From a342d10cc4ddf2a446e5f09d0d89d3913182effe Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 03:56:19 +0530 Subject: [PATCH 01/12] Add runnable CodeAnt full-repository security pipeline example --- .github/workflows/codeant-security-demo.yml | 32 +++++ .github/workflows/codeant-security.yml | 89 +++++++++++++ .../__pycache__/report.cpython-311.pyc | Bin 0 -> 11605 bytes .../__pycache__/test_report.cpython-311.pyc | Bin 0 -> 7078 bytes examples/security-pipeline/policy.json | 5 + examples/security-pipeline/report.py | 120 ++++++++++++++++++ examples/security-pipeline/test_report.py | 64 ++++++++++ 7 files changed, 310 insertions(+) create mode 100644 .github/workflows/codeant-security-demo.yml create mode 100644 .github/workflows/codeant-security.yml create mode 100644 examples/security-pipeline/__pycache__/report.cpython-311.pyc create mode 100644 examples/security-pipeline/__pycache__/test_report.cpython-311.pyc create mode 100644 examples/security-pipeline/policy.json create mode 100644 examples/security-pipeline/report.py create mode 100644 examples/security-pipeline/test_report.py diff --git a/.github/workflows/codeant-security-demo.yml b/.github/workflows/codeant-security-demo.yml new file mode 100644 index 0000000..9ae914b --- /dev/null +++ b/.github/workflows/codeant-security-demo.yml @@ -0,0 +1,32 @@ +name: CodeAnt security example + +on: + push: + branches: [examples/security-pipeline] + pull_request: + branches: [main] + workflow_dispatch: + inputs: + mode: + description: Policy rollout mode + type: choice + options: [enforce, warn] + default: enforce + +permissions: + contents: read + +concurrency: + group: codeant-security-${{ github.ref }} + cancel-in-progress: false + +jobs: + security: + if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} + uses: ./.github/workflows/codeant-security.yml + with: + mode: ${{ inputs.mode || 'warn' }} + secrets: + # This demo already has a legacy provider-token secret. New integrations + # should create a scoped CodeAnt token and use secrets.CODEANT_TOKEN. + CODEANT_TOKEN: ${{ secrets.CODEANT_TOKEN || secrets.ACCESS_TOKEN_GITHUB }} diff --git a/.github/workflows/codeant-security.yml b/.github/workflows/codeant-security.yml new file mode 100644 index 0000000..8169699 --- /dev/null +++ b/.github/workflows/codeant-security.yml @@ -0,0 +1,89 @@ +name: Reusable CodeAnt security pipeline + +on: + workflow_call: + inputs: + mode: + description: warn records policy failures; enforce blocks the caller + type: string + default: enforce + secrets: + CODEANT_TOKEN: + required: true + +permissions: + contents: read + +jobs: + scan: + name: Full repository scan + runs-on: ubuntu-latest + timeout-minutes: 25 + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + - name: Check pipeline configuration + env: + CODEANT_TOKEN: ${{ secrets.CODEANT_TOKEN }} + MODE: ${{ inputs.mode }} + run: | + test -n "$CODEANT_TOKEN" || { echo '::error::CODEANT_TOKEN is missing'; exit 1; } + case "$MODE" in warn|enforce) ;; *) echo '::error::mode must be warn or enforce'; exit 1 ;; esac + - name: Run full repository scan + uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.5 + with: + access_token: ${{ secrets.CODEANT_TOKEN }} + scanners: sast,sca,secrets + scan_timeout: '1200' + - name: Install PDF report dependency + run: python3 -m pip install reportlab==4.5.1 + - name: Export CSV and PDF; require completed results + env: + SCAN_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }} + run: python3 examples/security-pipeline/report.py export + - name: Preserve reports even when a later gate fails + if: ${{ always() }} + uses: actions/upload-artifact@v4 + with: + name: codeant-security-${{ github.run_id }}-${{ github.run_attempt }} + retention-days: 14 + if-no-files-found: error + path: | + results.json + codeant.sarif + codeant-qg.xml + codeant-findings.csv + codeant-summary.pdf + codeant-run.json + + gates: + name: ${{ matrix.scanner }} policy + needs: scan + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + scanner: [secrets, sast, sca] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + - uses: actions/download-artifact@v4 + with: + name: codeant-security-${{ github.run_id }}-${{ github.run_attempt }} + - name: Evaluate example policy + env: + SCANNER: ${{ matrix.scanner }} + MODE: ${{ inputs.mode }} + run: python3 examples/security-pipeline/report.py gate --scanner "$SCANNER" --mode "$MODE" + + staging: + name: Staging readiness + needs: [scan, gates] + runs-on: ubuntu-latest + steps: + - name: Demonstrate the deployment dependency + run: echo 'Security jobs passed. Replace this step with your staging deployment.' diff --git a/examples/security-pipeline/__pycache__/report.cpython-311.pyc b/examples/security-pipeline/__pycache__/report.cpython-311.pyc new file mode 100644 index 0000000000000000000000000000000000000000..68619e164b34d9fbbafe2009ae2b03471cd85e2c GIT binary patch literal 11605 zcmcgSZA=_VcHJ{QGd`4HwGp% zcWAST2glN~C$G%q?91F{caP2aawOVQNTevfRqoC|@}nDd8eNEiu8%vHW;M;Jv{Z;|-3DMW(#MDC=b>gQ(zM9#UhGa40Nz zTf4ktaY#b^8Xu1dEC)&IQcxI$r;+7D!7((95W*^X z1aWgUEud1lz>wN*WKiu5;Y}S+5lJGGpCV07MyJKi=x<@{oKvu_6=W!FsrSfD@foxw zQ>0*D!;>Th$J*Ox(Ep#|=|g$Ewnd{B&l_4ag$XUDl#Zd>h#Q`iKB-UYZj)TGrZ48C z{zt^4b^U&iyjPJVq1K5MrJ+U%=OvXz_=FF)tHlys`Ki1D^oK9UkYyu@SEj_X->v6ui+e zk26+Tn)ikxY%r$K!{HbMMfpTs>#6{#rM%H`9$}3M!EnqQ^yW)?BVk@pOi@`&}SI6 zScp|9Of^YG^db z3E>797iK&p#JPrvICqO53x-%I0{srggt}0;ZYUVK#m1Pr#s(OjTR|Znk2Tbz!30uQ z%Q0*;-jG{R_y(R0jdNjPs%|Vi#ztTe8aNg$P4#0_iVgL7FgJZ%B@kzWKVJrm#5A#N zcikI!M9sY`dG^bm{m(o{mpn%$Pm}CvlI+K2`|;`atjT^S@m^wfpJdu1o3_mT(UPfF zG}SIUJYvN=lH-Q#xFOOvvd+>E5_c1GwUTqU?A$%wxoj<+9sQJ&th;6F?iGSGoF{RW zPRY?FJGw-=E9)rv;O5<%a}}9$l4Gyz*gM^kEpA;QbcRk+g=u5f>Y6JTtzL-B#aqRy z_QhcU5T)V{xwu2Lb*$(K+xF+~EvQB#25Hl>vtn-Vr-voyKH0es+BP>XnEuZCx7Ni@ z>3~l@;KNxM-vO!kpj>=Vv>ja0L$T*p*L2TI7#W~H)*(q_l+6yM+8H^sU&uCveUF>b?)