{
  "version": "2.1.0",
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "Semgrep OSS",
          "rules": [
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution."
              },
              "help": {
                "markdown": "Dynamic execution.",
                "text": "Dynamic execution."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.bash.bash-dynamic-execution-exec-eval",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.bash.bash-dynamic-execution-exec-eval",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.bash.bash-dynamic-execution-exec-eval"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution."
              },
              "help": {
                "markdown": "Dynamic execution.",
                "text": "Dynamic execution."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.clojure.clojure-dynamic-execution-multiple",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.clojure.clojure-dynamic-execution-multiple",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.clojure.clojure-dynamic-execution-multiple"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by system commands."
              },
              "help": {
                "markdown": "Dynamic execution by system commands.",
                "text": "Dynamic execution by system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.clojure.clojure-dynamic-system-commands",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.clojure.clojure-dynamic-system-commands",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.clojure.clojure-dynamic-system-commands"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by system commands."
              },
              "help": {
                "markdown": "Dynamic execution by system commands.",
                "text": "Dynamic execution by system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.csharp.csharp-dynamic-execution-multiple",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.csharp.csharp-dynamic-execution-multiple",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.csharp.csharp-dynamic-execution-multiple"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by system commands."
              },
              "help": {
                "markdown": "Dynamic execution by system commands.",
                "text": "Dynamic execution by system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.dart.dart-dynamic-system-commands",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.dart.dart-dynamic-system-commands",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.dart.dart-dynamic-system-commands"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detect dynamic execution using script manager."
              },
              "help": {
                "markdown": "Detect dynamic execution using script manager.",
                "text": "Detect dynamic execution using script manager."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.java.java-dynamic-execution-scriptmanager",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.java.java-dynamic-execution-scriptmanager",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.java.java-dynamic-execution-scriptmanager"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by system commands."
              },
              "help": {
                "markdown": "Dynamic execution by system commands.",
                "text": "Dynamic execution by system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.java.java-dynamic-execution-system",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.java.java-dynamic-execution-system",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.java.java-dynamic-execution-system"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution using eval and Function."
              },
              "help": {
                "markdown": "Dynamic execution using eval and Function.",
                "text": "Dynamic execution using eval and Function."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.javascript_typescript.javascript-dynamic-execution-eval-Function",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.javascript_typescript.javascript-dynamic-execution-eval-Function",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.javascript_typescript.javascript-dynamic-execution-eval-Function"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by system commands."
              },
              "help": {
                "markdown": "Dynamic execution by system commands.",
                "text": "Dynamic execution by system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.javascript_typescript.javascript-dynamic-execution-system",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.javascript_typescript.javascript-dynamic-execution-system",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.javascript_typescript.javascript-dynamic-execution-system"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by system commands."
              },
              "help": {
                "markdown": "Dynamic execution by system commands.",
                "text": "Dynamic execution by system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.lua.lua-dynamic-execution-multiple",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.lua.lua-dynamic-execution-multiple",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.lua.lua-dynamic-execution-multiple"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by system commands."
              },
              "help": {
                "markdown": "Dynamic execution by system commands.",
                "text": "Dynamic execution by system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.lua.lua-dynamic-execution-system",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.lua.lua-dynamic-execution-system",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.lua.lua-dynamic-execution-system"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution."
              },
              "help": {
                "markdown": "Dynamic execution.",
                "text": "Dynamic execution."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.php.php-dynamic-execution-multiple",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.php.php-dynamic-execution-multiple",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.php.php-dynamic-execution-multiple"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by system commands."
              },
              "help": {
                "markdown": "Dynamic execution by system commands.",
                "text": "Dynamic execution by system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.php.php-dynamic-execution-system",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.php.php-dynamic-execution-system",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.php.php-dynamic-execution-system"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected dynamic execution of deserialized code using pickle."
              },
              "help": {
                "markdown": "Detected dynamic execution of deserialized code using pickle.",
                "text": "Detected dynamic execution of deserialized code using pickle."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-detect-pickle-execution",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-detect-pickle-execution",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-detect-pickle-execution"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution using exec or eval."
              },
              "help": {
                "markdown": "Dynamic execution using exec or eval.",
                "text": "Dynamic execution using exec or eval."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-dynamic-execution-eval",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-dynamic-execution-eval",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-dynamic-execution-eval"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected dynamic execution using compile and FunctionType in different formats."
              },
              "help": {
                "markdown": "Detected dynamic execution using compile and FunctionType in different formats.",
                "text": "Detected dynamic execution using compile and FunctionType in different formats."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-dynamic-execution-functiontype",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-dynamic-execution-functiontype",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-dynamic-execution-functiontype"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution using system commands."
              },
              "help": {
                "markdown": "Dynamic execution using system commands.",
                "text": "Dynamic execution using system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-dynamic-execution-system",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-dynamic-execution-system",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-dynamic-execution-system"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by eval."
              },
              "help": {
                "markdown": "Dynamic execution by eval.",
                "text": "Dynamic execution by eval."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.ruby.ruby-dynamic-execution-eval",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.ruby.ruby-dynamic-execution-eval",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.ruby.ruby-dynamic-execution-eval"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by system commands."
              },
              "help": {
                "markdown": "Dynamic execution by system commands.",
                "text": "Dynamic execution by system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.ruby.ruby-dynamic-execution-system",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.ruby.ruby-dynamic-execution-system",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.ruby.ruby-dynamic-execution-system"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by system commands."
              },
              "help": {
                "markdown": "Dynamic execution by system commands.",
                "text": "Dynamic execution by system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.rust.ruby-dynamic-execution-system",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.rust.ruby-dynamic-execution-system",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.rust.ruby-dynamic-execution-system"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution using script manager and runtime."
              },
              "help": {
                "markdown": "Dynamic execution using script manager and runtime.",
                "text": "Dynamic execution using script manager and runtime."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.scala.scala-dynamic-execution-eval",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.scala.scala-dynamic-execution-eval",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.scala.scala-dynamic-execution-eval"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Dynamic execution by system commands."
              },
              "help": {
                "markdown": "Dynamic execution by system commands.",
                "text": "Dynamic execution by system commands."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.scala.scala-dynamic-execution-system",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.scala.scala-dynamic-execution-system",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.scala.scala-dynamic-execution-system"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Minified, compressed, obfuscated or any other form of unreadable files is excluded from the scan, because although a strong indicator of maliciousness, its FP rate is relatively higher. It is highly recommended to store such files in CDN, cloud buckets, etc. and keep the codebase readable."
              },
              "help": {
                "markdown": "Minified, compressed, obfuscated or any other form of unreadable files is excluded from the scan, because although a strong indicator of maliciousness, its FP rate is relatively higher. It is highly recommended to store such files in CDN, cloud buckets, etc. and keep the codebase readable.",
                "text": "Minified, compressed, obfuscated or any other form of unreadable files is excluded from the scan, because although a strong indicator of maliciousness, its FP rate is relatively higher. It is highly recommended to store such files in CDN, cloud buckets, etc. and keep the codebase readable."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.generic-one-liners",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.generic-one-liners",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.generic-one-liners"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Line contains 3 or more occurrences of '/dev/null'"
              },
              "help": {
                "markdown": "Line contains 3 or more occurrences of '/dev/null'",
                "text": "Line contains 3 or more occurrences of '/dev/null'"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.bash.bash-obfuscation-dev-null",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.bash.bash-obfuscation-dev-null",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.bash.bash-obfuscation-dev-null"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Code hidden remotely."
              },
              "help": {
                "markdown": "Code hidden remotely.",
                "text": "Code hidden remotely."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.bash.bash-obfuscation-remote",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.bash.bash-obfuscation-remote",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.bash.bash-obfuscation-remote"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by spurious conditions."
              },
              "help": {
                "markdown": "Obfuscation by spurious conditions.",
                "text": "Obfuscation by spurious conditions."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-conditions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-conditions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-conditions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscated declarations names."
              },
              "help": {
                "markdown": "Obfuscated declarations names.",
                "text": "Obfuscated declarations names."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-declarations",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-declarations",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-declarations"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "help": {
                "markdown": "Detect obfuscation by deep anonymous nesting.",
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-generic",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-generic",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-generic"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "help": {
                "markdown": "Obfuscation by concatenation of string manipulating methods.",
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-methods-masking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-methods-masking",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-methods-masking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "help": {
                "markdown": "Obfuscation by reconstruction of hardcoded data.",
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-reconstruction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-reconstruction",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.clojure.clojure-obfuscation-reconstruction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by anonymous nesting."
              },
              "help": {
                "markdown": "Obfuscation by anonymous nesting.",
                "text": "Obfuscation by anonymous nesting."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-anonymous-nesting",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-anonymous-nesting",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-anonymous-nesting"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by spurious conditions."
              },
              "help": {
                "markdown": "Obfuscation by spurious conditions.",
                "text": "Obfuscation by spurious conditions."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-conditions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-conditions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-conditions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscated declarations names."
              },
              "help": {
                "markdown": "Obfuscated declarations names.",
                "text": "Obfuscated declarations names."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-declarations",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-declarations",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-declarations"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "help": {
                "markdown": "Obfuscation by reconstruction of hardcoded data.",
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-methods-masking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-methods-masking",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-methods-masking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences."
              },
              "help": {
                "markdown": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences.",
                "text": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-operators",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-operators",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-operators"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "help": {
                "markdown": "Obfuscation by concatenation of string manipulating methods.",
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-reconstruction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-reconstruction",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.csharp.csharp-obfuscation-reconstruction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "help": {
                "markdown": "Detect obfuscation by deep anonymous nesting.",
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-anonymous-nesting",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-anonymous-nesting",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-anonymous-nesting"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscated declarations names."
              },
              "help": {
                "markdown": "Obfuscated declarations names.",
                "text": "Obfuscated declarations names."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-declarations",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-declarations",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-declarations"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "help": {
                "markdown": "Obfuscation by concatenation of string manipulating methods.",
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-methods-masking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-methods-masking",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-methods-masking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "help": {
                "markdown": "Obfuscation by reconstruction of hardcoded data.",
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-reconstruction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-reconstruction",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.dart.dart-obfuscation-reconstruction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Hiding payloads remotely. Leveraged to detect some staging and exfiltration."
              },
              "help": {
                "markdown": "Hiding payloads remotely. Leveraged to detect some staging and exfiltration.",
                "text": "Hiding payloads remotely. Leveraged to detect some staging and exfiltration."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.generic-hide-remotely",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.generic-hide-remotely",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.generic-hide-remotely"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences."
              },
              "help": {
                "markdown": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences.",
                "text": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.generic-obfuscation-operators",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.generic-obfuscation-operators",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.generic-obfuscation-operators"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Binary file signature found in string"
              },
              "help": {
                "markdown": "Binary file signature found in string",
                "text": "Binary file signature found in string"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.generic-obfuscation-stringified-binaries",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.generic-obfuscation-stringified-binaries",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.generic-obfuscation-stringified-binaries"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by spurious conditions."
              },
              "help": {
                "markdown": "Detect obfuscation by spurious conditions.",
                "text": "Detect obfuscation by spurious conditions."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.go.go-obfuscation-conditions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.go.go-obfuscation-conditions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.go.go-obfuscation-conditions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscated declarations names."
              },
              "help": {
                "markdown": "Obfuscated declarations names.",
                "text": "Obfuscated declarations names."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.go.go-obfuscation-declarations",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.go.go-obfuscation-declarations",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.go.go-obfuscation-declarations"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "help": {
                "markdown": "Obfuscation by concatenation of string manipulating methods.",
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.go.go-obfuscation-methods-masking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.go.go-obfuscation-methods-masking",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.go.go-obfuscation-methods-masking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "help": {
                "markdown": "Detect obfuscation by deep anonymous nesting.",
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-anonymous-nesting",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-anonymous-nesting",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-anonymous-nesting"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by spurious conditions."
              },
              "help": {
                "markdown": "Obfuscation by spurious conditions.",
                "text": "Obfuscation by spurious conditions."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-conditions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-conditions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-conditions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "help": {
                "markdown": "Obfuscation by concatenation of string manipulating methods.",
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-methods-masking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-methods-masking",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-methods-masking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences."
              },
              "help": {
                "markdown": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences.",
                "text": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-operators",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-operators",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-operators"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "help": {
                "markdown": "Obfuscation by reconstruction of hardcoded data.",
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-reconstruction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-reconstruction",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.java.java-obfuscation-reconstruction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "help": {
                "markdown": "Detect obfuscation by deep anonymous nesting.",
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-anonymous-nesting",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-anonymous-nesting",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-anonymous-nesting"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detect jjencode and jsfuck."
              },
              "help": {
                "markdown": "Detect jjencode and jsfuck.",
                "text": "Detect jjencode and jsfuck."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-blatant",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-blatant",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-blatant"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscation by indirect calls."
              },
              "help": {
                "markdown": "Obfuscation by indirect calls.",
                "text": "Obfuscation by indirect calls."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-indirect-execution",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-indirect-execution",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-indirect-execution"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "help": {
                "markdown": "Obfuscation by concatenation of string manipulating methods.",
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-methods-masking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-methods-masking",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-methods-masking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscation by overriding builtin constructs."
              },
              "help": {
                "markdown": "Obfuscation by overriding builtin constructs.",
                "text": "Obfuscation by overriding builtin constructs."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-override",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-override",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-override"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "help": {
                "markdown": "Obfuscation by reconstruction of hardcoded data.",
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-reconstruction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-reconstruction",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-obfuscation-reconstruction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscated objects names that don't follow naming standards and best practices."
              },
              "help": {
                "markdown": "Obfuscated objects names that don't follow naming standards and best practices.",
                "text": "Obfuscated objects names that don't follow naming standards and best practices."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-suspicious-declaration-names",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-suspicious-declaration-names",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.javascript_typescript.javascript-suspicious-declaration-names"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Deeply nested anonymous functions detected"
              },
              "help": {
                "markdown": "Deeply nested anonymous functions detected",
                "text": "Deeply nested anonymous functions detected"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-anonymous-functions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-anonymous-functions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-anonymous-functions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Common obfuscation techniques."
              },
              "help": {
                "markdown": "Common obfuscation techniques.",
                "text": "Common obfuscation techniques."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-conditions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-conditions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-conditions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscated declarations names."
              },
              "help": {
                "markdown": "Obfuscated declarations names.",
                "text": "Obfuscated declarations names."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-declarations",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-declarations",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-declarations"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscation by overriding builtin constructs."
              },
              "help": {
                "markdown": "Obfuscation by overriding builtin constructs.",
                "text": "Obfuscation by overriding builtin constructs."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-override",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-override",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-override"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "help": {
                "markdown": "Obfuscation by reconstruction of hardcoded data.",
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-reconstruction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-reconstruction",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.lua.lua-obfuscation-reconstruction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Deeply nested anonymous functions detected"
              },
              "help": {
                "markdown": "Deeply nested anonymous functions detected",
                "text": "Deeply nested anonymous functions detected"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.lua-obfuscation-anonymous-functions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.lua-obfuscation-anonymous-functions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.lua-obfuscation-anonymous-functions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by spurious conditions."
              },
              "help": {
                "markdown": "Detect obfuscation by spurious conditions.",
                "text": "Detect obfuscation by spurious conditions."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-conditions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-conditions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-conditions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscated declarations names."
              },
              "help": {
                "markdown": "Obfuscated declarations names.",
                "text": "Obfuscated declarations names."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-declarations",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-declarations",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-declarations"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "help": {
                "markdown": "Obfuscation by concatenation of string manipulating methods.",
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-methods-masking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-methods-masking",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-methods-masking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "help": {
                "markdown": "Obfuscation by reconstruction of hardcoded data.",
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-reconstruction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-reconstruction",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.php.php-obfuscation-reconstruction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences."
              },
              "help": {
                "markdown": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences.",
                "text": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.generic-obfuscation-operators",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.generic-obfuscation-operators",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.generic-obfuscation-operators"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "help": {
                "markdown": "Detect obfuscation by deep anonymous nesting.",
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-anonymous-nesting",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-anonymous-nesting",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-anonymous-nesting"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by spurious conditions."
              },
              "help": {
                "markdown": "Obfuscation by spurious conditions.",
                "text": "Obfuscation by spurious conditions."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-conditions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-conditions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-conditions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Common obfuscation signatures."
              },
              "help": {
                "markdown": "Common obfuscation signatures.",
                "text": "Common obfuscation signatures."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-generic",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-generic",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-generic"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected potential obfuscation by alternative usage of `eval`."
              },
              "help": {
                "markdown": "Detected potential obfuscation by alternative usage of `eval`.",
                "text": "Detected potential obfuscation by alternative usage of `eval`."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-indirect-eval",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-indirect-eval",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-indirect-eval"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected potential obfuscation by alternative usage of `exec`."
              },
              "help": {
                "markdown": "Detected potential obfuscation by alternative usage of `exec`.",
                "text": "Detected potential obfuscation by alternative usage of `exec`."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-indirect-exec",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-indirect-exec",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-indirect-exec"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected potential obfuscation by alternative usage of `Pickle`."
              },
              "help": {
                "markdown": "Detected potential obfuscation by alternative usage of `Pickle`.",
                "text": "Detected potential obfuscation by alternative usage of `Pickle`."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-indirect-pickle",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-indirect-pickle",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-indirect-pickle"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "help": {
                "markdown": "Obfuscation by concatenation of string manipulating methods.",
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-methods-masking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-methods-masking",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-methods-masking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscation by overriding builtin constructs."
              },
              "help": {
                "markdown": "Obfuscation by overriding builtin constructs.",
                "text": "Obfuscation by overriding builtin constructs."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-override",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-override",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-override"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "help": {
                "markdown": "Obfuscation by reconstruction of hardcoded data.",
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-reconstruction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-reconstruction",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-obfuscation-reconstruction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscated declarations names."
              },
              "help": {
                "markdown": "Obfuscated declarations names.",
                "text": "Obfuscated declarations names."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-suspicious-declaration-names",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-suspicious-declaration-names",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.python.python-suspicious-declaration-names"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "help": {
                "markdown": "Detect obfuscation by deep anonymous nesting.",
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-anonymous-nesting",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-anonymous-nesting",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-anonymous-nesting"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by spurious conditions."
              },
              "help": {
                "markdown": "Detect obfuscation by spurious conditions.",
                "text": "Detect obfuscation by spurious conditions."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-conditions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-conditions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-conditions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscated declarations names."
              },
              "help": {
                "markdown": "Obfuscated declarations names.",
                "text": "Obfuscated declarations names."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-declarations",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-declarations",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-declarations"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "help": {
                "markdown": "Obfuscation by concatenation of string manipulating methods.",
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-methods-masking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-methods-masking",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-methods-masking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscation by overriding builtin constructs."
              },
              "help": {
                "markdown": "Obfuscation by overriding builtin constructs.",
                "text": "Obfuscation by overriding builtin constructs."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-override",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-override",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-override"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "help": {
                "markdown": "Obfuscation by reconstruction of hardcoded data.",
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-reconstruction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-reconstruction",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.ruby.ruby-obfuscation-reconstruction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences."
              },
              "help": {
                "markdown": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences.",
                "text": "Obfuscation containing operators that are uncommon in sequences of 10 or more consecutive occurrences."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.generic-obfuscation-operators",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.generic-obfuscation-operators",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.generic-obfuscation-operators"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "help": {
                "markdown": "Detect obfuscation by deep anonymous nesting.",
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-anonymous-nesting",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-anonymous-nesting",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-anonymous-nesting"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by spurious conditions."
              },
              "help": {
                "markdown": "Detect obfuscation by spurious conditions.",
                "text": "Detect obfuscation by spurious conditions."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-conditions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-conditions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-conditions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscated declarations names."
              },
              "help": {
                "markdown": "Obfuscated declarations names.",
                "text": "Obfuscated declarations names."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-declarations",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-declarations",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-declarations"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "help": {
                "markdown": "Obfuscation by concatenation of string manipulating methods.",
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-methods-masking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-methods-masking",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-methods-masking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "help": {
                "markdown": "Obfuscation by reconstruction of hardcoded data.",
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-reconstruction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-reconstruction",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.rust.rust-obfuscation-reconstruction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "help": {
                "markdown": "Detect obfuscation by deep anonymous nesting.",
                "text": "Detect obfuscation by deep anonymous nesting."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-anonymous-nesting",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-anonymous-nesting",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-anonymous-nesting"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by spurious conditions."
              },
              "help": {
                "markdown": "Obfuscation by spurious conditions.",
                "text": "Obfuscation by spurious conditions."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-conditions",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-conditions",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-conditions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Obfuscated declarations names."
              },
              "help": {
                "markdown": "Obfuscated declarations names.",
                "text": "Obfuscated declarations names."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-declarations",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-declarations",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-declarations"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "help": {
                "markdown": "Obfuscation by concatenation of string manipulating methods.",
                "text": "Obfuscation by concatenation of string manipulating methods."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-methods-masking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-methods-masking",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-methods-masking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "help": {
                "markdown": "Obfuscation by reconstruction of hardcoded data.",
                "text": "Obfuscation by reconstruction of hardcoded data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-reconstruction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-reconstruction",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.obfuscation.scala.scala-obfuscation-reconstruction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Process execution detected $EXEC"
              },
              "help": {
                "markdown": "Process execution detected $EXEC",
                "text": "Process execution detected $EXEC"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.c.lang.security.audit.exec",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.c.lang.security.audit.exec",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.c.lang.security.audit.exec"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Dynamic OrderBy using string/expression. If understanding of property paths is attacker-controlled, this can aid schema inference and leaks."
              },
              "help": {
                "markdown": "Dynamic OrderBy using string/expression. If understanding of property paths is attacker-controlled, this can aid schema inference and leaks.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/leaking-more-than-you-joined-for/](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)\n",
                "text": "Dynamic OrderBy using string/expression. If understanding of property paths is attacker-controlled, this can aid schema inference and leaks."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-dynamic-orderby",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-dynamic-orderby",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-dynamic-orderby"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Dynamic Where clause or expression tree construction. Review whether query structure (property paths/operators) can be influenced by user input."
              },
              "help": {
                "markdown": "Dynamic Where clause or expression tree construction. Review whether query structure (property paths/operators) can be influenced by user input.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/leaking-more-than-you-joined-for/](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)\n",
                "text": "Dynamic Where clause or expression tree construction. Review whether query structure (property paths/operators) can be influenced by user input."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-dynamic-where",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-dynamic-where",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-dynamic-where"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "User-controlled navigation path passed to Include(string). Dynamic Include allows traversal of relations and can expose sensitive data."
              },
              "help": {
                "markdown": "User-controlled navigation path passed to Include(string). Dynamic Include allows traversal of relations and can expose sensitive data.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/leaking-more-than-you-joined-for/](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)\n",
                "text": "User-controlled navigation path passed to Include(string). Dynamic Include allows traversal of relations and can expose sensitive data."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-taint-dynamic-include",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-taint-dynamic-include",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-taint-dynamic-include"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "User-controlled data flows into EF.Property(). If attackers control the property name, this enables dynamic field access and ORM leak-style inference."
              },
              "help": {
                "markdown": "User-controlled data flows into EF.Property(). If attackers control the property name, this enables dynamic field access and ORM leak-style inference.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/leaking-more-than-you-joined-for/](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)\n",
                "text": "User-controlled data flows into EF.Property(). If attackers control the property name, this enables dynamic field access and ORM leak-style inference."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-taint-property",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-taint-property",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.orm-leak.ef-ormleak-taint-property"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "HTTP endpoint $ROUTE$PATH will handle $METHOD requests"
              },
              "help": {
                "markdown": "HTTP endpoint $ROUTE$PATH will handle $METHOD requests",
                "text": "HTTP endpoint $ROUTE$PATH will handle $METHOD requests"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.security.audit.entrypoints.aspnet-controller-entrypoint",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.security.audit.entrypoints.aspnet-controller-entrypoint",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.csharp.dotnet.security.audit.entrypoints.aspnet-controller-entrypoint"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "gorilla/sessions.NewCookieStore (and NewFilesystemStore) initialise Options.SameSite to http.SameSiteNoneMode by default, which allows the session cookie to be sent on cross-site requests and removes a key CSRF defence. The existing session-cookie-samesitenone rule only catches an explicit &sessions.Options{SameSite: http.SameSiteNoneMode}; this insecure value is also the silent default when you never set Options at all. After NewCookieStore, explicitly set store.Options.SameSite to http.SameSiteLaxMode or http.SameSiteStrictMode."
              },
              "help": {
                "markdown": "gorilla/sessions.NewCookieStore (and NewFilesystemStore) initialise Options.SameSite to http.SameSiteNoneMode by default, which allows the session cookie to be sent on cross-site requests and removes a key CSRF defence. The existing session-cookie-samesitenone rule only catches an explicit &sessions.Options{SameSite: http.SameSiteNoneMode}; this insecure value is also the silent default when you never set Options at all. After NewCookieStore, explicitly set store.Options.SameSite to http.SameSiteLaxMode or http.SameSiteStrictMode.\n\n<b>References:</b>\n - [https://github.com/gorilla/sessions/blob/v1.4.0/store.go#L59](https://github.com/gorilla/sessions/blob/v1.4.0/store.go#L59)\n",
                "text": "gorilla/sessions.NewCookieStore (and NewFilesystemStore) initialise Options.SameSite to http.SameSiteNoneMode by default, which allows the session cookie to be sent on cross-site requests and removes a key CSRF defence. The existing session-cookie-samesitenone rule only catches an explicit &sessions.Options{SameSite: http.SameSiteNoneMode}; this insecure value is also the silent default when you never set Options at all. After NewCookieStore, explicitly set store.Options.SameSite to http.SameSiteLaxMode or http.SameSiteStrictMode."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.gorilla.security.audit.gorilla-cookiestore-default-samesite-none",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.gorilla.security.audit.gorilla-cookiestore-default-samesite-none",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1275: Sensitive Cookie with Improper SameSite Attribute",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.gorilla.security.audit.gorilla-cookiestore-default-samesite-none"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "An HTTP handler decodes the request body as JSON without validating the Content-Type header. Browsers send no CORS preflight for \"simple\" requests using text/plain or application/x-www-form-urlencoded, so a cross-site HTML form can POST a body the server parses as JSON (encoding/json also ignores trailing bytes, so a form's trailing \"=\" doesn't break parsing). With cookie auth this is exploitable as CSRF. Reject requests whose Content-Type is not application/json, and/or wrap handlers with http.CrossOriginProtection (Go 1.25+).\nv2: handler matching widened to cover method receivers, extra parameters (e.g. ctx), and common framework handler signatures (gin, echo, chi/std) \u2014 the std-only two-arg pattern missed real handlers like func (h *T) handleWrite(w, r, ctx) found in production code."
              },
              "help": {
                "markdown": "An HTTP handler decodes the request body as JSON without validating the Content-Type header. Browsers send no CORS preflight for \"simple\" requests using text/plain or application/x-www-form-urlencoded, so a cross-site HTML form can POST a body the server parses as JSON (encoding/json also ignores trailing bytes, so a form's trailing \"=\" doesn't break parsing). With cookie auth this is exploitable as CSRF. Reject requests whose Content-Type is not application/json, and/or wrap handlers with http.CrossOriginProtection (Go 1.25+).\nv2: handler matching widened to cover method receivers, extra parameters (e.g. ctx), and common framework handler signatures (gin, echo, chi/std) \u2014 the std-only two-arg pattern missed real handlers like func (h *T) handleWrite(w, r, ctx) found in production code.\n\n<b>References:</b>\n - [https://pkg.go.dev/net/http#CrossOriginProtection](https://pkg.go.dev/net/http#CrossOriginProtection)\n - [https://pkg.go.dev/encoding/json#Decoder.Decode](https://pkg.go.dev/encoding/json#Decoder.Decode)\n",
                "text": "An HTTP handler decodes the request body as JSON without validating the Content-Type header. Browsers send no CORS preflight for \"simple\" requests using text/plain or application/x-www-form-urlencoded, so a cross-site HTML form can POST a body the server parses as JSON (encoding/json also ignores trailing bytes, so a form's trailing \"=\" doesn't break parsing). With cookie auth this is exploitable as CSRF. Reject requests whose Content-Type is not application/json, and/or wrap handlers with http.CrossOriginProtection (Go 1.25+).\nv2: handler matching widened to cover method receivers, extra parameters (e.g. ctx), and common framework handler signatures (gin, echo, chi/std) \u2014 the std-only two-arg pattern missed real handlers like func (h *T) handleWrite(w, r, ctx) found in production code."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.json-decode-without-content-type-check",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.json-decode-without-content-type-check",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.json-decode-without-content-type-check"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "MarshalJSON is defined on a pointer receiver (*$T). Because encoding/json resolves json.Marshaler via reflection under strict method-set rules, a pointer-receiver MarshalJSON is NOT in the method set of the value type $T. Encoding a value of $T (or a struct containing a $T field) by value silently skips the custom marshaller and uses default marshalling. If the marshaller performs redaction/masking/field-omission, that protection disappears silently.\nAUDIT NOTE: this only becomes a bug if the type is somewhere encoded BY VALUE. On large codebases most pointer-receiver MarshalJSON are always encoded by pointer and therefore safe \u2014 this rule fires broadly and is intended as an audit aid, not a finding. To resolve a hit, check whether the type is ever passed by value to json.Marshal/Encode. Fix by moving MarshalJSON to a value receiver, or always storing/encoding a pointer."
              },
              "help": {
                "markdown": "MarshalJSON is defined on a pointer receiver (*$T). Because encoding/json resolves json.Marshaler via reflection under strict method-set rules, a pointer-receiver MarshalJSON is NOT in the method set of the value type $T. Encoding a value of $T (or a struct containing a $T field) by value silently skips the custom marshaller and uses default marshalling. If the marshaller performs redaction/masking/field-omission, that protection disappears silently.\nAUDIT NOTE: this only becomes a bug if the type is somewhere encoded BY VALUE. On large codebases most pointer-receiver MarshalJSON are always encoded by pointer and therefore safe \u2014 this rule fires broadly and is intended as an audit aid, not a finding. To resolve a hit, check whether the type is ever passed by value to json.Marshal/Encode. Fix by moving MarshalJSON to a value receiver, or always storing/encoding a pointer.\n\n<b>References:</b>\n - [https://github.com/golang/go/issues/22967](https://github.com/golang/go/issues/22967)\n - [https://go.dev/wiki/MethodSets](https://go.dev/wiki/MethodSets)\n",
                "text": "MarshalJSON is defined on a pointer receiver (*$T). Because encoding/json resolves json.Marshaler via reflection under strict method-set rules, a pointer-receiver MarshalJSON is NOT in the method set of the value type $T. Encoding a value of $T (or a struct containing a $T field) by value silently skips the custom marshaller and uses default marshalling. If the marshaller performs redaction/masking/field-omission, that protection disappears silently.\nAUDIT NOTE: this only becomes a bug if the type is somewhere encoded BY VALUE. On large codebases most pointer-receiver MarshalJSON are always encoded by pointer and therefore safe \u2014 this rule fires broadly and is intended as an audit aid, not a finding. To resolve a hit, check whether the type is ever passed by value to json.Marshal/Encode. Fix by moving MarshalJSON to a value receiver, or always storing/encoding a pointer."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.json-marshaler-pointer-receiver",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.json-marshaler-pointer-receiver",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.json-marshaler-pointer-receiver"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A narrowing cast of len() is written as a binary length prefix via encoding/binary, then the corresponding payload is emitted. This is the exploitable shape from the msgp/DEF CON 32 class: if the length exceeds the narrow type's max it wraps, the on-wire length field desynchronises from the actual payload, and a downstream parser can be smuggled extra/short data. Bound the length against the type max (or the protocol limit) before writing it, and reject oversized payloads."
              },
              "help": {
                "markdown": "A narrowing cast of len() is written as a binary length prefix via encoding/binary, then the corresponding payload is emitted. This is the exploitable shape from the msgp/DEF CON 32 class: if the length exceeds the narrow type's max it wraps, the on-wire length field desynchronises from the actual payload, and a downstream parser can be smuggled extra/short data. Bound the length against the type max (or the protocol limit) before writing it, and reject oversized payloads.\n\n<b>References:</b>\n - [https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/](https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/)\n - [https://github.com/tinylib/msgp/blob/v1.5.0/msgp/write.go](https://github.com/tinylib/msgp/blob/v1.5.0/msgp/write.go)\n",
                "text": "A narrowing cast of len() is written as a binary length prefix via encoding/binary, then the corresponding payload is emitted. This is the exploitable shape from the msgp/DEF CON 32 class: if the length exceeds the narrow type's max it wraps, the on-wire length field desynchronises from the actual payload, and a downstream parser can be smuggled extra/short data. Bound the length against the type max (or the protocol limit) before writing it, and reject oversized payloads."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.len-cast-into-binary-length-prefix",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.len-cast-into-binary-length-prefix",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-190: Integer Overflow or Wraparound",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.len-cast-into-binary-length-prefix"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "The result of len() is cast to a narrower fixed-width integer (uint32/int32/uint16/int16/uint8/int8). len() returns int (64-bit on amd64/arm64), so a length above the target type's max silently wraps. This is benign for in-memory counts/sizes but dangerous when the value becomes a length/size field in a binary or wire format, where a truncated length desynchronises the parser from the payload (data smuggling / boundary confusion). Validate the length before casting, or keep the full-width value and reject oversized input.\nNOTE: this broad rule fires on every narrowing len() cast and is INFO/audit. For the dangerous subset, see len-cast-into-binary-length-prefix below."
