],{"type":47,"value":2668},{"type":42,"tag":1616,"props":2860,"children":2861},{"style":1832},[2862],{"type":47,"value":2863},"(url",{"type":42,"tag":1616,"props":2865,"children":2866},{"style":1735},[2867],{"type":47,"value":1760},{"type":42,"tag":1616,"props":2869,"children":2870},{"style":1735},[2871],{"type":47,"value":1765},{"type":42,"tag":1616,"props":2873,"children":2874},{"style":1782},[2875],{"type":47,"value":2876}," redirect",{"type":42,"tag":1616,"props":2878,"children":2879},{"style":1735},[2880],{"type":47,"value":1749},{"type":42,"tag":1616,"props":2882,"children":2883},{"style":1735},[2884],{"type":47,"value":2187},{"type":42,"tag":1616,"props":2886,"children":2887},{"style":2190},[2888],{"type":47,"value":2889},"manual",{"type":42,"tag":1616,"props":2891,"children":2892},{"style":1735},[2893],{"type":47,"value":2198},{"type":42,"tag":1616,"props":2895,"children":2896},{"style":1735},[2897],{"type":47,"value":1811},{"type":42,"tag":1616,"props":2899,"children":2900},{"style":1832},[2901],{"type":47,"value":1923},{"type":42,"tag":1616,"props":2903,"children":2904},{"style":1735},[2905],{"type":47,"value":1928},{"type":42,"tag":946,"props":2907,"children":2909},{"id":2908},"pattern-inline-json-xss",[2910],{"type":47,"value":2911},"Pattern: inline JSON XSS",{"type":42,"tag":43,"props":2913,"children":2914},{},[2915],{"type":42,"tag":1599,"props":2916,"children":2917},{},[2918],{"type":47,"value":1603},{"type":42,"tag":1605,"props":2920,"children":2922},{"className":1607,"code":2921,"language":1609,"meta":1610,"style":1610},"return HttpResponse(f\"\u003Cscript>window.__STATE__ = {json.dumps(profile)}\u003C\u002Fscript>\")\n",[2923],{"type":42,"tag":60,"props":2924,"children":2925},{"__ignoreMap":1610},[2926],{"type":42,"tag":1616,"props":2927,"children":2928},{"class":1618,"line":1619},[2929],{"type":42,"tag":1616,"props":2930,"children":2931},{},[2932],{"type":47,"value":2921},{"type":42,"tag":43,"props":2934,"children":2935},{},[2936],{"type":42,"tag":1599,"props":2937,"children":2938},{},[2939],{"type":47,"value":1650},{"type":42,"tag":1605,"props":2941,"children":2943},{"className":1607,"code":2942,"language":1609,"meta":1610,"style":1610},"state = json.dumps(profile).replace(\"\u003C\", \"\\\\u003c\")\nreturn HttpResponse(f\"\u003Cscript>window.__STATE__ = {state}\u003C\u002Fscript>\")\n",[2944],{"type":42,"tag":60,"props":2945,"children":2946},{"__ignoreMap":1610},[2947,2955],{"type":42,"tag":1616,"props":2948,"children":2949},{"class":1618,"line":1619},[2950],{"type":42,"tag":1616,"props":2951,"children":2952},{},[2953],{"type":47,"value":2954},"state = json.dumps(profile).replace(\"\u003C\", \"\\\\u003c\")\n",{"type":42,"tag":1616,"props":2956,"children":2957},{"class":1618,"line":1628},[2958],{"type":42,"tag":1616,"props":2959,"children":2960},{},[2961],{"type":47,"value":2962},"return HttpResponse(f\"\u003Cscript>window.__STATE__ = {state}\u003C\u002Fscript>\")\n",{"type":42,"tag":43,"props":2964,"children":2965},{},[2966],{"type":42,"tag":1599,"props":2967,"children":2968},{},[2969],{"type":47,"value":1697},{"type":42,"tag":1605,"props":2971,"children":2975},{"className":2972,"code":2973,"language":2974,"meta":1610,"style":1610},"language-tsx shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u003Cscript dangerouslySetInnerHTML={{ __html: `window.__STATE__ = ${JSON.stringify(data)}` }} \u002F>\n","tsx",[2976],{"type":42,"tag":60,"props":2977,"children":2978},{"__ignoreMap":1610},[2979],{"type":42,"tag":1616,"props":2980,"children":2981},{"class":1618,"line":1619},[2982,2986,2991,2996,3001,3006,3010,3015,3020,3024,3029,3033,3038,3043,3047],{"type":42,"tag":1616,"props":2983,"children":2984},{"style":1735},[2985],{"type":47,"value":1244},{"type":42,"tag":1616,"props":2987,"children":2988},{"style":1782},[2989],{"type":47,"value":2990},"script",{"type":42,"tag":1616,"props":2992,"children":2993},{"style":1718},[2994],{"type":47,"value":2995}," dangerouslySetInnerHTML",{"type":42,"tag":1616,"props":2997,"children":2998},{"style":1735},[2999],{"type":47,"value":3000},"={{",{"type":42,"tag":1616,"props":3002,"children":3003},{"style":1782},[3004],{"type":47,"value":3005}," __html",{"type":42,"tag":1616,"props":3007,"children":3008},{"style":1735},[3009],{"type":47,"value":1749},{"type":42,"tag":1616,"props":3011,"children":3012},{"style":1735},[3013],{"type":47,"value":3014}," `",{"type":42,"tag":1616,"props":3016,"children":3017},{"style":2190},[3018],{"type":47,"value":3019},"window.