CASE 01
High-risk payment API
Dynamic execution, SQL injection, TLS, debug mode, and bind exposure
ACTUAL PROMPT
Audit this payment API for dynamic code execution, SQL injection, TLS configuration, debug mode, and network exposure. Return severities and remediation guidance.
VerdictBLOCK
Findings6
High3
Files1
HIGHdangerous_eval· app/payments_api.py:9
return eval(request.args["expr"])
HIGHsql_injection· app/payments_api.py:14
cursor.execute(f"SELECT * FROM invoices WHERE user_id = {user_id}")
HIGHtls_verification_disabled· app/payments_api.py:18
return requests.get(url, verify=False)
MEDIUMdebug_enabled· app/payments_api.py:20
app.run(host="0.0.0.0", debug=True)
$ python3 code_audit.py inputs/en_case1_web_api.json
Executed with Python 3. Stdout is one structured JSON object. The prompt is preserved in the input for documentation; scan logic reads mode + files.
Executed with Python 3. Stdout is one structured JSON object. The prompt is preserved in the input for documentation; scan logic reads mode + files.
Expand full actual Output / Result
{
"ok": true,
"skill": "code-security-audit",
"version": "0.1.0",
"mode": "audit",
"data": {
"findings": [
{
"path": "app/payments_api.py",
"line": 9,
"rule_id": "dangerous_eval",
"category": "code_execution",
"severity": "high",
"excerpt": "return eval(request.args[\"expr\"])",
"recommendation": "Avoid eval/exec on dynamic input; use explicit parsing (e.g. ast.literal_eval) or a dispatch table instead."
},
{
"path": "app/payments_api.py",
"line": 14,
"rule_id": "sql_injection",
"category": "injection",
"severity": "high",
"excerpt": "cursor.execute(f\"SELECT * FROM invoices WHERE user_id = {user_id}\")",
"recommendation": "Use parameterized queries / bound parameters instead of string concatenation or formatting to build SQL."
},
{
"path": "app/payments_api.py",
"line": 18,
"rule_id": "tls_verification_disabled",
"category": "transport",
"severity": "high",
"excerpt": "return requests.get(url, verify=False)",
"recommendation": "Keep TLS certificate verification enabled; configure a trusted CA bundle rather than disabling verification."
},
{
"path": "app/payments_api.py",
"line": 20,
"rule_id": "debug_enabled",
"category": "config",
"severity": "medium",
"excerpt": "app.run(host=\"0.0.0.0\", debug=True)",
"recommendation": "Disable debug mode in production; it can expose stack traces and enable interactive code execution."
},
{
"path": "<repo>",
"line": 0,
"rule_id": "missing_license",
"category": "compliance",
"severity": "low",
"excerpt": "",
"recommendation": "Add a LICENSE file (e.g. LICENSE or LICENSE.txt) so usage terms are explicit and license compliance can be assessed."
},
{
"path": "app/payments_api.py",
"line": 20,
"rule_id": "bind_all_interfaces",
"category": "config",
"severity": "low",
"excerpt": "app.run(host=\"0.0.0.0\", debug=True)",
"recommendation": "Binding to 0.0.0.0 exposes the service on all interfaces; bind to a specific interface or place it behind a firewall/proxy."
}
],
"summary": {
"files_scanned": 1,
"total": 6,
"by_severity": {
"high": 3,
"medium": 1,
"low": 2
},
"by_category": {
"code_execution": 1,
"injection": 1,
"transport": 1,
"config": 2,
"compliance": 1
}
},
"verdict": "block"
}
}