              },
              "help": {
                "markdown": "The result of len() is cast to a narrower fixed-width integer (uint32/int32/uint16/int16/uint8/int8). len() returns int (64-bit on amd64/arm64), so a length above the target type's max silently wraps. This is benign for in-memory counts/sizes but dangerous when the value becomes a length/size field in a binary or wire format, where a truncated length desynchronises the parser from the payload (data smuggling / boundary confusion). Validate the length before casting, or keep the full-width value and reject oversized input.\nNOTE: this broad rule fires on every narrowing len() cast and is INFO/audit. For the dangerous subset, see len-cast-into-binary-length-prefix below.\n\n<b>References:</b>\n - [https://github.com/tinylib/msgp/blob/v1.5.0/msgp/write.go](https://github.com/tinylib/msgp/blob/v1.5.0/msgp/write.go)\n - [https://blog.trailofbits.com/2025/12/31/detect-gos-silent-arithmetic-bugs-with-go-panikint/](https://blog.trailofbits.com/2025/12/31/detect-gos-silent-arithmetic-bugs-with-go-panikint/)\n",
                "text": "The result of len() is cast to a narrower fixed-width integer (uint32/int32/uint16/int16/uint8/int8). len() returns int (64-bit on amd64/arm64), so a length above the target type's max silently wraps. This is benign for in-memory counts/sizes but dangerous when the value becomes a length/size field in a binary or wire format, where a truncated length desynchronises the parser from the payload (data smuggling / boundary confusion). Validate the length before casting, or keep the full-width value and reject oversized input.\nNOTE: this broad rule fires on every narrowing len() cast and is INFO/audit. For the dangerous subset, see len-cast-into-binary-length-prefix below."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.len-cast-to-narrow-int-overflow",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.len-cast-to-narrow-int-overflow",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-190: Integer Overflow or Wraparound",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.len-cast-to-narrow-int-overflow"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "A string is compared against a PRIVILEGED account name (admin/root/etc.) and then passed to a C-interop / LDAP / exec sink in the same function, with no null-byte rejection. Go strings may contain \\x00; C-style consumers truncate at the first null byte. An input like \"admin\\x00x\" fails the Go equality check yet resolves to \"admin\" past the boundary, bypassing the gate. Reject null bytes (strings.ContainsRune(s, 0) / strings.IndexByte(s, 0) != -1) before any comparison or interop call at the trust boundary.\nv2: the gate must compare against a non-empty privileged-looking literal (not `== \"\"` or arbitrary config values), and the sink must be a real C call, os/exec, or a named LDAP/PAM package \u2014 narrowed after real-code runs where empty-string defaults and cloud-SDK method names produced false positives."
              },
              "help": {
                "markdown": "A string is compared against a PRIVILEGED account name (admin/root/etc.) and then passed to a C-interop / LDAP / exec sink in the same function, with no null-byte rejection. Go strings may contain \\x00; C-style consumers truncate at the first null byte. An input like \"admin\\x00x\" fails the Go equality check yet resolves to \"admin\" past the boundary, bypassing the gate. Reject null bytes (strings.ContainsRune(s, 0) / strings.IndexByte(s, 0) != -1) before any comparison or interop call at the trust boundary.\nv2: the gate must compare against a non-empty privileged-looking literal (not `== \"\"` or arbitrary config values), and the sink must be a real C call, os/exec, or a named LDAP/PAM package \u2014 narrowed after real-code runs where empty-string defaults and cloud-SDK method names produced false positives.\n\n<b>References:</b>\n - [https://www.elttam.com/blog/golang-codereview](https://www.elttam.com/blog/golang-codereview)\n",
                "text": "A string is compared against a PRIVILEGED account name (admin/root/etc.) and then passed to a C-interop / LDAP / exec sink in the same function, with no null-byte rejection. Go strings may contain \\x00; C-style consumers truncate at the first null byte. An input like \"admin\\x00x\" fails the Go equality check yet resolves to \"admin\" past the boundary, bypassing the gate. Reject null bytes (strings.ContainsRune(s, 0) / strings.IndexByte(s, 0) != -1) before any comparison or interop call at the trust boundary.\nv2: the gate must compare against a non-empty privileged-looking literal (not `== \"\"` or arbitrary config values), and the sink must be a real C call, os/exec, or a named LDAP/PAM package \u2014 narrowed after real-code runs where empty-string defaults and cloud-SDK method names produced false positives."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.missing-null-byte-check-at-trust-boundary",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.missing-null-byte-check-at-trust-boundary",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-158: Improper Neutralization of Null Byte or NUL Character",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.missing-null-byte-check-at-trust-boundary"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "A *url.URL pointer held in a variable or field is aliased (not copied) and then a field of it is mutated. Assigning a *url.URL copies the pointer, not the struct, so the write mutates the shared original. If that original is package-level, a struct field, or otherwise shared across requests or goroutines, this corrupts the URL seen elsewhere (open-redirect / parameter-smuggling / data race).\nThis rule only fires when the alias source is a bare identifier (e.g. `u := s.someURL`) \u2014 the shape most likely to be a shared pointer. It does NOT fire on fresh allocations, which are safe: value composite literals (`url.URL{}`), dereference copies (`*p`), or any function/method call result (`url.Parse(...)`, `r.URL()`, `x.Copy()`, `ResolveReference(...)`), because those return a new value/struct that is not shared.\nFix: copy the struct (`u := *original`) or build a fresh &url.URL{...}."
              },
              "help": {
                "markdown": "A *url.URL pointer held in a variable or field is aliased (not copied) and then a field of it is mutated. Assigning a *url.URL copies the pointer, not the struct, so the write mutates the shared original. If that original is package-level, a struct field, or otherwise shared across requests or goroutines, this corrupts the URL seen elsewhere (open-redirect / parameter-smuggling / data race).\nThis rule only fires when the alias source is a bare identifier (e.g. `u := s.someURL`) \u2014 the shape most likely to be a shared pointer. It does NOT fire on fresh allocations, which are safe: value composite literals (`url.URL{}`), dereference copies (`*p`), or any function/method call result (`url.Parse(...)`, `r.URL()`, `x.Copy()`, `ResolveReference(...)`), because those return a new value/struct that is not shared.\nFix: copy the struct (`u := *original`) or build a fresh &url.URL{...}.\n\n<b>References:</b>\n - [https://pkg.go.dev/net/url#URL](https://pkg.go.dev/net/url#URL)\n",
                "text": "A *url.URL pointer held in a variable or field is aliased (not copied) and then a field of it is mutated. Assigning a *url.URL copies the pointer, not the struct, so the write mutates the shared original. If that original is package-level, a struct field, or otherwise shared across requests or goroutines, this corrupts the URL seen elsewhere (open-redirect / parameter-smuggling / data race).\nThis rule only fires when the alias source is a bare identifier (e.g. `u := s.someURL`) \u2014 the shape most likely to be a shared pointer. It does NOT fire on fresh allocations, which are safe: value composite literals (`url.URL{}`), dereference copies (`*p`), or any function/method call result (`url.Parse(...)`, `r.URL()`, `x.Copy()`, `ResolveReference(...)`), because those return a new value/struct that is not shared.\nFix: copy the struct (`u := *original`) or build a fresh &url.URL{...}."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.net-url-pointer-alias-mutation",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.net-url-pointer-alias-mutation",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.lang.security.audit.net-url-pointer-alias-mutation"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Dynamic Beego ORM expression string passed to Filter/Exclude/Condition.*. Review whether the expression can include attacker-controlled \"__\" traversal or operator suffixes (e.g. \"__contains\", \"__gt\")."
              },
              "help": {
                "markdown": "Dynamic Beego ORM expression string passed to Filter/Exclude/Condition.*. Review whether the expression can include attacker-controlled \"__\" traversal or operator suffixes (e.g. \"__contains\", \"__gt\").\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/leaking-more-than-you-joined-for/](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)\n",
                "text": "Dynamic Beego ORM expression string passed to Filter/Exclude/Condition.*. Review whether the expression can include attacker-controlled \"__\" traversal or operator suffixes (e.g. \"__contains\", \"__gt\")."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-dynamic-expr-review",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-dynamic-expr-review",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-dynamic-expr-review"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Dynamic OrderBy expression. Beego supports ordering on related fields and \"-\" prefix for descending order. Review attacker control and inference/oracle risk."
              },
              "help": {
                "markdown": "Dynamic OrderBy expression. Beego supports ordering on related fields and \"-\" prefix for descending order. Review attacker control and inference/oracle risk.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/leaking-more-than-you-joined-for/](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)\n",
                "text": "Dynamic OrderBy expression. Beego supports ordering on related fields and \"-\" prefix for descending order. Review attacker control and inference/oracle risk."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-dynamic-orderby-review",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-dynamic-orderby-review",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-dynamic-orderby-review"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Beego ORM FilterRaw used. Docs warn it treats input directly as a query condition and Beego performs no checks. Review carefully (can enable injection or leak oracles)."
              },
              "help": {
                "markdown": "Beego ORM FilterRaw used. Docs warn it treats input directly as a query condition and Beego performs no checks. Review carefully (can enable injection or leak oracles).\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/leaking-more-than-you-joined-for/](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)\n",
                "text": "Beego ORM FilterRaw used. Docs warn it treats input directly as a query condition and Beego performs no checks. Review carefully (can enable injection or leak oracles)."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-filterraw",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-filterraw",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-filterraw"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "User-controlled input flows into Beego ORM query expression (Filter/Exclude/Condition.*). Beego expressions support \"__\" traversal and operators (e.g. \"__contains\", \"__gt\"), so attacker-controlled expressions can enable ORM leak-style inference."
              },
              "help": {
                "markdown": "User-controlled input flows into Beego ORM query expression (Filter/Exclude/Condition.*). Beego expressions support \"__\" traversal and operators (e.g. \"__contains\", \"__gt\"), so attacker-controlled expressions can enable ORM leak-style inference.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/leaking-more-than-you-joined-for/](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)\n",
                "text": "User-controlled input flows into Beego ORM query expression (Filter/Exclude/Condition.*). Beego expressions support \"__\" traversal and operators (e.g. \"__contains\", \"__gt\"), so attacker-controlled expressions can enable ORM leak-style inference."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-taint-dynamic-expr",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-taint-dynamic-expr",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.go.orm-leak.beego-ormleak-taint-dynamic-expr"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Jackson Polymorphic Typing: This rule is to detect any instances of polymorphic typing to aid in determining vulnerable Jackson deserialization issues. Check if deserializing untrusted JSON to a nominal type such as `java.lang.Object` or permissive tag interfaces such as `java.io.Serializable` or `java.lang.Comparable` is occuring."
              },
              "help": {
                "markdown": "Jackson Polymorphic Typing: This rule is to detect any instances of polymorphic typing to aid in determining vulnerable Jackson deserialization issues. Check if deserializing untrusted JSON to a nominal type such as `java.lang.Object` or permissive tag interfaces such as `java.io.Serializable` or `java.lang.Comparable` is occuring.",
                "text": "Jackson Polymorphic Typing: This rule is to detect any instances of polymorphic typing to aid in determining vulnerable Jackson deserialization issues. Check if deserializing untrusted JSON to a nominal type such as `java.lang.Object` or permissive tag interfaces such as `java.io.Serializable` or `java.lang.Comparable` is occuring."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jackson.polymorphic-typing",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jackson.polymorphic-typing",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A8: Insecure Deserialization",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jackson.polymorphic-typing"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "$X Jackson Polymorphic Typing: Polymorphic typing may have been introduced through overriding the default Jackson type resolver."
              },
              "help": {
                "markdown": "$X Jackson Polymorphic Typing: Polymorphic typing may have been introduced through overriding the default Jackson type resolver.",
                "text": "$X Jackson Polymorphic Typing: Polymorphic typing may have been introduced through overriding the default Jackson type resolver."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jackson.type-resolver-override",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jackson.type-resolver-override",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A8: Insecure Deserialization",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jackson.type-resolver-override"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JAX-RS @Consumes(\"*/*\") $CLASS"
              },
              "help": {
                "markdown": "JAX-RS @Consumes(\"*/*\") $CLASS",
                "text": "JAX-RS @Consumes(\"*/*\") $CLASS"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.consumes-class-star",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.consumes-class-star",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.consumes-class-star"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JAX-RS @Consumes(\"*/*\") $CLASS.$METHOD"
              },
              "help": {
                "markdown": "JAX-RS @Consumes(\"*/*\") $CLASS.$METHOD",
                "text": "JAX-RS @Consumes(\"*/*\") $CLASS.$METHOD"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.consumes-method-star",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.consumes-method-star",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.consumes-method-star"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JAX-RS $METHOD class $PATH1 endpoint $CLASS.$FUNC()"
              },
              "help": {
                "markdown": "JAX-RS $METHOD class $PATH1 endpoint $CLASS.$FUNC()",
                "text": "JAX-RS $METHOD class $PATH1 endpoint $CLASS.$FUNC()"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.class-path",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.class-path",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.class-path"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JAX-RS $METHOD method $PATH2 endpoint $CLASS.$FUNC()"
              },
              "help": {
                "markdown": "JAX-RS $METHOD method $PATH2 endpoint $CLASS.$FUNC()",
                "text": "JAX-RS $METHOD method $PATH2 endpoint $CLASS.$FUNC()"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.method-path",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.method-path",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.method-path"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JAX-RS $METHOD endpoint $CLASS.$FUNC()"
              },
              "help": {
                "markdown": "JAX-RS $METHOD endpoint $CLASS.$FUNC()",
                "text": "JAX-RS $METHOD endpoint $CLASS.$FUNC()"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.no-path",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.no-path",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.no-path"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JAX-RS $METHOD $PATH1/$PATH2 endpoint $CLASS.$FUNC()"
              },
              "help": {
                "markdown": "JAX-RS $METHOD $PATH1/$PATH2 endpoint $CLASS.$FUNC()",
                "text": "JAX-RS $METHOD $PATH1/$PATH2 endpoint $CLASS.$FUNC()"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.path-path",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.path-path",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.http-method.path-path"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JAX-RS @HttpMethod HTTP Method Annotation $INTERFACE, $TARGET annotated with this will handle $METHOD"
              },
              "help": {
                "markdown": "JAX-RS @HttpMethod HTTP Method Annotation $INTERFACE, $TARGET annotated with this will handle $METHOD",
                "text": "JAX-RS @HttpMethod HTTP Method Annotation $INTERFACE, $TARGET annotated with this will handle $METHOD"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.jax-rs.httpmethod",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.jax-rs.httpmethod",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.jax-rs.httpmethod"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JAX-RS Path Expression $PATH1/$PATH2 class $CLASS.$FUNC()"
              },
              "help": {
                "markdown": "JAX-RS Path Expression $PATH1/$PATH2 class $CLASS.$FUNC()",
                "text": "JAX-RS Path Expression $PATH1/$PATH2 class $CLASS.$FUNC()"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.jax-rs.path-expression",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.jax-rs.path-expression",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.jax-rs.path-expression"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JAX-RS class $CLASS.$FUNC Path $PATH1/$PATH2"
              },
              "help": {
                "markdown": "JAX-RS class $CLASS.$FUNC Path $PATH1/$PATH2",
                "text": "JAX-RS class $CLASS.$FUNC Path $PATH1/$PATH2"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.path-class-method",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.path-class-method",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.path-class-method"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JAX-RS Path \"$PATH1/$PATH2\" endpoint $CLASS.$FUNC()"
              },
              "help": {
                "markdown": "JAX-RS Path \"$PATH1/$PATH2\" endpoint $CLASS.$FUNC()",
                "text": "JAX-RS Path \"$PATH1/$PATH2\" endpoint $CLASS.$FUNC()"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.path-method-string",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.path-method-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.path-method-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JAX-RS @Provider $CLASS"
              },
              "help": {
                "markdown": "JAX-RS @Provider $CLASS",
                "text": "JAX-RS @Provider $CLASS"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.provider-class",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.provider-class",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.jax-rs.security.audit.entrypoints.provider-class"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "ProcessBuilder in $METHOD()"
              },
              "help": {
                "markdown": "ProcessBuilder in $METHOD()",
                "text": "ProcessBuilder in $METHOD()"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.lang.security.audit.processbuilder",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.lang.security.audit.processbuilder",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.lang.security.audit.processbuilder"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Entrypoint DELETE $METHOD"
              },
              "help": {
                "markdown": "Entrypoint DELETE $METHOD",
                "text": "Entrypoint DELETE $METHOD"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-DeleteMapping",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-DeleteMapping",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-DeleteMapping"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Entrypoint $METHOD GET $PATH"
              },
              "help": {
                "markdown": "Entrypoint $METHOD GET $PATH",
                "text": "Entrypoint $METHOD GET $PATH"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-GetMapping",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-GetMapping",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-GetMapping"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Entrypoint PATCH $METHOD"
              },
              "help": {
                "markdown": "Entrypoint PATCH $METHOD",
                "text": "Entrypoint PATCH $METHOD"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-PatchMapping",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-PatchMapping",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-PatchMapping"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Entrypoint POST $METHOD"
              },
              "help": {
                "markdown": "Entrypoint POST $METHOD",
                "text": "Entrypoint POST $METHOD"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-PostMapping",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-PostMapping",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-PostMapping"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Entrypoint PUT $METHOD"
              },
              "help": {
                "markdown": "Entrypoint PUT $METHOD",
                "text": "Entrypoint PUT $METHOD"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-PutMapping",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-PutMapping",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-PutMapping"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Method return value should be bound to the web response body"
              },
              "help": {
                "markdown": "Method return value should be bound to the web response body",
                "text": "Method return value should be bound to the web response body"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-ResponseBody",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-ResponseBody",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-ResponseBody"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "ServletRegistrationBean SERVLET $ALWAYS_MAP_URL $URL_MAPPINGS"
              },
              "help": {
                "markdown": "ServletRegistrationBean SERVLET $ALWAYS_MAP_URL $URL_MAPPINGS",
                "text": "ServletRegistrationBean SERVLET $ALWAYS_MAP_URL $URL_MAPPINGS"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-servletregistrationbean",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-servletregistrationbean",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.spring.security.audit.entrypoints.rest-servletregistrationbean"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "default.properties struts.devMode = $MODE"
              },
              "help": {
                "markdown": "default.properties struts.devMode = $MODE",
                "text": "default.properties struts.devMode = $MODE"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.devmode.default-properties-devmode",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.devmode.default-properties-devmode",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.devmode.default-properties-devmode"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "struts.xml devMode = \"$...MODE\""
              },
              "help": {
                "markdown": "struts.xml devMode = \"$...MODE\"",
                "text": "struts.xml devMode = \"$...MODE\""
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.devmode.struts-xml-devmode",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.devmode.struts-xml-devmode",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.devmode.struts-xml-devmode"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "web.xml devMode = $MODE"
              },
              "help": {
                "markdown": "web.xml devMode = $MODE",
                "text": "web.xml devMode = $MODE"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.devmode.web-xml-devmode",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.devmode.web-xml-devmode",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.devmode.web-xml-devmode"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "struts.xml action $...NAME either using Dynamic Method Invocation or Wildcard Method feature"
              },
              "help": {
                "markdown": "struts.xml action $...NAME either using Dynamic Method Invocation or Wildcard Method feature",
                "text": "struts.xml action $...NAME either using Dynamic Method Invocation or Wildcard Method feature"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.dmi.struts-xml-action-dmi",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.dmi.struts-xml-action-dmi",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.dmi.struts-xml-action-dmi"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "struts.xml Dynamic Method Invocation"
              },
              "help": {
                "markdown": "struts.xml Dynamic Method Invocation",
                "text": "struts.xml Dynamic Method Invocation"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.dmi.struts-xml-dmi",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.dmi.struts-xml-dmi",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.dmi.struts-xml-dmi"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JSTL taglib directive either Dynamic Method Invocation (DMI) or Wildcard Method feature prefix=\"$...PREFIX\" uri=\"$...URI\" action=\"$...ACTION\""
              },
              "help": {
                "markdown": "JSTL taglib directive either Dynamic Method Invocation (DMI) or Wildcard Method feature prefix=\"$...PREFIX\" uri=\"$...URI\" action=\"$...ACTION\"",
                "text": "JSTL taglib directive either Dynamic Method Invocation (DMI) or Wildcard Method feature prefix=\"$...PREFIX\" uri=\"$...URI\" action=\"$...ACTION\""
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.dmi.taglib-action-dmi",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.dmi.taglib-action-dmi",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.dmi.taglib-action-dmi"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Struts2 Convention plugin annotation $ANNOTATION params $...PARAMS package $PACKAGE"
              },
              "help": {
                "markdown": "Struts2 Convention plugin annotation $ANNOTATION params $...PARAMS package $PACKAGE",
                "text": "Struts2 Convention plugin annotation $ANNOTATION params $...PARAMS package $PACKAGE"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.convention-annotation-package-info",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.convention-annotation-package-info",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.convention-annotation-package-info"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Struts2 Possible Action Handler class $CLASS has execute() method"
              },
              "help": {
                "markdown": "Struts2 Possible Action Handler class $CLASS has execute() method",
                "text": "Struts2 Possible Action Handler class $CLASS has execute() method"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.execute-method",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.execute-method",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.execute-method"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "struts.xml action $...NAME"
              },
              "help": {
                "markdown": "struts.xml action $...NAME",
                "text": "struts.xml action $...NAME"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.struts-xml-action-name",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.struts-xml-action-name",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.struts-xml-action-name"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JSTL taglib directive prefix=\"$...PREFIX\" uri=\"$...URI\" action=\"$...ACTION\""
              },
              "help": {
                "markdown": "JSTL taglib directive prefix=\"$...PREFIX\" uri=\"$...URI\" action=\"$...ACTION\"",
                "text": "JSTL taglib directive prefix=\"$...PREFIX\" uri=\"$...URI\" action=\"$...ACTION\""
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.taglib-action",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.taglib-action",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.taglib-action"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "JSTL taglib directive prefix=\"$...PREFIX\" uri=\"$...URI\""
              },
              "help": {
                "markdown": "JSTL taglib directive prefix=\"$...PREFIX\" uri=\"$...URI\"",
                "text": "JSTL taglib directive prefix=\"$...PREFIX\" uri=\"$...URI\""
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.taglib-directive",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.taglib-directive",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.taglib-directive"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "web.xml Struts2 filter $FILTER_NAME class $...FILTER_CLASS"
              },
              "help": {
                "markdown": "web.xml Struts2 filter $FILTER_NAME class $...FILTER_CLASS",
                "text": "web.xml Struts2 filter $FILTER_NAME class $...FILTER_CLASS"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.web-xml",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.web-xml",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.web-xml"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "web.xml Struts2 filter $FILTER_NAME class $...FILTER_CLASS url-pattern $...URL_PATTERN"
              },
              "help": {
                "markdown": "web.xml Struts2 filter $FILTER_NAME class $...FILTER_CLASS url-pattern $...URL_PATTERN",
                "text": "web.xml Struts2 filter $FILTER_NAME class $...FILTER_CLASS url-pattern $...URL_PATTERN"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.web-xml-filter-url-pattern",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.web-xml-filter-url-pattern",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.web-xml-filter-url-pattern"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "web.xml Struts2 listener-class $...LISTENER_CLASS"
              },
              "help": {
                "markdown": "web.xml Struts2 listener-class $...LISTENER_CLASS",
                "text": "web.xml Struts2 listener-class $...LISTENER_CLASS"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.web-xml-listener",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.web-xml-listener",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.entrypoints.web-xml-listener"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "struts.xml using alwaysSelectFullNamespace"
              },
              "help": {
                "markdown": "struts.xml using alwaysSelectFullNamespace",
                "text": "struts.xml using alwaysSelectFullNamespace"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.struts-xml-always-select-full-namespace",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.struts-xml-always-select-full-namespace",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.struts2.security.audit.struts-xml-always-select-full-namespace"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "XStream XML Deserialzation: Check that they have correctly set an allow-list and if an attacker can control input."
              },
              "help": {
                "markdown": "XStream XML Deserialzation: Check that they have correctly set an allow-list and if an attacker can control input.",
                "text": "XStream XML Deserialzation: Check that they have correctly set an allow-list and if an attacker can control input."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.xstream.security.audit.fromXML",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.xstream.security.audit.fromXML",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A8: Insecure Deserialization",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.java.xstream.security.audit.fromXML"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Express HTTP route $ROUTE will handle $METHOD requests"
              },
              "help": {
                "markdown": "Express HTTP route $ROUTE will handle $METHOD requests",
                "text": "Express HTTP route $ROUTE will handle $METHOD requests"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.express.security.audit.entrypoints.express-app-router-handler",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.express.security.audit.entrypoints.express-app-router-handler",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "HIGH CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.express.security.audit.entrypoints.express-app-router-handler"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Depending on the context, using (user-controlled) request data directly in a MongoDB query can lead to a NoSQLi vulnerability."
              },
              "help": {
                "markdown": "Depending on the context, using (user-controlled) request data directly in a MongoDB query can lead to a NoSQLi vulnerability.\n\n<b>References:</b>\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n",
                "text": "Depending on the context, using (user-controlled) request data directly in a MongoDB query can lead to a NoSQLi vulnerability."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.express.security.audit.express-mongodb-nosqli",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.express.security.audit.express-mongodb-nosqli",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 \u2013 Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.express.security.audit.express-mongodb-nosqli"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "User-controlled data flows into Prisma `where` option for a field. If attackers can influence coerce the input type into an object, then they could inject Prisma operators. If the Prisma query is used during an authentication flow, it could result in an authentication bypass. Ensure input type validation checks are performed or the equals operator is explicitly used."
              },
              "help": {
                "markdown": "User-controlled data flows into Prisma `where` option for a field. If attackers can influence coerce the input type into an object, then they could inject Prisma operators. If the Prisma query is used during an authentication flow, it could result in an authentication bypass. Ensure input type validation checks are performed or the equals operator is explicitly used.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/plorming-your-primsa-orm/](https://www.elttam.com/blog/plorming-your-primsa-orm/)\n",
                "text": "User-controlled data flows into Prisma `where` option for a field. If attackers can influence coerce the input type into an object, then they could inject Prisma operators. If the Prisma query is used during an authentication flow, it could result in an authentication bypass. Ensure input type validation checks are performed or the equals operator is explicitly used."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-orm-operator-injection",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-orm-operator-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-orm-operator-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "User-controlled data flows into Prisma `orderBy`. Attacker-controlled order fields can aid schema inference and can combine with other oracles."
              },
              "help": {
                "markdown": "User-controlled data flows into Prisma `orderBy`. Attacker-controlled order fields can aid schema inference and can combine with other oracles.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/plorming-your-primsa-orm/](https://www.elttam.com/blog/plorming-your-primsa-orm/)\n",
                "text": "User-controlled data flows into Prisma `orderBy`. Attacker-controlled order fields can aid schema inference and can combine with other oracles."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-ormleak-taint-orderby",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-ormleak-taint-orderby",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-ormleak-taint-orderby"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "User-controlled data flows into Prisma `select/include`. If attackers can control projection/relations, sensitive data may be exposed."
              },
              "help": {
                "markdown": "User-controlled data flows into Prisma `select/include`. If attackers can control projection/relations, sensitive data may be exposed.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/plorming-your-primsa-orm/](https://www.elttam.com/blog/plorming-your-primsa-orm/)\n",
                "text": "User-controlled data flows into Prisma `select/include`. If attackers can control projection/relations, sensitive data may be exposed."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-ormleak-taint-projection",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-ormleak-taint-projection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-ormleak-taint-projection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "User-controlled data flows into Prisma `where`. If attackers can influence nested relations/operators (contains/startsWith/etc), this can enable ORM leak-style data inference."
              },
              "help": {
                "markdown": "User-controlled data flows into Prisma `where`. If attackers can influence nested relations/operators (contains/startsWith/etc), this can enable ORM leak-style data inference.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/plorming-your-primsa-orm/](https://www.elttam.com/blog/plorming-your-primsa-orm/)\n",
                "text": "User-controlled data flows into Prisma `where`. If attackers can influence nested relations/operators (contains/startsWith/etc), this can enable ORM leak-style data inference."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-ormleak-taint-where",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-ormleak-taint-where",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.orm-leak.prisma-ormleak-taint-where"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "rand-token defaults to using `crypto.pseudoRandomBytes`, insecure RNG"
              },
              "help": {
                "markdown": "rand-token defaults to using `crypto.pseudoRandomBytes`, insecure RNG",
                "text": "rand-token defaults to using `crypto.pseudoRandomBytes`, insecure RNG"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.rand-token-insecure-rng",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.rand-token-insecure-rng",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\n",
                  "HIGH CONFIDENCE",
                  "OWASP-A06:2021 \u2013 Vulnerable and Outdated Components",
                  "OWASP-A09:2017 - Using Components with Known Vulnerabilities",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.javascript.rand-token-insecure-rng"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Spark HTTP route $ROUTE will handle $METHOD requests"
              },
              "help": {
                "markdown": "Spark HTTP route $ROUTE will handle $METHOD requests",
                "text": "Spark HTTP route $ROUTE will handle $METHOD requests"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.kotlin.spark.security.audit.entrypoints.spark-route-handler",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.kotlin.spark.security.audit.entrypoints.spark-route-handler",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.kotlin.spark.security.audit.entrypoints.spark-route-handler"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Flask HTTP route $ROUTE will handle $METHOD requests"
              },
              "help": {
                "markdown": "Flask HTTP route $ROUTE will handle $METHOD requests",
                "text": "Flask HTTP route $ROUTE will handle $METHOD requests"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.flask.security.audit.entrypoints.flask-app-route-handler",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.flask.security.audit.entrypoints.flask-app-route-handler",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "HIGH CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.flask.security.audit.entrypoints.flask-app-route-handler"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "FilterSet exposes all model fields. Sensitive fields (password, tokens, PII) may unintentionally become filterable via lookup operators."
              },
              "help": {
                "markdown": "FilterSet exposes all model fields. Sensitive fields (password, tokens, PII) may unintentionally become filterable via lookup operators.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/plormbing-your-django-orm/](https://www.elttam.com/blog/plormbing-your-django-orm/)\n",
                "text": "FilterSet exposes all model fields. Sensitive fields (password, tokens, PII) may unintentionally become filterable via lookup operators."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-filter-exposes-all-fields",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-filter-exposes-all-fields",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-filter-exposes-all-fields"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Dynamic kwargs passed into Django ORM lookup methods. Review if these keys can be attacker-controlled (e.g. \"user__password__contains\"). This is a primary ORM Leak sink."
              },
              "help": {
                "markdown": "Dynamic kwargs passed into Django ORM lookup methods. Review if these keys can be attacker-controlled (e.g. \"user__password__contains\"). This is a primary ORM Leak sink.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/plormbing-your-django-orm/](https://www.elttam.com/blog/plormbing-your-django-orm/)\n",
                "text": "Dynamic kwargs passed into Django ORM lookup methods. Review if these keys can be attacker-controlled (e.g. \"user__password__contains\"). This is a primary ORM Leak sink."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-orm-dynamic-lookup-kwargs",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-orm-dynamic-lookup-kwargs",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-orm-dynamic-lookup-kwargs"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Dynamic kwargs passed into Django ORM lookup methods with a variable key. Review if these keys can be attacker-controlled (e.g. \"user__password__contains\"). This is a primary ORM Leak sink."
              },
              "help": {
                "markdown": "Dynamic kwargs passed into Django ORM lookup methods with a variable key. Review if these keys can be attacker-controlled (e.g. \"user__password__contains\"). This is a primary ORM Leak sink.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/plormbing-your-django-orm/](https://www.elttam.com/blog/plormbing-your-django-orm/)\n",
                "text": "Dynamic kwargs passed into Django ORM lookup methods with a variable key. Review if these keys can be attacker-controlled (e.g. \"user__password__contains\"). This is a primary ORM Leak sink."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-orm-dynamic-lookup-variable-key",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-orm-dynamic-lookup-variable-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-orm-dynamic-lookup-variable-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Dynamic field names used in order_by() or values(). Review if an attacker can influence the selected or sorted fields."
              },
              "help": {
                "markdown": "Dynamic field names used in order_by() or values(). Review if an attacker can influence the selected or sorted fields.\n\n<b>References:</b>\n - [https://cwe.mitre.org/data/definitions/203.html](https://cwe.mitre.org/data/definitions/203.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://www.elttam.com/blog/plormbing-your-django-orm/](https://www.elttam.com/blog/plormbing-your-django-orm/)\n",
                "text": "Dynamic field names used in order_by() or values(). Review if an attacker can influence the selected or sorted fields."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-orm-dynamic-orderby-or-values",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-orm-dynamic-orderby-or-values",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-203: Observable Discrepancy",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules-audit.python.orm-leak.django-orm-dynamic-orderby-or-values"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "An unsafe.Pointer converted to an uintptr must be used in an atomic step. Without this it is not guaranteed that the memory location uintptr points to will contain the intended structure."
              },
              "help": {
                "markdown": "An unsafe.Pointer converted to an uintptr must be used in an atomic step. Without this it is not guaranteed that the memory location uintptr points to will contain the intended structure.",
                "text": "An unsafe.Pointer converted to an uintptr must be used in an atomic step. Without this it is not guaranteed that the memory location uintptr points to will contain the intended structure."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.go.lang.security.audit.non-atomic-use-of-converted-uintptr",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.go.lang.security.audit.non-atomic-use-of-converted-uintptr",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "MEDIUM CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.go.lang.security.audit.non-atomic-use-of-converted-uintptr"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "os.Executable()s behaviour varies between operating systems. On Linux symlinks are followed, while on MacOS and Windows they are not. Depending on context, this could lead to file replacement attacks and local privilege escalation."
              },
              "help": {
                "markdown": "os.Executable()s behaviour varies between operating systems. On Linux symlinks are followed, while on MacOS and Windows they are not. Depending on context, this could lead to file replacement attacks and local privilege escalation.",
                "text": "os.Executable()s behaviour varies between operating systems. On Linux symlinks are followed, while on MacOS and Windows they are not. Depending on context, this could lead to file replacement attacks and local privilege escalation."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.go.lang.security.audit.potential-symlink-takeover-with-os.executable",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.go.lang.security.audit.potential-symlink-takeover-with-os.executable",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.go.lang.security.audit.potential-symlink-takeover-with-os.executable"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "fmt.Sprintf()'s %s formatting verb does not escape control characters in a string, such as \\u000a or backtick-enclosed multilines. This could lead to various vulnerabilities such as header injection, request smuggling, log injection, etc."