__STATE__ = ",{"type":42,"tag":1616,"props":3021,"children":3022},{"style":1735},[3023],{"type":47,"value":2467},{"type":42,"tag":1616,"props":3025,"children":3026},{"style":1832},[3027],{"type":47,"value":3028},"JSON",{"type":42,"tag":1616,"props":3030,"children":3031},{"style":1735},[3032],{"type":47,"value":67},{"type":42,"tag":1616,"props":3034,"children":3035},{"style":1729},[3036],{"type":47,"value":3037},"stringify",{"type":42,"tag":1616,"props":3039,"children":3040},{"style":1832},[3041],{"type":47,"value":3042},"(data)",{"type":42,"tag":1616,"props":3044,"children":3045},{"style":1735},[3046],{"type":47,"value":2550},{"type":42,"tag":1616,"props":3048,"children":3049},{"style":1735},[3050],{"type":47,"value":3051}," }} \u002F>\n",{"type":42,"tag":43,"props":3053,"children":3054},{},[3055],{"type":42,"tag":1599,"props":3056,"children":3057},{},[3058],{"type":47,"value":1983},{"type":42,"tag":1605,"props":3060,"children":3062},{"className":2972,"code":3061,"language":2974,"meta":1610,"style":1610},"const state = JSON.stringify(data).replace(\u002F\u003C\u002Fg, \"\\\\u003c\");\n\u003Cscript dangerouslySetInnerHTML={{ __html: `window.__STATE__ = ${state}` }} \u002F>\n",[3063],{"type":42,"tag":60,"props":3064,"children":3065},{"__ignoreMap":1610},[3066,3161],{"type":42,"tag":1616,"props":3067,"children":3068},{"class":1618,"line":1619},[3069,3073,3078,3082,3087,3091,3095,3099,3103,3108,3112,3117,3121,3125,3131,3135,3139,3144,3149,3153,3157],{"type":42,"tag":1616,"props":3070,"children":3071},{"style":1718},[3072],{"type":47,"value":2649},{"type":42,"tag":1616,"props":3074,"children":3075},{"style":1832},[3076],{"type":47,"value":3077}," state ",{"type":42,"tag":1616,"props":3079,"children":3080},{"style":1735},[3081],{"type":47,"value":2659},{"type":42,"tag":1616,"props":3083,"children":3084},{"style":1832},[3085],{"type":47,"value":3086}," JSON",{"type":42,"tag":1616,"props":3088,"children":3089},{"style":1735},[3090],{"type":47,"value":67},{"type":42,"tag":1616,"props":3092,"children":3093},{"style":1729},[3094],{"type":47,"value":3037},{"type":42,"tag":1616,"props":3096,"children":3097},{"style":1832},[3098],{"type":47,"value":3042},{"type":42,"tag":1616,"props":3100,"children":3101},{"style":1735},[3102],{"type":47,"value":67},{"type":42,"tag":1616,"props":3104,"children":3105},{"style":1729},[3106],{"type":47,"value":3107},"replace",{"type":42,"tag":1616,"props":3109,"children":3110},{"style":1832},[3111],{"type":47,"value":1738},{"type":42,"tag":1616,"props":3113,"children":3114},{"style":1735},[3115],{"type":47,"value":3116},"\u002F",{"type":42,"tag":1616,"props":3118,"children":3119},{"style":2190},[3120],{"type":47,"value":1244},{"type":42,"tag":1616,"props":3122,"children":3123},{"style":1735},[3124],{"type":47,"value":3116},{"type":42,"tag":1616,"props":3126,"children":3128},{"style":3127},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[3129],{"type":47,"value":3130},"g",{"type":42,"tag":1616,"props":3132,"children":3133},{"style":1735},[3134],{"type":47,"value":1760},{"type":42,"tag":1616,"props":3136,"children":3137},{"style":1735},[3138],{"type":47,"value":2187},{"type":42,"tag":1616,"props":3140,"children":3141},{"style":1832},[3142],{"type":47,"value":3143},"\\\\",{"type":42,"tag":1616,"props":3145,"children":3146},{"style":2190},[3147],{"type":47,"value":3148},"u003c",{"type":42,"tag":1616,"props