Prompt: Perform a security review of this TypeScript code in the logging domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate event data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Java code in the sync domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate payload data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Go code in the streaming domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate file data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Rust code in the exports domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate record data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this C++ code in the imports domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate metric data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Bash code in the payments domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate notification data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this SQL code in the messaging domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate task data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Python code in the admin domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate route data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this JavaScript code in the dashboard domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate service data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this TypeScript code in the billing domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate adapter data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Java code in the auth domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate handler data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Go code in the search domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate controller data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Rust code in the analytics domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate repository data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this C++ code in the notifications domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate client data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Bash code in the reports domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate pipeline data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this SQL code in the cache domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate module data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Python code in the scheduler domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate invoice data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this JavaScript code in the uploads domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate session data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this TypeScript code in the webhooks domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate token data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Java code in the profiles domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate queue data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Go code in the checkout domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate worker data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Rust code in the inventory domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate parser data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this C++ code in the recommendations domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate report data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Bash code in the audit domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate profile data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this SQL code in the logging domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate cart data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Python code in the sync domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate order data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this JavaScript code in the streaming domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate cache_key data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this TypeScript code in the exports domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate job data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Java code in the imports domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate event data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Go code in the payments domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate payload data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Rust code in the messaging domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate file data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this C++ code in the admin domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate record data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Bash code in the dashboard domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate metric data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this SQL code in the billing domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate notification data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Python code in the auth domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate task data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this JavaScript code in the search domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate route data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this TypeScript code in the analytics domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate service data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Java code in the notifications domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate adapter data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Go code in the reports domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate handler data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Rust code in the cache domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate controller data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this C++ code in the scheduler domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate repository data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Bash code in the uploads domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate client data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this SQL code in the webhooks domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate pipeline data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Python code in the profiles domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate module data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this JavaScript code in the checkout domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate invoice data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this TypeScript code in the inventory domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate session data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Java code in the recommendations domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate token data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Go code in the audit domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate queue data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Rust code in the logging domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate worker data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this C++ code in the sync domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate parser data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Bash code in the streaming domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate report data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this SQL code in the exports domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate profile data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Python code in the imports domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate cart data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this JavaScript code in the payments domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate order data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this TypeScript code in the messaging domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate cache_key data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Java code in the admin domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate job data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Go code in the dashboard domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate event data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Rust code in the billing domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate payload data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this C++ code in the auth domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate file data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Bash code in the search domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate record data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this SQL code in the analytics domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate metric data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Python code in the notifications domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate notification data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this JavaScript code in the reports domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate task data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this TypeScript code in the cache domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate route data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Java code in the scheduler domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate service data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Go code in the uploads domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate adapter data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Rust code in the webhooks domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate handler data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this C++ code in the profiles domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate controller data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Bash code in the checkout domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate repository data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this SQL code in the inventory domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate client data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Python code in the recommendations domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate pipeline data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this JavaScript code in the audit domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate module data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this TypeScript code in the logging domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate invoice data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Java code in the sync domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate session data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Go code in the streaming domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate token data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Rust code in the exports domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate queue data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this C++ code in the imports domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate worker data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Bash code in the payments domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate parser data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this SQL code in the messaging domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate report data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Python code in the admin domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate profile data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this JavaScript code in the dashboard domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate cart data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this TypeScript code in the billing domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate order data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Java code in the auth domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate cache_key data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Go code in the search domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate job data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Rust code in the analytics domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate event data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this C++ code in the notifications domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate payload data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Bash code in the reports domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate file data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this SQL code in the cache domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate record data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Python code in the scheduler domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate metric data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this JavaScript code in the uploads domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate notification data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this TypeScript code in the webhooks domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate task data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Java code in the profiles domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate route data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Go code in the checkout domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate service data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Rust code in the inventory domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate adapter data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this C++ code in the recommendations domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate handler data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Bash code in the audit domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate controller data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this SQL code in the logging domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate repository data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Python code in the sync domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate client data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this JavaScript code in the streaming domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate pipeline data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this TypeScript code in the exports domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate module data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Java code in the imports domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate invoice data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Go code in the payments domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate session data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Rust code in the messaging domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate token data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this C++ code in the admin domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate queue data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Bash code in the dashboard domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate worker data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this SQL code in the billing domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate parser data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Python code in the auth domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate report data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this JavaScript code in the search domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate profile data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this TypeScript code in the analytics domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate cart data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Java code in the notifications domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate order data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Go code in the reports domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate cache_key data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Rust code in the cache domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate job data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this C++ code in the scheduler domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate event data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Bash code in the uploads domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate payload data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this SQL code in the webhooks domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate file data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Python code in the profiles domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate record data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this JavaScript code in the checkout domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate metric data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this TypeScript code in the inventory domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate notification data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Java code in the recommendations domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate task data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Go code in the audit domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate route data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Rust code in the logging domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate service data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this C++ code in the sync domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate adapter data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Bash code in the streaming domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate handler data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this SQL code in the exports domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate controller data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Python code in the imports domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate repository data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this JavaScript code in the payments domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate client data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this TypeScript code in the messaging domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate pipeline data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Java code in the admin domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate module data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Go code in the dashboard domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate invoice data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Rust code in the billing domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate session data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this C++ code in the auth domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate token data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Bash code in the search domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate queue data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this SQL code in the analytics domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate worker data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Python code in the notifications domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate parser data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this JavaScript code in the reports domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate report data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this TypeScript code in the cache domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate profile data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Java code in the scheduler domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate cart data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Go code in the uploads domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate order data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Rust code in the webhooks domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate cache_key data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this C++ code in the profiles domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate job data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Bash code in the checkout domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate event data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this SQL code in the inventory domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate payload data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Python code in the recommendations domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate file data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this JavaScript code in the audit domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate record data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this TypeScript code in the logging domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate metric data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Java code in the sync domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate notification data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Go code in the streaming domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate task data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Rust code in the exports domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate route data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this C++ code in the imports domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate service data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Bash code in the payments domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate adapter data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this SQL code in the messaging domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate handler data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Python code in the admin domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate controller data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this JavaScript code in the dashboard domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate repository data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this TypeScript code in the billing domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate client data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Java code in the auth domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate pipeline data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Go code in the search domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate module data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Rust code in the analytics domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate invoice data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this C++ code in the notifications domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate session data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Bash code in the reports domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate token data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this SQL code in the cache domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate queue data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Python code in the scheduler domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate worker data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this JavaScript code in the uploads domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate parser data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this TypeScript code in the webhooks domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate report data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Java code in the profiles domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate profile data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Go code in the checkout domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate cart data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Rust code in the inventory domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate order data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this C++ code in the recommendations domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate cache_key data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Bash code in the audit domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate job data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this SQL code in the logging domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate event data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Python code in the sync domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate payload data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this JavaScript code in the streaming domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate file data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this TypeScript code in the exports domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate record data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Java code in the imports domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate metric data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Go code in the payments domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate notification data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Rust code in the messaging domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate task data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this C++ code in the admin domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate route data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Bash code in the dashboard domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate service data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this SQL code in the billing domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate adapter data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Python code in the auth domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate handler data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this JavaScript code in the search domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate controller data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this TypeScript code in the analytics domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate repository data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Java code in the notifications domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate client data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Go code in the reports domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate pipeline data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Rust code in the cache domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate module data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this C++ code in the scheduler domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate invoice data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Bash code in the uploads domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate session data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this SQL code in the webhooks domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate token data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Python code in the profiles domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate queue data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this JavaScript code in the checkout domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate worker data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this TypeScript code in the inventory domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate parser data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Java code in the recommendations domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate report data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Go code in the audit domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate profile data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Rust code in the logging domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate cart data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this C++ code in the sync domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate order data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Bash code in the streaming domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate cache_key data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this SQL code in the exports domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate job data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Python code in the imports domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate event data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this JavaScript code in the payments domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate payload data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this TypeScript code in the messaging domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate file data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Java code in the admin domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate record data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Go code in the dashboard domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate metric data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Rust code in the billing domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate notification data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this C++ code in the auth domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate task data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Bash code in the search domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate route data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this SQL code in the analytics domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate service data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Python code in the notifications domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate adapter data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this JavaScript code in the reports domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate handler data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this TypeScript code in the cache domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate controller data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Java code in the scheduler domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate repository data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Go code in the uploads domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate client data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Rust code in the webhooks domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate pipeline data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this C++ code in the profiles domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate module data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Bash code in the checkout domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate invoice data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this SQL code in the inventory domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate session data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Python code in the recommendations domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate token data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this JavaScript code in the audit domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate queue data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this TypeScript code in the logging domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate worker data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Java code in the sync domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate parser data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Go code in the streaming domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate report data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Rust code in the exports domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate profile data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this C++ code in the imports domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate cart data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Bash code in the payments domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate order data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this SQL code in the messaging domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate cache_key data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Python code in the admin domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate job data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this JavaScript code in the dashboard domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate event data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this TypeScript code in the billing domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate payload data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Java code in the auth domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate file data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Go code in the search domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate record data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Rust code in the analytics domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate metric data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this C++ code in the notifications domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate notification data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Bash code in the reports domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate task data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this SQL code in the cache domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate route data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Python code in the scheduler domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate service data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this JavaScript code in the uploads domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate adapter data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this TypeScript code in the webhooks domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate handler data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Java code in the profiles domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate controller data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Go code in the checkout domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate repository data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Rust code in the inventory domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate client data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this C++ code in the recommendations domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate pipeline data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Bash code in the audit domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate module data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this SQL code in the logging domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate invoice data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Python code in the sync domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate session data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this JavaScript code in the streaming domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate token data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this TypeScript code in the exports domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate queue data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Java code in the imports domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate worker data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Go code in the payments domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate parser data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Rust code in the messaging domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate report data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this C++ code in the admin domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate profile data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this Bash code in the dashboard domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate cart data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this SQL code in the billing domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate order data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this Python code in the auth domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate cache_key data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this JavaScript code in the search domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate job data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this TypeScript code in the analytics domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate event data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Java code in the notifications domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate payload data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Go code in the reports domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate file data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this Rust code in the cache domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate record data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this C++ code in the scheduler domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate metric data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Bash code in the uploads domain and explain the vulnerability.