              },
              "help": {
                "markdown": "fmt.Sprintf()'s %s formatting verb does not escape control characters in a string, such as \\u000a or backtick-enclosed multilines. This could lead to various vulnerabilities such as header injection, request smuggling, log injection, etc.",
                "text": "fmt.Sprintf()'s %s formatting verb does not escape control characters in a string, such as \\u000a or backtick-enclosed multilines. This could lead to various vulnerabilities such as header injection, request smuggling, log injection, etc."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.go.lang.security.audit.sprintf-unescaped-control-characters",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.go.lang.security.audit.sprintf-unescaped-control-characters",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "MEDIUM CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.go.lang.security.audit.sprintf-unescaped-control-characters"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Domain/tenant derived using email.endsWith(\"...\"). This can be bypassed with addresses like tester@evil.com@trusted.com. Prefer comparing the canonical domain returned by a parser."
              },
              "help": {
                "markdown": "Domain/tenant derived using email.endsWith(\"...\"). This can be bypassed with addresses like tester@evil.com@trusted.com. Prefer comparing the canonical domain returned by a parser.\n\n<b>References:</b>\n - [https://elttam.com/blog/jakarta-mail-primitives/](https://elttam.com/blog/jakarta-mail-primitives/)\n - [https://cwe.mitre.org/data/definitions/20.html](https://cwe.mitre.org/data/definitions/20.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n",
                "text": "Domain/tenant derived using email.endsWith(\"...\"). This can be bypassed with addresses like tester@evil.com@trusted.com. Prefer comparing the canonical domain returned by a parser."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.email-domain-endswith",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.email-domain-endswith",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 \u2013 Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.email-domain-endswith"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Domain derived via substring(lastIndexOf(\"@\") + 1). This can be tricked by overloaded or encoded email addresses. Prefer a proper parser and canonical form instead of manual substring logic."
              },
              "help": {
                "markdown": "Domain derived via substring(lastIndexOf(\"@\") + 1). This can be tricked by overloaded or encoded email addresses. Prefer a proper parser and canonical form instead of manual substring logic.\n\n<b>References:</b>\n - [https://elttam.com/blog/jakarta-mail-primitives/](https://elttam.com/blog/jakarta-mail-primitives/)\n - [https://cwe.mitre.org/data/definitions/20.html](https://cwe.mitre.org/data/definitions/20.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n",
                "text": "Domain derived via substring(lastIndexOf(\"@\") + 1). This can be tricked by overloaded or encoded email addresses. Prefer a proper parser and canonical form instead of manual substring logic."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.email-domain-lastindexof",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.email-domain-lastindexof",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 \u2013 Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.email-domain-lastindexof"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Domain derived via email.split(\"@\")[1]. This is fragile for complex, RFC-compliant addresses (e.g. \"\\\"foo@bar.com\\\"@example.com\"). Prefer a proper email parser and canonicalization for domain checks."
              },
              "help": {
                "markdown": "Domain derived via email.split(\"@\")[1]. This is fragile for complex, RFC-compliant addresses (e.g. \"\\\"foo@bar.com\\\"@example.com\"). Prefer a proper email parser and canonicalization for domain checks.\n\n<b>References:</b>\n - [https://elttam.com/blog/jakarta-mail-primitives/](https://elttam.com/blog/jakarta-mail-primitives/)\n - [https://cwe.mitre.org/data/definitions/20.html](https://cwe.mitre.org/data/definitions/20.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n",
                "text": "Domain derived via email.split(\"@\")[1]. This is fragile for complex, RFC-compliant addresses (e.g. \"\\\"foo@bar.com\\\"@example.com\"). Prefer a proper email parser and canonicalization for domain checks."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.email-domain-split-index",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.email-domain-split-index",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 \u2013 Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.email-domain-split-index"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Field annotated with @Email. The default Hibernate validator is not RFC 2047-aware and can accept complex syntax (e.g. \"\\\"foo@bar.com\\\"@example.com\"). Review any domain or trust logic that uses this field (split/substring/endsWith)."
              },
              "help": {
                "markdown": "Field annotated with @Email. The default Hibernate validator is not RFC 2047-aware and can accept complex syntax (e.g. \"\\\"foo@bar.com\\\"@example.com\"). Review any domain or trust logic that uses this field (split/substring/endsWith).\n\n<b>References:</b>\n - [https://elttam.com/blog/jakarta-mail-primitives/](https://elttam.com/blog/jakarta-mail-primitives/)\n - [https://cwe.mitre.org/data/definitions/20.html](https://cwe.mitre.org/data/definitions/20.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n",
                "text": "Field annotated with @Email. The default Hibernate validator is not RFC 2047-aware and can accept complex syntax (e.g. \"\\\"foo@bar.com\\\"@example.com\"). Review any domain or trust logic that uses this field (split/substring/endsWith)."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.hibernate-email-annotation-field",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.hibernate-email-annotation-field",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 \u2013 Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.hibernate-email-annotation-field"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "InternetAddress(String, ...) constructors do NOT validate the email address. They assign the address field directly. Prefer the single-arg constructor + explicit validation."
              },
              "help": {
                "markdown": "InternetAddress(String, ...) constructors do NOT validate the email address. They assign the address field directly. Prefer the single-arg constructor + explicit validation.\n\n<b>References:</b>\n - [https://elttam.com/blog/jakarta-mail-primitives/](https://elttam.com/blog/jakarta-mail-primitives/)\n - [https://cwe.mitre.org/data/definitions/20.html](https://cwe.mitre.org/data/definitions/20.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n",
                "text": "InternetAddress(String, ...) constructors do NOT validate the email address. They assign the address field directly. Prefer the single-arg constructor + explicit validation."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-internetaddress-overloaded-ctor",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-internetaddress-overloaded-ctor",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 \u2013 Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-internetaddress-overloaded-ctor"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "new InternetAddress(String) parses an email for RFC compliance, but should not be treated as a full security/identity check. Ensure domain checks and trust decisions are not based solely on constructor success."
              },
              "help": {
                "markdown": "new InternetAddress(String) parses an email for RFC compliance, but should not be treated as a full security/identity check. Ensure domain checks and trust decisions are not based solely on constructor success.\n\n<b>References:</b>\n - [https://elttam.com/blog/jakarta-mail-primitives/](https://elttam.com/blog/jakarta-mail-primitives/)\n - [https://cwe.mitre.org/data/definitions/20.html](https://cwe.mitre.org/data/definitions/20.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n",
                "text": "new InternetAddress(String) parses an email for RFC compliance, but should not be treated as a full security/identity check. Ensure domain checks and trust decisions are not based solely on constructor success."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-internetaddress-single-arg-validator",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-internetaddress-single-arg-validator",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 \u2013 Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-internetaddress-single-arg-validator"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "MimeMessage.getRecipients(Message.RecipientType.NEWSGROUPS) used. Newsgroups headers may be concatenated and parsed via NewsAddress, which silently normalizes malformed values. Review how this data is used."
              },
              "help": {
                "markdown": "MimeMessage.getRecipients(Message.RecipientType.NEWSGROUPS) used. Newsgroups headers may be concatenated and parsed via NewsAddress, which silently normalizes malformed values. Review how this data is used.\n\n<b>References:</b>\n - [https://elttam.com/blog/jakarta-mail-primitives/](https://elttam.com/blog/jakarta-mail-primitives/)\n - [https://cwe.mitre.org/data/definitions/20.html](https://cwe.mitre.org/data/definitions/20.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n",
                "text": "MimeMessage.getRecipients(Message.RecipientType.NEWSGROUPS) used. Newsgroups headers may be concatenated and parsed via NewsAddress, which silently normalizes malformed values. Review how this data is used."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-mimemessage-newsgroups-recipients",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-mimemessage-newsgroups-recipients",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 \u2013 Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-mimemessage-newsgroups-recipients"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "MimeMessage constructed from a raw source or InputStream. Headers such as From, Reply-To, Subject, and Newsgroups will be parsed using InternetAddress/NewsAddress. Ensure user-controlled envelopes are canonicalized and not blindly trusted."
              },
              "help": {
                "markdown": "MimeMessage constructed from a raw source or InputStream. Headers such as From, Reply-To, Subject, and Newsgroups will be parsed using InternetAddress/NewsAddress. Ensure user-controlled envelopes are canonicalized and not blindly trusted.\n\n<b>References:</b>\n - [https://elttam.com/blog/jakarta-mail-primitives/](https://elttam.com/blog/jakarta-mail-primitives/)\n - [https://cwe.mitre.org/data/definitions/20.html](https://cwe.mitre.org/data/definitions/20.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n",
                "text": "MimeMessage constructed from a raw source or InputStream. Headers such as From, Reply-To, Subject, and Newsgroups will be parsed using InternetAddress/NewsAddress. Ensure user-controlled envelopes are canonicalized and not blindly trusted."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-mimemessage-raw-envelope-ctor",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-mimemessage-raw-envelope-ctor",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 \u2013 Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.jakarta-mail-mimemessage-raw-envelope-ctor"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Spring InternetAddressEditor used. This relies on Jakarta Mail parsing and will decode encoded personal names (RFC 2047). Ensure the resulting personal/name fields are not used as trust signals."
              },
              "help": {
                "markdown": "Spring InternetAddressEditor used. This relies on Jakarta Mail parsing and will decode encoded personal names (RFC 2047). Ensure the resulting personal/name fields are not used as trust signals.\n\n<b>References:</b>\n - [https://elttam.com/blog/jakarta-mail-primitives/](https://elttam.com/blog/jakarta-mail-primitives/)\n - [https://cwe.mitre.org/data/definitions/20.html](https://cwe.mitre.org/data/definitions/20.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n",
                "text": "Spring InternetAddressEditor used. This relies on Jakarta Mail parsing and will decode encoded personal names (RFC 2047). Ensure the resulting personal/name fields are not used as trust signals."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.spring-internetaddresseditor-usage",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.spring-internetaddresseditor-usage",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 \u2013 Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.spring-internetaddresseditor-usage"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "SimpleMailMessage.setFrom(...) called. If the from-address is influenced by user input, be aware of encoded names and complex email syntax (e.g. encoded words, group addresses, angle-bracket forms)."
              },
              "help": {
                "markdown": "SimpleMailMessage.setFrom(...) called. If the from-address is influenced by user input, be aware of encoded names and complex email syntax (e.g. encoded words, group addresses, angle-bracket forms).\n\n<b>References:</b>\n - [https://elttam.com/blog/jakarta-mail-primitives/](https://elttam.com/blog/jakarta-mail-primitives/)\n - [https://cwe.mitre.org/data/definitions/20.html](https://cwe.mitre.org/data/definitions/20.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n",
                "text": "SimpleMailMessage.setFrom(...) called. If the from-address is influenced by user input, be aware of encoded names and complex email syntax (e.g. encoded words, group addresses, angle-bracket forms)."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.spring-simplemailmessage-setfrom-raw",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.spring-simplemailmessage-setfrom-raw",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 \u2013 Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.audit.email-validation.spring-simplemailmessage-setfrom-raw"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "GCM IV and key are both same source $KEY_BYTES"
              },
              "help": {
                "markdown": "GCM IV and key are both same source $KEY_BYTES\n\n<b>References:</b>\n - [https://www.elttam.com/blog/key-recovery-attacks-on-gcm](https://www.elttam.com/blog/key-recovery-attacks-on-gcm)\n",
                "text": "GCM IV and key are both same source $KEY_BYTES"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.lang.security.audit.crypto.gcm-static-iv",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.lang.security.audit.crypto.gcm-static-iv",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "# Closer match, but specifically CBC mode, whereas this is GCM mode.\n#CWE-329: Not Using a Random IV with CBC Mode\nCWE-330: Use of Insufficiently Random Values\n",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.lang.security.audit.crypto.gcm-static-iv"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "RandomStringUtils uses java.util.Random by default which is not suitable for security"
              },
              "help": {
                "markdown": "RandomStringUtils uses java.util.Random by default which is not suitable for security\n\n<b>References:</b>\n - [https://www.elttam.com/blog/cracking-randomness-in-java/](https://www.elttam.com/blog/cracking-randomness-in-java/)\n",
                "text": "RandomStringUtils uses java.util.Random by default which is not suitable for security"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.lang.security.audit.crypto.randomstringutils-insecure-rng",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.lang.security.audit.crypto.randomstringutils-insecure-rng",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
                  "LOW CONFIDENCE",
                  "OWASP-A9: Using Components with Known Vulnerabilities",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.lang.security.audit.crypto.randomstringutils-insecure-rng"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Unsafe Spring Service Exporter XML"
              },
              "help": {
                "markdown": "Unsafe Spring Service Exporter XML",
                "text": "Unsafe Spring Service Exporter XML"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.spring.security.audit.remoting.UnsafeHttpInvokerServiceExporter-XML",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.spring.security.audit.remoting.UnsafeHttpInvokerServiceExporter-XML",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.spring.security.audit.remoting.UnsafeHttpInvokerServiceExporter-XML"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Unsafe Spring Service Exporter func $FUNC"
              },
              "help": {
                "markdown": "Unsafe Spring Service Exporter func $FUNC",
                "text": "Unsafe Spring Service Exporter func $FUNC"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.spring.security.audit.remoting.UnsafeHttpInvokerServiceExporter-func",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.spring.security.audit.remoting.UnsafeHttpInvokerServiceExporter-func",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.spring.security.audit.remoting.UnsafeHttpInvokerServiceExporter-func"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Unsafe Spring Service Exporter var $VAR"
              },
              "help": {
                "markdown": "Unsafe Spring Service Exporter var $VAR",
                "text": "Unsafe Spring Service Exporter var $VAR"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.spring.security.audit.remoting.UnsafeHttpInvokerServiceExporter-var",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.spring.security.audit.remoting.UnsafeHttpInvokerServiceExporter-var",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.java.spring.security.audit.remoting.UnsafeHttpInvokerServiceExporter-var"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected possible file read caused by the the error-based oracle of PHP filter chains. It can be used to leak the content of a local file when passed to vulnerable functions even when the server does not return the file content."
              },
              "help": {
                "markdown": "Detected possible file read caused by the the error-based oracle of PHP filter chains. It can be used to leak the content of a local file when passed to vulnerable functions even when the server does not return the file content.",
                "text": "Detected possible file read caused by the the error-based oracle of PHP filter chains. It can be used to leak the content of a local file when passed to vulnerable functions even when the server does not return the file content."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.php.php-filter-chain-read-from-oracle",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.php.php-filter-chain-read-from-oracle",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')\n",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.php.php-filter-chain-read-from-oracle"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "::save-state workflow command is deprecated, use GITHUB_STATE environment file instead."
              },
              "help": {
                "markdown": "::save-state workflow command is deprecated, use GITHUB_STATE environment file instead.\n\n<b>References:</b>\n - [https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/](https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/)\n",
                "text": "::save-state workflow command is deprecated, use GITHUB_STATE environment file instead."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.github-actions.security.save-state",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.github-actions.security.save-state",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.github-actions.security.save-state"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "::set-output workflow command is deprecated, use GITHUB_STATE environment file instead."
              },
              "help": {
                "markdown": "::set-output workflow command is deprecated, use GITHUB_STATE environment file instead.\n\n<b>References:</b>\n - [https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/](https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/)\n",
                "text": "::set-output workflow command is deprecated, use GITHUB_STATE environment file instead."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.github-actions.security.set-output",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.github-actions.security.set-output",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "LOW CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.github-actions.security.set-output"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "NetworkPolicy with Ingress Permit ANY"
              },
              "help": {
                "markdown": "NetworkPolicy with Ingress Permit ANY\n\n<b>References:</b>\n - [https://kubernetes.io/docs/concepts/services-networking/network-policies/](https://kubernetes.io/docs/concepts/services-networking/network-policies/)\n",
                "text": "NetworkPolicy with Ingress Permit ANY"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.audit.network-policy-ingress-any",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.audit.network-policy-ingress-any",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "HIGH CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.audit.network-policy-ingress-any"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Privileged Container $IMAGE"
              },
              "help": {
                "markdown": "Privileged Container $IMAGE\n\n<b>References:</b>\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n",
                "text": "Privileged Container $IMAGE"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.audit.privileged-container",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.audit.privileged-container",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "HIGH CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.audit.privileged-container"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Container $NAME allows for privilege escalation via setuid or setgid binaries. Add 'allowPrivilegeEscalation: false' in 'securityContext' to prevent this."
              },
              "help": {
                "markdown": "Container $NAME allows for privilege escalation via setuid or setgid binaries. Add 'allowPrivilegeEscalation: false' in 'securityContext' to prevent this.\n\n<b>References:</b>\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n",
                "text": "Container $NAME allows for privilege escalation via setuid or setgid binaries. Add 'allowPrivilegeEscalation: false' in 'securityContext' to prevent this."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.allow-privilege-escalation",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.allow-privilege-escalation",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "HIGH CONFIDENCE",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "OWASP-A06:2017 - Security Misconfiguration",
                  "OWASP-K01:2022 - Insecure Workload Configurations"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.allow-privilege-escalation"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Container allows for running applications as root. This can result in privilege escalation attacks. Add 'runAsNonRoot: true' in 'securityContext' to prevent this."
              },
              "help": {
                "markdown": "Container allows for running applications as root. This can result in privilege escalation attacks. Add 'runAsNonRoot: true' in 'securityContext' to prevent this.\n\n<b>References:</b>\n - [https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/](https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user)\n",
                "text": "Container allows for running applications as root. This can result in privilege escalation attacks. Add 'runAsNonRoot: true' in 'securityContext' to prevent this."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.no-security-context",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.no-security-context",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-250: Execution with Unnecessary Privileges",
                  "LOW CONFIDENCE",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "OWASP-A06:2017 - Security Misconfiguration",
                  "OWASP-K01:2022 - Insecure Workload Configurations",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.no-security-context"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Container allows for running applications as root. This can result in privilege escalation attacks. Add 'runAsNonRoot: true' in 'securityContext' to prevent this."
              },
              "help": {
                "markdown": "Container allows for running applications as root. This can result in privilege escalation attacks. Add 'runAsNonRoot: true' in 'securityContext' to prevent this.\n\n<b>References:</b>\n - [https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/](https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user)\n",
                "text": "Container allows for running applications as root. This can result in privilege escalation attacks. Add 'runAsNonRoot: true' in 'securityContext' to prevent this."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.run-as-non-root",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.run-as-non-root",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-250: Execution with Unnecessary Privileges",
                  "LOW CONFIDENCE",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "OWASP-A06:2017 - Security Misconfiguration",
                  "OWASP-K01:2022 - Insecure Workload Configurations",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.run-as-non-root"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Container allows for running applications as root. This can result in privilege escalation attacks. Change 'runAsNonRoot:' to 'true' in 'securityContext' to prevent this."
              },
              "help": {
                "markdown": "Container allows for running applications as root. This can result in privilege escalation attacks. Change 'runAsNonRoot:' to 'true' in 'securityContext' to prevent this.\n\n<b>References:</b>\n - [https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/](https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user)\n",
                "text": "Container allows for running applications as root. This can result in privilege escalation attacks. Change 'runAsNonRoot:' to 'true' in 'securityContext' to prevent this."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.run-as-non-root-unsafe-value",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.run-as-non-root-unsafe-value",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-250: Execution with Unnecessary Privileges",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "OWASP-A06:2017 - Security Misconfiguration",
                  "OWASP-K01:2022 - Insecure Workload Configurations",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.elttam-semgrep-rules.rules.yaml.kubernetes.security.run-as-non-root-unsafe-value"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Amazon MWS Auth Token detected"
              },
              "help": {
                "markdown": "Amazon MWS Auth Token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Amazon MWS Auth Token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token",
              "id": "generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token",
              "name": "generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Artifactory token detected"
              },
              "help": {
                "markdown": "Artifactory token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Artifactory token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password",
              "id": "generic.secrets.security.detected-artifactory-password.detected-artifactory-password",
              "name": "generic.secrets.security.detected-artifactory-password.detected-artifactory-password",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-artifactory-password.detected-artifactory-password"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Artifactory token detected"
              },
              "help": {
                "markdown": "Artifactory token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Artifactory token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token",
              "id": "generic.secrets.security.detected-artifactory-token.detected-artifactory-token",
              "name": "generic.secrets.security.detected-artifactory-token.detected-artifactory-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-artifactory-token.detected-artifactory-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."
              },
              "help": {
                "markdown": "AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value",
              "id": "generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value",
              "name": "generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "AWS AppSync GraphQL Key detected"
              },
              "help": {
                "markdown": "AWS AppSync GraphQL Key detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "AWS AppSync GraphQL Key detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key",
              "id": "generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key",
              "name": "generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "AWS Secret Access Key detected"
              },
              "help": {
                "markdown": "AWS Secret Access Key detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "AWS Secret Access Key detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key",
              "id": "generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key",
              "name": "generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "AWS Session Token detected"
              },
              "help": {
                "markdown": "AWS Session Token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "AWS Session Token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token",
              "id": "generic.secrets.security.detected-aws-session-token.detected-aws-session-token",
              "name": "generic.secrets.security.detected-aws-session-token.detected-aws-session-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-aws-session-token.detected-aws-session-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "bcrypt hash detected"
              },
              "help": {
                "markdown": "bcrypt hash detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "bcrypt hash detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash",
              "id": "generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash",
              "name": "generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "CodeClimate detected"
              },
              "help": {
                "markdown": "CodeClimate detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "CodeClimate detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate",
              "id": "generic.secrets.security.detected-codeclimate.detected-codeclimate",
              "name": "generic.secrets.security.detected-codeclimate.detected-codeclimate",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-codeclimate.detected-codeclimate"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "linux shadow file detected"
              },
              "help": {
                "markdown": "linux shadow file detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "linux shadow file detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow",
              "id": "generic.secrets.security.detected-etc-shadow.detected-etc-shadow",
              "name": "generic.secrets.security.detected-etc-shadow.detected-etc-shadow",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-etc-shadow.detected-etc-shadow"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Facebook Access Token detected"
              },
              "help": {
                "markdown": "Facebook Access Token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Facebook Access Token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token",
              "id": "generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token",
              "name": "generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Facebook OAuth detected"
              },
              "help": {
                "markdown": "Facebook OAuth detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Facebook OAuth detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth",
              "id": "generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth",
              "name": "generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Google (GCM) Service account detected"
              },
              "help": {
                "markdown": "Google (GCM) Service account detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-google-gcm-service-account.detected-google-gcm-service-account)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Google (GCM) Service account detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-google-gcm-service-account.detected-google-gcm-service-account",
              "id": "generic.secrets.security.detected-google-gcm-service-account.detected-google-gcm-service-account",
              "name": "generic.secrets.security.detected-google-gcm-service-account.detected-google-gcm-service-account",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-google-gcm-service-account.detected-google-gcm-service-account"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Google OAuth Access Token detected"
              },
              "help": {
                "markdown": "Google OAuth Access Token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Google OAuth Access Token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token",
              "id": "generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token",
              "name": "generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Heroku API Key detected"
              },
              "help": {
                "markdown": "Heroku API Key detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Heroku API Key detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key",
              "id": "generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key",
              "name": "generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "HockeyApp detected"
              },
              "help": {
                "markdown": "HockeyApp detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "HockeyApp detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp",
              "id": "generic.secrets.security.detected-hockeyapp.detected-hockeyapp",
              "name": "generic.secrets.security.detected-hockeyapp.detected-hockeyapp",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-hockeyapp.detected-hockeyapp"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "MailChimp API Key detected"
              },
              "help": {
                "markdown": "MailChimp API Key detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "MailChimp API Key detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key",
              "id": "generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key",
              "name": "generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Mailgun API Key detected"
              },
              "help": {
                "markdown": "Mailgun API Key detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Mailgun API Key detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key",
              "id": "generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key",
              "name": "generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "NPM registry authentication token detected"
              },
              "help": {
                "markdown": "NPM registry authentication token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "NPM registry authentication token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token",
              "id": "generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token",
              "name": "generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Onfido live API Token detected"
              },
              "help": {
                "markdown": "Onfido live API Token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token)\n - [https://documentation.onfido.com/api/latest/#api-tokens](https://documentation.onfido.com/api/latest/#api-tokens)\n",
                "text": "Onfido live API Token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token",
              "id": "generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token",
              "name": "generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Outlook Team detected"
              },
              "help": {
                "markdown": "Outlook Team detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Outlook Team detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team",
              "id": "generic.secrets.security.detected-outlook-team.detected-outlook-team",
              "name": "generic.secrets.security.detected-outlook-team.detected-outlook-team",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-outlook-team.detected-outlook-team"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "PayPal Braintree Access Token detected"
              },
              "help": {
                "markdown": "PayPal Braintree Access Token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "PayPal Braintree Access Token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token",
              "id": "generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token",
              "name": "generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."
              },
              "help": {
                "markdown": "Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block",
              "id": "generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block",
              "name": "generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Picatic API Key detected"
              },
              "help": {
                "markdown": "Picatic API Key detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Picatic API Key detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key",
              "id": "generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key",
              "name": "generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."
              },
              "help": {
                "markdown": "Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key",
              "id": "generic.secrets.security.detected-private-key.detected-private-key",
              "name": "generic.secrets.security.detected-private-key.detected-private-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-private-key.detected-private-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Sauce Token detected"
              },
              "help": {
                "markdown": "Sauce Token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Sauce Token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token",
              "id": "generic.secrets.security.detected-sauce-token.detected-sauce-token",
              "name": "generic.secrets.security.detected-sauce-token.detected-sauce-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-sauce-token.detected-sauce-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Slack Token detected"
              },
              "help": {
                "markdown": "Slack Token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token)\n - [https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58](https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58)\n",
                "text": "Slack Token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token",
              "id": "generic.secrets.security.detected-slack-token.detected-slack-token",
              "name": "generic.secrets.security.detected-slack-token.detected-slack-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-slack-token.detected-slack-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Slack Webhook detected"
              },
              "help": {
                "markdown": "Slack Webhook detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook)\n - [https://api.slack.com/messaging/webhooks](https://api.slack.com/messaging/webhooks)\n",
                "text": "Slack Webhook detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook",
              "id": "generic.secrets.security.detected-slack-webhook.detected-slack-webhook",
              "name": "generic.secrets.security.detected-slack-webhook.detected-slack-webhook",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-slack-webhook.detected-slack-webhook"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "SonarQube Docs API Key detected"
              },
              "help": {
                "markdown": "SonarQube Docs API Key detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "SonarQube Docs API Key detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key",
              "id": "generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key",
              "name": "generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Square Access Token detected"
              },
              "help": {
                "markdown": "Square Access Token detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Square Access Token detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token",
              "id": "generic.secrets.security.detected-square-access-token.detected-square-access-token",
              "name": "generic.secrets.security.detected-square-access-token.detected-square-access-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-square-access-token.detected-square-access-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Square OAuth Secret detected"
              },
              "help": {
                "markdown": "Square OAuth Secret detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret)\n - [https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py](https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py)\n",
                "text": "Square OAuth Secret detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret",
              "id": "generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret",
              "name": "generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "SSH Password detected"
              },
              "help": {
                "markdown": "SSH Password detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "SSH Password detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password",
              "id": "generic.secrets.security.detected-ssh-password.detected-ssh-password",
              "name": "generic.secrets.security.detected-ssh-password.detected-ssh-password",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-ssh-password.detected-ssh-password"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Stripe API Key detected"
              },
              "help": {
                "markdown": "Stripe API Key detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Stripe API Key detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key",
              "id": "generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key",
              "name": "generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Stripe Restricted API Key detected"
              },
              "help": {
                "markdown": "Stripe Restricted API Key detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Stripe Restricted API Key detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key",
              "id": "generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key",
              "name": "generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Telegram Bot API Key detected"
              },
              "help": {
                "markdown": "Telegram Bot API Key detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Telegram Bot API Key detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key",
              "id": "generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key",
              "name": "generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Twilio API Key detected"
              },
              "help": {
                "markdown": "Twilio API Key detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Twilio API Key detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key",
              "id": "generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key",
              "name": "generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Username and password in URI detected"
              },
              "help": {
                "markdown": "Username and password in URI detected\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri)\n - [https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go](https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go)\n",
                "text": "Username and password in URI detected\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri",
              "id": "generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri",
              "name": "generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."
              },
              "help": {
                "markdown": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n",
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key",
              "id": "go.jwt-go.security.jwt.hardcoded-jwt-key",
              "name": "go.jwt-go.security.jwt.hardcoded-jwt-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.jwt-go.security.jwt.hardcoded-jwt-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."
              },
              "help": {
                "markdown": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n",
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret",
              "id": "java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret",
              "name": "java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."
              },
              "help": {
                "markdown": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n",
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret",
              "id": "javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret",
              "name": "javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."
              },
              "help": {
                "markdown": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n",
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret",
              "id": "javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret",
              "name": "javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."
              },
              "help": {
                "markdown": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n",
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret",
              "id": "javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret",
              "name": "javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."
              },
              "help": {
                "markdown": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n",
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret",
              "id": "javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret",
              "name": "javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."
              },
              "help": {
                "markdown": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n",
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret",
              "id": "javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret",
              "name": "javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."
              },
              "help": {
                "markdown": "A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded",
              "id": "kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded",
              "name": "kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."
              },
              "help": {
                "markdown": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://bento.dev/checks/boto3/hardcoded-access-token/](https://bento.dev/checks/boto3/hardcoded-access-token/)\n - [https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/](https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/)\n",
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token",
              "id": "python.boto3.security.hardcoded-token.hardcoded-token",
              "name": "python.boto3.security.hardcoded-token.hardcoded-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.boto3.security.hardcoded-token.hardcoded-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files."
              },
              "help": {
                "markdown": "Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n",
                "text": "Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller",
              "id": "ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller",
              "name": "ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file."
              },
              "help": {
                "markdown": "Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n",
                "text": "Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase",
              "id": "ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase",
              "name": "ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."
              },
              "help": {
                "markdown": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n",
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials",
              "id": "terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials",
              "name": "terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."
              },
              "help": {
                "markdown": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n",
                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials",
              "id": "terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials",
              "name": "terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource."
              },
              "help": {
                "markdown": "RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password)\n - [https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password)\n",
                "text": "RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code",
              "id": "terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code",
              "name": "terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-522: Insufficiently Protected Credentials",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2017 - Broken Authentication",
                  "OWASP-A04:2021 - Insecure Design",
                  "OWASP-A06:2025 - Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Secrets ($VALUE) should not be stored in infrastructure as code files. Use an alternative such as Bitnami Sealed Secrets or KSOPS to encrypt Kubernetes Secrets. "
              },
              "help": {
                "markdown": "Secrets ($VALUE) should not be stored in infrastructure as code files. Use an alternative such as Bitnami Sealed Secrets or KSOPS to encrypt Kubernetes Secrets. \n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file)\n - [https://kubernetes.io/docs/concepts/configuration/secret/](https://kubernetes.io/docs/concepts/configuration/secret/)\n - [https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF](https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF)\n - [https://docs.gitlab.com/ee/user/clusters/agent/gitops/secrets_management.html](https://docs.gitlab.com/ee/user/clusters/agent/gitops/secrets_management.html)\n - [https://www.cncf.io/blog/2021/04/22/revealing-the-secrets-of-kubernetes-secrets/](https://www.cncf.io/blog/2021/04/22/revealing-the-secrets-of-kubernetes-secrets/)\n - [https://github.com/bitnami-labs/sealed-secrets](https://github.com/bitnami-labs/sealed-secrets)\n - [https://www.cncf.io/blog/2022/01/25/secrets-management-essential-when-using-kubernetes/](https://www.cncf.io/blog/2022/01/25/secrets-management-essential-when-using-kubernetes/)\n - [https://blog.oddbit.com/post/2021-03-09-getting-started-with-ksops/](https://blog.oddbit.com/post/2021-03-09-getting-started-with-ksops/)\n",
                "text": "Secrets ($VALUE) should not be stored in infrastructure as code files. Use an alternative such as Bitnami Sealed Secrets or KSOPS to encrypt Kubernetes Secrets. \n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file",
              "id": "yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file",
              "name": "yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Variable '$VAR' was freed twice. This can lead to undefined behavior."
              },
              "help": {
                "markdown": "Variable '$VAR' was freed twice. This can lead to undefined behavior.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.double-free.double-free)\n - [https://cwe.mitre.org/data/definitions/415.html](https://cwe.mitre.org/data/definitions/415.html)\n - [https://owasp.org/www-community/vulnerabilities/Doubly_freeing_memory](https://owasp.org/www-community/vulnerabilities/Doubly_freeing_memory)\n",
                "text": "Variable '$VAR' was freed twice. This can lead to undefined behavior.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/c.lang.security.double-free.double-free",
              "id": "c.lang.security.double-free.double-free",
              "name": "c.lang.security.double-free.double-free",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-415: Double Free",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: c.lang.security.double-free.double-free"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."
              },
              "help": {
                "markdown": "Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn)\n - [https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s](https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s)\n",
                "text": "Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn",
              "id": "c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn",
              "name": "c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Avoid using user-controlled format strings passed into 'sprintf', 'printf' and 'vsprintf'. These functions put you at risk of buffer overflow vulnerabilities through the use of format string exploits. Instead, use 'snprintf' and 'vsnprintf'."
              },
              "help": {
                "markdown": "Avoid using user-controlled format strings passed into 'sprintf', 'printf' and 'vsprintf'. These functions put you at risk of buffer overflow vulnerabilities through the use of format string exploits. Instead, use 'snprintf' and 'vsnprintf'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn)\n - [https://doc.castsoftware.com/display/SBX/Never+use+sprintf%28%29+or+vsprintf%28%29+functions](https://doc.castsoftware.com/display/SBX/Never+use+sprintf%28%29+or+vsprintf%28%29+functions)\n - [https://www.cvedetails.com/cwe-details/134/Uncontrolled-Format-String.html](https://www.cvedetails.com/cwe-details/134/Uncontrolled-Format-String.html)\n",
                "text": "Avoid using user-controlled format strings passed into 'sprintf', 'printf' and 'vsprintf'. These functions put you at risk of buffer overflow vulnerabilities through the use of format string exploits. Instead, use 'snprintf' and 'vsnprintf'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn",
              "id": "c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn",
              "name": "c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-134: Use of Externally-Controlled Format String",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."