":3150,"children":3151},{"style":1735},[3152],{"type":47,"value":2198},{"type":42,"tag":1616,"props":3154,"children":3155},{"style":1832},[3156],{"type":47,"value":1923},{"type":42,"tag":1616,"props":3158,"children":3159},{"style":1735},[3160],{"type":47,"value":1928},{"type":42,"tag":1616,"props":3162,"children":3163},{"class":1618,"line":1628},[3164,3168,3172,3176,3180,3184,3188,3192,3196,3200,3205,3209],{"type":42,"tag":1616,"props":3165,"children":3166},{"style":1735},[3167],{"type":47,"value":1244},{"type":42,"tag":1616,"props":3169,"children":3170},{"style":1782},[3171],{"type":47,"value":2990},{"type":42,"tag":1616,"props":3173,"children":3174},{"style":1718},[3175],{"type":47,"value":2995},{"type":42,"tag":1616,"props":3177,"children":3178},{"style":1735},[3179],{"type":47,"value":3000},{"type":42,"tag":1616,"props":3181,"children":3182},{"style":1782},[3183],{"type":47,"value":3005},{"type":42,"tag":1616,"props":3185,"children":3186},{"style":1735},[3187],{"type":47,"value":1749},{"type":42,"tag":1616,"props":3189,"children":3190},{"style":1735},[3191],{"type":47,"value":3014},{"type":42,"tag":1616,"props":3193,"children":3194},{"style":2190},[3195],{"type":47,"value":3019},{"type":42,"tag":1616,"props":3197,"children":3198},{"style":1735},[3199],{"type":47,"value":2467},{"type":42,"tag":1616,"props":3201,"children":3202},{"style":1832},[3203],{"type":47,"value":3204},"state",{"type":42,"tag":1616,"props":3206,"children":3207},{"style":1735},[3208],{"type":47,"value":2550},{"type":42,"tag":1616,"props":3210,"children":3211},{"style":1735},[3212],{"type":47,"value":3051},{"type":42,"tag":946,"props":3214,"children":3216},{"id":3215},"pattern-command-execution",[3217],{"type":47,"value":3218},"Pattern: command execution",{"type":42,"tag":43,"props":3220,"children":3221},{},[3222],{"type":42,"tag":1599,"props":3223,"children":3224},{},[3225],{"type":47,"value":1603},{"type":42,"tag":1605,"props":3227,"children":3229},{"className":1607,"code":3228,"language":1609,"meta":1610,"style":1610},"subprocess.run(f\"git clone {repo_url}\", shell=True, check=True)\n",[3230],{"type":42,"tag":60,"props":3231,"children":3232},{"__ignoreMap":1610},[3233],{"type":42,"tag":1616,"props":3234,"children":3235},{"class":1618,"line":1619},[3236],{"type":42,"tag":1616,"props":3237,"children":3238},{},[3239],{"type":47,"value":3228},{"type":42,"tag":43,"props":3241,"children":3242},{},[3243],{"type":42,"tag":1599,"props":3244,"children":3245},{},[3246],{"type":47,"value":1650},{"type":42,"tag":1605,"props":3248,"children":3250},{"className":1607,"code":3249,"language":1609,"meta":1610,"style":1610},"subprocess.run([\"git\", \"clone\", \"--\", repo_url], check=True)\n",[3251],{"type":42,"tag":60,"props":3252,"children":3253},{"__ignoreMap":1610},[3254],{"type":42,"tag":1616,"props":3255,"children":3256},{"class":1618,"line":1619},[3257],{"type":42,"tag":1616,"props":3258,"children":3259},{},[3260],{"type":47,"value":3249},{"type":42,"tag":43,"props":3262,"children":3263},{},[3264],{"type":42,"tag":1599,"props":3265,"children":3266},{},[3267],{"type":47,"value":1697},{"type":42,"tag":1605,"props":3269,"children":3271},{"className":1700,"code":3270,"language":1702,"meta":1610,"style":1610},"execSync(`convert ${fileName} out.png`);\n",[3272],{"type":42,"tag":60,"props":3273,"children":3274},{"__ignoreMap":1610},[3275],{"type":42,"tag":1616,"props":3276,"children":3277},{"class":1618,"line":1619},[3278,3283,3287,3291,3296,3300,3305,3309,3314,3318,3322],{"type":42,"tag":1616,"props":3279,"children":3280},{"style":1729},[3281],{"type":47,"value":3282},"execSync",{"type":42,"tag":1616,"props":3284,"children":3285},{"style":1832},[3286],{"type":47,"value":1738},{"type":42,"tag":1616,"props":3288,"children":3289},{"style":1735},[3290],{"type":47,"value":2457},{"type":42,"tag":1616,"props":3292,"children":3293},{"style":2190},[3294],{"type":47,"value":3295},"convert ",{"type":42,"tag":1616,"props":3297,"children":3298},{"style":1735},[3299],{"type":47,"value":2467},{"type":42,"tag":1616,"props":3301,"children":3302},{"style":1832},[3303],{"type":47,"value":3304},"fileName",{"type":42,"tag":1616,"props":3306,"children":3307},{"style":1735},[3308],{"type":47,"value":2477},{"type":42,"tag":1616,"props":3310,"children":3311},{"style":2190},[3312],{"type":47,"value":3313}," out.png",{"type":42,"tag":1616,"props":3315,"children":3316},{"style":1735},[3317],{"type":47,"value":2457},{"type":42,"tag":1616,"props":3319,"children":3320},{"style":1832},[3321],{"type":47,"value":1923},{"type":42,"tag":1616,"props":3323,"children":3324},{"style":1735},[3325],{"type":47,"value":1928},{"type":42,"tag":43,"props":3327,"children":3328},{},[3329],{"type":42,"tag":1599,"props":3330,"children":3331},{},[3332],{"type":47,"value":1983},{"type":42,"tag":1605,"props":3334,"children":3336},{"className":1700,"code":3335,"language":1702,"meta":1610,"style":1610},"execFileSync(\"convert\", [fileName, \"out.png\"]);\n",[3337],{"type":42,"tag":60,"props":3338,"children":3339},{"__ignoreMap":1610},[3340],{"type":42,"tag":1616,"props":3341,"children":3342},{"class":1618,"line":1619},[3343,3348,3352,3356,3361,3365,3369,3374,3378,3382,3387,3391,3396],{"type":42,"tag":1616,"props":3344,"children":3345},{"style":1729},[3346],{"type":47,"value":3347},"execFileSync",{"type":42,"tag":1616,"props":3349,"children":3350},{"style":1832},[3351],{"type":47,"value":1738},{"type":42,"tag":1616,"props":3353,"children":3354},{"style":1735},[3355],{"type":47,"value":2198},{"type":42,"tag":1616,"props":3357,"children":3358},{"style":2190},[3359],{"type":47,"value":3360},"convert",{"type":42,"tag":1616,"props":3362,"children":3363},{"style":1735},[3364],{"type":47,"value":2198},{"type":42,"tag":1616,"props":3366,"children":3367},{"style":1735},[3368],{"type":47,"value":1760},{"type":42,"tag":1616,"props":3370,"children":3371},{"style":1832},[3372],{"type":47,"value":3373}," [fileName",{"type":42,"tag":1616,"props":3375,"children":3376},{"style":1735},[3377],{"type":47,"value":1760},{"type":42,"tag":1616,"props":3379,"children":3380},{"style":1735},[3381],{"type":47,"value":2187},{"type":42,"tag":1616,"props":3383,"children":3384},{"style":2190},[3385],{"type":47,"value":3386},"out.png",{"type":42,"tag":1616,"props":3388,"children":3389},{"style":1735},[3390],{"type":47,"value":2198},{"type":42,"tag":1616,"props":3392,"children":3393},{"style":1832},[3394],{"type":47,"value":3395},"])",{"type":42,"tag":1616,"props":3397,"children":3398},{"style":1735},[3399],{"type":47,"value":1928},{"type":42,"tag":69,"props":3401,"children":3403},{"id":3402},"output-requirements",[3404],{"type":47,"value":3405},"Output Requirements",{"type":42,"tag":43,"props":3407,"children":3408},{},[3409],{"type":47,"value":3410},"For each finding, include:",{"type":42,"tag":76,"props":3412,"children":3413},{},[3414,3419,3436,3460,3465,3470,3475,3480,3485],{"type":42,"tag":80,"props":3415,"children":3416},{},[3417],{"type":47,"value":3418},"Exact file and line.",{"type":42,"tag":80,"props":3420,"children":3421},{},[3422,3428,3430,3435],{"type":42,"tag":60,"props":3423,"children":3425},{"className":3424},[],[3426],{"type":47,"value":3427},"vulnSlug",{"type":47,"value":3429}," from the category table, or ",{"type":42,"tag":60,"props":3431,"children":3433},{"className":3432},[],[3434],{"type":47,"value":264},{"type":47,"value":67},{"type":42,"tag":80,"props":3437,"children":3438},{},[3439,3441,3446,3447,3452,3454,3459],{"type":47,"value":3440},"Severity: ",{"type":42,"tag":60,"props":3442,"children":3444},{"className":3443},[],[3445],{"type":47,"value":211},{"type":47,"value":488},{"type":42,"tag":60,"props":3448,"children":3450},{"className":3449},[],[3451],{"type":47,"value":224},{"type":47,"value":3453},", or ",{"type":42,"tag":60,"props":3455,"children":3457},{"className":3456},[],[3458],{"type":47,"value":237},{"type":47,"value":67},{"type":42,"tag":80,"props":3461,"children":3462},{},[3463],{"type":47,"value":3464},"The