record = db.get_invoice(invoice_id)
return record

Access is controlled only by identifier, not by authorization context.

The issue can expose or manipulate notification data in production.

Apply least privilege, input validation, and safe framework APIs.

record = db.get_invoice_for_user(invoice_id, current_user.id)
return record


Prompt: Perform a security review of this SQL code in the webhooks domain and explain the vulnerability.

A secret is embedded directly in source code.

The issue can expose or manipulate task data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this Python code in the profiles domain and explain the vulnerability.

path = f"/uploads/{filename}"
open(path)

A user-controlled filename can escape the intended directory.

The issue can expose or manipulate route data in production.

Apply least privilege, input validation, and safe framework APIs.

safe = os.path.basename(filename)
path = f"/uploads/{safe}"
open(path)


Prompt: Perform a security review of this JavaScript code in the checkout domain and explain the vulnerability.

Shell command is constructed from untrusted input.

The issue can expose or manipulate service data in production.

Apply least privilege, input validation, and safe framework APIs.


Prompt: Perform a security review of this TypeScript code in the inventory domain and explain the vulnerability.

Passwords must never be stored in plaintext.

The issue can expose or manipulate adapter data in production.

Apply least privilege, input validation, and safe framework APIs.

stored = bcrypt.hashpw(password.encode(), bcrypt.gensalt())


Prompt: Perform a security review of this Java code in the recommendations domain and explain the vulnerability.

Predictable randomness is not suitable for security tokens.

The issue can expose or manipulate handler data in production.

Apply least privilege, input validation, and safe framework APIs.

token = secrets.randbelow(900000) + 100000


Prompt: Perform a security review of this Go code in the audit domain and explain the vulnerability.

def export_report(request):
    return build_report()

Sensitive functionality is exposed without identity verification.

The issue can expose or manipulate controller data in production.

Apply least privilege, input validation, and safe framework APIs.

def export_report(request):
    if not request.user.is_authenticated:
        raise PermissionError()
    return build_report()


Prompt: Perform a security review of this Rust code in the logging domain and explain the vulnerability.

The server fetches arbitrary URLs without destination validation.

The issue can expose or manipulate repository data in production.

Apply least privilege, input validation, and safe framework APIs.

allowed = is_allowed_host(url)
if allowed:
    response = requests.get(url, timeout=3)


Prompt: Perform a security review of this C++ code in the sync domain and explain the vulnerability.

query = f"SELECT * FROM users WHERE id = {user_id}"

User-controlled input is concatenated directly into the SQL query.

The issue can expose or manipulate client data in production.

Apply least privilege, input validation, and safe framework APIs.

cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))


Prompt: Perform a security review of this Bash code in the streaming domain and explain the vulnerability.

Untrusted content is rendered into HTML without encoding.

The issue can expose or manipulate pipeline data in production.

Apply least privilege, input validation, and safe framework APIs.