              },
              "help": {
                "markdown": "Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn)\n - [http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html](http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html)\n",
                "text": "Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn",
              "id": "c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn",
              "name": "c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead to buffer overflow vulns. Fix this by using strcat_s instead."
              },
              "help": {
                "markdown": "Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead to buffer overflow vulns. Fix this by using strcat_s instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn)\n - [https://nvd.nist.gov/vuln/detail/CVE-2019-12553](https://nvd.nist.gov/vuln/detail/CVE-2019-12553)\n - [https://techblog.mediaservice.net/2020/04/cve-2020-2851-stack-based-buffer-overflow-in-cde-libdtsvc/](https://techblog.mediaservice.net/2020/04/cve-2020-2851-stack-based-buffer-overflow-in-cde-libdtsvc/)\n",
                "text": "Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead to buffer overflow vulns. Fix this by using strcat_s instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn",
              "id": "c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn",
              "name": "c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available)."
              },
              "help": {
                "markdown": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn)\n - [https://cwe.mitre.org/data/definitions/676](https://cwe.mitre.org/data/definitions/676)\n - [https://nvd.nist.gov/vuln/detail/CVE-2019-11365](https://nvd.nist.gov/vuln/detail/CVE-2019-11365)\n",
                "text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn",
              "id": "c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn",
              "name": "c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."
              },
              "help": {
                "markdown": "Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged](https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged)\n - [https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS](https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS)\n - [https://stackoverflow.com/a/40335556](https://stackoverflow.com/a/40335556)\n",
                "text": "Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn",
              "id": "c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn",
              "name": "c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."
              },
              "help": {
                "markdown": "Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion)\n - [https://lwn.net/Articles/606141/](https://lwn.net/Articles/606141/)\n",
                "text": "Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion",
              "id": "c.lang.security.random-fd-exhaustion.random-fd-exhaustion",
              "name": "c.lang.security.random-fd-exhaustion.random-fd-exhaustion",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: c.lang.security.random-fd-exhaustion.random-fd-exhaustion"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Variable '$VAR' was used after being freed. This can lead to undefined behavior."
              },
              "help": {
                "markdown": "Variable '$VAR' was used after being freed. This can lead to undefined behavior.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.use-after-free.use-after-free)\n - [https://cwe.mitre.org/data/definitions/416.html](https://cwe.mitre.org/data/definitions/416.html)\n - [https://ctf-wiki.github.io/ctf-wiki/pwn/linux/glibc-heap/use_after_free/](https://ctf-wiki.github.io/ctf-wiki/pwn/linux/glibc-heap/use_after_free/)\n",
                "text": "Variable '$VAR' was used after being freed. This can lead to undefined behavior.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/c.lang.security.use-after-free.use-after-free",
              "id": "c.lang.security.use-after-free.use-after-free",
              "name": "c.lang.security.use-after-free.use-after-free",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-416: Use After Free",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: c.lang.security.use-after-free.use-after-free"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."
              },
              "help": {
                "markdown": "The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root)\n - [https://github.com/hadolint/hadolint/wiki/DL3002](https://github.com/hadolint/hadolint/wiki/DL3002)\n",
                "text": "The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root",
              "id": "dockerfile.security.last-user-is-root.last-user-is-root",
              "name": "dockerfile.security.last-user-is-root.last-user-is-root",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-269: Improper Privilege Management",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A04:2021 - Insecure Design",
                  "OWASP-A06:2025 - Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: dockerfile.security.last-user-is-root.last-user-is-root"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"{{ expr }}\"."
              },
              "help": {
                "markdown": "Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"{{ expr }}\".\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss)\n",
                "text": "Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"{{ expr }}\".\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var",
              "id": "generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var",
              "name": "generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href=\"/{{link}}\"`). You may also consider setting the Content Security Policy (CSP) header."
              },
              "help": {
                "markdown": "Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href=\"/{{link}}\"`). You may also consider setting the Content Security Policy (CSP) header.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.html-templates.security.var-in-href.var-in-href)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n - [https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#url](https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#url)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n - [https://content-security-policy.com/](https://content-security-policy.com/)\n",
                "text": "Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href=\"/{{link}}\"`). You may also consider setting the Content Security Policy (CSP) header.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.html-templates.security.var-in-href.var-in-href",
              "id": "generic.html-templates.security.var-in-href.var-in-href",
              "name": "generic.html-templates.security.var-in-href.var-in-href",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.html-templates.security.var-in-href.var-in-href"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`)."
              },
              "help": {
                "markdown": "Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.html-templates.security.var-in-script-tag.var-in-script-tag)\n - [https://adamj.eu/tech/2020/02/18/safely-including-data-for-javascript-in-a-django-template/?utm_campaign=Django%2BNewsletter&utm_medium=rss&utm_source=Django_Newsletter_12A](https://adamj.eu/tech/2020/02/18/safely-including-data-for-javascript-in-a-django-template/?utm_campaign=Django%2BNewsletter&utm_medium=rss&utm_source=Django_Newsletter_12A)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n",
                "text": "Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.html-templates.security.var-in-script-tag.var-in-script-tag",
              "id": "generic.html-templates.security.var-in-script-tag.var-in-script-tag",
              "name": "generic.html-templates.security.var-in-script-tag.var-in-script-tag",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.html-templates.security.var-in-script-tag.var-in-script-tag"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."
              },
              "help": {
                "markdown": "The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/](https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/)\n - [https://www.youtube.com/watch?v=CIhHpkybYsY](https://www.youtube.com/watch?v=CIhHpkybYsY)\n - [https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf](https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf)\n",
                "text": "The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal",
              "id": "generic.nginx.security.alias-path-traversal.alias-path-traversal",
              "name": "generic.nginx.security.alias-path-traversal.alias-path-traversal",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A05:2017 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.nginx.security.alias-path-traversal.alias-path-traversal"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."
              },
              "help": {
                "markdown": "The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host)\n - [https://nginx.org/en/docs/http/ngx_http_map_module.html](https://nginx.org/en/docs/http/ngx_http_map_module.html)\n",
                "text": "The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host",
              "id": "generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host",
              "name": "generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."
              },
              "help": {
                "markdown": "The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n",
                "text": "The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme",
              "id": "generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme",
              "name": "generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-16: CWE CATEGORY: Configuration",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "OWASP-A06:2017 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."
              },
              "help": {
                "markdown": "The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md)\n - [https://owasp.org/www-community/attacks/HTTP_Response_Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)\n",
                "text": "The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection",
              "id": "generic.nginx.security.header-injection.header-injection",
              "name": "generic.nginx.security.header-injection.header-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.nginx.security.header-injection.header-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."
              },
              "help": {
                "markdown": "The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md)\n",
                "text": "The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition",
              "id": "generic.nginx.security.header-redefinition.header-redefinition",
              "name": "generic.nginx.security.header-redefinition.header-redefinition",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-16: CWE CATEGORY: Configuration",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "OWASP-A06:2017 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.nginx.security.header-redefinition.header-redefinition"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."
              },
              "help": {
                "markdown": "Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect",
              "id": "generic.nginx.security.insecure-redirect.insecure-redirect",
              "name": "generic.nginx.security.insecure-redirect.insecure-redirect",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.nginx.security.insecure-redirect.insecure-redirect"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."
              },
              "help": {
                "markdown": "Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/](https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/)\n",
                "text": "Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version",
              "id": "generic.nginx.security.insecure-ssl-version.insecure-ssl-version",
              "name": "generic.nginx.security.insecure-ssl-version.insecure-ssl-version",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.nginx.security.insecure-ssl-version.insecure-ssl-version"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."
              },
              "help": {
                "markdown": "This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n - [https://nginx.org/en/docs/http/ngx_http_core_module.html#internal](https://nginx.org/en/docs/http/ngx_http_core_module.html#internal)\n",
                "text": "This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal",
              "id": "generic.nginx.security.missing-internal.missing-internal",
              "name": "generic.nginx.security.missing-internal.missing-internal",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-16: CWE CATEGORY: Configuration",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "OWASP-A06:2017 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.nginx.security.missing-internal.missing-internal"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."
              },
              "help": {
                "markdown": "This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://nginx.org/en/docs/http/configuring_https_servers.html](https://nginx.org/en/docs/http/configuring_https_servers.html)\n",
                "text": "This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version",
              "id": "generic.nginx.security.missing-ssl-version.missing-ssl-version",
              "name": "generic.nginx.security.missing-ssl-version.missing-ssl-version",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: generic.nginx.security.missing-ssl-version.missing-ssl-version"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."
              },
              "help": {
                "markdown": "Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n",
                "text": "Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection",
              "id": "go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection",
              "name": "go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-300: Channel Accessible by Non-Endpoint",
                  "HIGH CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'."
              },
              "help": {
                "markdown": "Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n",
                "text": "Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection",
              "id": "go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection",
              "name": "go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-300: Channel Accessible by Non-Endpoint",
                  "HIGH CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead."
              },
              "help": {
                "markdown": "The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used)\n - [https://godoc.org/golang.org/x/crypto/sha3](https://godoc.org/golang.org/x/crypto/sha3)\n",
                "text": "The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used",
              "id": "go.lang.security.audit.crypto.bad_imports.insecure-module-used",
              "name": "go.lang.security.audit.crypto.bad_imports.insecure-module-used",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.crypto.bad_imports.insecure-module-used"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it."
              },
              "help": {
                "markdown": "Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key)\n - [https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/](https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/)\n - [https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d](https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d)\n",
                "text": "Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key",
              "id": "go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key",
              "name": "go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-322: Key Exchange without Entity Authentication",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Do not use `math/rand`. Use `crypto/rand` instead."
              },
              "help": {
                "markdown": "Do not use `math/rand`. Use `crypto/rand` instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation)\n",
                "text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used",
              "id": "go.lang.security.audit.crypto.math_random.math-random-used",
              "name": "go.lang.security.audit.crypto.math_random.math-random-used",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.crypto.math_random.math-random-used"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'."
              },
              "help": {
                "markdown": "SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure)\n - [https://golang.org/doc/go1.14#crypto/tls](https://golang.org/doc/go1.14#crypto/tls)\n - [https://www.us-cert.gov/ncas/alerts/TA14-290A](https://www.us-cert.gov/ncas/alerts/TA14-290A)\n",
                "text": "SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure",
              "id": "go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure",
              "name": "go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use."
              },
              "help": {
                "markdown": "Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher)\n - [https://golang.org/pkg/crypto/tls/#InsecureCipherSuites](https://golang.org/pkg/crypto/tls/#InsecureCipherSuites)\n",
                "text": "Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher",
              "id": "go.lang.security.audit.crypto.tls.tls-with-insecure-cipher",
              "name": "go.lang.security.audit.crypto.tls.tls-with-insecure-cipher",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead."
              },
              "help": {
                "markdown": "Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES",
              "id": "go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES",
              "name": "go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."
              },
              "help": {
                "markdown": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5",
              "id": "go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5",
              "name": "go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-328: Use of Weak Hash",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead."
              },
              "help": {
                "markdown": "Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4",
              "id": "go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4",
              "name": "go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."
              },
              "help": {
                "markdown": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1",
              "id": "go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1",
              "name": "go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-328: Use of Weak Hash",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data."
              },
              "help": {
                "markdown": "String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query",
              "id": "go.lang.security.audit.database.string-formatted-query.string-formatted-query",
              "name": "go.lang.security.audit.database.string-formatted-query.string-formatted-query",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.database.string-formatted-query.string-formatted-query"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string."
              },
              "help": {
                "markdown": "Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces",
              "id": "go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces",
              "name": "go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "HIGH CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined."
              },
              "help": {
                "markdown": "Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace)\n - [https://github.com/returntocorp/semgrep-rules/issues/518](https://github.com/returntocorp/semgrep-rules/issues/518)\n",
                "text": "Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace",
              "id": "go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace",
              "name": "go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-913: Improper Control of Dynamically-Managed Code Resources",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability."
              },
              "help": {
                "markdown": "Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n",
                "text": "Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string",
              "id": "go.lang.security.audit.net.formatted-template-string.formatted-template-string",
              "name": "go.lang.security.audit.net.formatted-template-string.formatted-template-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.net.formatted-template-string.formatted-template-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation."
              },
              "help": {
                "markdown": "The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure)\n - [https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/](https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/)\n",
                "text": "The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure",
              "id": "go.lang.security.audit.net.pprof.pprof-debug-exposure",
              "name": "go.lang.security.audit.net.pprof.pprof-debug-exposure",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-489: Active Debug Code",
                  "LOW CONFIDENCE",
                  "OWASP-A06:2017 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.net.pprof.pprof-debug-exposure"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template."
              },
              "help": {
                "markdown": "Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr)\n - [https://golang.org/pkg/html/template/#HTMLAttr](https://golang.org/pkg/html/template/#HTMLAttr)\n",
                "text": "Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr",
              "id": "go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr",
              "name": "go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template."
              },
              "help": {
                "markdown": "Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js)\n - [https://golang.org/pkg/html/template/#JS](https://golang.org/pkg/html/template/#JS)\n",
                "text": "Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js",
              "id": "go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js",
              "name": "go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function."
              },
              "help": {
                "markdown": "Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url)\n - [https://golang.org/pkg/html/template/#URL](https://golang.org/pkg/html/template/#URL)\n",
                "text": "Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url",
              "id": "go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url",
              "name": "go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information."
              },
              "help": {
                "markdown": "Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls)\n - [https://golang.org/pkg/net/http/#ListenAndServeTLS](https://golang.org/pkg/net/http/#ListenAndServeTLS)\n",
                "text": "Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls",
              "id": "go.lang.security.audit.net.use-tls.use-tls",
              "name": "go.lang.security.audit.net.use-tls.use-tls",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.net.use-tls.use-tls"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped."
              },
              "help": {
                "markdown": "Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf",
              "id": "go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf",
              "name": "go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability."
              },
              "help": {
                "markdown": "'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc",
              "id": "go.lang.security.audit.reflect-makefunc.reflect-makefunc",
              "name": "go.lang.security.audit.reflect-makefunc.reflect-makefunc",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-913: Improper Control of Dynamically-Managed Code Resources",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.reflect-makefunc.reflect-makefunc"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing."
              },
              "help": {
                "markdown": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.unsafe.use-of-unsafe-block)\n - [https://cwe.mitre.org/data/definitions/242.html](https://cwe.mitre.org/data/definitions/242.html)\n",
                "text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.audit.unsafe.use-of-unsafe-block",
              "id": "go.lang.security.audit.unsafe.use-of-unsafe-block",
              "name": "go.lang.security.audit.unsafe.use-of-unsafe-block",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-242: Use of Inherently Dangerous Function",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.audit.unsafe.use-of-unsafe-block"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "File creation in shared tmp directory without using `io.CreateTemp`."
              },
              "help": {
                "markdown": "File creation in shared tmp directory without using `io.CreateTemp`.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://pkg.go.dev/io/ioutil#TempFile](https://pkg.go.dev/io/ioutil#TempFile)\n - [https://pkg.go.dev/os#CreateTemp](https://pkg.go.dev/os#CreateTemp)\n - [https://github.com/securego/gosec/blob/5fd2a370447223541cddb35da8d1bc707b7bb153/rules/tempfiles.go#L67](https://github.com/securego/gosec/blob/5fd2a370447223541cddb35da8d1bc707b7bb153/rules/tempfiles.go#L67)\n",
                "text": "File creation in shared tmp directory without using `io.CreateTemp`.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation",
              "id": "go.lang.security.bad_tmp.bad-tmp-file-creation",
              "name": "go.lang.security.bad_tmp.bad-tmp-file-creation",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-377: Insecure Temporary File",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.bad_tmp.bad-tmp-file-creation"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. "
              },
              "help": {
                "markdown": "Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. \n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb)\n - [https://golang.org/pkg/io/#CopyN](https://golang.org/pkg/io/#CopyN)\n - [https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go](https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go)\n",
                "text": "Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. \n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb",
              "id": "go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb",
              "name": "go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-400: Uncontrolled Resource Consumption",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "File traversal when extracting zip archive"
              },
              "help": {
                "markdown": "File traversal when extracting zip archive\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "File traversal when extracting zip archive\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction",
              "id": "go.lang.security.zip.path-traversal-inside-zip-extraction",
              "name": "go.lang.security.zip.path-traversal-inside-zip-extraction",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A05:2017 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.lang.security.zip.path-traversal-inside-zip-extraction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."
              },
              "help": {
                "markdown": "Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution",
              "id": "go.otto.security.audit.dangerous-execution.dangerous-execution",
              "name": "go.otto.security.audit.dangerous-execution.dangerous-execution",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-94: Improper Control of Generation of Code ('Code Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: go.otto.security.audit.dangerous-execution.dangerous-execution"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."
              },
              "help": {
                "markdown": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n",
                "text": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal",
              "id": "java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal",
              "name": "java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A05:2017 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."
              },
              "help": {
                "markdown": "Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind",
              "id": "java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind",
              "name": "java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-287: Improper Authentication",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2017 - Broken Authentication",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."
              },
              "help": {
                "markdown": "'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion)\n - [https://cwe.mitre.org/data/definitions/704.html](https://cwe.mitre.org/data/definitions/704.html)\n",
                "text": "'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion",
              "id": "java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion",
              "name": "java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-704: Incorrect Type Conversion or Cast",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."
              },
              "help": {
                "markdown": "Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle)\n - [https://capec.mitre.org/data/definitions/463.html](https://capec.mitre.org/data/definitions/463.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n - [https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY](https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY)\n",
                "text": "Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle",
              "id": "java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle",
              "name": "java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."
              },
              "help": {
                "markdown": "A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call",
              "id": "java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call",
              "name": "java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"
              },
              "help": {
                "markdown": "A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
                "text": "A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly",
              "id": "java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly",
              "name": "java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"
              },
              "help": {
                "markdown": "A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
                "text": "A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag",
              "id": "java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag",
              "name": "java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."
              },
              "help": {
                "markdown": "When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs",
              "id": "java.lang.security.audit.crlf-injection-logs.crlf-injection-logs",
              "name": "java.lang.security.audit.crlf-injection-logs.crlf-injection-logs",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."
              },
              "help": {
                "markdown": "DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated)\n - [https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard](https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n",
                "text": "DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated",
              "id": "java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated",
              "name": "java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."
              },
              "help": {
                "markdown": "Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated)\n - [https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA](https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA)\n",
                "text": "Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated",
              "id": "java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated",
              "name": "java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."
              },
              "help": {
                "markdown": "NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher",
              "id": "java.lang.security.audit.crypto.no-null-cipher.no-null-cipher",
              "name": "java.lang.security.audit.crypto.no-null-cipher.no-null-cipher",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."
              },
              "help": {
                "markdown": "Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector)\n - [https://cwe.mitre.org/data/definitions/329.html](https://cwe.mitre.org/data/definitions/329.html)\n",
                "text": "Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector",
              "id": "java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector",
              "name": "java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-329: Generation of Predictable IV with CBC Mode",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Using RSA without OAEP mode weakens the encryption."
              },
              "help": {
                "markdown": "Using RSA without OAEP mode weakens the encryption.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding)\n - [https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/](https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/)\n",
                "text": "Using RSA without OAEP mode weakens the encryption.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding",
              "id": "java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding",
              "name": "java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");"
              },
              "help": {
                "markdown": "Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms)\n",
                "text": "Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests",
              "id": "java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests",
              "name": "java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead."
              },
              "help": {
                "markdown": "DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated",
              "id": "java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated",
              "name": "java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks."
              },
              "help": {
                "markdown": "Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier",
              "id": "java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier",
              "name": "java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information."
              },
              "help": {
                "markdown": "Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager)\n - [https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https](https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https)\n",
                "text": "Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager",
              "id": "java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager",
              "name": "java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."
              },
              "help": {
                "markdown": "Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket",
              "id": "java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket",
              "name": "java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."
              },
              "help": {
                "markdown": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5",
              "id": "java.lang.security.audit.crypto.use-of-md5.use-of-md5",
              "name": "java.lang.security.audit.crypto.use-of-md5.use-of-md5",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-328: Use of Weak Hash",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.use-of-md5.use-of-md5"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."
              },
              "help": {
                "markdown": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1",
              "id": "java.lang.security.audit.crypto.use-of-sha1.use-of-sha1",
              "name": "java.lang.security.audit.crypto.use-of-sha1.use-of-sha1",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-328: Use of Weak Hash",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead."
              },
              "help": {
                "markdown": "Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random",
              "id": "java.lang.security.audit.crypto.weak-random.weak-random",
              "name": "java.lang.security.audit.crypto.weak-random.weak-random",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-330: Use of Insufficiently Random Values",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.crypto.weak-random.weak-random"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."
              },
              "help": {
                "markdown": "An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection",
              "id": "java.lang.security.audit.el-injection.el-injection",
              "name": "java.lang.security.audit.el-injection.el-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-94: Improper Control of Generation of Code ('Code Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.el-injection.el-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."
              },
              "help": {
                "markdown": "Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n",
                "text": "Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string",
              "id": "java.lang.security.audit.formatted-sql-string.formatted-sql-string",
              "name": "java.lang.security.audit.formatted-sql-string.formatted-sql-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.formatted-sql-string.formatted-sql-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."
              },
              "help": {
                "markdown": "Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting)\n - [https://www.owasp.org/index.php/HTTP_Response_Splitting](https://www.owasp.org/index.php/HTTP_Response_Splitting)\n",
                "text": "Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting",
              "id": "java.lang.security.audit.http-response-splitting.http-response-splitting",
              "name": "java.lang.security.audit.http-response-splitting.http-response-splitting",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.http-response-splitting.http-response-splitting"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."
              },
              "help": {
                "markdown": "Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection",
              "id": "java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection",
              "name": "java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-297: Improper Validation of Certificate with Host Mismatch",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'"
              },
              "help": {
                "markdown": "Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string",
              "id": "java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string",
              "name": "java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution."
              },
              "help": {
                "markdown": "An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)\n",
                "text": "An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning",
              "id": "java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning",
              "name": "java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data."
              },
              "help": {
                "markdown": "Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection",
              "id": "java.lang.security.audit.ldap-injection.ldap-injection",
              "name": "java.lang.security.audit.ldap-injection.ldap-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.ldap-injection.ldap-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."
              },
              "help": {
                "markdown": "Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization)\n - [https://www.owasp.org/index.php/Deserialization_of_untrusted_data](https://www.owasp.org/index.php/Deserialization_of_untrusted_data)\n - [https://www.oracle.com/java/technologies/javase/seccodeguide.html#8](https://www.oracle.com/java/technologies/javase/seccodeguide.html#8)\n",
                "text": "Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization",
              "id": "java.lang.security.audit.object-deserialization.object-deserialization",
              "name": "java.lang.security.audit.object-deserialization.object-deserialization",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.object-deserialization.object-deserialization"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need."
              },
              "help": {
                "markdown": "Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission",
              "id": "java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission",
              "name": "java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-276: Incorrect Default Permissions",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks."
              },
              "help": {
                "markdown": "https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n",
                "text": "https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors",
              "id": "java.lang.security.audit.permissive-cors.permissive-cors",
              "name": "java.lang.security.audit.permissive-cors.permissive-cors",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-183: Permissive List of Allowed Inputs",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 - Insecure Design",
                  "OWASP-A06:2025 - Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.permissive-cors.permissive-cors"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability."
              },
              "help": {
                "markdown": "Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection",
              "id": "java.lang.security.audit.script-engine-injection.script-engine-injection",
              "name": "java.lang.security.audit.script-engine-injection.script-engine-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-94: Improper Control of Generation of Code ('Code Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.script-engine-injection.script-engine-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."
              },
              "help": {
                "markdown": "Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n",
                "text": "Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request",
              "id": "java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request",
              "name": "java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "HIGH CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."
              },
              "help": {
                "markdown": "Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request",
              "id": "java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request",
              "name": "java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."
              },
              "help": {
                "markdown": "Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection](https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection)\n",
                "text": "Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request",
              "id": "java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request",
              "name": "java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."
              },
              "help": {
                "markdown": "Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n",
                "text": "Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request",
              "id": "java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request",
              "name": "java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-501: Trust Boundary Violation",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A04:2021 - Insecure Design",
                  "OWASP-A06:2025 - Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."
              },
              "help": {
                "markdown": "Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request",
              "id": "java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request",
              "name": "java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."
              },
              "help": {
                "markdown": "Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect",
              "id": "java.lang.security.audit.unvalidated-redirect.unvalidated-redirect",
              "name": "java.lang.security.audit.unvalidated-redirect.unvalidated-redirect",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."
              },
              "help": {
                "markdown": "URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting",
              "id": "java.lang.security.audit.url-rewriting.url-rewriting",
              "name": "java.lang.security.audit.url-rewriting.url-rewriting",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.url-rewriting.url-rewriting"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."
              },
              "help": {
                "markdown": "An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n",
                "text": "An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context",
              "id": "java.lang.security.audit.weak-ssl-context.weak-ssl-context",
              "name": "java.lang.security.audit.weak-ssl-context.weak-ssl-context",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.weak-ssl-context.weak-ssl-context"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention."
              },
              "help": {
                "markdown": "XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n",
                "text": "XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder",
              "id": "java.lang.security.audit.xml-decoder.xml-decoder",
              "name": "java.lang.security.audit.xml-decoder.xml-decoder",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-611: Improper Restriction of XML External Entity Reference",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A04:2017 - XML External Entities (XXE)",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.xml-decoder.xml-decoder"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."
              },
              "help": {
                "markdown": "Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n",
                "text": "Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer",
              "id": "java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer",
              "name": "java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself."
              },
              "help": {
                "markdown": "It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure",
              "id": "java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure",
              "name": "java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."
              },
              "help": {
                "markdown": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n",
                "text": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal",
              "id": "java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal",
              "name": "java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A05:2017 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."
              },
              "help": {
                "markdown": "Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss",
              "id": "java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss",
              "name": "java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."
              },
              "help": {
                "markdown": "XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n",
                "text": "XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled",
              "id": "java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled",
              "name": "java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-611: Improper Restriction of XML External Entity Reference",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A04:2017 - XML External Entities (XXE)",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."
              },
              "help": {
                "markdown": "XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser)\n",
                "text": "XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe",
              "id": "java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe",
              "name": "java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-611: Improper Restriction of XML External Entity Reference",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A04:2017 - XML External Entities (XXE)",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."
              },
              "help": {
                "markdown": "Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization)\n - [https://frohoff.github.io/appseccali-marshalling-pickles/](https://frohoff.github.io/appseccali-marshalling-pickles/)\n - [https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi](https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi)\n - [https://youtu.be/t_aw1mDNhzI](https://youtu.be/t_aw1mDNhzI)\n - [https://github.com/qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser)\n - [https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331](https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331)\n",
                "text": "Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization",
              "id": "java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization",
              "name": "java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."
              },
              "help": {
                "markdown": "A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection",
              "id": "java.spring.security.audit.spel-injection.spel-injection",
              "name": "java.spring.security.audit.spel-injection.spel-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-94: Improper Control of Generation of Code ('Code Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.spring.security.audit.spel-injection.spel-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "CSRF protection is disabled for this configuration. This is a security risk."
              },
              "help": {
                "markdown": "CSRF protection is disabled for this configuration. This is a security risk.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "CSRF protection is disabled for this configuration. This is a security risk.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled",
              "id": "java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled",
              "name": "java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."
              },
              "help": {
                "markdown": "Application redirects a user to a destination URL specified by a user supplied parameter that is not validated.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Application redirects a user to a destination URL specified by a user supplied parameter that is not validated.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect",
              "id": "java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect",
              "name": "java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST')."
              },
              "help": {
                "markdown": "Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST').\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping)\n - [https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING](https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING)\n",
                "text": "Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST').\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping",
              "id": "java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping",
              "name": "java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "It looks like '$UNK' is read from user input and it is used to as a redirect. Ensure '$UNK' is not externally controlled, otherwise this is an open redirect."
              },
              "help": {
                "markdown": "It looks like '$UNK' is read from user input and it is used to as a redirect. Ensure '$UNK' is not externally controlled, otherwise this is an open redirect.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "It looks like '$UNK' is read from user input and it is used to as a redirect. Ensure '$UNK' is not externally controlled, otherwise this is an open redirect.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect",
              "id": "javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect",
              "name": "javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."
              },
              "help": {
                "markdown": "Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security](https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security)\n",
                "text": "Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection",
              "id": "javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection",
              "name": "javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."
              },
              "help": {
                "markdown": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg",
              "id": "javascript.jose.security.jwt-none-alg.jwt-none-alg",
              "name": "javascript.jose.security.jwt-none-alg.jwt-none-alg",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.jose.security.jwt-none-alg.jwt-none-alg"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."
              },
              "help": {
                "markdown": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg",
              "id": "javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg",
              "name": "javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data."
              },
              "help": {
                "markdown": "Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag)\n - [https://www.developsec.com/2017/11/09/xss-in-a-script-tag/](https://www.developsec.com/2017/11/09/xss-in-a-script-tag/)\n - [https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68](https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68)\n",
                "text": "Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag",
              "id": "javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag",
              "name": "javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer."
              },
              "help": {
                "markdown": "Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert)\n - [https://cwe.mitre.org/data/definitions/119.html](https://cwe.mitre.org/data/definitions/119.html)\n",
                "text": "Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert",
              "id": "javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert",
              "name": "javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. "
              },
              "help": {
                "markdown": "Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. \n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n",
                "text": "Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. \n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process",
              "id": "javascript.lang.security.detect-child-process.detect-child-process",
              "name": "javascript.lang.security.detect-child-process.detect-child-process",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.lang.security.detect-child-process.detect-child-process"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks."
              },
              "help": {
                "markdown": "Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape",
              "id": "javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape",
              "name": "javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-116: Improper Encoding or Escaping of Output",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input."
              },
              "help": {
                "markdown": "Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!)\n",
                "text": "Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression",
              "id": "javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression",
              "name": "javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later."
              },
              "help": {
                "markdown": "Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md](https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md)\n",
                "text": "Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override",
              "id": "javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override",
              "name": "javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A05:2017 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers."
              },
              "help": {
                "markdown": "Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes",
              "id": "javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes",
              "name": "javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input."
              },
              "help": {
                "markdown": "Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone",
              "id": "javascript.lang.security.spawn-git-clone.spawn-git-clone",
              "name": "javascript.lang.security.spawn-git-clone.spawn-git-clone",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.lang.security.spawn-git-clone.spawn-git-clone"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"
              },
              "help": {
                "markdown": "If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
                "text": "If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe",
              "id": "javascript.node-expat.security.audit.expat-xxe.expat-xxe",
              "name": "javascript.node-expat.security.audit.expat-xxe.expat-xxe",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-611: Improper Restriction of XML External Entity Reference",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A04:2017 - XML External Entities (XXE)",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.node-expat.security.audit.expat-xxe.expat-xxe"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML."
              },
              "help": {
                "markdown": "Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe)\n - [https://github.com/Leonidas-from-XIV/node-xml2js/issues/415](https://github.com/Leonidas-from-XIV/node-xml2js/issues/415)\n - [https://github.com/isaacs/sax-js](https://github.com/isaacs/sax-js)\n",
                "text": "Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe",
              "id": "javascript.sax.security.audit.sax-xxe.sax-xxe",
              "name": "javascript.sax.security.audit.sax-xxe.sax-xxe",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-611: Improper Restriction of XML External Entity Reference",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A04:2017 - XML External Entities (XXE)",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.sax.security.audit.sax-xxe.sax-xxe"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"
              },
              "help": {
                "markdown": "If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
                "text": "If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe",
              "id": "javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe",
              "name": "javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-611: Improper Restriction of XML External Entity Reference",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A04:2017 - XML External Entities (XXE)",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket."
              },
              "help": {
                "markdown": "Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html)\n",
                "text": "Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement",
              "id": "json.aws.security.public-s3-policy-statement.public-s3-policy-statement",
              "name": "json.aws.security.public-s3-policy-statement.public-s3-policy-statement",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: json.aws.security.public-s3-policy-statement.public-s3-policy-statement"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources."
              },
              "help": {
                "markdown": "Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator",
              "id": "python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator",
              "name": "python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."
              },
              "help": {
                "markdown": "IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA)\n",
                "text": "IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea",
              "id": "python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea",
              "name": "python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM."
              },
              "help": {
                "markdown": "ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes)\n - [https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption](https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption)\n",
                "text": "ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb",
              "id": "python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb",
              "name": "python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."
              },
              "help": {
                "markdown": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n",
                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
              "id": "python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
              "name": "python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'."
              },
              "help": {
                "markdown": "Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves)\n",
                "text": "Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size",
              "id": "python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size",
              "name": "python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities."
              },
              "help": {
                "markdown": "Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n",
                "text": "Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization",
              "id": "python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization",
              "name": "python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead."
              },
              "help": {
                "markdown": "'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html)\n",
                "text": "'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe",
              "id": "python.django.security.audit.avoid-mark-safe.avoid-mark-safe",
              "name": "python.django.security.audit.avoid-mark-safe.avoid-mark-safe",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.avoid-mark-safe.avoid-mark-safe"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator."
              },
              "help": {
                "markdown": "Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt",
              "id": "python.django.security.audit.csrf-exempt.no-csrf-exempt",
              "name": "python.django.security.audit.csrf-exempt.no-csrf-exempt",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.csrf-exempt.no-csrf-exempt"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."
              },
              "help": {
                "markdown": "Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n",
                "text": "Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql",
              "id": "python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql",
              "name": "python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."
              },
              "help": {
                "markdown": "Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n",
                "text": "Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression",
              "id": "python.django.security.audit.extends-custom-expression.extends-custom-expression",
              "name": "python.django.security.audit.extends-custom-expression.extends-custom-expression",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.extends-custom-expression.extends-custom-expression"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`."
              },
              "help": {
                "markdown": "QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra)\n - [https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra](https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n",
                "text": "QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra",
              "id": "python.django.security.audit.query-set-extra.avoid-query-set-extra",
              "name": "python.django.security.audit.query-set-extra.avoid-query-set-extra",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.query-set-extra.avoid-query-set-extra"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`"
              },
              "help": {
                "markdown": "Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n",
                "text": "Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql",
              "id": "python.django.security.audit.raw-query.avoid-raw-sql",
              "name": "python.django.security.audit.raw-query.avoid-raw-sql",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.raw-query.avoid-raw-sql"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None."