(jI3$nY?|g2YF<+%Vlv!641(Zxej1P<2R>nZhB48fpN|N~hf( zwG*5v6qkIZb&Q5vJNEz98f@9W5b%^wz?AD1vR0vUV?3px3_UM!oC}Cm4C7;Cpm0$f znm^8qvu?%W6ESWlqzz`}&a691bTd)GIIRj;Z6<}E^>OgDSDx52s_b;3m>rO*l zc9+cx4<>&wnX$~Dlgb<9@&?I$Kz1K^=03XQJ}SAJWOvizdC}bt@mm#sVi4Uvh${xd zRr(w!;SDpJVv7bR2lHFiYhAN9vDG^SoO}!I`uY45-e4pWpJ16&H6{+}TAULBG!P0s z2-PF(;Gklj2n(Zwv0#+tkanZ!BW$dO=E_jf?I^>j3Je5NBxeuby^YYeA5SB!++J$qWV?U?p0TOH}inN#;p z%^g{?dNWtW9YYX*sbA>)8~Yb_^-a9~om|2?BvM0ot~6qdRweX*`96RLu+mL~DHL;P z#EH-fC0Yr;S)8?d$Tth`dYzs#F#05!fYxJx7etEcwkEfq=uTP`r`jEziz>60%*5R8eTADgvn=@BAD3u`+T zadXw!Nz&`4)SNVD3XGpMyfdZRk|Y5oQC~NNbSbC>7OWOn*BV{F!LP^0fHlsnGm%Il zX5C2~gcWi^H>tlyOuz_UBS`oONd9x-CR$^0U~G(C+w)DzIX206uCM>CuoW>bZ8@eG zvGFEtY@iX9W!!J5QL>&YT%+`%K4sDHN11j^GsWttXrX}Ahg`T>l20WqO!;Hax?WVE zcC?jqHls;fk|ge(N`kK=X<)W7)mrLt|Ga=}`)0UC zbP15Dlnvx|$Hye})+wN!Cl{EV@56%1d~0b)6*0SD9Q-Mla43(101U}>e1^xVIOR?{ zzj>UJF5yT){i39+fPT=!)_hLMVot~Gj*-lsk#!>ovUaQhhkL`Q1z>cHNhkDt@5dyw z?eV_PVD@opdxGLkkeRa$;vj<5g9AQw?{FNd~X(>~uk;TjlDy|5uY1;m9-xpDs%`=9 z&=@;`>TOVlkmS8Q3g9F14tW9g9HbQ8D85T#vzK_Ep3$w})B1@AutVK*Ge~{WX)q#_ z3tLG6j4@{=?E=Rm$YDOr=rRRw`COQTb%wik%)#i~?I$=S4>dZh++eE%)Fi}oivAWm zg>4Rv;i;M#yTDP5+&F8d<_H^uJg(5_JPug+w*Vlcv!YFn3!z8*GKYWK^l{UC>rYO7 za!RT^C|4d_{fyP3UX>=54ore#91gP)hF3{Bo3nwuh#fUIrB>Thl7 z9Rx>aPgg*(0-r!IfG7yknRrxT`~>~Z$^@UTL4^mU?`+S_wwV>Xpo!2x#)nY z)!*+8a;z7LD>&7`0Y0QTdGaEM^Dr3ps6LzLF+jwyu=+xA@Ybs~H|FdUUO1sb&9Gyz z;0vsGn2Sg8NmdL9zYXo>*!;WW!3gp`kDx+1?yFCDdbOo;AHY-Z&Q%yh6$aJQiA2Aj zW#P;~b%Pgf26!02AF;~ltNm?J<=7jEkMOt@$RzX}&NYG~u{bZlAwzw_oyVCQt@<%$ z7`8iufFv<-dF|{1`TtIMC%8CtB44MFj{U2-1(?<{^Xoy)cEzrG-y^}H`bc<)>xAi7 zN;G-(JlbP74#sSMBH;#b!cC;K#wj#wrF-O89qrwOWdzk7<8yXKsn3^)x3xs-(`?zU;6k~i` z7#kP3J5W?H<&HVfkrf&r#lWLgn7fMbw4o9dhx!GpGMtg}IWN<25VQ-1>qFlS0#Zb{ zw;|0V+r;}#A?IH*s+$@22+AEm71A)cu!&}=U7|K-sU}eyv($k2?c#HLyNKg-`?A?C zI(A9s-LiT2Gjr{dxpw~0qE0l|O6C)?`NRsLH?ZX5?PXWV{mQv^$+c5P(bY0tEz;GH^NjW^(VoKXQ@ngte0xZ~9D+>A!^i+>My45&W>!oHv5H=WU*V>{ z#;`DdvoyHdHv9Bn7Gj(C;Wcq@^J0fo)h1W9Emv%LSdlsP%N<|TEOtNLD>e4XjeSyu zU#{>kS8jb+BknpT9`BJVd*#Yr@p3?_3@p3c_bbFL^$RA+)g-%`zS5Ihj%QC?K+kUS zcj)WfnfVUMby#*C{>q@+a%9CoIghRo0H!;D0)tsJZ;`02GPU&?wRefy`*Z5CW#QP9 zgW^7)w9hB+^F5`cecck(BU3#h)swY*MY~tB?~v^~z$a)gOJ5Vq4=x;C-225D$=)j4 zTSZ&jv@cs$^&t9#=!fz9@fA42x(H*4;EW}$PhZK>_77}#ZL`;AuRXdw?-utQgScQ& zpHg*`T-~&|=Sij9+%1*%$fZ3J-7C|*B92+goE}aO&t9I>%|!1-=dR7c0G@eL_S7P` z_@%0VTon-QS0w5R&|o_us?mCKx^3BBqHdWB#)X7@;2gY2C9N_*Of~eyU593>90NEC ztK2(pgki00k}I2LoN42%DNEZvu->)KUVRkG?3pkBq(R!&C~s?gViXSt7CIL?pLU8R zS0uV$ru#*@f0?$YM`j%N9BKGvZLYL$c2}kW{T73w?W|-wE8ETjm6Z8T?