attacker-controlled source.",{"type":42,"tag":80,"props":3466,"children":3467},{},[3468],{"type":47,"value":3469},"The sink or sensitive operation.",{"type":42,"tag":80,"props":3471,"children":3472},{},[3473],{"type":47,"value":3474},"The missing or ineffective mitigation.",{"type":42,"tag":80,"props":3476,"children":3477},{},[3478],{"type":47,"value":3479},"The concrete impact.",{"type":42,"tag":80,"props":3481,"children":3482},{},[3483],{"type":47,"value":3484},"The shortest fix that closes the path.",{"type":42,"tag":80,"props":3486,"children":3487},{},[3488],{"type":47,"value":3489},"Any confidence caveat if severity or reachability depends on an assumption.",{"type":42,"tag":43,"props":3491,"children":3492},{},[3493],{"type":47,"value":3494},"If there are no findings, say so plainly. Do not return benchmark filler.",{"type":42,"tag":3496,"props":3497,"children":3498},"style",{},[3499],{"type":47,"value":3500},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3502,"total":3598},[3503,3510,3528,3544,3555,3566,3582],{"slug":4,"name":4,"fn":5,"description":6,"org":3504,"tags":3505,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3506,3507,3508,3509],{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":9,"slug":8,"type":16},{"name":18,"slug":19,"type":16},{"slug":3511,"name":3511,"fn":3512,"description":3513,"org":3514,"tags":3515,"stars":24,"repoUrl":25,"updatedAt":3527},"wrdn-authz","detect authorization and IDOR flaws","Detects authorization flaws: IDOR, missing ownership or tenant scoping, role checks that fail open, privilege escalation, unauthenticated admin actions, mass assignment, and token\u002Fsession claims trusted for permission decisions. Use when asked to review route handlers, middleware, decorators, resolvers, RBAC\u002FACL logic, serializers, ORM queries, token-derived scopes, or admin surfaces.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3516,3519,3522,3525,3526],{"name":3517,"slug":3518,"type":16},"Access Control","access-control",{"name":3520,"slug":3521,"type":16},"Auth","auth",{"name":3523,"slug":3524,"type":16},"Code Analysis","code-analysis",{"name":14,"slug":15,"type":16},{"name":9,"slug":8,"type":16},"2026-04-29T05:41:41.218677",{"slug":3529,"name":3529,"fn":3530,"description":3531,"org":3532,"tags":3533,"stars":24,"repoUrl":25,"updatedAt":3543},"wrdn-code-execution","detect code and command execution bugs","Detects bugs where untrusted input reaches a sink that produces code or command execution on the server. Covers command\u002Fshell injection, unsafe deserialization, server-side template injection, eval\u002FFunction\u002Fvm reached by user data, XXE-to-RCE gadgets, and prototype pollution that lands on a code-executing sink. Run on any diff touching subprocess\u002Fexec calls, template rendering, deserialization of bytes, XML parsing, or deep-merge of user-controlled objects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3534,3537,3538,3541,3542],{"name":3535,"slug":3536,"type":16},"Backend","backend",{"name":3523,"slug":3524,"type":16},{"name":3539,"slug":3540,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":9,"slug":8,"type":16},"2026-04-29T05:41:39.861655",{"slug":3545,"name":3545,"fn":3546,"description":3547,"org":3548,"tags":3549,"stars":24,"repoUrl":25,"updatedAt":3554},"wrdn-data-exfil","detect data exfiltration and SSRF bugs","Detects bugs where untrusted input reaches a sink that leaks data beyond its intended scope. Covers SSRF (including cloud metadata, internal services, image proxies), path traversal and archive zip-slip, SQL\u002FNoSQL injection enabling bulk reads, XXE file read, response serializers over-exposing internal fields, verbose error pages, logs capturing secrets, and CSV\u002Fformula injection in exports. Run on any diff touching HTTP clients with user URLs, file I\u002FO with user paths, raw queries, XML parsing, response serializers, error handlers, or export pipelines.