              },
              "help": {
                "markdown": "Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie)\n - [https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie](https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie)\n - [https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/](https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/)\n - [https://bento.dev/checks/flask/secure-set-cookie/](https://bento.dev/checks/flask/secure-set-cookie/)\n",
                "text": "Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie",
              "id": "python.django.security.audit.secure-cookies.django-secure-set-cookie",
              "name": "python.django.security.audit.secure-cookies.django-secure-set-cookie",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.secure-cookies.django-secure-set-cookie"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information."
              },
              "help": {
                "markdown": "The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password)\n - [https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation](https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation)\n",
                "text": "The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password",
              "id": "python.django.security.audit.unvalidated-password.unvalidated-password",
              "name": "python.django.security.audit.unvalidated-password.unvalidated-password",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-521: Weak Password Requirements",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.unvalidated-password.unvalidated-password"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."
              },
              "help": {
                "markdown": "Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n",
                "text": "Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off",
              "id": "python.django.security.audit.xss.context-autoescape-off.context-autoescape-off",
              "name": "python.django.security.audit.xss.context-autoescape-off.context-autoescape-off",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.xss.context-autoescape-off.context-autoescape-off"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."
              },
              "help": {
                "markdown": "Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n",
                "text": "Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off",
              "id": "python.django.security.audit.xss.global-autoescape-off.global-autoescape-off",
              "name": "python.django.security.audit.xss.global-autoescape-off.global-autoescape-off",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.xss.global-autoescape-off.global-autoescape-off"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code."
              },
              "help": {
                "markdown": "Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape](https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape)\n",
                "text": "Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off",
              "id": "python.django.security.audit.xss.template-autoescape-off.template-autoescape-off",
              "name": "python.django.security.audit.xss.template-autoescape-off.template-autoescape-off",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.xss.template-autoescape-off.template-autoescape-off"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."
              },
              "help": {
                "markdown": "Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n",
                "text": "Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape",
              "id": "python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape",
              "name": "python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."
              },
              "help": {
                "markdown": "Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n",
                "text": "Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape",
              "id": "python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape",
              "name": "python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code."
              },
              "help": {
                "markdown": "Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq)\n - [https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq](https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq)\n",
                "text": "Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq",
              "id": "python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq",
              "name": "python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."
              },
              "help": {
                "markdown": "Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution)\n - [https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186](https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186)\n",
                "text": "Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution",
              "id": "python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution",
              "name": "python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."
              },
              "help": {
                "markdown": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n",
                "text": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval",
              "id": "python.django.security.injection.code.user-eval.user-eval",
              "name": "python.django.security.injection.code.user-eval.user-eval",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.code.user-eval.user-eval"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."
              },
              "help": {
                "markdown": "Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n",
                "text": "Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec",
              "id": "python.django.security.injection.code.user-exec.user-exec",
              "name": "python.django.security.injection.code.user-exec.user-exec",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.code.user-exec.user-exec"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information."
              },
              "help": {
                "markdown": "Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n",
                "text": "Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system",
              "id": "python.django.security.injection.command.command-injection-os-system.command-injection-os-system",
              "name": "python.django.security.injection.command.command-injection-os-system.command-injection-os-system",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.command.command-injection-os-system.command-injection-os-system"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."
              },
              "help": {
                "markdown": "Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n",
                "text": "Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body",
              "id": "python.django.security.injection.email.xss-html-email-body.xss-html-email-body",
              "name": "python.django.security.injection.email.xss-html-email-body.xss-html-email-body",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.email.xss-html-email-body.xss-html-email-body"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."
              },
              "help": {
                "markdown": "Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n",
                "text": "Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message",
              "id": "python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message",
              "name": "python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html."
              },
              "help": {
                "markdown": "Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n",
                "text": "Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment",
              "id": "python.django.security.injection.mass-assignment.mass-assignment",
              "name": "python.django.security.injection.mass-assignment.mass-assignment",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.mass-assignment.mass-assignment"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."
              },
              "help": {
                "markdown": "Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n",
                "text": "Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name",
              "id": "python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name",
              "name": "python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A05:2017 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'."
              },
              "help": {
                "markdown": "'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n",
                "text": "'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default",
              "id": "python.django.security.passwords.use-none-for-password-default.use-none-for-password-default",
              "name": "python.django.security.passwords.use-none-for-password-default.use-none-for-password-default",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-521: Weak Password Requirements",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Running flask app with host 0.0.0.0 could expose the server publicly."
              },
              "help": {
                "markdown": "Running flask app with host 0.0.0.0 could expose the server publicly.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Running flask app with host 0.0.0.0 could expose the server publicly.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host",
              "id": "python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host",
              "name": "python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-668: Exposure of Resource to Wrong Sphere",
                  "HIGH CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function"
              },
              "help": {
                "markdown": "top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly",
              "id": "python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly",
              "name": "python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-668: Exposure of Resource to Wrong Sphere",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."
              },
              "help": {
                "markdown": "Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled)\n - [https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/](https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/)\n",
                "text": "Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled",
              "id": "python.flask.security.audit.debug-enabled.debug-enabled",
              "name": "python.flask.security.audit.debug-enabled.debug-enabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-489: Active Debug Code",
                  "HIGH CONFIDENCE",
                  "OWASP-A06:2017 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.debug-enabled.debug-enabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable"
              },
              "help": {
                "markdown": "Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n",
                "text": "Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG",
              "id": "python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG",
              "name": "python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-489: Active Debug Code",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable"
              },
              "help": {
                "markdown": "Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n",
                "text": "Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV",
              "id": "python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV",
              "name": "python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-489: Active Debug Code",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead"
              },
              "help": {
                "markdown": "Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n",
                "text": "Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY",
              "id": "python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY",
              "name": "python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-489: Active Debug Code",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Hardcoded variable `TESTING` detected. Use environment variables or config files instead"
              },
              "help": {
                "markdown": "Hardcoded variable `TESTING` detected. Use environment variables or config files instead\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n",
                "text": "Hardcoded variable `TESTING` detected. Use environment variables or config files instead\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING",
              "id": "python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING",
              "name": "python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-489: Active Debug Code",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."
              },
              "help": {
                "markdown": "Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n",
                "text": "Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string",
              "id": "python.flask.security.audit.render-template-string.render-template-string",
              "name": "python.flask.security.audit.render-template-string.render-template-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.render-template-string.render-template-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration."
              },
              "help": {
                "markdown": "Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie](https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options](https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options)\n",
                "text": "Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie",
              "id": "python.flask.security.audit.secure-set-cookie.secure-set-cookie",
              "name": "python.flask.security.audit.secure-set-cookie.secure-set-cookie",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.secure-set-cookie.secure-set-cookie"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection."
              },
              "help": {
                "markdown": "Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled)\n - [https://flask-wtf.readthedocs.io/en/1.2.x/csrf/](https://flask-wtf.readthedocs.io/en/1.2.x/csrf/)\n",
                "text": "Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled",
              "id": "python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled",
              "name": "python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."
              },
              "help": {
                "markdown": "Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n - [https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti](https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti)\n",
                "text": "Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string",
              "id": "python.flask.security.dangerous-template-string.dangerous-template-string",
              "name": "python.flask.security.dangerous-template-string.dangerous-template-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.dangerous-template-string.dangerous-template-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected user data flowing into eval. This is code injection and should be avoided."
              },
              "help": {
                "markdown": "Detected user data flowing into eval. This is code injection and should be avoided.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n",
                "text": "Detected user data flowing into eval. This is code injection and should be avoided.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection",
              "id": "python.flask.security.injection.user-eval.eval-injection",
              "name": "python.flask.security.injection.user-eval.eval-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.injection.user-eval.eval-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected user data flowing into exec. This is code injection and should be avoided."
              },
              "help": {
                "markdown": "Detected user data flowing into exec. This is code injection and should be avoided.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection)\n - [https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html)\n",
                "text": "Detected user data flowing into exec. This is code injection and should be avoided.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection",
              "id": "python.flask.security.injection.user-exec.exec-injection",
              "name": "python.flask.security.injection.user-exec.exec-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.injection.user-exec.exec-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON."
              },
              "help": {
                "markdown": "Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n",
                "text": "Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization",
              "id": "python.flask.security.insecure-deserialization.insecure-deserialization",
              "name": "python.flask.security.insecure-deserialization.insecure-deserialization",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.insecure-deserialization.insecure-deserialization"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information."
              },
              "help": {
                "markdown": "Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect)\n - [https://flask-login.readthedocs.io/en/latest/#login-example](https://flask-login.readthedocs.io/en/latest/#login-example)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1)\n - [https://docs.python.org/3/library/urllib.parse.html#url-parsing](https://docs.python.org/3/library/urllib.parse.html#url-parsing)\n",
                "text": "Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect",
              "id": "python.flask.security.open-redirect.open-redirect",
              "name": "python.flask.security.open-redirect.open-redirect",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.open-redirect.open-redirect"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`"
              },
              "help": {
                "markdown": "Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n",
                "text": "Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization",
              "id": "python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization",
              "name": "python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-73: External Control of File Name or Path",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 - Insecure Design",
                  "OWASP-A06:2025 - Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information."
              },
              "help": {
                "markdown": "Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n - [https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/](https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/)\n - [https://bento.dev/checks/flask/unescaped-file-extension/](https://bento.dev/checks/flask/unescaped-file-extension/)\n",
                "text": "Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension",
              "id": "python.flask.security.unescaped-template-extension.unescaped-template-extension",
              "name": "python.flask.security.unescaped-template-extension.unescaped-template-extension",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.unescaped-template-extension.unescaped-template-extension"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/)."
              },
              "help": {
                "markdown": "Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input)\n - [https://flask.palletsprojects.com/en/1.0.x/security/](https://flask.palletsprojects.com/en/1.0.x/security/)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n",
                "text": "Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input",
              "id": "python.flask.security.unsanitized-input.response-contains-unsanitized-input",
              "name": "python.flask.security.unsanitized-input.response-contains-unsanitized-input",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.unsanitized-input.response-contains-unsanitized-input"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on."
              },
              "help": {
                "markdown": "Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping](https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n",
                "text": "Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off",
              "id": "python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off",
              "name": "python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability."
              },
              "help": {
                "markdown": "Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss)\n",
                "text": "Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe",
              "id": "python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe",
              "name": "python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection"
              },
              "help": {
                "markdown": "The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv)\n - [https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection](https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection)\n",
                "text": "The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv",
              "id": "python.lang.security.audit.conn_recv.multiprocessing-recv",
              "name": "python.lang.security.audit.conn_recv.multiprocessing-recv",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.conn_recv.multiprocessing-recv"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."
              },
              "help": {
                "markdown": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected)\n - [https://cwe.mitre.org/data/definitions/939.html](https://cwe.mitre.org/data/definitions/939.html)\n",
                "text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected",
              "id": "python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected",
              "name": "python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-939: Improper Authorization in Handler for Custom URL Scheme",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."
              },
              "help": {
                "markdown": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected",
              "id": "python.lang.security.audit.eval-detected.eval-detected",
              "name": "python.lang.security.audit.eval-detected.eval-detected",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.eval-detected.eval-detected"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."
              },
              "help": {
                "markdown": "Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected",
              "id": "python.lang.security.audit.exec-detected.exec-detected",
              "name": "python.lang.security.audit.exec-detected.exec-detected",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.exec-detected.exec-detected"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied."
              },
              "help": {
                "markdown": "Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument",
              "id": "python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument",
              "name": "python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information."
              },
              "help": {
                "markdown": "The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n",
                "text": "The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected",
              "id": "python.lang.security.audit.httpsconnection-detected.httpsconnection-detected",
              "name": "python.lang.security.audit.httpsconnection-detected.httpsconnection-detected",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.httpsconnection-detected.httpsconnection-detected"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations."
              },
              "help": {
                "markdown": "Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval)\n - [https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen](https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen)\n",
                "text": "Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval",
              "id": "python.lang.security.audit.logging.listeneval.listen-eval",
              "name": "python.lang.security.audit.logging.listeneval.listen-eval",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.logging.listeneval.listen-eval"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping."
              },
              "help": {
                "markdown": "Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected)\n - [https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping](https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping)\n - [https://jinja.palletsprojects.com/en/2.11.x/intro/#](https://jinja.palletsprojects.com/en/2.11.x/intro/#)\n",
                "text": "Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected",
              "id": "python.lang.security.audit.mako-templates-detected.mako-templates-detected",
              "name": "python.lang.security.audit.mako-templates-detected.mako-templates-detected",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.mako-templates-detected.mako-templates-detected"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security"
              },
              "help": {
                "markdown": "The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage)\n - [https://docs.python.org/3/library/marshal.html?highlight=security](https://docs.python.org/3/library/marshal.html?highlight=security)\n",
                "text": "The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage",
              "id": "python.lang.security.audit.marshal.marshal-usage",
              "name": "python.lang.security.audit.marshal.marshal-usage",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.marshal.marshal-usage"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file."
              },
              "help": {
                "markdown": "Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces",
              "id": "python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces",
              "name": "python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "HIGH CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications."
              },
              "help": {
                "markdown": "Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection)\n - [https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool](https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool)\n",
                "text": "Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection",
              "id": "python.lang.security.audit.network.http-not-https-connection.http-not-https-connection",
              "name": "python.lang.security.audit.network.http-not-https-connection.http-not-https-connection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead."
              },
              "help": {
                "markdown": "Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy)\n",
                "text": "Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key",
              "id": "python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key",
              "name": "python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-322: Key Exchange without Entity Authentication",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead."
              },
              "help": {
                "markdown": "Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py](https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py)\n",
                "text": "Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command",
              "id": "python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command",
              "name": "python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket."
              },
              "help": {
                "markdown": "'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated)\n - [https://docs.python.org/3/library/ssl.html#ssl.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.wrap_socket)\n - [https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket)\n",
                "text": "'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated",
              "id": "python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated",
              "name": "python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."
              },
              "help": {
                "markdown": "Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n",
                "text": "Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true",
              "id": "python.lang.security.audit.subprocess-shell-true.subprocess-shell-true",
              "name": "python.lang.security.audit.subprocess-shell-true.subprocess-shell-true",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information."
              },
              "help": {
                "markdown": "Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected)\n - [https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt](https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt)\n",
                "text": "Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected",
              "id": "python.lang.security.audit.system-wildcard-detected.system-wildcard-detected",
              "name": "python.lang.security.audit.system-wildcard-detected.system-wildcard-detected",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-155: Improper Neutralization of Wildcards or Matching Symbols",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.system-wildcard-detected.system-wildcard-detected"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Telnet does not encrypt communications. Use SSH instead."
              },
              "help": {
                "markdown": "Telnet does not encrypt communications. Use SSH instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib)\n - [https://docs.python.org/3/library/telnetlib.html](https://docs.python.org/3/library/telnetlib.html)\n",
                "text": "Telnet does not encrypt communications. Use SSH instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib",
              "id": "python.lang.security.audit.telnetlib.telnetlib",
              "name": "python.lang.security.audit.telnetlib.telnetlib",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.telnetlib.telnetlib"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher."
              },
              "help": {
                "markdown": "An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n - [https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2](https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2)\n",
                "text": "An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version",
              "id": "python.lang.security.audit.weak-ssl-version.weak-ssl-version",
              "name": "python.lang.security.audit.weak-ssl-version.weak-ssl-version",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.weak-ssl-version.weak-ssl-version"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead."
              },
              "help": {
                "markdown": "Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n",
                "text": "Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load",
              "id": "python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load",
              "name": "python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."
              },
              "help": {
                "markdown": "Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n",
                "text": "Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle",
              "id": "python.lang.security.deserialization.pickle.avoid-cPickle",
              "name": "python.lang.security.deserialization.pickle.avoid-cPickle",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.deserialization.pickle.avoid-cPickle"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."
              },
              "help": {
                "markdown": "Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n",
                "text": "Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill",
              "id": "python.lang.security.deserialization.pickle.avoid-dill",
              "name": "python.lang.security.deserialization.pickle.avoid-dill",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.deserialization.pickle.avoid-dill"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."
              },
              "help": {
                "markdown": "Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n",
                "text": "Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle",
              "id": "python.lang.security.deserialization.pickle.avoid-pickle",
              "name": "python.lang.security.deserialization.pickle.avoid-pickle",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.deserialization.pickle.avoid-pickle"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."
              },
              "help": {
                "markdown": "Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n",
                "text": "Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve",
              "id": "python.lang.security.deserialization.pickle.avoid-shelve",
              "name": "python.lang.security.deserialization.pickle.avoid-shelve",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.deserialization.pickle.avoid-shelve"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."
              },
              "help": {
                "markdown": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n",
                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
              "id": "python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
              "name": "python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead."
              },
              "help": {
                "markdown": "Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n",
                "text": "Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function",
              "id": "python.lang.security.insecure-hash-function.insecure-hash-function",
              "name": "python.lang.security.insecure-hash-function.insecure-hash-function",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.insecure-hash-function.insecure-hash-function"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead."
              },
              "help": {
                "markdown": "Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context)\n - [https://docs.python.org/3/library/ssl.html#ssl-security](https://docs.python.org/3/library/ssl.html#ssl-security)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n",
                "text": "Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context",
              "id": "python.lang.security.unverified-ssl-context.unverified-ssl-context",
              "name": "python.lang.security.unverified-ssl-context.unverified-ssl-context",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.unverified-ssl-context.unverified-ssl-context"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service."
              },
              "help": {
                "markdown": "The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xml.use-defused-xml)\n - [https://docs.python.org/3/library/xml.html](https://docs.python.org/3/library/xml.html)\n - [https://github.com/tiran/defusedxml](https://github.com/tiran/defusedxml)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n",
                "text": "The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.use-defused-xml.use-defused-xml",
              "id": "python.lang.security.use-defused-xml.use-defused-xml",
              "name": "python.lang.security.use-defused-xml.use-defused-xml",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-611: Improper Restriction of XML External Entity Reference",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A04:2017 - XML External Entities (XXE)",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.use-defused-xml.use-defused-xml"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead."
              },
              "help": {
                "markdown": "Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n",
                "text": "Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc",
              "id": "python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc",
              "name": "python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A04:2017 - XML External Entities (XXE)",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead."
              },
              "help": {
                "markdown": "Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n",
                "text": "Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor",
              "id": "python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor",
              "name": "python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."
              },
              "help": {
                "markdown": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n",
                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1",
              "id": "python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1",
              "name": "python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation."
              },
              "help": {
                "markdown": "Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation)\n - [https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib](https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib)\n",
                "text": "Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation",
              "id": "python.requests.security.disabled-cert-validation.disabled-cert-validation",
              "name": "python.requests.security.disabled-cert-validation.disabled-cert-validation",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.requests.security.disabled-cert-validation.disabled-cert-validation"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead."
              },
              "help": {
                "markdown": "Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http)\n - [https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/](https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/)\n - [https://bento.dev/checks/requests/no-auth-over-http/](https://bento.dev/checks/requests/no-auth-over-http/)\n",
                "text": "Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http",
              "id": "python.requests.security.no-auth-over-http.no-auth-over-http",
              "name": "python.requests.security.no-auth-over-http.no-auth-over-http",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-523: Unprotected Transport of Credentials",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2017 - Broken Authentication",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.requests.security.no-auth-over-http.no-auth-over-http"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."
              },
              "help": {
                "markdown": "Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection",
              "id": "python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection",
              "name": "python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead."
              },
              "help": {
                "markdown": "Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization)\n - [https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ](https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb)\n",
                "text": "Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization",
              "id": "ruby.lang.security.bad-deserialization.bad-deserialization",
              "name": "ruby.lang.security.bad-deserialization.bad-deserialization",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.bad-deserialization.bad-deserialization"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice."
              },
              "help": {
                "markdown": "Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb)\n - [https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/](https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/)\n",
                "text": "Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization",
              "id": "ruby.lang.security.cookie-serialization.cookie-serialization",
              "name": "ruby.lang.security.cookie-serialization.cookie-serialization",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-94: Improper Control of Generation of Code ('Code Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.cookie-serialization.cookie-serialization"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set."
              },
              "help": {
                "markdown": "Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.create-with.create-with)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ](https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ)\n",
                "text": "Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.create-with.create-with",
              "id": "ruby.lang.security.create-with.create-with",
              "name": "ruby.lang.security.create-with.create-with",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.create-with.create-with"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a possible ZeroDivisionError."
              },
              "help": {
                "markdown": "Detected a possible ZeroDivisionError.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb)\n",
                "text": "Detected a possible ZeroDivisionError.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero",
              "id": "ruby.lang.security.divide-by-zero.divide-by-zero",
              "name": "ruby.lang.security.divide-by-zero.divide-by-zero",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-369: Divide By Zero",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.divide-by-zero.divide-by-zero"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false."
              },
              "help": {
                "markdown": "Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ](https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ)\n",
                "text": "Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure",
              "id": "ruby.lang.security.file-disclosure.file-disclosure",
              "name": "ruby.lang.security.file-disclosure.file-disclosure",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A05:2017 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.file-disclosure.file-disclosure"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Checks for use of action in Ruby routes. This can cause Rails to render an arbitrary view if an attacker creates an URL accurately. Affects 3.0 applications. Can avoid the vulnerability by providing additional constraints."
              },
              "help": {
                "markdown": "Checks for use of action in Ruby routes. This can cause Rails to render an arbitrary view if an attacker creates an URL accurately. Affects 3.0 applications. Can avoid the vulnerability by providing additional constraints.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.filter-skipping.filter-skipping)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_filter_skipping.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_filter_skipping.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY](https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY)\n",
                "text": "Checks for use of action in Ruby routes. This can cause Rails to render an arbitrary view if an attacker creates an URL accurately. Affects 3.0 applications. Can avoid the vulnerability by providing additional constraints.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.filter-skipping.filter-skipping",
              "id": "ruby.lang.security.filter-skipping.filter-skipping",
              "name": "ruby.lang.security.filter-skipping.filter-skipping",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
                  "LOW CONFIDENCE",
                  "OWASP-A04:2021 - Insecure Design",
                  "OWASP-A06:2025 - Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.filter-skipping.filter-skipping"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true."
              },
              "help": {
                "markdown": "Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb)\n",
                "text": "Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false",
              "id": "ruby.lang.security.force-ssl-false.force-ssl-false",
              "name": "ruby.lang.security.force-ssl-false.force-ssl-false",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-311: Missing Encryption of Sensitive Data",
                  "HIGH CONFIDENCE",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2021 - Insecure Design",
                  "OWASP-A06:2025 - Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.force-ssl-false.force-ssl-false"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect."
              },
              "help": {
                "markdown": "Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n",
                "text": "Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled",
              "id": "ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled",
              "name": "ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class."
              },
              "help": {
                "markdown": "Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection",
              "id": "ruby.lang.security.missing-csrf-protection.missing-csrf-protection",
              "name": "ruby.lang.security.missing-csrf-protection.missing-csrf-protection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.missing-csrf-protection.missing-csrf-protection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval."
              },
              "help": {
                "markdown": "Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval",
              "id": "ruby.lang.security.no-eval.ruby-eval",
              "name": "ruby.lang.security.no-eval.ruby-eval",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-94: Improper Control of Generation of Code ('Code Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.no-eval.ruby-eval"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this."
              },
              "help": {
                "markdown": "Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-send.bad-send)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb)\n - [https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html](https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html)\n",
                "text": "Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.no-send.bad-send",
              "id": "ruby.lang.security.no-send.bad-send",
              "name": "ruby.lang.security.no-send.bad-send",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-94: Improper Control of Generation of Code ('Code Injection')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.no-send.bad-send"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead."
              },
              "help": {
                "markdown": "Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify",
              "id": "ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify",
              "name": "ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access."
              },
              "help": {
                "markdown": "Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb)\n - [https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/](https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/)\n",
                "text": "Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln",
              "id": "ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln",
              "name": "ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
                  "LOW CONFIDENCE",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead."
              },
              "help": {
                "markdown": "Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5)\n - [https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575](https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575)\n",
                "text": "Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5",
              "id": "ruby.lang.security.weak-hashes-md5.weak-hashes-md5",
              "name": "ruby.lang.security.weak-hashes-md5.weak-hashes-md5",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-328: Use of Weak Hash",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.weak-hashes-md5.weak-hashes-md5"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead."
              },
              "help": {
                "markdown": "Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1)\n - [https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html](https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html)\n - [https://shattered.io/](https://shattered.io/)\n",
                "text": "Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1",
              "id": "ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1",
              "name": "ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-328: Use of Weak Hash",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access"
              },
              "help": {
                "markdown": "The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled",
              "id": "terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled",
              "name": "terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "LOW CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "CORS rule on bucket permits any origin"
              },
              "help": {
                "markdown": "CORS rule on bucket permits any origin\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors)\n",
                "text": "CORS rule on bucket permits any origin\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed",
              "id": "terraform.lang.security.s3-cors-all-origins.all-origins-allowed",
              "name": "terraform.lang.security.s3-cors-all-origins.all-origins-allowed",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
                  "LOW CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: terraform.lang.security.s3-cors-all-origins.all-origins-allowed"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "S3 bucket with public read-write access detected."
              },
              "help": {
                "markdown": "S3 bucket with public read-write access detected.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl)\n",
                "text": "S3 bucket with public read-write access detected.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket",
              "id": "terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket",
              "name": "terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."
              },
              "help": {
                "markdown": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n",
                "text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml",
              "id": "typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml",
              "name": "typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Unencrypted request over HTTP detected."
              },
              "help": {
                "markdown": "Unencrypted request over HTTP detected.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request)\n - [https://www.npmjs.com/package/axios](https://www.npmjs.com/package/axios)\n",
                "text": "Unencrypted request over HTTP detected.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request",
              "id": "typescript.react.security.react-insecure-request.react-insecure-request",
              "name": "typescript.react.security.react-insecure-request.react-insecure-request",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: typescript.react.security.react-insecure-request.react-insecure-request"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors."
              },
              "help": {
                "markdown": "Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html)\n - [https://www.npmjs.com/package/react-markdown#security](https://www.npmjs.com/package/react-markdown#security)\n",
                "text": "Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html",
              "id": "typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html",
              "name": "typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "LOW CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found unencrypted AMQP connection, prefer TLS encrypted `amqps://` transport\n"
              },
              "help": {
                "markdown": "Found unencrypted AMQP connection, prefer TLS encrypted `amqps://` transport\n\n\n<b>References:</b>\n - [https://www.rabbitmq.com/docs/uri-spec#the-amqps-uri-scheme](https://www.rabbitmq.com/docs/uri-spec#the-amqps-uri-scheme)\n",
                "text": "Found unencrypted AMQP connection, prefer TLS encrypted `amqps://` transport\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.amqp-unencrypted-transport",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.amqp-unencrypted-transport",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.amqp-unencrypted-transport"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found container command (docker, podman) with extended privileges"
              },
              "help": {
                "markdown": "Found container command (docker, podman) with extended privileges\n\n<b>References:</b>\n - [https://docs.docker.com/engine/reference/commandline/run/](https://docs.docker.com/engine/reference/commandline/run/)\n",
                "text": "Found container command (docker, podman) with extended privileges"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.container-privileged",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.container-privileged",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-250: Execution with Unnecessary Privileges",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.container-privileged"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found container command running as root"
              },
              "help": {
                "markdown": "Found container command running as root\n\n<b>References:</b>\n - [https://docs.docker.com/engine/reference/commandline/run/](https://docs.docker.com/engine/reference/commandline/run/)\n",
                "text": "Found container command running as root"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.container-user-root",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.container-user-root",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-250: Execution with Unnecessary Privileges",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.container-user-root"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found `curl` command disabling SSL verification"
              },
              "help": {
                "markdown": "Found `curl` command disabling SSL verification\n\n<b>References:</b>\n - [https://curl.se/docs/manpage.html](https://curl.se/docs/manpage.html)\n",
                "text": "Found `curl` command disabling SSL verification"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.curl-insecure",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.curl-insecure",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.curl-insecure"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found `curl` command with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "help": {
                "markdown": "Found `curl` command with unencrypted URL (e.g. HTTP, FTP, etc.)\n\n<b>References:</b>\n - [https://curl.se/docs/manpage.html](https://curl.se/docs/manpage.html)\n",
                "text": "Found `curl` command with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.curl-unencrypted-url",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.curl-unencrypted-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.curl-unencrypted-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found `gpg` command using insecure flags"
              },
              "help": {
                "markdown": "Found `gpg` command using insecure flags\n\n<b>References:</b>\n - [https://www.gnupg.org/gph/de/manual/r1023.html](https://www.gnupg.org/gph/de/manual/r1023.html)\n",
                "text": "Found `gpg` command using insecure flags"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.gpg-insecure-flags",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.gpg-insecure-flags",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.gpg-insecure-flags"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found `installer` command allowing untrusted installations"
              },
              "help": {
                "markdown": "Found `installer` command allowing untrusted installations\n\n<b>References:</b>\n - [https://ss64.com/mac/installer.html](https://ss64.com/mac/installer.html)\n",
                "text": "Found `installer` command allowing untrusted installations"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.installer-allow-untrusted",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.installer-allow-untrusted",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-494: Download of Code Without Integrity Check",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.installer-allow-untrusted"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found insecure MongoDB connection, prefer TLS encrypted transport by\nsetting the `tls=true` connection option and ensuring proper verification\n"
              },
              "help": {
                "markdown": "Found insecure MongoDB connection, prefer TLS encrypted transport by\nsetting the `tls=true` connection option and ensuring proper verification\n\n\n<b>References:</b>\n - [https://www.mongodb.com/docs/manual/reference/connection-string/#connection-options](https://www.mongodb.com/docs/manual/reference/connection-string/#connection-options)\n",
                "text": "Found insecure MongoDB connection, prefer TLS encrypted transport by\nsetting the `tls=true` connection option and ensuring proper verification\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.mongodb-insecure-transport",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.mongodb-insecure-transport",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.mongodb-insecure-transport"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found MySQL connection string disabling SSL verification\n"
              },
              "help": {
                "markdown": "Found MySQL connection string disabling SSL verification\n\n\n<b>References:</b>\n - [https://dev.mysql.com/doc/connector-net/en/connector-net-8-0-connection-options.html](https://dev.mysql.com/doc/connector-net/en/connector-net-8-0-connection-options.html)\n - [https://dev.mysql.com/doc/connector-j/en/connector-j-connp-props-security.html](https://dev.mysql.com/doc/connector-j/en/connector-j-connp-props-security.html)\n",
                "text": "Found MySQL connection string disabling SSL verification\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.mysql-insecure-sslmode",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.mysql-insecure-sslmode",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.mysql-insecure-sslmode"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Setting this environment variable disables TLS certificate validation.\nThis makes TLS, and HTTPS by extension, insecure. The use of this\nenvironment variable is strongly discouraged.\n"
              },
              "help": {
                "markdown": "Setting this environment variable disables TLS certificate validation.\nThis makes TLS, and HTTPS by extension, insecure. The use of this\nenvironment variable is strongly discouraged.\n\n\n<b>References:</b>\n - [https://nodejs.org/api/cli.html#node_tls_reject_unauthorizedvalue](https://nodejs.org/api/cli.html#node_tls_reject_unauthorizedvalue)\n",
                "text": "Setting this environment variable disables TLS certificate validation.\nThis makes TLS, and HTTPS by extension, insecure. The use of this\nenvironment variable is strongly discouraged.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.node-disable-certificate-validation",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.node-disable-certificate-validation",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.node-disable-certificate-validation"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found `openssl` command using insecure flags"
              },
              "help": {
                "markdown": "Found `openssl` command using insecure flags\n\n<b>References:</b>\n - [https://www.openssl.org/docs/manmaster/man1/](https://www.openssl.org/docs/manmaster/man1/)\n",
                "text": "Found `openssl` command using insecure flags"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.openssl-insecure-flags",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.openssl-insecure-flags",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.openssl-insecure-flags"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found PostgreSQL connection string disabling SSL verification\n"
              },
              "help": {
                "markdown": "Found PostgreSQL connection string disabling SSL verification\n\n\n<b>References:</b>\n - [https://www.postgresql.org/docs/current/libpq-connect.html](https://www.postgresql.org/docs/current/libpq-connect.html)\n",
                "text": "Found PostgreSQL connection string disabling SSL verification\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.postgres-insecure-sslmode",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.postgres-insecure-sslmode",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.postgres-insecure-sslmode"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found unencrypted Redis connection, prefer TLS encrypted `rediss://` transport\n"
              },
              "help": {
                "markdown": "Found unencrypted Redis connection, prefer TLS encrypted `rediss://` transport\n\n\n<b>References:</b>\n - [https://redis.io/docs/latest/develop/connect/cli/#host-port-password-and-database](https://redis.io/docs/latest/develop/connect/cli/#host-port-password-and-database)\n",
                "text": "Found unencrypted Redis connection, prefer TLS encrypted `rediss://` transport\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.redis-unencrypted-transport",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.redis-unencrypted-transport",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.redis-unencrypted-transport"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found `ssh` command disabling host key checking"
              },
              "help": {
                "markdown": "Found `ssh` command disabling host key checking\n\n<b>References:</b>\n - [https://man7.org/linux/man-pages/man1/ssh.1.html](https://man7.org/linux/man-pages/man1/ssh.1.html)\n",
                "text": "Found `ssh` command disabling host key checking"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.ssh-disable-host-key-checking",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.ssh-disable-host-key-checking",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.ssh-disable-host-key-checking"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found `tar` command using insecure flags"
              },
              "help": {
                "markdown": "Found `tar` command using insecure flags\n\n<b>References:</b>\n - [https://man7.org/linux/man-pages/man1/tar.1.html](https://man7.org/linux/man-pages/man1/tar.1.html)\n",
                "text": "Found `tar` command using insecure flags"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.tar-insecure-flags",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.tar-insecure-flags",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-73: External Control of File Name or Path",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.tar-insecure-flags"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found `wget` command disabling SSL verification"
              },
              "help": {
                "markdown": "Found `wget` command disabling SSL verification\n\n<b>References:</b>\n - [https://linux.die.net/man/1/wget](https://linux.die.net/man/1/wget)\n",
                "text": "Found `wget` command disabling SSL verification"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.wget-no-check-certificate",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.wget-no-check-certificate",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.wget-no-check-certificate"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found `wget` command  with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "help": {
                "markdown": "Found `wget` command  with unencrypted URL (e.g. HTTP, FTP, etc.)\n\n<b>References:</b>\n - [https://linux.die.net/man/1/wget](https://linux.die.net/man/1/wget)\n",
                "text": "Found `wget` command  with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.wget-unencrypted-url",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.wget-unencrypted-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.generic.wget-unencrypted-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Using built-in transaction tracers can be dangerous if measures are not taken to filter out reverted call frames.  Review the related code to ensure the following properties:  1. Reverted call frames and their associated subtraces are filtered out from any analysis.   2. The transaction being traced is from a finalized block."