|Z$o&9luJ z+x+mt$l~pP`u;zB|LK%;=9+xwnpi!M_3i;m=*69jx8*Yz#p+Ah>h^4PEAVEuj|6@! zX(xdn0V3Y)Kxu%e7XWF(U`eyH{j>dZEpyz5H}2oabY;54`p&0&#LL&^^Y2KzZpgcC zWF6({FnD7tu9DB+epeg}%WvNVZgEBc8-n1Jb$Zg_M@F&w_&>HjG5*%_rA55(9qDXP zJ{y!y4#_8nr0OBb6Ouh4k-a5GZp-Y1~-V30oDR|Mf~ zM=toRp+q^>Vh zX3=s(qTZFMcg1|<-LNA4ifVD4+phm|J9Tci>C1g2zz}4w2BdYMwff~>1KjjT5^Wi| z@OYi2g0FNS3>yNYWAqF)qI+!6TA^U66Pa(WVFVw8>0|N_s6jJk#xkN~ERU^PuLN$T zfbKQ&*7>$bGf{XgW8GIB_#uq>x^O84spm^6=pA;M-h95^l(W8Zb0Qjk^(Oo98%u2<#RUr%fPxvM~1m@ zbJY{fIJK0d3`qlbSt#&ofZwc0O9ObFjY(q$*&Q1K<0_;b=qmmu>KOMUleS$Ly+6oL zoYZr>3VY0$b91C)O2FGynlcrR5L1>k0WD>SmPhOSNiZ@y*Se9^$1NJX78S3ST0gOq z5O%HA5|E*i3&Os93OvQ=G$I#M5_OK$pF&3|#GkLlR^MC}z;=&|R2#467sxh16pxWD1SO!*EF?VXmt~N-C(hTnxxb z80+eypfD@cM39RqCN>5JLx=?@!^iMdF@aVegllN3eN&E=bB@JVXL#=_riAH)7a=*N zxbxO@z;|iTf2F6V18F8bWLg8ld0q2hpHmq`*a^?W{5yl;X zbNmPi z`O!tASa(LG$|dToOq~^}v)Q$;VqHfrqVJtD)hSY)Yv1YlqYKBy+EY)aaQ(|Nbs0{@ z;9AWy>((XfR>`_ewr-nlThX}^K038I$^y zY_+njRO3`FAQqKn`(SKYBM|joXtV9T~ z)V8A(vdFNIphnRJ16T$u{wW?TRo^7s8bH2O)m>Ntsn_&LkaF-UpXQ#xEApoCzXJd> zPm)=pPbB)D6V7S;%MzAp{L2#7Y5dC)=4t%P64jzMW(kj|jag!+sEsQ|2MG+j3U*k? z5O7-otkjczNReHGwteIv(47ILkOOVv;P|D1ni&W!+HG6$fIcnp<75o2_!L+C&eTf zntKvnnzIR(=DviF=Kh4A=7B_j=3Ih<+?xufLx~VW#$Zzw>2M;%|GNM3szX!rttxo5V@!HRRq?{0P51AX9^dlJ>I*iiwV0qtF)WX&SdYn9Xr>8+vOdui zJCjjj<4JuumQj+rE^B(zFJy|IIAgPYf<6qnZ&c95VcVY@;At?IH;qn+d13%@82ac0 zeB44Z0(C$Mk5nmnrx{QQb{c^~_yGDOKR`cW1*ifCkduM{gHi}!NU8u>A%*)%1Wgy&A~J~D5@tTKfu37P&#MMPBYE7-$XC%- zR`(Ug7|9F6-R`PS4;Hn`_n2f$1sz0_%=-t5$CMa%n^}Khqyna|E#M=ZgHM+9b&td# zeVx-1fjUUQX~{R~mHd;QA-`MIUj?PniY=8awW};ys7P83vsL4lpQ4saQ#eQn7mb z=cPl5ZbQ%8b{yqsDo2Zi%27{h;(?xQ7|U8FrE5(inyO?uZ9;1j@X#10s%5i7f-Yx+ zjg6WpD2j};{>H|%D#`IGo73g==wLD>+b^93OvM78Xis8U)KxrziSpZCaa^)Js%HDd zVJV62&^S)&GOx>5bekp9**+{!BUehHtquZXOYIFTM zPAWs)y_jqon@tNzCGLmaE2jpDSs}}SQXtO`EYoWTbHe~hHaCjpv80;OG_tf9eV$%# zeoK?F)+`Pum9#K1Ff3p_*$k9O8M2V(aTQuZCNQv|=#65saX=6+%Zk*vuNf@I zWkFX}rMYRD{Cqn}POHuG6(K#Eg5H`eW?=Objibw!sF_$vK5qnV4rdgevb%N_W7Xu; zl3l7D0jo5H9#qy?l?`U)E~|3a5()*k%_SeKf92+tKV)xauXjBNues6n;W;zB*$Qtq z!kd>ofy!-*>!QZG9So>nT_4O$;+G<5x zmk?6}wE!M$-tp;sAHVmftDjt5@;Zfu>W8Gw<9zESuQO_4{D)+w$NB00&7tabH@TS& zX4O`!YO7JTb*TncPM2Q*4+%FO6Hq8yTC;NgCr_Rfh$+R~#FWrcAg~0ZL#|xLO1gpc zCx7&~mO_f2JXyJ>RhLt;y8I_4z`gQ(9p#306;$YELr2W}_m*(`5zqI*o$XQI_s!9E zCh!9n2KS{?K1aTn5fW-ZL;+cdc*0?F*_tMTzgM%WHBYX<=UtGVz3w_%>!FcbN-?&G>y{qt*| zUAsGA)*rFzkC@S;R`lq-7Lz+}amNiO;XTmR#eU)nDEt2bNO|^CtpuGMDhZ;lGA}9^ zqSbEZOFs8ELzLi!gk2ii!AWH`@dkP@iEC}PtGl!7j>q=P$`FLaHmAvBGVx6|J1$^_ z>cB6AfVh{69XA6`wcyV3UU>xyTze%>g*coX8s_QF97w5fj^I@#HNhtpmkt~&s{_x| zy`IcG0ss`Cy5`oVk2cMn_||W1=_D!EWmb1v)!oJyhc?dozyg9vsDaw;TQ~vf@lcJ4+_Z?56Y+zr6IaV znv#Gn+gDa={>u@GCD0ZCfFiAbWoCHJZ`3v4ZMfHM>^}Y3mY7+eL$;yrP4@7E&p79D?4KvK!@jhafKEncHNi@%B5$ zp>rf1OqliOt@`t3^j$0Zu5pn!xl0yz$#Bw2S>!{v4`CW|Z~%|nTHfR8MRD@#F>`4c zHA{@+ibwLe4Vn9kK{wjyX7TpK*=*&pu5*1IXHItayxFifp7q9d@6CD|_hz}*``eCt*!S<*>T z<(xR>D{$cemo0F^na-pHEqk!6IG@??C@?