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3550,3551,3552,3553],{"name":3535,"slug":3536,"type":16},{"name":3523,"slug":3524,"type":16},{"name":14,"slug":15,"type":16},{"name":9,"slug":8,"type":16},"2026-04-29T05:41:42.567486",{"slug":3556,"name":3556,"fn":3557,"description":3558,"org":3559,"tags":3560,"stars":24,"repoUrl":25,"updatedAt":3565},"wrdn-dos-review","identify denial-of-service vulnerabilities in code","Finds availability \u002F denial-of-service bugs reachable from untrusted input — unbounded allocation, uncontrolled recursion, non-terminating loops, decompression bombs, panic\u002Fresource-leak, super-linear output amplification, algorithmic-complexity \u002F ReDoS catastrophic regex backtracking, and bounds that are present but ineffective (wrong dimension, applied too late, under-counting cost, or defaulted off). Use for DoS and resource-exhaustion audits, CPU-complexity and cost-limit \u002F quota-accuracy review, parser\u002Fdecoder\u002Fdeserialization hardening, and crash-safety review of code that processes attacker-controlled bytes.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3561,3562,3563,3564],{"name":3523,"slug":3524,"type":16},{"name":3539,"slug":3540,"type":16},{"name":14,"slug":15,"type":16},{"name":9,"slug":8,"type":16},"2026-07-18T05:47:48.104703",{"slug":3567,"name":3567,"fn":3568,"description":3569,"org":3570,"tags":3571,"stars":24,"repoUrl":25,"updatedAt":3581},"wrdn-gha-workflows","detect GitHub Actions workflow vulnerabilities","Detects exploitable GitHub Actions workflow vulnerabilities, including pull_request_target pwn requests, unsafe PR checkout, expression injection in run steps and actions\u002Fgithub-script blocks, workflow_dispatch and workflow_call input command injection, comment- and discussion-triggered commands, TOCTOU between approval and checkout, secret exposure, broad permissions, reusable workflows that consume undeclared secrets, ArtiPACKED-style token leaks through uploaded artifacts, cache poisoning and eviction-stuffing, supply-chain risk from unpinned third-party actions (tj-actions\u002Fchanged-files class), and self-hosted runner abuse. Run on diffs touching .github\u002Fworkflows, action.yml, action.yaml, repo-local actions, or CI-loaded scripts and config.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3572,3575,3576,3579,3580],{"name":3573,"slug":3574,"type":16},"CI\u002FCD","ci-cd",{"name":3523,"slug":3524,"type":16},{"name":3577,"slug":3578,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},{"name":9,"slug":8,"type":16},"2026-04-29T05:41:43.93205",{"slug":3583,"name":3583,"fn":3584,"description":3585,"org":3586,"tags":3587,"stars":24,"repoUrl":25,"updatedAt":3597},"wrdn-pii","detect PII and confidential data in code","Detects real personally identifiable information, customer identifiers, and customer-confidential business data in code changes. Use when asked to find PII, customer IPs, real email addresses, revenue data, billing data, personal data, privacy leaks, customer info in logs, PII in URLs, or accidental production data in tests, fixtures, comments, docs, config, telemetry, or API responses.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3588,3589,3592,3595,3596],{"name":3523,"slug":3524,"type":16},{"name":3590,"slug":3591,"type":16},"Compliance","compliance",{"name":3593,"slug":3594,"type":16},"Privacy","privacy",{"name":14,"slug":15,"type":16},{"name":9,"slug":8,"type":16},"2026-04-29T05:41:38.512082",7,{"items":3600,"total":3769},[3601,3624,3638,3653,3667,3684,3698,3712,3720,3731,3741,3756],{"slug":3602,"name":3602,"fn":3603,"description":3604,"org":3605,"tags":3606,"stars":3621,"repoUrl":3622,"updatedAt":3623},"xcodebuildmcp","build and test Apple apps with XcodeBuildMCP","Official skill for XcodeBuildMCP. Use when doing iOS\u002FmacOS\u002FwatchOS\u002FtvOS\u002FvisionOS work (build, test, run, debug, log, UI automation).