              },
              "help": {
                "markdown": "Using built-in transaction tracers can be dangerous if measures are not taken to filter out reverted call frames.  Review the related code to ensure the following properties:  1. Reverted call frames and their associated subtraces are filtered out from any analysis.   2. The transaction being traced is from a finalized block.\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2023/08/23/the-engineers-guide-to-blockchain-finality/](https://blog.trailofbits.com/2023/08/23/the-engineers-guide-to-blockchain-finality/)\n",
                "text": "Using built-in transaction tracers can be dangerous if measures are not taken to filter out reverted call frames.  Review the related code to ensure the following properties:  1. Reverted call frames and their associated subtraces are filtered out from any analysis.   2. The transaction being traced is from a finalized block."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.eth-rpc-tracetransaction",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.eth-rpc-tracetransaction",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1284: Improper Validation of Specified Quantity in Input",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.eth-rpc-tracetransaction"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "A transaction receipt's status is inspected using `$RECEIVER.Status()`. For bridges and exchanges, this is a high-risk pattern because even though the transaction was successful, calls within the transaction may have failed. Review the related code to ensure the following properties:  1. The receipt's success is not being used as a verification measure. 2. The transaction being inspected is from a finalized block."
              },
              "help": {
                "markdown": "A transaction receipt's status is inspected using `$RECEIVER.Status()`. For bridges and exchanges, this is a high-risk pattern because even though the transaction was successful, calls within the transaction may have failed. Review the related code to ensure the following properties:  1. The receipt's success is not being used as a verification measure. 2. The transaction being inspected is from a finalized block.\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2023/08/23/the-engineers-guide-to-blockchain-finality/](https://blog.trailofbits.com/2023/08/23/the-engineers-guide-to-blockchain-finality/)\n",
                "text": "A transaction receipt's status is inspected using `$RECEIVER.Status()`. For bridges and exchanges, this is a high-risk pattern because even though the transaction was successful, calls within the transaction may have failed. Review the related code to ensure the following properties:  1. The receipt's success is not being used as a verification measure. 2. The transaction being inspected is from a finalized block."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.eth-txreceipt-status",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.eth-txreceipt-status",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-437: Incomplete Model of Endpoint Features",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.eth-txreceipt-status"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Potential goroutine leak due to unbuffered channel send inside loop or unbuffered channel receive in select block"
              },
              "help": {
                "markdown": "Potential goroutine leak due to unbuffered channel send inside loop or unbuffered channel receive in select block\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2021/11/08/discovering-goroutine-leaks-with-semgrep](https://blog.trailofbits.com/2021/11/08/discovering-goroutine-leaks-with-semgrep)\n",
                "text": "Potential goroutine leak due to unbuffered channel send inside loop or unbuffered channel receive in select block"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.hanging-goroutine",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.hanging-goroutine",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-833: Deadlock",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.hanging-goroutine"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"
              },
              "help": {
                "markdown": "Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n",
                "text": "Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.invalid-usage-of-modified-variable",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.invalid-usage-of-modified-variable",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-665: Improper Initialization",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.invalid-usage-of-modified-variable"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"
              },
              "help": {
                "markdown": "Iteration over a possibly empty map `$C`. This is likely a bug or redundant code\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n",
                "text": "Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.iterate-over-empty-map",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.iterate-over-empty-map",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-665: Improper Initialization",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.iterate-over-empty-map"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"
              },
              "help": {
                "markdown": "Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function\n\n<b>References:</b>\n - [https://pkg.go.dev/sync#RWMutex](https://pkg.go.dev/sync#RWMutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n",
                "text": "Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.missing-runlock-on-rwmutex",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.missing-runlock-on-rwmutex",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-667: Improper Locking",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.missing-runlock-on-rwmutex"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"
              },
              "help": {
                "markdown": "Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations\n\n<b>References:</b>\n - [https://pkg.go.dev/sync#Mutex](https://pkg.go.dev/sync#Mutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n",
                "text": "Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.missing-unlock-before-return",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.missing-unlock-before-return",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-667: Improper Locking",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.missing-unlock-before-return"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Potential `$FOO` nil dereference when `$BAR` is called"
              },
              "help": {
                "markdown": "Potential `$FOO` nil dereference when `$BAR` is called\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n",
                "text": "Potential `$FOO` nil dereference when `$BAR` is called"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.nil-check-after-call",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.nil-check-after-call",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-253: Incorrect Check of Function Return Value",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.nil-check-after-call"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Appending `$SLICE` from multiple goroutines is not concurrency safe"
              },
              "help": {
                "markdown": "Appending `$SLICE` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n",
                "text": "Appending `$SLICE` from multiple goroutines is not concurrency safe"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.racy-append-to-slice",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.racy-append-to-slice",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.racy-append-to-slice"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Writing `$MAP` from multiple goroutines is not concurrency safe"
              },
              "help": {
                "markdown": "Writing `$MAP` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n",
                "text": "Writing `$MAP` from multiple goroutines is not concurrency safe"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.racy-write-to-map",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.racy-write-to-map",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.racy-write-to-map"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"
              },
              "help": {
                "markdown": "The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service\n\n<b>References:</b>\n - [https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658](https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658)\n",
                "text": "The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.servercodec-readrequestbody-unhandled-nil",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.servercodec-readrequestbody-unhandled-nil",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-476: NULL Pointer Dereference",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.servercodec-readrequestbody-unhandled-nil"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Downcasting or changing sign of an integer with `$CAST_METHOD` method"
              },
              "help": {
                "markdown": "Downcasting or changing sign of an integer with `$CAST_METHOD` method\n\n<b>References:</b>\n - [https://github.com/golang/go/issues/30209](https://github.com/golang/go/issues/30209)\n",
                "text": "Downcasting or changing sign of an integer with `$CAST_METHOD` method"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.string-to-int-signedness-cast",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.string-to-int-signedness-cast",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-681: Incorrect Conversion between Numeric Types",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.string-to-int-signedness-cast"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"
              },
              "help": {
                "markdown": "A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended\n\n<b>References:</b>\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n",
                "text": "A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.sync-mutex-value-copied",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.sync-mutex-value-copied",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-688: Function Call With Incorrect Variable or Reference as Argument",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.sync-mutex-value-copied"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Struct field can be decoded with the `-` key because the JSON tag starts with a `-` but is followed by a comma."
              },
              "help": {
                "markdown": "Struct field can be decoded with the `-` key because the JSON tag starts with a `-` but is followed by a comma.\n\n<b>References:</b>\n - [https://blog.trailofbits.com/](https://blog.trailofbits.com/)\n",
                "text": "Struct field can be decoded with the `-` key because the JSON tag starts with a `-` but is followed by a comma."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.unmarshal-tag-is-dash",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.unmarshal-tag-is-dash",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-172: Encoding Error",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.unmarshal-tag-is-dash"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Struct field can be unmarshaled with the `omitempty` key. The developer likely wanted to write \",omitempty\" instead."
              },
              "help": {
                "markdown": "Struct field can be unmarshaled with the `omitempty` key. The developer likely wanted to write \",omitempty\" instead.\n\n<b>References:</b>\n - [https://blog.trailofbits.com/](https://blog.trailofbits.com/)\n",
                "text": "Struct field can be unmarshaled with the `omitempty` key. The developer likely wanted to write \",omitempty\" instead."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.unmarshal-tag-is-omitempty",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.unmarshal-tag-is-omitempty",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-172: Encoding Error",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.unmarshal-tag-is-omitempty"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The function is vulnerable to DLL hijacking attacks. Use `windows.NewLazySystemDLL()` function to limit DLL search to the Windows directory"
              },
              "help": {
                "markdown": "The function is vulnerable to DLL hijacking attacks. Use `windows.NewLazySystemDLL()` function to limit DLL search to the Windows directory\n\n<b>References:</b>\n - [https://pkg.go.dev/golang.org/x/sys/windows#LazyDLL](https://pkg.go.dev/golang.org/x/sys/windows#LazyDLL)\n",
                "text": "The function is vulnerable to DLL hijacking attacks. Use `windows.NewLazySystemDLL()` function to limit DLL search to the Windows directory"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.unsafe-dll-loading",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.unsafe-dll-loading",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-427: Uncontrolled Search Path Element",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.unsafe-dll-loading"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"
              },
              "help": {
                "markdown": "Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n\n\n<b>References:</b>\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n",
                "text": "Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.waitgroup-add-called-inside-goroutine",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.waitgroup-add-called-inside-goroutine",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-667: Improper Locking",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.waitgroup-add-called-inside-goroutine"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"
              },
              "help": {
                "markdown": "Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`\n\n<b>References:</b>\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n",
                "text": "Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.waitgroup-wait-inside-loop",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.waitgroup-wait-inside-loop",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-667: Improper Locking",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.go.waitgroup-wait-inside-loop"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Nomad task using Docker auth with hardcoded password\n"
              },
              "help": {
                "markdown": "Found Nomad task using Docker auth with hardcoded password\n\n\n<b>References:</b>\n - [https://developer.hashicorp.com/nomad/docs/drivers/docker#password](https://developer.hashicorp.com/nomad/docs/drivers/docker#password)\n",
                "text": "Found Nomad task using Docker auth with hardcoded password\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.docker-hardcoded-password",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.docker-hardcoded-password",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.docker-hardcoded-password"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Nomad task using Docker containers in privileged mode\n"
              },
              "help": {
                "markdown": "Found Nomad task using Docker containers in privileged mode\n\n\n<b>References:</b>\n - [https://developer.hashicorp.com/nomad/docs/drivers/docker#privileged](https://developer.hashicorp.com/nomad/docs/drivers/docker#privileged)\n - [https://developer.hashicorp.com/nomad/docs/drivers/docker#allow_privileged](https://developer.hashicorp.com/nomad/docs/drivers/docker#allow_privileged)\n",
                "text": "Found Nomad task using Docker containers in privileged mode\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.docker-privileged-mode",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.docker-privileged-mode",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-250: Execution with Unnecessary Privileges",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.docker-privileged-mode"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Nomad task using Podman with registry TLS verification disabled\n"
              },
              "help": {
                "markdown": "Found Nomad task using Podman with registry TLS verification disabled\n\n\n<b>References:</b>\n - [https://developer.hashicorp.com/nomad/plugins/drivers/podman#auth](https://developer.hashicorp.com/nomad/plugins/drivers/podman#auth)\n",
                "text": "Found Nomad task using Podman with registry TLS verification disabled\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.podman-tls-verify-disabled",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.podman-tls-verify-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.podman-tls-verify-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Nomad task using root user\n"
              },
              "help": {
                "markdown": "Found Nomad task using root user\n\n\n<b>References:</b>\n - [https://developer.hashicorp.com/nomad/docs/job-specification/task#user](https://developer.hashicorp.com/nomad/docs/job-specification/task#user)\n - [https://developer.hashicorp.com/nomad/docs/configuration/client#user-denylist](https://developer.hashicorp.com/nomad/docs/configuration/client#user-denylist)\n",
                "text": "Found Nomad task using root user\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.root-user",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.root-user",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-250: Execution with Unnecessary Privileges",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.root-user"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Nomad `tls` block with server hostname verification disabled\n"
              },
              "help": {
                "markdown": "Found Nomad `tls` block with server hostname verification disabled\n\n\n<b>References:</b>\n - [https://developer.hashicorp.com/nomad/docs/configuration/tls](https://developer.hashicorp.com/nomad/docs/configuration/tls)\n - [https://github.com/hashicorp/nomad/blob/v1.8.0/nomad/structs/config/tls.go#L25-L31](https://github.com/hashicorp/nomad/blob/v1.8.0/nomad/structs/config/tls.go#L25-L31)\n",
                "text": "Found Nomad `tls` block with server hostname verification disabled\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.tls-hostname-verification-disabled",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.tls-hostname-verification-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.nomad.tls-hostname-verification-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found AWS role policy for GitHub Actions with duplicate condition.\nThis overrides previous conditions, and the last condition with the\nduplicated key \"wins.\" This likely breaks access controls and allows\nunauthorized access.\n"
              },
              "help": {
                "markdown": "Found AWS role policy for GitHub Actions with duplicate condition.\nThis overrides previous conditions, and the last condition with the\nduplicated key \"wins.\" This likely breaks access controls and allows\nunauthorized access.\n\n\n<b>References:</b>\n - [https://securitylabs.datadoghq.com/articles/exploring-github-to-aws-keyless-authentication-flaws/](https://securitylabs.datadoghq.com/articles/exploring-github-to-aws-keyless-authentication-flaws/)\n - [https://www.rezonate.io/blog/github-misconfigurations-put-gcp-aws-in-account-takeover-risk](https://www.rezonate.io/blog/github-misconfigurations-put-gcp-aws-in-account-takeover-risk)\n - [https://github.com/Rezonate-io/github-oidc-checker/](https://github.com/Rezonate-io/github-oidc-checker/)\n",
                "text": "Found AWS role policy for GitHub Actions with duplicate condition.\nThis overrides previous conditions, and the last condition with the\nduplicated key \"wins.\" This likely breaks access controls and allows\nunauthorized access.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.aws-oidc-role-policy-duplicate-condition",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.aws-oidc-role-policy-duplicate-condition",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-284: Improper Access Control",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.aws-oidc-role-policy-duplicate-condition"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found AWS role policy for GitHub Actions missing OIDC subject. This\nmeans any GitHub repository can assume this role in CI.\n"
              },
              "help": {
                "markdown": "Found AWS role policy for GitHub Actions missing OIDC subject. This\nmeans any GitHub repository can assume this role in CI.\n\n\n<b>References:</b>\n - [https://securitylabs.datadoghq.com/articles/exploring-github-to-aws-keyless-authentication-flaws/](https://securitylabs.datadoghq.com/articles/exploring-github-to-aws-keyless-authentication-flaws/)\n - [https://www.rezonate.io/blog/github-misconfigurations-put-gcp-aws-in-account-takeover-risk](https://www.rezonate.io/blog/github-misconfigurations-put-gcp-aws-in-account-takeover-risk)\n - [https://github.com/Rezonate-io/github-oidc-checker/](https://github.com/Rezonate-io/github-oidc-checker/)\n",
                "text": "Found AWS role policy for GitHub Actions missing OIDC subject. This\nmeans any GitHub repository can assume this role in CI.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.aws-oidc-role-policy-missing-sub",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.aws-oidc-role-policy-missing-sub",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-284: Improper Access Control",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.aws-oidc-role-policy-missing-sub"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Terraform Vault instance with hardcoded token\n"
              },
              "help": {
                "markdown": "Found Terraform Vault instance with hardcoded token\n\n\n<b>References:</b>\n - [https://registry.terraform.io/providers/hashicorp/vault/latest/docs#token](https://registry.terraform.io/providers/hashicorp/vault/latest/docs#token)\n",
                "text": "Found Terraform Vault instance with hardcoded token\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.vault-hardcoded-token",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.vault-hardcoded-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.vault-hardcoded-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Terraform Vault instance with TLS verification disabled\n"
              },
              "help": {
                "markdown": "Found Terraform Vault instance with TLS verification disabled\n\n\n<b>References:</b>\n - [https://registry.terraform.io/providers/hashicorp/vault/latest/docs#skip_tls_verify](https://registry.terraform.io/providers/hashicorp/vault/latest/docs#skip_tls_verify)\n",
                "text": "Found Terraform Vault instance with TLS verification disabled\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.vault-skip-tls-verify",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.vault-skip-tls-verify",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.hcl.terraform.vault-skip-tls-verify"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The Apollo GraphQL uses the 'schemaDirectives' option. This works in ApolloServer v2, but does nothing in version >=3. Depending on what the directives are used for, this can expose authenticated endpoints, disable rate limiting, and more. See the references on how to create custom directives in v3 and v4."
              },
              "help": {
                "markdown": "The Apollo GraphQL uses the 'schemaDirectives' option. This works in ApolloServer v2, but does nothing in version >=3. Depending on what the directives are used for, this can expose authenticated endpoints, disable rate limiting, and more. See the references on how to create custom directives in v3 and v4.\n\n<b>References:</b>\n - [https://www.apollographql.com/docs/apollo-server/schema/directives/#custom-directives](https://www.apollographql.com/docs/apollo-server/schema/directives/#custom-directives)\n",
                "text": "The Apollo GraphQL uses the 'schemaDirectives' option. This works in ApolloServer v2, but does nothing in version >=3. Depending on what the directives are used for, this can expose authenticated endpoints, disable rate limiting, and more. See the references on how to create custom directives in v3 and v4."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.schema-directives",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.schema-directives",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-686: Function Call With Incorrect Argument Type",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.schema-directives"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The Apollo GraphQL server is using the graphql-upload library. This library allows file uploads using POSTs with content-type: multipart/form-data, which can enable to CSRF attacks. Ensure that you are enabling CSRF protection if you really need to use graphql-upload ."
              },
              "help": {
                "markdown": "The Apollo GraphQL server is using the graphql-upload library. This library allows file uploads using POSTs with content-type: multipart/form-data, which can enable to CSRF attacks. Ensure that you are enabling CSRF protection if you really need to use graphql-upload .\n\n<b>References:</b>\n - [https://github.com/apollographql/apollo-server/security/advisories/GHSA-2p3c-p3qw-69r4](https://github.com/apollographql/apollo-server/security/advisories/GHSA-2p3c-p3qw-69r4)\n",
                "text": "The Apollo GraphQL server is using the graphql-upload library. This library allows file uploads using POSTs with content-type: multipart/form-data, which can enable to CSRF attacks. Ensure that you are enabling CSRF protection if you really need to use graphql-upload ."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.use-of-graphql-upload",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.use-of-graphql-upload",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.use-of-graphql-upload"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The Apollo GraphQL server is setup with a CORS policy that reflects any origin, or with a regex that has known flaws."
              },
              "help": {
                "markdown": "The Apollo GraphQL server is setup with a CORS policy that reflects any origin, or with a regex that has known flaws.\n\n<b>References:</b>\n - [https://www.apollographql.com/docs/apollo-server/v3/security/cors#configuring-cors-options-for-apollo-server](https://www.apollographql.com/docs/apollo-server/v3/security/cors#configuring-cors-options-for-apollo-server)\n",
                "text": "The Apollo GraphQL server is setup with a CORS policy that reflects any origin, or with a regex that has known flaws."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-bad-cors",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-bad-cors",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-bad-cors"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The Apollo GraphQL server lacks the 'csrfPrevention' option. This option is 'false' by the default in v3 of the Apollo GraphQL v3, which can enable CSRF attacks."
              },
              "help": {
                "markdown": "The Apollo GraphQL server lacks the 'csrfPrevention' option. This option is 'false' by the default in v3 of the Apollo GraphQL v3, which can enable CSRF attacks.\n\n<b>References:</b>\n - [https://www.apollographql.com/docs/apollo-server/v3/security/cors/#preventing-cross-site-request-forgery-csrf](https://www.apollographql.com/docs/apollo-server/v3/security/cors/#preventing-cross-site-request-forgery-csrf)\n",
                "text": "The Apollo GraphQL server lacks the 'csrfPrevention' option. This option is 'false' by the default in v3 of the Apollo GraphQL v3, which can enable CSRF attacks."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-csrf-prevention",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-csrf-prevention",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-csrf-prevention"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The Apollo GraphQL server is setup with a CORS policy that reflects any origin, or with a regex that has known flaws."
              },
              "help": {
                "markdown": "The Apollo GraphQL server is setup with a CORS policy that reflects any origin, or with a regex that has known flaws.\n\n<b>References:</b>\n - [https://www.apollographql.com/docs/apollo-server/v3/security/cors#configuring-cors-options-for-apollo-server](https://www.apollographql.com/docs/apollo-server/v3/security/cors#configuring-cors-options-for-apollo-server)\n",
                "text": "The Apollo GraphQL server is setup with a CORS policy that reflects any origin, or with a regex that has known flaws."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-express-bad-cors",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-express-bad-cors",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-express-bad-cors"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The Apollo GraphQL server lacks a CORS policy. By default, the server uses the Access-Control-Allow-Origin HTTP header with the wildcard value (*)."
              },
              "help": {
                "markdown": "The Apollo GraphQL server lacks a CORS policy. By default, the server uses the Access-Control-Allow-Origin HTTP header with the wildcard value (*).\n\n<b>References:</b>\n - [https://www.apollographql.com/docs/apollo-server/v3/security/cors#configuring-cors-options-for-apollo-server](https://www.apollographql.com/docs/apollo-server/v3/security/cors#configuring-cors-options-for-apollo-server)\n",
                "text": "The Apollo GraphQL server lacks a CORS policy. By default, the server uses the Access-Control-Allow-Origin HTTP header with the wildcard value (*)."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-express-no-cors",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-express-no-cors",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-express-no-cors"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The Apollo GraphQL server lacks a CORS policy. By default, the batteries-included apollo-server package serves the Access-Control-Allow-Origin HTTP header with the wildcard value (*)."
              },
              "help": {
                "markdown": "The Apollo GraphQL server lacks a CORS policy. By default, the batteries-included apollo-server package serves the Access-Control-Allow-Origin HTTP header with the wildcard value (*).\n\n<b>References:</b>\n - [https://www.apollographql.com/docs/apollo-server/v3/security/cors#configuring-cors-options-for-apollo-server](https://www.apollographql.com/docs/apollo-server/v3/security/cors#configuring-cors-options-for-apollo-server)\n",
                "text": "The Apollo GraphQL server lacks a CORS policy. By default, the batteries-included apollo-server package serves the Access-Control-Allow-Origin HTTP header with the wildcard value (*)."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-no-cors",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-no-cors",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-no-cors"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The Apollo GraphQL server is setup with a CORS policy that does not deny all origins. Carefully review the origins to see if any of them are incorrectly setup (third-party websites, bad regexes, functions that reflect every origin, etc.)."
              },
              "help": {
                "markdown": "The Apollo GraphQL server is setup with a CORS policy that does not deny all origins. Carefully review the origins to see if any of them are incorrectly setup (third-party websites, bad regexes, functions that reflect every origin, etc.).\n\n<b>References:</b>\n - [https://www.apollographql.com/docs/apollo-server/v3/security/cors#configuring-cors-options-for-apollo-server](https://www.apollographql.com/docs/apollo-server/v3/security/cors#configuring-cors-options-for-apollo-server)\n",
                "text": "The Apollo GraphQL server is setup with a CORS policy that does not deny all origins. Carefully review the origins to see if any of them are incorrectly setup (third-party websites, bad regexes, functions that reflect every origin, etc.)."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-potentially-bad-cors",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-potentially-bad-cors",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v3-potentially-bad-cors"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The Apollo GraphQL server sets the 'csrfPrevention' option to false. This can enable CSRF attacks."
              },
              "help": {
                "markdown": "The Apollo GraphQL server sets the 'csrfPrevention' option to false. This can enable CSRF attacks.\n\n<b>References:</b>\n - [https://www.apollographql.com/docs/apollo-server/v3/security/cors/#preventing-cross-site-request-forgery-csrf](https://www.apollographql.com/docs/apollo-server/v3/security/cors/#preventing-cross-site-request-forgery-csrf)\n",
                "text": "The Apollo GraphQL server sets the 'csrfPrevention' option to false. This can enable CSRF attacks."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v4-csrf-prevention",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v4-csrf-prevention",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.javascript.apollo-graphql.v4-csrf-prevention"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Calling `gc` suggests to the JVM that the garbage collector should be\nrun, and memory should be reclaimed. This is only a suggestion, and there\nis no guarantee that anything will happen. Relying on this behavior for\ncorrectness or memory management is an anti-pattern.\n"
              },
              "help": {
                "markdown": "Calling `gc` suggests to the JVM that the garbage collector should be\nrun, and memory should be reclaimed. This is only a suggestion, and there\nis no guarantee that anything will happen. Relying on this behavior for\ncorrectness or memory management is an anti-pattern.\n\n\n<b>References:</b>\n - [https://stackoverflow.com/questions/2414105/why-is-it-bad-practice-to-call-system-gc](https://stackoverflow.com/questions/2414105/why-is-it-bad-practice-to-call-system-gc)\n",
                "text": "Calling `gc` suggests to the JVM that the garbage collector should be\nrun, and memory should be reclaimed. This is only a suggestion, and there\nis no guarantee that anything will happen. Relying on this behavior for\ncorrectness or memory management is an anti-pattern.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.jvm.gc-call",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.jvm.gc-call",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "HIGH CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.jvm.gc-call"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found MongoDB client with SSL hostname verification disabled"
              },
              "help": {
                "markdown": "Found MongoDB client with SSL hostname verification disabled\n\n<b>References:</b>\n - [https://www.mongodb.com/docs/drivers/java/sync/current/fundamentals/connection/tls/#disable-hostname-verification](https://www.mongodb.com/docs/drivers/java/sync/current/fundamentals/connection/tls/#disable-hostname-verification)\n",
                "text": "Found MongoDB client with SSL hostname verification disabled"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.jvm.mongo-hostname-verification-disabled",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.jvm.mongo-hostname-verification-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.jvm.mongo-hostname-verification-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"
              },
              "help": {
                "markdown": "If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency\n\n<b>References:</b>\n - [https://pytorch.org/docs/stable/data.html#memory-pinning](https://pytorch.org/docs/stable/data.html#memory-pinning)\n",
                "text": "If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.automatic-memory-pinning",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.automatic-memory-pinning",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.automatic-memory-pinning"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"
              },
              "help": {
                "markdown": "Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks\n\n<b>References:</b>\n - [https://lxml.de/FAQ.html](https://lxml.de/FAQ.html)\n",
                "text": "Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.lxml-in-pandas",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.lxml-in-pandas",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-611: Improper Restriction of XML External Entity Reference",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.lxml-in-pandas"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found usage of msgpack-numpy unpacking, which relies on pickle to deserialize numpy arrays containing objects. Functions reliant on pickle can result in arbitrary code execution.  Consider switching to a safer serialization method."
              },
              "help": {
                "markdown": "Found usage of msgpack-numpy unpacking, which relies on pickle to deserialize numpy arrays containing objects. Functions reliant on pickle can result in arbitrary code execution.  Consider switching to a safer serialization method.\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n",
                "text": "Found usage of msgpack-numpy unpacking, which relies on pickle to deserialize numpy arrays containing objects. Functions reliant on pickle can result in arbitrary code execution.  Consider switching to a safer serialization method."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.msgpack-numpy",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.msgpack-numpy",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.msgpack-numpy"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "NumPy distutils is deprecated, and will be removed in the future"
              },
              "help": {
                "markdown": "NumPy distutils is deprecated, and will be removed in the future\n\n<b>References:</b>\n - [https://numpy.org/doc/stable/reference/distutils.html](https://numpy.org/doc/stable/reference/distutils.html)\n",
                "text": "NumPy distutils is deprecated, and will be removed in the future"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-distutils",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-distutils",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-distutils"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Compiling arbitrary code can result in code execution. Ensure the source code is from a trusted location"
              },
              "help": {
                "markdown": "Compiling arbitrary code can result in code execution. Ensure the source code is from a trusted location\n\n<b>References:</b>\n - [https://numpy.org/doc/stable/f2py/usage.html](https://numpy.org/doc/stable/f2py/usage.html)\n",
                "text": "Compiling arbitrary code can result in code execution. Ensure the source code is from a trusted location"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-f2py-compile",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-f2py-compile",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-f2py-compile"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Using the NumPy RNG inside of a PyTorch dataset can lead to a number of issues with loading data, including identical augmentations. Instead, use the random number generators built into Python and PyTorch"
              },
              "help": {
                "markdown": "Using the NumPy RNG inside of a PyTorch dataset can lead to a number of issues with loading data, including identical augmentations. Instead, use the random number generators built into Python and PyTorch\n\n<b>References:</b>\n - [https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects](https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects)\n",
                "text": "Using the NumPy RNG inside of a PyTorch dataset can lead to a number of issues with loading data, including identical augmentations. Instead, use the random number generators built into Python and PyTorch"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-in-pytorch-datasets",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-in-pytorch-datasets",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-330: Use of Insufficiently Random Values",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-in-pytorch-datasets"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"
              },
              "help": {
                "markdown": "Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading\n\n<b>References:</b>\n - [https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects](https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects)\n",
                "text": "Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-in-pytorch-modules",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-in-pytorch-modules",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "MEDIUM CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-in-pytorch-modules"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Loading custom operator libraries can result in arbitrary code execution"
              },
              "help": {
                "markdown": "Loading custom operator libraries can result in arbitrary code execution\n\n<b>References:</b>\n - [https://numpy.org/doc/stable/reference/routines.ctypeslib.html#numpy.ctypeslib.load_library](https://numpy.org/doc/stable/reference/routines.ctypeslib.html#numpy.ctypeslib.load_library)\n",
                "text": "Loading custom operator libraries can result in arbitrary code execution"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-load-library",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-load-library",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.numpy-load-library"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Loading custom operator libraries can result in arbitrary code execution"
              },
              "help": {
                "markdown": "Loading custom operator libraries can result in arbitrary code execution\n\n<b>References:</b>\n - [https://onnxruntime.ai/docs/reference/operators/add-custom-op.html](https://onnxruntime.ai/docs/reference/operators/add-custom-op.html)\n",
                "text": "Loading custom operator libraries can result in arbitrary code execution"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.onnx-session-options",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.onnx-session-options",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.onnx-session-options"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Pandas eval() and query() may be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."
              },
              "help": {
                "markdown": "Pandas eval() and query() may be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n",
                "text": "Pandas eval() and query() may be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pandas-eval",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pandas-eval",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pandas-eval"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Keras' load_model function may result in arbitrary code execution: - It can load vulnerable pickled models - It can load an hdf5 model that contains a lambda layer with arbitrary code\n  that will be executed every time the model is used (loading, training, eval)\nNote: Keras loading with the built-in file format should be safe as long as checks are not disabled."
              },
              "help": {
                "markdown": "Keras' load_model function may result in arbitrary code execution: - It can load vulnerable pickled models - It can load an hdf5 model that contains a lambda layer with arbitrary code\n  that will be executed every time the model is used (loading, training, eval)\nNote: Keras loading with the built-in file format should be safe as long as checks are not disabled.\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n",
                "text": "Keras' load_model function may result in arbitrary code execution: - It can load vulnerable pickled models - It can load an hdf5 model that contains a lambda layer with arbitrary code\n  that will be executed every time the model is used (loading, training, eval)\nNote: Keras loading with the built-in file format should be safe as long as checks are not disabled."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-keras",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-keras",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-keras"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "The usage of pickle and hdf5 formats for model files are deprecated in Keras. The keras.models.load_model function is deprecated as well. Keras is now embedded in Tensorflow 2 under tensorflow.keras."
              },
              "help": {
                "markdown": "The usage of pickle and hdf5 formats for model files are deprecated in Keras. The keras.models.load_model function is deprecated as well. Keras is now embedded in Tensorflow 2 under tensorflow.keras.\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n",
                "text": "The usage of pickle and hdf5 formats for model files are deprecated in Keras. The keras.models.load_model function is deprecated as well. Keras is now embedded in Tensorflow 2 under tensorflow.keras."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-keras-deprecation",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-keras-deprecation",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-keras-deprecation"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"
              },
              "help": {
                "markdown": "Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n",
                "text": "Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-numpy",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-numpy",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-numpy"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"
              },
              "help": {
                "markdown": "Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n",
                "text": "Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-pandas",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-pandas",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-pandas"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"
              },
              "help": {
                "markdown": "Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n",
                "text": "Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-pytorch",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-pytorch",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-pytorch"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Functions reliant on pickle can result in arbitrary code execution"
              },
              "help": {
                "markdown": "Functions reliant on pickle can result in arbitrary code execution\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n",
                "text": "Functions reliant on pickle can result in arbitrary code execution"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-pytorch-distributed",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-pytorch-distributed",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-pytorch-distributed"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Tensorflow's low-level load function may result in arbitrary code execution."
              },
              "help": {
                "markdown": "Tensorflow's low-level load function may result in arbitrary code execution.\n\n<b>References:</b>\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n",
                "text": "Tensorflow's low-level load function may result in arbitrary code execution."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-tensorflow",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-tensorflow",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pickles-in-tensorflow"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Loading custom operator libraries can result in arbitrary code execution"
              },
              "help": {
                "markdown": "Loading custom operator libraries can result in arbitrary code execution\n\n<b>References:</b>\n - [https://pytorch.org/tutorials/advanced/torch_script_custom_classes.html](https://pytorch.org/tutorials/advanced/torch_script_custom_classes.html)\n",
                "text": "Loading custom operator libraries can result in arbitrary code execution"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pytorch-classes-load-library",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pytorch-classes-load-library",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pytorch-classes-load-library"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Avoid importing torch.package - it can result in arbitrary code execution via pickle"
              },
              "help": {
                "markdown": "Avoid importing torch.package - it can result in arbitrary code execution via pickle\n\n<b>References:</b>\n - [https://pytorch.org/docs/1.13/package.html#torch-package](https://pytorch.org/docs/1.13/package.html#torch-package)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n",
                "text": "Avoid importing torch.package - it can result in arbitrary code execution via pickle"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pytorch-package",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pytorch-package",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pytorch-package"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Avoid using `torch.Tensor()` to directly create a tensor for efficiency and proper parsing"
              },
              "help": {
                "markdown": "Avoid using `torch.Tensor()` to directly create a tensor for efficiency and proper parsing\n\n<b>References:</b>\n - [https://pytorch.org/docs/stable/tensors.html](https://pytorch.org/docs/stable/tensors.html)\n",
                "text": "Avoid using `torch.Tensor()` to directly create a tensor for efficiency and proper parsing"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pytorch-tensor",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pytorch-tensor",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "HIGH CONFIDENCE"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.pytorch-tensor"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Scikit `joblib` uses pickle under the hood. Functions reliant on pickle can result in arbitrary code execution. Consider using `skops` instead."