_l0RX11=GWkfg6+iL0leO^7_Rz#?+3kq zKJjVq$GvkMX6-(!cHctnvH99#_e8U{)v9eZ!);c$&7cXKU%oRHXAdli7(1%J@vzPD zydtD!p0`6har>DR!NWXHjv=|4!eImxBa8`o_}2swbBsF)c!Pk`1neS!czSxG!z6B_ zfZWb&UjdlPze}D9AKVtW!A6e{4sUtDF+Rcp2l&0d{YxkhLS7#U1&UyZ@eLDZ6`-H- zWobzsLWw|2^3d<`5f-lwbE_c>A>1N2U_2k+Xa{(ZyvXyIT+7;PlH@*)T%7ZmLMpjhE)nQc?zP;Y$FU5x z!xyZ>7tFv#D{yg&T@1c-W79&gVLsR}7cqlPRv)2H6=o$j5Y?~)g>8=-<~(|-V$ Cc#`)3 literal 0 HcmV?d00001 diff --git a/examples/security-pipeline/policy.json b/examples/security-pipeline/policy.json new file mode 100644 index 0000000..9487670 --- /dev/null +++ b/examples/security-pipeline/policy.json @@ -0,0 +1,5 @@ +{ + "secrets": {"severities": ["*"], "max_findings": 0}, + "sast": {"severities": ["HIGH", "CRITICAL"], "max_findings": 0}, + "sca": {"severities": ["HIGH", "CRITICAL"], "max_findings": 0} +} diff --git a/examples/security-pipeline/report.py b/examples/security-pipeline/report.py new file mode 100644 index 0000000..2d3b7f5 --- /dev/null +++ b/examples/security-pipeline/report.py @@ -0,0 +1,120 @@ +"""Export completed CodeAnt results and apply the example's explicit CI policy.""" + +import argparse +import csv +import json +import os +from collections import Counter +from pathlib import Path +from xml.sax.saxutils import escape + + +def load_results(): + result = json.loads(Path("results.json").read_text()) + if result.get("status") != "COMPLETED": + raise ValueError("Scan did not complete; refusing to treat missing results as clean") + findings = result.get("findings") + if not isinstance(findings, list): + raise ValueError("Completed result must contain a findings list") + metrics = result.get("metrics", {}) + for metric in ("sast_rating_full_code", "sca_rating_full_code"): + if metric not in metrics: + raise ValueError(f"Missing required scan metric: {metric}") + for finding in findings: + if not isinstance(finding, dict) or not finding.get("engine"): + raise ValueError("Malformed finding") + return result + + +def policy_result(result, scanner): + policy = json.loads(Path(__file__).with_name("policy.json").read_text())[scanner] + selected = [item for item in result["findings"] if item["engine"] == scanner] + severities = policy["severities"] + # An unknown severity must not silently evade an enforcement policy. + known = {"INFO", "INFORMATIONAL", "LOW", "MEDIUM", "MODERATE", "HIGH", "CRITICAL"} + blocking = [item for item in selected if "*" in severities + or str(item.get("severity", "")).upper() in severities + or str(item.get("severity", "")).upper() not in known] + limit = policy["max_findings"] + return len(blocking) > limit, f"{scanner}: {len(blocking)} blocking findings; allowed={limit}" + + +def csv_cell(value): + text = "" if value is None else str(value) + # Findings are untrusted content; prevent