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3607,3608,3611,3614,3615,3618],{"name":3539,"slug":3540,"type":16},{"name":3609,"slug":3610,"type":16},"iOS","ios",{"name":3612,"slug":3613,"type":16},"macOS","macos",{"name":9,"slug":8,"type":16},{"name":3616,"slug":3617,"type":16},"Testing","testing",{"name":3619,"slug":3620,"type":16},"Xcode","xcode",6176,"https:\u002F\u002Fgithub.com\u002Fgetsentry\u002FXcodeBuildMCP","2026-04-06T18:13:34.8719",{"slug":3625,"name":3625,"fn":3626,"description":3627,"org":3628,"tags":3629,"stars":3621,"repoUrl":3622,"updatedAt":3637},"xcodebuildmcp-cli","build and test Apple apps via CLI","Official skill for the XcodeBuildMCP CLI. Use when doing iOS\u002FmacOS\u002FwatchOS\u002FtvOS\u002FvisionOS work (build, test, run, debug, log, UI automation).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3630,3633,3634,3635,3636],{"name":3631,"slug":3632,"type":16},"CLI","cli",{"name":3609,"slug":3610,"type":16},{"name":3612,"slug":3613,"type":16},{"name":3616,"slug":3617,"type":16},{"name":3619,"slug":3620,"type":16},"2026-04-06T18:13:36.13414",{"slug":3639,"name":3639,"fn":3640,"description":3641,"org":3642,"tags":3643,"stars":3650,"repoUrl":3651,"updatedAt":3652},"agents-md","maintain project instruction files","Creates and maintains concise AGENTS.md and CLAUDE.md project instruction files. Use when asked to create AGENTS.md, update AGENTS.md, maintain agent docs, set up CLAUDE.md, document repository agent conventions, or keep coding-agent instructions minimal and reference-backed.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3644,3647],{"name":3645,"slug":3646,"type":16},"Documentation","documentation",{"name":3648,"slug":3649,"type":16},"Engineering","engineering",861,"https:\u002F\u002Fgithub.com\u002Fgetsentry\u002Fskills","2026-05-15T06:16:29.695991",{"slug":3654,"name":3654,"fn":3655,"description":3656,"org":3657,"tags":3658,"stars":3650,"repoUrl":3651,"updatedAt":3666},"blog-writing-guide","write and review engineering blog posts","Write, review, and improve blog posts for the Sentry engineering blog following Sentry's specific writing standards, voice, and quality bar. Use this skill whenever someone asks to write a blog post, draft a technical article, review blog content, improve a draft, write a product announcement, create an engineering deep-dive, or produce any written content destined for the Sentry blog or developer audience. Also trigger when the user mentions \"blog post,\" \"blog draft,\" \"write-up,\" \"announcement post,\" \"engineering post,\" \"deep dive,\" \"postmortem,\" or asks for help with technical writing for Sentry. Even if the user just says \"help me write about [feature\u002Ftopic]\" — if it sounds like it could become a Sentry blog post, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3659,3662,3663],{"name":3660,"slug":3661,"type":16},"Communications","communications",{"name":9,"slug":8,"type":16},{"name":3664,"slug":3665,"type":16},"Technical Writing","technical-writing","2026-05-15T06:16:33.38217",{"slug":3668,"name":3668,"fn":3669,"description":3670,"org":3671,"tags":3672,"stars":3650,"repoUrl":3651,"updatedAt":3683},"brand-guidelines","write copy following Sentry brand guidelines","Write copy following Sentry brand guidelines. Use when writing UI text, error messages, empty states, onboarding flows, 404 pages, documentation, marketing copy, or any user-facing content. Covers both Plain Speech (default) and Sentry Voice tones.