              },
              "help": {
                "markdown": "Scikit `joblib` uses pickle under the hood. Functions reliant on pickle can result in arbitrary code execution. Consider using `skops` instead.\n\n<b>References:</b>\n - [https://scikit-learn.org/stable/model_persistence.html](https://scikit-learn.org/stable/model_persistence.html)\n",
                "text": "Scikit `joblib` uses pickle under the hood. Functions reliant on pickle can result in arbitrary code execution. Consider using `skops` instead."
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.scikit-joblib-load",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.scikit-joblib-load",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.scikit-joblib-load"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"
              },
              "help": {
                "markdown": "Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker\n\n<b>References:</b>\n - [https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall](https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall)\n",
                "text": "Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.tarfile-extractall-traversal",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.tarfile-extractall-traversal",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.tarfile-extractall-traversal"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Loading custom operator libraries can result in arbitrary code execution"
              },
              "help": {
                "markdown": "Loading custom operator libraries can result in arbitrary code execution\n\n<b>References:</b>\n - [https://www.tensorflow.org/api_docs/python/tf/load_library](https://www.tensorflow.org/api_docs/python/tf/load_library)\n - [https://www.tensorflow.org/api_docs/python/tf/load_op_library](https://www.tensorflow.org/api_docs/python/tf/load_op_library)\n",
                "text": "Loading custom operator libraries can result in arbitrary code execution"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.tensorflow-load-library",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.tensorflow-load-library",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-676: Use of Potentially Dangerous Function",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.tensorflow-load-library"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Not waiting for requests is a source of undefined behavior"
              },
              "help": {
                "markdown": "Not waiting for requests is a source of undefined behavior\n\n<b>References:</b>\n - [https://pytorch.org/docs/stable/distributed.html#torch.distributed.isend](https://pytorch.org/docs/stable/distributed.html#torch.distributed.isend)\n",
                "text": "Not waiting for requests is a source of undefined behavior"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.waiting-with-pytorch-distributed",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.waiting-with-pytorch-distributed",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.python.waiting-with-pytorch-distributed"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "`expect` or `unwrap` called in function returning a `Result`"
              },
              "help": {
                "markdown": "`expect` or `unwrap` called in function returning a `Result`\n\n<b>References:</b>\n - [https://doc.rust-lang.org/std/result/](https://doc.rust-lang.org/std/result/)\n",
                "text": "`expect` or `unwrap` called in function returning a `Result`"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.rs.panic-in-function-returning-result",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.rs.panic-in-function-returning-result",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-755: Improper Handling of Exceptional Conditions",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.rs.panic-in-function-returning-result"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Rails application with insecure SSL setting.\n"
              },
              "help": {
                "markdown": "Found Rails application with insecure SSL setting.\n\n\n<b>References:</b>\n - [https://api.rubyonrails.org/v7.1.3.4/classes/ActionDispatch/SSL.html](https://api.rubyonrails.org/v7.1.3.4/classes/ActionDispatch/SSL.html)\n",
                "text": "Found Rails application with insecure SSL setting.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.action-dispatch-insecure-ssl",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.action-dispatch-insecure-ssl",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.action-dispatch-insecure-ssl"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found ActionMailer SMTP configuration with insecure TLS setting. These\nsettings do not require a successful, encrypted, verified TLS connection\nis made. Set `enable_starttls: true` and `openssl_verify_mode` to verify\npeer\n"
              },
              "help": {
                "markdown": "Found ActionMailer SMTP configuration with insecure TLS setting. These\nsettings do not require a successful, encrypted, verified TLS connection\nis made. Set `enable_starttls: true` and `openssl_verify_mode` to verify\npeer\n\n\n<b>References:</b>\n - [https://guides.rubyonrails.org/action_mailer_basics.html#action-mailer-configuration](https://guides.rubyonrails.org/action_mailer_basics.html#action-mailer-configuration)\n",
                "text": "Found ActionMailer SMTP configuration with insecure TLS setting. These\nsettings do not require a successful, encrypted, verified TLS connection\nis made. Set `enable_starttls: true` and `openssl_verify_mode` to verify\npeer\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.action-mailer-insecure-tls",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.action-mailer-insecure-tls",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.action-mailer-insecure-tls"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found an ActiveRecord value with encryption before serialization. The\ndeclaration of the serialized attribute should go before the encryption\ndeclaration.\n"
              },
              "help": {
                "markdown": "Found an ActiveRecord value with encryption before serialization. The\ndeclaration of the serialized attribute should go before the encryption\ndeclaration.\n\n\n<b>References:</b>\n - [https://guides.rubyonrails.org/active_record_encryption.html#supported-types](https://guides.rubyonrails.org/active_record_encryption.html#supported-types)\n",
                "text": "Found an ActiveRecord value with encryption before serialization. The\ndeclaration of the serialized attribute should go before the encryption\ndeclaration.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.active-record-encrypts-misorder",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.active-record-encrypts-misorder",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-311: Missing Encryption of Sensitive Data",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.active-record-encrypts-misorder"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found hardcoded ActiveRecord encryption key\n"
              },
              "help": {
                "markdown": "Found hardcoded ActiveRecord encryption key\n\n\n<b>References:</b>\n - [https://guides.rubyonrails.org/active_record_encryption.html#supported-types](https://guides.rubyonrails.org/active_record_encryption.html#supported-types)\n",
                "text": "Found hardcoded ActiveRecord encryption key\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.active-record-hardcoded-encryption-key",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.active-record-hardcoded-encryption-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.active-record-hardcoded-encryption-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Faraday HTTP request disabling SSL/TLS verification.\n"
              },
              "help": {
                "markdown": "Found Faraday HTTP request disabling SSL/TLS verification.\n\n\n<b>References:</b>\n - [https://lostisland.github.io/faraday/#/customization/ssl-options](https://lostisland.github.io/faraday/#/customization/ssl-options)\n",
                "text": "Found Faraday HTTP request disabling SSL/TLS verification.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.faraday-disable-verification",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.faraday-disable-verification",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.faraday-disable-verification"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found `Timeout::timeout` (or `timeout`) use. Setting a global timeout\ncan cause an exception to be raised anywhere in the passed block of code.\nThis precludes any possible clean up action typically associated with\nrescuing from exceptions. This can lead to denial-of-service, data\nintegrity failure, and general availability concerns. Instead prefer to\nuse the library's built in timeout functionality, if it has any, to\nensure processing happens as expected. If it does not have built in\ntimeout functionality, then consider implementing it.\n"
              },
              "help": {
                "markdown": "Found `Timeout::timeout` (or `timeout`) use. Setting a global timeout\ncan cause an exception to be raised anywhere in the passed block of code.\nThis precludes any possible clean up action typically associated with\nrescuing from exceptions. This can lead to denial-of-service, data\nintegrity failure, and general availability concerns. Instead prefer to\nuse the library's built in timeout functionality, if it has any, to\nensure processing happens as expected. If it does not have built in\ntimeout functionality, then consider implementing it.\n\n\n<b>References:</b>\n - [https://ruby-doc.org/3.3.2/stdlibs/timeout/Timeout.html](https://ruby-doc.org/3.3.2/stdlibs/timeout/Timeout.html)\n - [https://jvns.ca/blog/2015/11/27/why-rubys-timeout-is-dangerous-and-thread-dot-raise-is-terrifying/](https://jvns.ca/blog/2015/11/27/why-rubys-timeout-is-dangerous-and-thread-dot-raise-is-terrifying/)\n - [https://www.mikeperham.com/2015/05/08/timeout-rubys-most-dangerous-api/](https://www.mikeperham.com/2015/05/08/timeout-rubys-most-dangerous-api/)\n - [http://blog.headius.com/2008/02/rubys-threadraise-threadkill-timeoutrb.html](http://blog.headius.com/2008/02/rubys-threadraise-threadkill-timeoutrb.html)\n",
                "text": "Found `Timeout::timeout` (or `timeout`) use. Setting a global timeout\ncan cause an exception to be raised anywhere in the passed block of code.\nThis precludes any possible clean up action typically associated with\nrescuing from exceptions. This can lead to denial-of-service, data\nintegrity failure, and general availability concerns. Instead prefer to\nuse the library's built in timeout functionality, if it has any, to\nensure processing happens as expected. If it does not have built in\ntimeout functionality, then consider implementing it.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.global-timeout",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.global-timeout",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-460: Improper Cleanup on Thrown Exception",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.global-timeout"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Rails session cookie missing SameSite=Secure. As of Rails 7.2,\nsession cookies default to SameSite=Lax.\n"
              },
              "help": {
                "markdown": "Found Rails session cookie missing SameSite=Secure. As of Rails 7.2,\nsession cookies default to SameSite=Lax.\n\n\n<b>References:</b>\n - [https://api.rubyonrails.org/classes/ActionDispatch/Session/CookieStore.html](https://api.rubyonrails.org/classes/ActionDispatch/Session/CookieStore.html)\n",
                "text": "Found Rails session cookie missing SameSite=Secure. As of Rails 7.2,\nsession cookies default to SameSite=Lax.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.insecure-rails-cookie-session-store",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.insecure-rails-cookie-session-store",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-345: Insufficient Verification of Data Authenticity",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.insecure-rails-cookie-session-store"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Found `json_create` class method. This implies custom JSON deserialization\nis occuring. This can lead to RCE and other deserialization-type bugs.\nUsage should be audited and, at least, fuzzed.\n"
              },
              "help": {
                "markdown": "Found `json_create` class method. This implies custom JSON deserialization\nis occuring. This can lead to RCE and other deserialization-type bugs.\nUsage should be audited and, at least, fuzzed.\n\n\n<b>References:</b>\n - [https://github.blog/2024-06-20-execute-commands-by-sending-json-learn-how-unsafe-deserialization-vulnerabilities-work-in-ruby-projects/](https://github.blog/2024-06-20-execute-commands-by-sending-json-learn-how-unsafe-deserialization-vulnerabilities-work-in-ruby-projects/)\n - [https://github.com/github/codeql/blob/main/ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationCustomizations.qll](https://github.com/github/codeql/blob/main/ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationCustomizations.qll)\n - [https://stackoverflow.com/questions/17226402/whats-the-difference-between-json-load-and-json-parse-methods-of-ruby-lib](https://stackoverflow.com/questions/17226402/whats-the-difference-between-json-load-and-json-parse-methods-of-ruby-lib)\n",
                "text": "Found `json_create` class method. This implies custom JSON deserialization\nis occuring. This can lead to RCE and other deserialization-type bugs.\nUsage should be audited and, at least, fuzzed.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.json-create-deserialization",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.json-create-deserialization",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.json-create-deserialization"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Found `marshal_load` class method. This implies custom Marshal\ndeserialization is occuring. This can lead to RCE and other\ndeserialization-type bugs.  Usage should be audited and, at least, fuzzed.\n"
              },
              "help": {
                "markdown": "Found `marshal_load` class method. This implies custom Marshal\ndeserialization is occuring. This can lead to RCE and other\ndeserialization-type bugs.  Usage should be audited and, at least, fuzzed.\n\n\n<b>References:</b>\n - [https://github.blog/2024-06-20-execute-commands-by-sending-json-learn-how-unsafe-deserialization-vulnerabilities-work-in-ruby-projects/](https://github.blog/2024-06-20-execute-commands-by-sending-json-learn-how-unsafe-deserialization-vulnerabilities-work-in-ruby-projects/)\n - [https://github.com/GitHubSecurityLab/ruby-unsafe-deserialization/blob/main/marshal/3.4-rc/marshal-rce-ruby-3.4-rc.rb](https://github.com/GitHubSecurityLab/ruby-unsafe-deserialization/blob/main/marshal/3.4-rc/marshal-rce-ruby-3.4-rc.rb)\n",
                "text": "Found `marshal_load` class method. This implies custom Marshal\ndeserialization is occuring. This can lead to RCE and other\ndeserialization-type bugs.  Usage should be audited and, at least, fuzzed.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.marshal-load-method",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.marshal-load-method",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.marshal-load-method"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Rails cache store configured to allow Marshaling. As of Rails 7.1\nthe default serializer is `:marshal_7_1`. If an attacker can inject\ndata into the cache store (SSRF, etc.), then they can achieve code\nexecution when the object is later deserialized. Consider using a\ncustom serializer like JSON or MessagePack that does not fallback on\nMarshal.\n"
              },
              "help": {
                "markdown": "Found Rails cache store configured to allow Marshaling. As of Rails 7.1\nthe default serializer is `:marshal_7_1`. If an attacker can inject\ndata into the cache store (SSRF, etc.), then they can achieve code\nexecution when the object is later deserialized. Consider using a\ncustom serializer like JSON or MessagePack that does not fallback on\nMarshal.\n\n\n<b>References:</b>\n - [https://github.com/rails/rails/blob/v7.1.4/activesupport/lib/active_support/cache.rb#L327](https://github.com/rails/rails/blob/v7.1.4/activesupport/lib/active_support/cache.rb#L327)\n - [https://github.com/rails/rails/blob/v7.1.4/activesupport/lib/active_support/cache/serializer_with_fallback.rb#L166-L172](https://github.com/rails/rails/blob/v7.1.4/activesupport/lib/active_support/cache/serializer_with_fallback.rb#L166-L172)\n - [https://api.rubyonrails.org/v7.1.3.4/classes/ActiveSupport/Cache/MemCacheStore.html](https://api.rubyonrails.org/v7.1.3.4/classes/ActiveSupport/Cache/MemCacheStore.html)\n - [https://api.rubyonrails.org/v7.1.3.4/classes/ActiveSupport/Cache/Store.html](https://api.rubyonrails.org/v7.1.3.4/classes/ActiveSupport/Cache/Store.html)\n",
                "text": "Found Rails cache store configured to allow Marshaling. As of Rails 7.1\nthe default serializer is `:marshal_7_1`. If an attacker can inject\ndata into the cache store (SSRF, etc.), then they can achieve code\nexecution when the object is later deserialized. Consider using a\ncustom serializer like JSON or MessagePack that does not fallback on\nMarshal.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rails-cache-store-marshal",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rails-cache-store-marshal",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rails-cache-store-marshal"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Rails cookie set with insecure attribute.\n"
              },
              "help": {
                "markdown": "Found Rails cookie set with insecure attribute.\n\n\n<b>References:</b>\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie)\n - [https://api.rubyonrails.org/classes/ActionDispatch/Session/CookieStore.html](https://api.rubyonrails.org/classes/ActionDispatch/Session/CookieStore.html)\n",
                "text": "Found Rails cookie set with insecure attribute.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rails-cookie-attributes",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rails-cookie-attributes",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-345: Insufficient Verification of Data Authenticity",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rails-cookie-attributes"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Rails parameters (`params`) using the `_json` parameter. This\nparameter is subject to parser juggling. This may allow an attacker to\nexploit differences in parameter processing at different points in the\nrequest processing lifecycle. For example, object ID processing during\nthe authentication/authorization phase and action execution phase.\n"
              },
              "help": {
                "markdown": "Found Rails parameters (`params`) using the `_json` parameter. This\nparameter is subject to parser juggling. This may allow an attacker to\nexploit differences in parameter processing at different points in the\nrequest processing lifecycle. For example, object ID processing during\nthe authentication/authorization phase and action execution phase.\n\n\n<b>References:</b>\n - [https://nastystereo.com/security/rails-_json-juggling-attack.html](https://nastystereo.com/security/rails-_json-juggling-attack.html)\n - [https://api.rubyonrails.org/v5.1.7/classes/ActionDispatch/Http/Parameters.html](https://api.rubyonrails.org/v5.1.7/classes/ActionDispatch/Http/Parameters.html)\n - [https://api.rubyonrails.org/classes/ActionController/Parameters.html](https://api.rubyonrails.org/classes/ActionController/Parameters.html)\n",
                "text": "Found Rails parameters (`params`) using the `_json` parameter. This\nparameter is subject to parser juggling. This may allow an attacker to\nexploit differences in parameter processing at different points in the\nrequest processing lifecycle. For example, object ID processing during\nthe authentication/authorization phase and action execution phase.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rails-params-json",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rails-params-json",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rails-params-json"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found RestClient HTTP request disabling SSL/TLS verification.\n"
              },
              "help": {
                "markdown": "Found RestClient HTTP request disabling SSL/TLS verification.\n\n\n<b>References:</b>\n - [https://github.com/rest-client/rest-client#ssl-client-certificates](https://github.com/rest-client/rest-client#ssl-client-certificates)\n",
                "text": "Found RestClient HTTP request disabling SSL/TLS verification.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rest-client-disable-verification",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rest-client-disable-verification",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.rest-client-disable-verification"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "SAML response validation disabled for $KEY.\n"
              },
              "help": {
                "markdown": "SAML response validation disabled for $KEY.\n\n\n<b>References:</b>\n - [https://github.com/SAML-Toolkits/ruby-saml/blob/v1.16.0/lib/onelogin/ruby-saml/response.rb](https://github.com/SAML-Toolkits/ruby-saml/blob/v1.16.0/lib/onelogin/ruby-saml/response.rb)\n",
                "text": "SAML response validation disabled for $KEY.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.ruby-saml-skip-validation",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.ruby-saml-skip-validation",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-345: Insufficient Verification of Data Authenticity",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.ruby-saml-skip-validation"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found YAML call to `unsafe_load`. This can lead to deserialization bugs and RCE.\n"
              },
              "help": {
                "markdown": "Found YAML call to `unsafe_load`. This can lead to deserialization bugs and RCE.\n\n\n<b>References:</b>\n - [https://bishopfox.com/blog/ruby-vulnerabilities-exploits](https://bishopfox.com/blog/ruby-vulnerabilities-exploits)\n - [https://github.com/semgrep/semgrep-rules/blob/develop/ruby/lang/security/bad-deserialization-yaml.yaml](https://github.com/semgrep/semgrep-rules/blob/develop/ruby/lang/security/bad-deserialization-yaml.yaml)\n",
                "text": "Found YAML call to `unsafe_load`. This can lead to deserialization bugs and RCE.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.yaml-unsafe-load",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.yaml-unsafe-load",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.ruby.yaml-unsafe-load"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Potentially insecure URL host suffix check. Using hasSuffix(\"domain.com\") without  a leading dot can match unintended domains like \"fakedomain.com\"\n"
              },
              "help": {
                "markdown": "Potentially insecure URL host suffix check. Using hasSuffix(\"domain.com\") without  a leading dot can match unintended domains like \"fakedomain.com\"\n\n\n<b>References:</b>\n - [https://developer.apple.com/documentation/foundation/url/host(percentencoded:)](https://developer.apple.com/documentation/foundation/url/host(percentencoded:))\n - [https://developer.apple.com/documentation/foundation/nsstring/hassuffix(_:)](https://developer.apple.com/documentation/foundation/nsstring/hassuffix(_:))\n - [https://pentesterlab.com/blog/rust-cors-vulnerabilities](https://pentesterlab.com/blog/rust-cors-vulnerabilities)\n",
                "text": "Potentially insecure URL host suffix check. Using hasSuffix(\"domain.com\") without  a leading dot can match unintended domains like \"fakedomain.com\"\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.swift.insecure-url-host-hassuffix-check",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.swift.insecure-url-host-hassuffix-check",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-697",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.swift.insecure-url-host-hassuffix-check"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found apt key download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "help": {
                "markdown": "Found apt key download with unencrypted URL (e.g. HTTP, FTP, etc.)\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_key_module.html#parameter-url](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_key_module.html#parameter-url)\n",
                "text": "Found apt key download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.apt-key-unencrypted-url",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.apt-key-unencrypted-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.apt-key-unencrypted-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found apt key with SSL verification disabled"
              },
              "help": {
                "markdown": "Found apt key with SSL verification disabled\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_key_module.html#parameter-validate_certs](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_key_module.html#parameter-validate_certs)\n",
                "text": "Found apt key with SSL verification disabled"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.apt-key-validate-certs-disabled",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.apt-key-validate-certs-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.apt-key-validate-certs-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found apt deb with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "help": {
                "markdown": "Found apt deb with unencrypted URL (e.g. HTTP, FTP, etc.)\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_module.html#parameter-deb](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_module.html#parameter-deb)\n",
                "text": "Found apt deb with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.apt-unencrypted-url",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.apt-unencrypted-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.apt-unencrypted-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found dnf download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "help": {
                "markdown": "Found dnf download with unencrypted URL (e.g. HTTP, FTP, etc.)\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/dnf_module.html#parameter-name](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/dnf_module.html#parameter-name)\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/dnf5_module.html#parameter-name](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/dnf5_module.html#parameter-name)\n",
                "text": "Found dnf download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.dnf-unencrypted-url",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.dnf-unencrypted-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.dnf-unencrypted-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found dnf with SSL verification disabled"
              },
              "help": {
                "markdown": "Found dnf with SSL verification disabled\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/dnf_module.html#parameter-validate_certs](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/dnf_module.html#parameter-validate_certs)\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/dnf5_module.html#parameter-validate_certs](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/dnf5_module.html#parameter-validate_certs)\n",
                "text": "Found dnf with SSL verification disabled"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.dnf-validate-certs-disabled",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.dnf-validate-certs-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.dnf-validate-certs-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found file download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "help": {
                "markdown": "Found file download with unencrypted URL (e.g. HTTP, FTP, etc.)\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/get_url_module.html#parameter-url](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/get_url_module.html#parameter-url)\n - [https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_get_url_module.html#parameter-url](https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_get_url_module.html#parameter-url)\n",
                "text": "Found file download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.get-url-unencrypted-url",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.get-url-unencrypted-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.get-url-unencrypted-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found file download with SSL verification disabled"
              },
              "help": {
                "markdown": "Found file download with SSL verification disabled\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/get_url_module.html#parameter-validate_certs](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/get_url_module.html#parameter-validate_certs)\n - [https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_get_url_module.html#parameter-validate_certs](https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_get_url_module.html#parameter-validate_certs)\n",
                "text": "Found file download with SSL verification disabled"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.get-url-validate-certs-disabled",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.get-url-validate-certs-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.get-url-validate-certs-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found RPM key download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "help": {
                "markdown": "Found RPM key download with unencrypted URL (e.g. HTTP, FTP, etc.)\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/rpm_key_module.html#parameter-key](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/rpm_key_module.html#parameter-key)\n",
                "text": "Found RPM key download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.rpm-key-unencrypted-url",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.rpm-key-unencrypted-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.rpm-key-unencrypted-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found RPM key with SSL verification disabled"
              },
              "help": {
                "markdown": "Found RPM key with SSL verification disabled\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/rpm_key_module.html#parameter-validate_certs](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/rpm_key_module.html#parameter-validate_certs)\n",
                "text": "Found RPM key with SSL verification disabled"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.rpm-key-validate-certs-disabled",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.rpm-key-validate-certs-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.rpm-key-validate-certs-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found unarchive download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "help": {
                "markdown": "Found unarchive download with unencrypted URL (e.g. HTTP, FTP, etc.)\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/unarchive_module.html#parameter-src](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/unarchive_module.html#parameter-src)\n",
                "text": "Found unarchive download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.unarchive-unencrypted-url",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.unarchive-unencrypted-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.unarchive-unencrypted-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found unarchive download with SSL verification disabled"
              },
              "help": {
                "markdown": "Found unarchive download with SSL verification disabled\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/unarchive_module.html#parameter-validate_certs](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/unarchive_module.html#parameter-validate_certs)\n",
                "text": "Found unarchive download with SSL verification disabled"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.unarchive-validate-certs-disabled",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.unarchive-validate-certs-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.unarchive-validate-certs-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Windows Remote Management connection with certificate validation disabled"
              },
              "help": {
                "markdown": "Found Windows Remote Management connection with certificate validation disabled\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/os_guide/windows_winrm.html#https-certificate-validation](https://docs.ansible.com/ansible/latest/os_guide/windows_winrm.html#https-certificate-validation)\n",
                "text": "Found Windows Remote Management connection with certificate validation disabled"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.wrm-cert-validation-ignore",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.wrm-cert-validation-ignore",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.wrm-cert-validation-ignore"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found yum download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "help": {
                "markdown": "Found yum download with unencrypted URL (e.g. HTTP, FTP, etc.)\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/yum_module.html#parameter-name](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/yum_module.html#parameter-name)\n",
                "text": "Found yum download with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.yum-unencrypted-url",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.yum-unencrypted-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.yum-unencrypted-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found yum with SSL verification disabled"
              },
              "help": {
                "markdown": "Found yum with SSL verification disabled\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/yum_module.html#parameter-validate_certs](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/yum_module.html#parameter-validate_certs)\n",
                "text": "Found yum with SSL verification disabled"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.yum-validate-certs-disabled",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.yum-validate-certs-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.yum-validate-certs-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Zypper repository with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "help": {
                "markdown": "Found Zypper repository with unencrypted URL (e.g. HTTP, FTP, etc.)\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/community/general/zypper_module.html#parameter-name](https://docs.ansible.com/ansible/latest/collections/community/general/zypper_module.html#parameter-name)\n",
                "text": "Found Zypper repository with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.zypper-repository-unencrypted-url",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.zypper-repository-unencrypted-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.zypper-repository-unencrypted-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found Zypper package with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "help": {
                "markdown": "Found Zypper package with unencrypted URL (e.g. HTTP, FTP, etc.)\n\n<b>References:</b>\n - [https://docs.ansible.com/ansible/latest/collections/community/general/zypper_module.html#parameter-name](https://docs.ansible.com/ansible/latest/collections/community/general/zypper_module.html#parameter-name)\n",
                "text": "Found Zypper package with unencrypted URL (e.g. HTTP, FTP, etc.)"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.zypper-unencrypted-url",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.zypper-unencrypted-url",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.ansible.zypper-unencrypted-url"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Service port is exposed on all interfaces"
              },
              "help": {
                "markdown": "Service port is exposed on all interfaces\n\n<b>References:</b>\n - [https://docs.docker.com/compose/compose-file/compose-file-v3/#ports](https://docs.docker.com/compose/compose-file/compose-file-v3/#ports)\n",
                "text": "Service port is exposed on all interfaces"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.docker-compose.port-all-interfaces",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.docker-compose.port-all-interfaces",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1327: Binding to an Unrestricted IP Address",
                  "LOW CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.docker-compose.port-all-interfaces"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found long-term access key. Instead prefer AWS role assumption and\ntemporary OIDC security credentials.\n"
              },
              "help": {
                "markdown": "Found long-term access key. Instead prefer AWS role assumption and\ntemporary OIDC security credentials.\n\n\n<b>References:</b>\n - [https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html#sec-alternatives-to-long-term-access-keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html#sec-alternatives-to-long-term-access-keys)\n - [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)\n - [https://github.com/aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials)\n",
                "text": "Found long-term access key. Instead prefer AWS role assumption and\ntemporary OIDC security credentials.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.aws-secret-key",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.aws-secret-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.aws-secret-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found long-term access key. Instead prefer Azure subscription ID and\ntemporary OIDC security credentials.\n"
              },
              "help": {
                "markdown": "Found long-term access key. Instead prefer Azure subscription ID and\ntemporary OIDC security credentials.\n\n\n<b>References:</b>\n - [https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure)\n - [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-azure](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-azure)\n - [https://github.com/Azure/login](https://github.com/Azure/login)\n",
                "text": "Found long-term access key. Instead prefer Azure subscription ID and\ntemporary OIDC security credentials.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.azure-principal-secret",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.azure-principal-secret",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.azure-principal-secret"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found long-term access key. Instead prefer GCP workload identity\nfederation and temporary OIDC security credentials.\n"
              },
              "help": {
                "markdown": "Found long-term access key. Instead prefer GCP workload identity\nfederation and temporary OIDC security credentials.\n\n\n<b>References:</b>\n - [https://cloud.google.com/blog/products/identity-security/enabling-keyless-authentication-from-github-actions](https://cloud.google.com/blog/products/identity-security/enabling-keyless-authentication-from-github-actions)\n - [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform)\n - [https://github.com/google-github-actions/auth](https://github.com/google-github-actions/auth)\n",
                "text": "Found long-term access key. Instead prefer GCP workload identity\nfederation and temporary OIDC security credentials.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.gcp-credentials-json",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.gcp-credentials-json",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.gcp-credentials-json"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found long-term access key. Instead prefer JFrog temporary OIDC security credentials\n"
              },
              "help": {
                "markdown": "Found long-term access key. Instead prefer JFrog temporary OIDC security credentials\n\n\n<b>References:</b>\n - [https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration)\n - [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-jfrog](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-jfrog)\n - [https://github.com/jfrog/setup-jfrog-cli#authorization](https://github.com/jfrog/setup-jfrog-cli#authorization)\n",
                "text": "Found long-term access key. Instead prefer JFrog temporary OIDC security credentials\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.jfrog-hardcoded-credential",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.jfrog-hardcoded-credential",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.jfrog-hardcoded-credential"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found long-term access key. Instead prefer PyPI trusted publishing and\ntemporary OIDC security credentials.\n"
              },
              "help": {
                "markdown": "Found long-term access key. Instead prefer PyPI trusted publishing and\ntemporary OIDC security credentials.\n\n\n<b>References:</b>\n - [https://docs.pypi.org/trusted-publishers/](https://docs.pypi.org/trusted-publishers/)\n - [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-pypi](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-pypi)\n - [https://github.com/pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish)\n",
                "text": "Found long-term access key. Instead prefer PyPI trusted publishing and\ntemporary OIDC security credentials.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.pypi-publish-password",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.pypi-publish-password",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.pypi-publish-password"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found long-term access key. Instead prefer RubyGems trusted publishing and\ntemporary OIDC security credentials.\n"
              },
              "help": {
                "markdown": "Found long-term access key. Instead prefer RubyGems trusted publishing and\ntemporary OIDC security credentials.\n\n\n<b>References:</b>\n - [https://guides.rubygems.org/trusted-publishing/](https://guides.rubygems.org/trusted-publishing/)\n - [https://guides.rubygems.org/api-key-scopes/#usage-with-gem-cli](https://guides.rubygems.org/api-key-scopes/#usage-with-gem-cli)\n - [https://github.com/rubygems/release-gem](https://github.com/rubygems/release-gem)\n",
                "text": "Found long-term access key. Instead prefer RubyGems trusted publishing and\ntemporary OIDC security credentials.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.rubygems-publish-key",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.rubygems-publish-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.rubygems-publish-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found long-term access key. Instead prefer Vault role assumption and\ntemporary OIDC security credentials.\n"
              },
              "help": {
                "markdown": "Found long-term access key. Instead prefer Vault role assumption and\ntemporary OIDC security credentials.\n\n\n<b>References:</b>\n - [https://developer.hashicorp.com/vault/docs/platform/github-actions](https://developer.hashicorp.com/vault/docs/platform/github-actions)\n - [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-hashicorp-vault](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-hashicorp-vault)\n - [https://github.com/hashicorp/vault-action](https://github.com/hashicorp/vault-action)\n",
                "text": "Found long-term access key. Instead prefer Vault role assumption and\ntemporary OIDC security credentials.\n"
              },
              "id": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.vault-token",
              "name": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.vault-token",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-798: Use of Hard-coded Credentials",
                  "HIGH CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.trailofbits-semgrep-rules.yaml.github-actions.vault-token"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."
              },
              "help": {
                "markdown": "Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec)\n - [https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec](https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n",
                "text": "Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec",
              "id": "python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec",
              "name": "python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."
              },
              "help": {
                "markdown": "Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec)\n - [https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec](https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n",
                "text": "Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec",
              "id": "python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec",
              "name": "python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."
              },
              "help": {
                "markdown": "Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell)\n - [https://docs.python.org/3/library/asyncio-subprocess.html](https://docs.python.org/3/library/asyncio-subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n",
                "text": "Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell",
              "id": "python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell",
              "name": "python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here."
              },
              "help": {
                "markdown": "Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process",
              "id": "python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process",
              "name": "python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose."
              },
              "help": {
                "markdown": "Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n",
                "text": "Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use",
              "id": "python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use",
              "name": "python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."
              },
              "help": {
                "markdown": "Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call",
              "id": "python.aws-lambda.security.dangerous-system-call.dangerous-system-call",
              "name": "python.aws-lambda.security.dangerous-system-call.dangerous-system-call",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.dangerous-system-call.dangerous-system-call"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."
              },
              "help": {
                "markdown": "Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection)\n - [https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac](https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac)\n",
                "text": "Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection",
              "id": "python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection",
              "name": "python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"
              },
              "help": {
                "markdown": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html)\n",
                "text": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli",
              "id": "python.aws-lambda.security.mysql-sqli.mysql-sqli",
              "name": "python.aws-lambda.security.mysql-sqli.mysql-sqli",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.mysql-sqli.mysql-sqli"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"
              },
              "help": {
                "markdown": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli)\n - [https://www.psycopg.org/docs/cursor.html#cursor.execute](https://www.psycopg.org/docs/cursor.html#cursor.execute)\n - [https://www.psycopg.org/docs/cursor.html#cursor.executemany](https://www.psycopg.org/docs/cursor.html#cursor.executemany)\n - [https://www.psycopg.org/docs/cursor.html#cursor.mogrify](https://www.psycopg.org/docs/cursor.html#cursor.mogrify)\n",
                "text": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli",
              "id": "python.aws-lambda.security.psycopg-sqli.psycopg-sqli",
              "name": "python.aws-lambda.security.psycopg-sqli.psycopg-sqli",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.psycopg-sqli.psycopg-sqli"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"
              },
              "help": {
                "markdown": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli)\n - [https://pypi.org/project/pymssql/](https://pypi.org/project/pymssql/)\n",
                "text": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli",
              "id": "python.aws-lambda.security.pymssql-sqli.pymssql-sqli",
              "name": "python.aws-lambda.security.pymssql-sqli.pymssql-sqli",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.pymssql-sqli.pymssql-sqli"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"
              },
              "help": {
                "markdown": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli)\n - [https://pypi.org/project/PyMySQL/#id4](https://pypi.org/project/PyMySQL/#id4)\n",
                "text": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli",
              "id": "python.aws-lambda.security.pymysql-sqli.pymysql-sqli",
              "name": "python.aws-lambda.security.pymysql-sqli.pymysql-sqli",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.pymysql-sqli.pymysql-sqli"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`"
              },
              "help": {
                "markdown": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli)\n - [https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute](https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute)\n",
                "text": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli",
              "id": "python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli",
              "name": "python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."