spreadsheet formula evaluation. + return "'" + text if text.lstrip().startswith(("=", "+", "-", "@")) else text + + +def export(result): + from reportlab.lib import colors + from reportlab.lib.styles import getSampleStyleSheet + from reportlab.platypus import SimpleDocTemplate, Paragraph, Spacer, Table, TableStyle + + fields = ["engine", "severity", "file", "line", "rule", "message"] + with Path("codeant-findings.csv").open("w", newline="") as output: + writer = csv.writer(output) + writer.writerow(fields) + writer.writerows([csv_cell(item.get(key)) for key in fields] for item in result["findings"]) + + context = {"repository": os.getenv("GITHUB_REPOSITORY", "local"), + "commit": os.getenv("SCAN_COMMIT", os.getenv("GITHUB_SHA", "local")), + "run_url": os.getenv("GITHUB_SERVER_URL", "https://github.com") + "/" + + os.getenv("GITHUB_REPOSITORY", "local") + "/actions/runs/" + + os.getenv("GITHUB_RUN_ID", "local")} + Path("codeant-run.json").write_text(json.dumps(context, indent=2) + "\n") + styles = getSampleStyleSheet() + story = [Paragraph("CodeAnt CI security scan", styles["Title"])] + for key, value in context.items(): + story.append(Paragraph(escape(f"{key}: {value}"), styles["BodyText"])) + story += [Spacer(1, 16), Paragraph("Example policy results", styles["Heading2"])] + rows = [["Scanner", "Total findings", "Policy verdict"]] + counts = Counter(item["engine"] for item in result["findings"]) + for scanner in ("secrets", "sast", "sca"): + failed, message = policy_result(result, scanner) + rows.append([scanner, str(counts[scanner]), "FAILED" if failed else "PASSED"]) + print(message) + table = Table(rows, colWidths=[140, 140, 160], repeatRows=1) + table.setStyle(TableStyle([("BACKGROUND", (0, 0), (-1, 0), colors.HexColor("#e9e9ff")), + ("GRID", (0, 0), (-1, -1), 0.5, colors.lightgrey), + ("BOTTOMPADDING", (0, 0), (-1, -1), 10), + ("TOPPADDING", (0, 0), (-1, -1), 10)])) + story += [table, Spacer(1, 16), Paragraph("Scope and interpretation", styles["Heading2"]), + Paragraph("Full repository results for secrets, SAST and SCA. This summary and the CSV " + "are generated by the example workflow. The policy is defined in policy.json; " + "it is separate from the native CodeAnt quality-gate verdict.", styles["BodyText"]), + Paragraph(escape("Native CodeAnt verdict: " + str(result.get("quality_gate_status"))), styles["BodyText"]), + Paragraph("See codeant-findings.csv for all findings and the Actions logs for runner diagnostics.", styles["BodyText"])] + SimpleDocTemplate("codeant-summary.pdf", title="CodeAnt CI security scan").build(story) + print("Completed scan; wrote codeant-findings.csv, codeant-summary.pdf, codeant-run.json") + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("operation", choices=["export", "gate"]) + parser.add_argument("--scanner", choices=["secrets", "sast", "sca"]) + parser.add_argument("--mode", choices=["warn", "enforce"], default="enforce") + args = parser.parse_args() + try: + result = load_results() + if args.operation == "export": + export(result) + return 0 + if not args.scanner: + parser.error("gate requires --scanner") + failed, message = policy_result(result, args.scanner) + print(f"{message}; mode={args.mode}") + summary = os.getenv("GITHUB_STEP_SUMMARY") + if summary: + with open(summary, "a") as output: + output.write(f"### {args.scanner} policy\n\n{message}; mode={args.mode}\n") + if failed: + level = "warning" if args.mode == "warn" else "error" + print(f"::{level}::{message}") + return int(failed and args.mode == "enforce") + except (OSError, ValueError, KeyError, TypeError) as error: + print(f"::error::Invalid or missing scan results: {error}") + return 1 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/examples/security-pipeline/test_report.py b/examples/security-pipeline/test_report.py new file mode 100644 index 0000000..b63154b --- /dev/null +++ b/examples/security-pipeline/test_report.py @@ -0,0 +1,64 @@ +"""Checks for deployment bypasses and report export safety. Run with unittest.""" + +import contextlib +import importlib.util +import io +import json +import os +import tempfile +import unittest +from pathlib import Path +from unittest.mock import patch + +spec = importlib.util.spec_from_file_location("report", Path(__file__).with_name("report.py")) +report = importlib.util.module_from_spec(spec) +spec.loader.exec_module(report) + + +class PipelinePolicyTests(unittest.TestCase): + def run_gate(self, result, mode="enforce", scanner="sast"): + with tempfile.TemporaryDirectory() as directory: + previous = Path.cwd() + os.chdir(directory) + try: + if result is not None: + Path("results.json").write_text(json.dumps(result)) + with patch("sys.argv", ["report.py", "gate", "--scanner", scanner, "--mode", mode]): + with contextlib.redirect_stdout(io.StringIO()): + return report.main() + finally: + os.chdir(previous) + + def completed(self, findings): + return {"status": "COMPLETED", "metrics": {"sast_rating_full_code": "S", "sca_rating_full_code": "S"}, + "findings": findings} + + def test_clean_completed_scan_passes_enforcement(self): + self.assertEqual(self.run_gate(self.completed([])), 0) + + def test_high_sast_blocks_only_in_enforcement(self): + result = self.completed([{"engine": "sast", "severity": "HIGH"}]) + self.assertEqual(self.run_gate(result, "warn"), 0) + self.assertEqual(self.run_gate(result), 1) + + def test_missing_or_incomplete_results_fail_even_in_warning_mode(self): + for result in [None, {"status": "done"}, {"status": "PENDING"}, {"status": "COMPLETED"}]: + with self.subTest(result=result): + self.assertEqual(self.run_gate(result, "warn"), 