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3673,3676,3679,3680],{"name":3674,"slug":3675,"type":16},"Branding","branding",{"name":3677,"slug":3678,"type":16},"Content Creation","content-creation",{"name":9,"slug":8,"type":16},{"name":3681,"slug":3682,"type":16},"UX Copy","ux-copy","2026-05-15T06:16:22.395707",{"slug":3685,"name":3685,"fn":3686,"description":3687,"org":3688,"tags":3689,"stars":3650,"repoUrl":3651,"updatedAt":3697},"claude-settings-audit","generate Claude Code settings permissions","Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3690,3693,3696],{"name":3691,"slug":3692,"type":16},"Claude Code","claude-code",{"name":3694,"slug":3695,"type":16},"Configuration","configuration",{"name":14,"slug":15,"type":16},"2026-05-15T06:16:44.335977",{"slug":3699,"name":3699,"fn":3700,"description":3701,"org":3702,"tags":3703,"stars":3650,"repoUrl":3651,"updatedAt":3711},"code-review","perform code reviews for Sentry projects","Perform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3704,3706,3707,3710],{"name":3705,"slug":3699,"type":16},"Code Review",{"name":3648,"slug":3649,"type":16},{"name":3708,"slug":3709,"type":16},"Performance","performance",{"name":14,"slug":15,"type":16},"2026-05-15T06:16:35.824864",{"slug":3713,"name":3713,"fn":3714,"description":3715,"org":3716,"tags":3717,"stars":3650,"repoUrl":3651,"updatedAt":3719},"code-simplifier","simplify and refine source code","Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Use when asked to \"simplify code\", \"clean up code\", \"refactor for clarity\", \"improve readability\", or review recently modified code for elegance. Focuses on project-specific best practices.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3718],{"name":3523,"slug":3524,"type":16},"2026-05-15T06:16:32.127981",{"slug":3721,"name":3721,"fn":3722,"description":3723,"org":3724,"tags":3725,"stars":3650,"repoUrl":3651,"updatedAt":3730},"commit","create commits with Sentry conventions","Use for every request to commit changes or draft a commit message. Creates Sentry-style conventional commits with issue references.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3726,3729],{"name":3727,"slug":3728,"type":16},"Git","git",{"name":9,"slug":8,"type":16},"2026-07-18T05:15:10.723937",{"slug":3732,"name":3732,"fn":3733,"description":3734,"org":3735,"tags":3736,"stars":3650,"repoUrl":3651,"updatedAt":3740},"create-branch","create git branches for Sentry workflows","Create a git branch following Sentry naming conventions. Use when asked to \"create a branch\", \"new branch\", \"start a branch\", \"make a branch\", \"switch to a new branch\", or when starting new work on the default branch.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3737,3738,3739],{"name":3648,"slug":3649,"type":16},{"name":3727,"slug":3728,"type":16},{"name":9,"slug":8,"type":16},"2026-05-15T06:16:39.458431",{"slug":3742,"name":3742,"fn":3743,"description":3744,"org":3745,"tags":3746,"stars":3650,"repoUrl":3651,"updatedAt":3755},"django-access-review","review Django access control and IDOR","Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python\u002FDjango code handling user authorization. Trigger keywords: \"IDOR\", \"access control\", \"authorization\", \"Django permissions\", \"object permissions\", \"tenant isolation\", \"broken access\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3747,3748,3749,3752,3754],{"name":3517,"slug":3518,"type":16},{"name":3523,"slug":3524,"type":16},{"name":3750,"slug":3751,"type":16},"Django","django",{"name":3753,"slug":1609,"type":16},"Python",{"name":14,"slug":15,"type":16},"2026-05-15T06:16:43.098698",{"slug":3757,"name":3757,"fn":3758,"description":3759,"org":3760,"tags":3761,"stars":3650,"repoUrl":3651,"updatedAt":3768},"django-perf-review","review and optimize Django performance","Django performance code review. Use when asked to \"review Django performance\", \"find N+1 queries\", \"optimize Django\", \"check queryset performance\", \"database performance\", \"Django ORM issues\", or audit Django code for performance problems.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3762,3763,3766,3767],{"name":3705,"slug":3699,"type":16},{"name":3764,"slug":3765,"type":16},"Database","database",{"name":3750,"slug":3751,"type":16},{"name":3708,"slug":3709,"type":16},"2026-05-15T06:16:24.832813",88]