              },
              "help": {
                "markdown": "Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec",
              "id": "python.aws-lambda.security.tainted-code-exec.tainted-code-exec",
              "name": "python.aws-lambda.security.tainted-code-exec.tainted-code-exec",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.tainted-code-exec.tainted-code-exec"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."
              },
              "help": {
                "markdown": "Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response",
              "id": "python.aws-lambda.security.tainted-html-response.tainted-html-response",
              "name": "python.aws-lambda.security.tainted-html-response.tainted-html-response",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.tainted-html-response.tainted-html-response"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."
              },
              "help": {
                "markdown": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string",
              "id": "python.aws-lambda.security.tainted-html-string.tainted-html-string",
              "name": "python.aws-lambda.security.tainted-html-string.tainted-html-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.tainted-html-string.tainted-html-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."
              },
              "help": {
                "markdown": "Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n",
                "text": "Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization",
              "id": "python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization",
              "name": "python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."
              },
              "help": {
                "markdown": "Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n",
                "text": "Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string",
              "id": "python.aws-lambda.security.tainted-sql-string.tainted-sql-string",
              "name": "python.aws-lambda.security.tainted-sql-string.tainted-sql-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.aws-lambda.security.tainted-sql-string.tainted-sql-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption."
              },
              "help": {
                "markdown": "Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://cwe.mitre.org/data/definitions/310.html](https://cwe.mitre.org/data/definitions/310.html)\n",
                "text": "Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key",
              "id": "python.cryptography.security.empty-aes-key.empty-aes-key",
              "name": "python.cryptography.security.empty-aes-key.empty-aes-key",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-310: Cryptographic Issues",
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A6:2017 misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.cryptography.security.empty-aes-key.empty-aes-key"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."
              },
              "help": {
                "markdown": "ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n",
                "text": "ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4",
              "id": "python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4",
              "name": "python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."
              },
              "help": {
                "markdown": "Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n",
                "text": "Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish",
              "id": "python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish",
              "name": "python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."
              },
              "help": {
                "markdown": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n",
                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
              "id": "python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
              "name": "python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."
              },
              "help": {
                "markdown": "Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf](https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n",
                "text": "Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
              "id": "python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
              "name": "python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher."
              },
              "help": {
                "markdown": "Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n",
                "text": "Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
              "id": "python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
              "name": "python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "An encryption mode of operation is being used without proper message authentication. This can potentially result in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. "
              },
              "help": {
                "markdown": "An encryption mode of operation is being used without proper message authentication. This can potentially result in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. \n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "An encryption mode of operation is being used without proper message authentication. This can potentially result in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. \n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication",
              "id": "python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication",
              "name": "python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security."
              },
              "help": {
                "markdown": "Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.distributed.security.require-encryption)\n - [https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters](https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters)\n",
                "text": "Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.distributed.security.require-encryption",
              "id": "python.distributed.security.require-encryption",
              "name": "python.distributed.security.require-encryption",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.distributed.security.require-encryption"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data"
              },
              "help": {
                "markdown": "Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid)\n - [https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data](https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data)\n",
                "text": "Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid",
              "id": "python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid",
              "name": "python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-20: Improper Input Validation",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs."
              },
              "help": {
                "markdown": "The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret)\n - [https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY](https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n",
                "text": "The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret",
              "id": "python.django.security.hashids-with-django-secret.hashids-with-django-secret",
              "name": "python.django.security.hashids-with-django-secret.hashids-with-django-secret",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 \u2013 Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.hashids-with-django-secret.hashids-with-django-secret"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information."
              },
              "help": {
                "markdown": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n",
                "text": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string",
              "id": "python.django.security.injection.code.user-eval-format-string.user-eval-format-string",
              "name": "python.django.security.injection.code.user-eval-format-string.user-eval-format-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.code.user-eval-format-string.user-eval-format-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."
              },
              "help": {
                "markdown": "Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n",
                "text": "Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string",
              "id": "python.django.security.injection.code.user-exec-format-string.user-exec-format-string",
              "name": "python.django.security.injection.code.user-exec-format-string.user-exec-format-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.code.user-exec-format-string.user-exec-format-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."
              },
              "help": {
                "markdown": "Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection",
              "id": "python.django.security.injection.command.subprocess-injection.subprocess-injection",
              "name": "python.django.security.injection.command.subprocess-injection.subprocess-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "HIGH CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.command.subprocess-injection.subprocess-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs."
              },
              "help": {
                "markdown": "Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.csv-writer-injection.csv-writer-injection)\n - [https://github.com/raphaelm/defusedcsv](https://github.com/raphaelm/defusedcsv)\n - [https://owasp.org/www-community/attacks/CSV_Injection](https://owasp.org/www-community/attacks/CSV_Injection)\n - [https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities](https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities)\n",
                "text": "Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.csv-writer-injection.csv-writer-injection",
              "id": "python.django.security.injection.csv-writer-injection.csv-writer-injection",
              "name": "python.django.security.injection.csv-writer-injection.csv-writer-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1236: Improper Neutralization of Formula Elements in a CSV File",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.csv-writer-injection.csv-writer-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information."
              },
              "help": {
                "markdown": "Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect)\n - [https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/](https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/)\n - [https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231](https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231)\n",
                "text": "Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect",
              "id": "python.django.security.injection.open-redirect.open-redirect",
              "name": "python.django.security.injection.open-redirect.open-redirect",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.open-redirect.open-redirect"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."
              },
              "help": {
                "markdown": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n",
                "text": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open",
              "id": "python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open",
              "name": "python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A05:2017 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead."
              },
              "help": {
                "markdown": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format)\n - [https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render](https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render)\n - [https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection](https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection)\n",
                "text": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format",
              "id": "python.django.security.injection.raw-html-format.raw-html-format",
              "name": "python.django.security.injection.raw-html-format.raw-html-format",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.raw-html-format.raw-html-format"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."
              },
              "help": {
                "markdown": "Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n",
                "text": "Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse",
              "id": "python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse",
              "name": "python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."
              },
              "help": {
                "markdown": "Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n",
                "text": "Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest",
              "id": "python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest",
              "name": "python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse."
              },
              "help": {
                "markdown": "Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n",
                "text": "Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse",
              "id": "python.django.security.injection.request-data-fileresponse.request-data-fileresponse",
              "name": "python.django.security.injection.request-data-fileresponse.request-data-fileresponse",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A05:2017 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.request-data-fileresponse.request-data-fileresponse"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized."
              },
              "help": {
                "markdown": "Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write",
              "id": "python.django.security.injection.request-data-write.request-data-write",
              "name": "python.django.security.injection.request-data-write.request-data-write",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.request-data-write.request-data-write"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."
              },
              "help": {
                "markdown": "User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra)\n",
                "text": "User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where",
              "id": "python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where",
              "name": "python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."
              },
              "help": {
                "markdown": "User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL)\n",
                "text": "User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql",
              "id": "python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql",
              "name": "python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."
              },
              "help": {
                "markdown": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n",
                "text": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute",
              "id": "python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute",
              "name": "python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."
              },
              "help": {
                "markdown": "Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n",
                "text": "Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw",
              "id": "python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw",
              "name": "python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."
              },
              "help": {
                "markdown": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n",
                "text": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests",
              "id": "python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests",
              "name": "python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-918: Server-Side Request Forgery (SSRF)",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A10:2021 - Server-Side Request Forgery (SSRF)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."
              },
              "help": {
                "markdown": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n",
                "text": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib",
              "id": "python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib",
              "name": "python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-918: Server-Side Request Forgery (SSRF)",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A10:2021 - Server-Side Request Forgery (SSRF)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."
              },
              "help": {
                "markdown": "Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n",
                "text": "Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.nan-injection.nan-injection",
              "id": "python.django.security.nan-injection.nan-injection",
              "name": "python.django.security.nan-injection.nan-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-704: Incorrect Type Conversion or Cast",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.nan-injection.nan-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'."
              },
              "help": {
                "markdown": "'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n",
                "text": "'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string",
              "id": "python.django.security.passwords.password-empty-string.password-empty-string",
              "name": "python.django.security.passwords.password-empty-string.password-empty-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-521: Weak Password Requirements",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.django.security.passwords.password-empty-string.password-empty-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided."
              },
              "help": {
                "markdown": "CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://cwe.mitre.org/data/definitions/942.html](https://cwe.mitre.org/data/definitions/942.html)\n",
                "text": "CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors",
              "id": "python.fastapi.security.wildcard-cors.wildcard-cors",
              "name": "python.fastapi.security.wildcard-cors.wildcard-cors",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.fastapi.security.wildcard-cors.wildcard-cors"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'."
              },
              "help": {
                "markdown": "Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string",
              "id": "python.flask.security.audit.directly-returned-format-string.directly-returned-format-string",
              "name": "python.flask.security.audit.directly-returned-format-string.directly-returned-format-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Function `flask.url_for` with `_external=True` argument will generate URLs using the `Host` header of the HTTP request, which may lead to security risks such as Host header injection"
              },
              "help": {
                "markdown": "Function `flask.url_for` with `_external=True` argument will generate URLs using the `Host` header of the HTTP request, which may lead to security risks such as Host header injection\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true)\n - [https://flask.palletsprojects.com/en/latest/api/#flask.url_for](https://flask.palletsprojects.com/en/latest/api/#flask.url_for)\n - [https://portswigger.net/kb/issues/00500300_host-header-injection](https://portswigger.net/kb/issues/00500300_host-header-injection)\n",
                "text": "Function `flask.url_for` with `_external=True` argument will generate URLs using the `Host` header of the HTTP request, which may lead to security risks such as Host header injection\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true",
              "id": "python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true",
              "name": "python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-673: External Influence of Sphere Definition",
                  "HIGH CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs."
              },
              "help": {
                "markdown": "The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret)\n - [https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY](https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n",
                "text": "The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret",
              "id": "python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret",
              "name": "python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 \u2013 Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs."
              },
              "help": {
                "markdown": "Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.csv-writer-injection.csv-writer-injection)\n - [https://github.com/raphaelm/defusedcsv](https://github.com/raphaelm/defusedcsv)\n - [https://owasp.org/www-community/attacks/CSV_Injection](https://owasp.org/www-community/attacks/CSV_Injection)\n - [https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities](https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities)\n",
                "text": "Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.injection.csv-writer-injection.csv-writer-injection",
              "id": "python.flask.security.injection.csv-writer-injection.csv-writer-injection",
              "name": "python.flask.security.injection.csv-writer-injection.csv-writer-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1236: Improper Neutralization of Formula Elements in a CSV File",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.injection.csv-writer-injection.csv-writer-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."
              },
              "help": {
                "markdown": "Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n",
                "text": "Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection",
              "id": "python.flask.security.injection.nan-injection.nan-injection",
              "name": "python.flask.security.injection.nan-injection.nan-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-704: Incorrect Type Conversion or Cast",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.injection.nan-injection.nan-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list."
              },
              "help": {
                "markdown": "User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n",
                "text": "User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection",
              "id": "python.flask.security.injection.os-system-injection.os-system-injection",
              "name": "python.flask.security.injection.os-system-injection.os-system-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.injection.os-system-injection.os-system-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."
              },
              "help": {
                "markdown": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n",
                "text": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open",
              "id": "python.flask.security.injection.path-traversal-open.path-traversal-open",
              "name": "python.flask.security.injection.path-traversal-open.path-traversal-open",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A05:2017 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.injection.path-traversal-open.path-traversal-open"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead."
              },
              "help": {
                "markdown": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format)\n - [https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss)\n",
                "text": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format",
              "id": "python.flask.security.injection.raw-html-concat.raw-html-format",
              "name": "python.flask.security.injection.raw-html-concat.raw-html-format",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.injection.raw-html-concat.raw-html-format"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."
              },
              "help": {
                "markdown": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n",
                "text": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests",
              "id": "python.flask.security.injection.ssrf-requests.ssrf-requests",
              "name": "python.flask.security.injection.ssrf-requests.ssrf-requests",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-918: Server-Side Request Forgery (SSRF)",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A10:2021 - Server-Side Request Forgery (SSRF)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.injection.ssrf-requests.ssrf-requests"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."
              },
              "help": {
                "markdown": "Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection",
              "id": "python.flask.security.injection.subprocess-injection.subprocess-injection",
              "name": "python.flask.security.injection.subprocess-injection.subprocess-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "HIGH CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.injection.subprocess-injection.subprocess-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."
              },
              "help": {
                "markdown": "Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n - [https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm](https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column)\n",
                "text": "Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string",
              "id": "python.flask.security.injection.tainted-sql-string.tainted-sql-string",
              "name": "python.flask.security.injection.tainted-sql-string.tainted-sql-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-704: Incorrect Type Conversion or Cast",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.injection.tainted-sql-string.tainted-sql-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."
              },
              "help": {
                "markdown": "User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n",
                "text": "User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host",
              "id": "python.flask.security.injection.tainted-url-host.tainted-url-host",
              "name": "python.flask.security.injection.tainted-url-host.tainted-url-host",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-918: Server-Side Request Forgery (SSRF)",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2025 - Broken Access Control",
                  "OWASP-A10:2021 - Server-Side Request Forgery (SSRF)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.flask.security.injection.tainted-url-host.tainted-url-host"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a Jinja2 environment with 'autoescaping' disabled. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable 'autoescaping' by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions."
              },
              "help": {
                "markdown": "Detected a Jinja2 environment with 'autoescaping' disabled. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable 'autoescaping' by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled)\n - [https://jinja.palletsprojects.com/en/2.11.x/api/#basics](https://jinja.palletsprojects.com/en/2.11.x/api/#basics)\n",
                "text": "Detected a Jinja2 environment with 'autoescaping' disabled. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable 'autoescaping' by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled",
              "id": "python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled",
              "name": "python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-116: Improper Encoding or Escaping of Output",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions."
              },
              "help": {
                "markdown": "Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled)\n - [https://jinja.palletsprojects.com/en/2.11.x/api/#basics](https://jinja.palletsprojects.com/en/2.11.x/api/#basics)\n",
                "text": "Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled",
              "id": "python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled",
              "name": "python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-116: Improper Encoding or Escaping of Output",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"
              },
              "help": {
                "markdown": "Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n",
                "text": "Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret",
              "id": "python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret",
              "name": "python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-522: Insufficiently Protected Credentials",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2017 - Broken Authentication",
                  "OWASP-A04:2021 - Insecure Design",
                  "OWASP-A06:2025 - Insecure Design",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."
              },
              "help": {
                "markdown": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg",
              "id": "python.jwt.security.jwt-none-alg.jwt-python-none-alg",
              "name": "python.jwt.security.jwt-none-alg.jwt-python-none-alg",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.jwt.security.jwt-none-alg.jwt-python-none-alg"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified."
              },
              "help": {
                "markdown": "Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode)\n - [https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96](https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96)\n",
                "text": "Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode",
              "id": "python.jwt.security.unverified-jwt-decode.unverified-jwt-decode",
              "name": "python.jwt.security.unverified-jwt-decode.unverified-jwt-decode",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-287: Improper Authentication",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2017 - Broken Authentication",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected subprocess function '$LOOP.subprocess_exec' with user controlled data. You may consider using 'shlex.escape()'."
              },
              "help": {
                "markdown": "Detected subprocess function '$LOOP.subprocess_exec' with user controlled data. You may consider using 'shlex.escape()'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args)\n - [https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec](https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Detected subprocess function '$LOOP.subprocess_exec' with user controlled data. You may consider using 'shlex.escape()'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args",
              "id": "python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args",
              "name": "python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected asyncio subprocess function with user controlled data. You may consider using 'shlex.escape()'."
              },
              "help": {
                "markdown": "Detected asyncio subprocess function with user controlled data. You may consider using 'shlex.escape()'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args)\n - [https://docs.python.org/3/library/asyncio-subprocess.html](https://docs.python.org/3/library/asyncio-subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Detected asyncio subprocess function with user controlled data. You may consider using 'shlex.escape()'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args",
              "id": "python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args",
              "name": "python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."
              },
              "help": {
                "markdown": "Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args",
              "id": "python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args",
              "name": "python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."
              },
              "help": {
                "markdown": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args",
              "id": "python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args",
              "name": "python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."
              },
              "help": {
                "markdown": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args",
              "id": "python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args",
              "name": "python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."
              },
              "help": {
                "markdown": "Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args)\n - [https://bugs.python.org/issue43472](https://bugs.python.org/issue43472)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args",
              "id": "python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args",
              "name": "python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'."
              },
              "help": {
                "markdown": "Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args",
              "id": "python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args",
              "name": "python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."
              },
              "help": {
                "markdown": "Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args",
              "id": "python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args",
              "name": "python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."
              },
              "help": {
                "markdown": "Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args",
              "id": "python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args",
              "name": "python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else."
              },
              "help": {
                "markdown": "These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions",
              "id": "python.lang.security.audit.insecure-file-permissions.insecure-file-permissions",
              "name": "python.lang.security.audit.insecure-file-permissions.insecure-file-permissions",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-276: Incorrect Default Permissions",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."
              },
              "help": {
                "markdown": "Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context",
              "id": "python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context",
              "name": "python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."
              },
              "help": {
                "markdown": "Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http",
              "id": "python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http",
              "name": "python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http"
              }
            },
            {
              "defaultConfiguration": {
                "level": "note"
              },
              "fullDescription": {
                "text": "Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead."
              },
              "help": {
                "markdown": "Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http",
              "id": "python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http",
              "name": "python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-319: Cleartext Transmission of Sensitive Information",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information."
              },
              "help": {
                "markdown": "Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n",
                "text": "Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure",
              "id": "python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure",
              "name": "python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-532: Insertion of Sensitive Information into Log File",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A09:2021 - Security Logging and Monitoring Failures",
                  "OWASP-A09:2025 - Security Logging & Alerting Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."
              },
              "help": {
                "markdown": "It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.python.org/3/library/hashlib.html#hashlib.scrypt](https://docs.python.org/3/library/hashlib.html#hashlib.scrypt)\n",
                "text": "It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password",
              "id": "python.lang.security.audit.md5-used-as-password.md5-used-as-password",
              "name": "python.lang.security.audit.md5-used-as-password.md5-used-as-password",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.md5-used-as-password.md5-used-as-password"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "certificate verification explicitly disabled, insecure connections possible"
              },
              "help": {
                "markdown": "certificate verification explicitly disabled, insecure connections possible\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
                "text": "certificate verification explicitly disabled, insecure connections possible\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation",
              "id": "python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation",
              "name": "python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-295: Improper Certificate Validation",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A07:2021 - Identification and Authentication Failures",
                  "OWASP-A07:2025 - Authentication Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security."
              },
              "help": {
                "markdown": "This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sha224-hash.sha224-hash)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf)\n - [https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography)\n",
                "text": "This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.audit.sha224-hash.sha224-hash",
              "id": "python.lang.security.audit.sha224-hash.sha224-hash",
              "name": "python.lang.security.audit.sha224-hash.sha224-hash",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.audit.sha224-hash.sha224-hash"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."
              },
              "help": {
                "markdown": "Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run",
              "id": "python.lang.security.dangerous-code-run.dangerous-interactive-code-run",
              "name": "python.lang.security.dangerous-code-run.dangerous-interactive-code-run",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.dangerous-code-run.dangerous-interactive-code-run"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."
              },
              "help": {
                "markdown": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec",
              "id": "python.lang.security.dangerous-os-exec.dangerous-os-exec",
              "name": "python.lang.security.dangerous-os-exec.dangerous-os-exec",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.dangerous-os-exec.dangerous-os-exec"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."
              },
              "help": {
                "markdown": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process",
              "id": "python.lang.security.dangerous-spawn-process.dangerous-spawn-process",
              "name": "python.lang.security.dangerous-spawn-process.dangerous-spawn-process",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.dangerous-spawn-process.dangerous-spawn-process"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."
              },
              "help": {
                "markdown": "Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string)\n - [https://bugs.python.org/issue43472](https://bugs.python.org/issue43472)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string",
              "id": "python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string",
              "name": "python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."
              },
              "help": {
                "markdown": "Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use",
              "id": "python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use",
              "name": "python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."
              },
              "help": {
                "markdown": "Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call",
              "id": "python.lang.security.dangerous-system-call.dangerous-system-call",
              "name": "python.lang.security.dangerous-system-call.dangerous-system-call",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.dangerous-system-call.dangerous-system-call"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."
              },
              "help": {
                "markdown": "Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n",
                "text": "Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp",
              "id": "python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp",
              "name": "python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead."
              },
              "help": {
                "markdown": "Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel)\n - [https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ](https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ)\n",
                "text": "Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel",
              "id": "python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel",
              "name": "python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-502: Deserialization of Untrusted Data",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A08:2017 - Insecure Deserialization",
                  "OWASP-A08:2021 - Software and Data Integrity Failures",
                  "OWASP-A08:2025 - Software or Data Integrity Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."
              },
              "help": {
                "markdown": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n",
                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
              "id": "python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
              "name": "python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security."
              },
              "help": {
                "markdown": "Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version)\n - [https://www.landh.tech/blog/20230811-sandwich-attack/](https://www.landh.tech/blog/20230811-sandwich-attack/)\n",
                "text": "Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version",
              "id": "python.lang.security.insecure-uuid-version.insecure-uuid-version",
              "name": "python.lang.security.insecure-uuid-version.insecure-uuid-version",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-330: Use of Insufficiently Random Values",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.insecure-uuid-version.insecure-uuid-version"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`."
              },
              "help": {
                "markdown": "The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse)\n - [https://docs.python.org/3/library/xml.html](https://docs.python.org/3/library/xml.html)\n - [https://github.com/tiran/defusedxml](https://github.com/tiran/defusedxml)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n",
                "text": "The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse",
              "id": "python.lang.security.use-defused-xml-parse.use-defused-xml-parse",
              "name": "python.lang.security.use-defused-xml-parse.use-defused-xml-parse",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-611: Improper Restriction of XML External Entity Reference",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A04:2017 - XML External Entities (XXE)",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.lang.security.use-defused-xml-parse.use-defused-xml-parse"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."
              },
              "help": {
                "markdown": "Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n",
                "text": "Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish",
              "id": "python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish",
              "name": "python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."
              },
              "help": {
                "markdown": "Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n",
                "text": "Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des",
              "id": "python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des",
              "name": "python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."
              },
              "help": {
                "markdown": "Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n",
                "text": "Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2",
              "id": "python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2",
              "name": "python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."
              },
              "help": {
                "markdown": "Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n",
                "text": "Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4",
              "id": "python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4",
              "name": "python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."
              },
              "help": {
                "markdown": "Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n",
                "text": "Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2",
              "id": "python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2",
              "name": "python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."
              },
              "help": {
                "markdown": "Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n",
                "text": "Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4",
              "id": "python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4",
              "name": "python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."
              },
              "help": {
                "markdown": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n",
                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5",
              "id": "python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5",
              "name": "python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."
              },
              "help": {
                "markdown": "Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/dsa](https://www.pycryptodome.org/src/public_key/dsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n",
                "text": "Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
              "id": "python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
              "name": "python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher."
              },
              "help": {
                "markdown": "Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/rsa#rsa](https://www.pycryptodome.org/src/public_key/rsa#rsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n",
                "text": "Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
              "id": "python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
              "name": "python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-326: Inadequate Encryption Strength",
                  "HIGH CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "An encryption mode of operation is being used without proper message authentication. This can potentially result in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. "
              },
              "help": {
                "markdown": "An encryption mode of operation is being used without proper message authentication. This can potentially result in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. \n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
                "text": "An encryption mode of operation is being used without proper message authentication. This can potentially result in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. \n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication",
              "id": "python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication",
              "name": "python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2021 - Cryptographic Failures",
                  "OWASP-A03:2017 - Sensitive Data Exposure",
                  "OWASP-A04:2025 - Cryptographic Failures",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details)."
              },
              "help": {
                "markdown": "Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth)\n - [https://cwe.mitre.org/data/definitions/477.html](https://cwe.mitre.org/data/definitions/477.html)\n",
                "text": "Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth",
              "id": "python.pymongo.security.mongodb.mongo-client-bad-auth",
              "name": "python.pymongo.security.mongodb.mongo-client-bad-auth",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-477: Use of Obsolete Function",
                  "MEDIUM CONFIDENCE",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pymongo.security.mongodb.mongo-client-bad-auth"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker."
              },
              "help": {
                "markdown": "Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
                "text": "Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default",
              "id": "python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default",
              "name": "python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker."
              },
              "help": {
                "markdown": "Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
                "text": "Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value",
              "id": "python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value",
              "name": "python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Pyramid Authentication Ticket without the samesite option correctly set. Pyramid cookies should be handled securely by setting samesite='Lax'. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker."
              },
              "help": {
                "markdown": "Found a Pyramid Authentication Ticket without the samesite option correctly set. Pyramid cookies should be handled securely by setting samesite='Lax'. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Found a Pyramid Authentication Ticket without the samesite option correctly set. Pyramid cookies should be handled securely by setting samesite='Lax'. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite",
              "id": "python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite",
              "name": "python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1275: Sensitive Cookie with Improper SameSite Attribute",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Pyramid Authentication Ticket cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker."
              },
              "help": {
                "markdown": "Found a Pyramid Authentication Ticket cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
                "text": "Found a Pyramid Authentication Ticket cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default",
              "id": "python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default",
              "name": "python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Pyramid Authentication Ticket cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker."
              },
              "help": {
                "markdown": "Found a Pyramid Authentication Ticket cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
                "text": "Found a Pyramid Authentication Ticket cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value",
              "id": "python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value",
              "name": "python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Automatic check of the referrer for cross-site request forgery tokens has been explicitly disabled globally, which might leave views unprotected when an unsafe CSRF storage policy is used. Use 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)' to turn the automatic check for all unsafe methods (per RFC2616)."
              },
              "help": {
                "markdown": "Automatic check of the referrer for cross-site request forgery tokens has been explicitly disabled globally, which might leave views unprotected when an unsafe CSRF storage policy is used. Use 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)' to turn the automatic check for all unsafe methods (per RFC2616).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Automatic check of the referrer for cross-site request forgery tokens has been explicitly disabled globally, which might leave views unprotected when an unsafe CSRF storage policy is used. Use 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)' to turn the automatic check for all unsafe methods (per RFC2616).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally",
              "id": "python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally",
              "name": "python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Origin check for the CSRF token is disabled for this view. This might represent a security risk if the CSRF storage policy is not known to be secure."
              },
              "help": {
                "markdown": "Origin check for the CSRF token is disabled for this view. This might represent a security risk if the CSRF storage policy is not known to be secure.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Origin check for the CSRF token is disabled for this view. This might represent a security risk if the CSRF storage policy is not known to be secure.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled",
              "id": "python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled",
              "name": "python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Pyramid cookie using an unsafe default for the httponly option. Pyramid cookies should be handled securely by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker."
              },
              "help": {
                "markdown": "Found a Pyramid cookie using an unsafe default for the httponly option. Pyramid cookies should be handled securely by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
                "text": "Found a Pyramid cookie using an unsafe default for the httponly option. Pyramid cookies should be handled securely by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default",
              "id": "python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default",
              "name": "python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Pyramid cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker."
              },
              "help": {
                "markdown": "Found a Pyramid cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value)\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n - [https://owasp.org/www-community/HttpOnly](https://owasp.org/www-community/HttpOnly)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#httponly-attribute](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#httponly-attribute)\n",
                "text": "Found a Pyramid cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value",
              "id": "python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value",
              "name": "python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Pyramid cookie using an unsafe value for the samesite option. Pyramid cookies should be handled securely by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker."
              },
              "help": {
                "markdown": "Found a Pyramid cookie using an unsafe value for the samesite option. Pyramid cookies should be handled securely by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Found a Pyramid cookie using an unsafe value for the samesite option. Pyramid cookies should be handled securely by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default",
              "id": "python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default",
              "name": "python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1275: Sensitive Cookie with Improper SameSite Attribute",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Pyramid cookie without the samesite option correctly set. Pyramid cookies should be handled securely by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker."
              },
              "help": {
                "markdown": "Found a Pyramid cookie without the samesite option correctly set. Pyramid cookies should be handled securely by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Found a Pyramid cookie without the samesite option correctly set. Pyramid cookies should be handled securely by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value",
              "id": "python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value",
              "name": "python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-1275: Sensitive Cookie with Improper SameSite Attribute",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Pyramid cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker."
              },
              "help": {
                "markdown": "Found a Pyramid cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
                "text": "Found a Pyramid cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default",
              "id": "python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default",
              "name": "python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Found a Pyramid cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker."
              },
              "help": {
                "markdown": "Found a Pyramid cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
                "text": "Found a Pyramid cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value",
              "id": "python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value",
              "name": "python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A02:2025 - Security Misconfiguration",
                  "OWASP-A05:2021 - Security Misconfiguration",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave views unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)' to turn the automatic check for all unsafe methods (per RFC2616)."
              },
              "help": {
                "markdown": "Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave views unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)' to turn the automatic check for all unsafe methods (per RFC2616).\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
                "text": "Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave views unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)' to turn the automatic check for all unsafe methods (per RFC2616).\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally",
              "id": "python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally",
              "name": "python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2021 - Broken Access Control",
                  "OWASP-A01:2025 - Broken Access Control",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML."
              },
              "help": {
                "markdown": "Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
                "text": "Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response",
              "id": "python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response",
              "name": "python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."
              },
              "help": {
                "markdown": "Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection)\n - [https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data](https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data)\n",
                "text": "Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection",
              "id": "python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection",
              "name": "python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection"
              }
            },
            {
              "defaultConfiguration": {
                "level": "error"
              },
              "fullDescription": {
                "text": "sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL."
              },
              "help": {
                "markdown": "sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n",
                "text": "sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text",
              "id": "python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text",
              "name": "python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A01:2017 - Injection",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text"
              }
            },
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands"
              },
              "help": {
                "markdown": "Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection)\n - [https://codeberg.org/fennix/funjection](https://codeberg.org/fennix/funjection)\n",
                "text": "Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
              },
              "helpUri": "https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection",
              "id": "python.twilio.security.twiml-injection.twiml-injection",
              "name": "python.twilio.security.twiml-injection.twiml-injection",
              "properties": {
                "precision": "very-high",
                "tags": [
                  "CWE-91: XML Injection",
                  "MEDIUM CONFIDENCE",
                  "OWASP-A03:2021 - Injection",
                  "OWASP-A05:2025 - Injection",
                  "security"
                ]
              },
              "shortDescription": {
                "text": "Semgrep Finding: python.twilio.security.twiml-injection.twiml-injection"
              }
            }
          ],
          "semanticVersion": "1.182.1"
        }
      },
      "results": [
        {
          "fingerprints": {
            "matchBasedId/v1": "requires login"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "/home/hatch/workspace/skills-list-eval/semgrep/ab/vulnerable_app/user_service.py",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 16,
                  "endLine": 54,
                  "snippet": {
                    "text": "    return eval(expression)"
                  },
                  "startColumn": 12,
                  "startLine": 54
                }
              }
            }
          ],
          "message": {
            "text": "Dynamic execution using exec or eval."
          },
          "properties": {},
          "ruleId": "workspace.skills-list-eval.semgrep.ab.with-skill.scan_output.repos.apiiro-malicious-code-ruleset.dynamic_execution.python.python-dynamic-execution-eval"
        },
        {
          "fingerprints": {
            "matchBasedId/v1": "requires login"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "/home/hatch/workspace/skills-list-eval/semgrep/ab/vulnerable_app/user_service.py",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 51,
                  "endLine": 11,
                  "snippet": {
                    "text": "STRIPE_API_KEY = \"sk_live_4eC39HqLyjWDarjtT1zdp7dc\""
                  },
                  "startColumn": 19,
                  "startLine": 11
                }
              }
            }
          ],
          "message": {
            "text": "Stripe API Key detected"
          },
          "properties": {},
          "ruleId": "generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key"
        },
        {
          "fingerprints": {
            "matchBasedId/v1": "requires login"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "/home/hatch/workspace/skills-list-eval/semgrep/ab/vulnerable_app/user_service.py",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 28,
                  "endLine": 54,
                  "snippet": {
                    "text": "    return eval(expression)"
                  },
                  "startColumn": 12,
                  "startLine": 54
                }
              }
            }
          ],
          "message": {
            "text": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."
          },
          "properties": {},
          "ruleId": "python.lang.security.audit.eval-detected.eval-detected"
        },
        {
          "fingerprints": {
            "matchBasedId/v1": "requires login"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "/home/hatch/workspace/skills-list-eval/semgrep/ab/vulnerable_app/user_service.py",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 49,
                  "endLine": 25,
                  "snippet": {
                    "text": "    return hashlib.md5(password.encode(\"utf-8\")).hexdigest()"
                  },
                  "startColumn": 12,
                  "startLine": 25
                }
              }
            }
          ],
          "message": {
            "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."
          },
          "properties": {},
          "ruleId": "python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5"
        },
        {
          "fingerprints": {
            "matchBasedId/v1": "requires login"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "/home/hatch/workspace/skills-list-eval/semgrep/ab/vulnerable_app/user_service.py",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 61,
                  "endLine": 25,
                  "snippet": {
                    "text": "    return hashlib.md5(password.encode(\"utf-8\")).hexdigest()"
                  },
                  "startColumn": 12,
                  "startLine": 25
                }
              }
            }
          ],
          "message": {
            "text": "It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."
          },
          "properties": {},
          "ruleId": "python.lang.security.audit.md5-used-as-password.md5-used-as-password"
        }
      ]
    }
  ]
}