1) + + def test_scanner_jobs_do_not_block_on_other_engines(self): + self.assertEqual(self.run_gate(self.completed([{"engine": "sca", "severity": "CRITICAL"}])), 0) + + def test_secrets_block_regardless_of_severity(self): + self.assertEqual(self.run_gate(self.completed([{"engine": "secrets", "severity": "LOW"}]), scanner="secrets"), 1) + + def test_unknown_severity_is_not_silently_allowed(self): + self.assertEqual(self.run_gate(self.completed([{"engine": "sast", "severity": ""}])), 1) + + def test_csv_does_not_execute_formulas(self): + for value in ["=HYPERLINK(1)", " +1", "-1", "@SUM(A1)"]: + self.assertTrue(report.csv_cell(value).startswith("'")) + + +if __name__ == "__main__": + unittest.main() From d860b95a2ef978cc9bfd188a35476a6e7bdb333e Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 03:59:11 +0530 Subject: [PATCH 02/12] Demonstrate enforcement after warning-mode validation --- .github/workflows/codeant-security-demo.yml | 2 +- examples/security-pipeline/.gitignore | 1 + examples/security-pipeline/README.md | 81 ++++++++++++++++++ .../__pycache__/report.cpython-311.pyc | Bin 11605 -> 0 bytes .../__pycache__/test_report.cpython-311.pyc | Bin 7078 -> 0 bytes 5 files changed, 83 insertions(+), 1 deletion(-) create mode 100644 examples/security-pipeline/.gitignore create mode 100644 examples/security-pipeline/README.md delete mode 100644 examples/security-pipeline/__pycache__/report.cpython-311.pyc delete mode 100644 examples/security-pipeline/__pycache__/test_report.cpython-311.pyc diff --git a/.github/workflows/codeant-security-demo.yml b/.github/workflows/codeant-security-demo.yml index 9ae914b..2da1d0b 100644 --- a/.github/workflows/codeant-security-demo.yml +++ b/.github/workflows/codeant-security-demo.yml @@ -25,7 +25,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} uses: ./.github/workflows/codeant-security.yml with: - mode: ${{ inputs.mode || 'warn' }} + mode: ${{ inputs.mode || 'enforce' }} secrets: # This demo already has a legacy provider-token secret. New integrations # should create a scoped CodeAnt token and use secrets.CODEANT_TOKEN. diff --git a/examples/security-pipeline/.gitignore b/examples/security-pipeline/.gitignore new file mode 100644 index 0000000..c18dd8d --- /dev/null +++ b/examples/security-pipeline/.gitignore @@ -0,0 +1 @@ +__pycache__/ diff --git a/examples/security-pipeline/README.md b/examples/security-pipeline/README.md new file mode 100644 index 0000000..e5d2b19 --- /dev/null +++ b/examples/security-pipeline/README.md @@ -0,0 +1,81 @@ +# CodeAnt security pipeline example + +Scan a full repository before staging, preserve findings, and evaluate secrets, +SAST, and SCA in separate jobs. This demo repository intentionally contains +vulnerabilities. The workflow never runs the vulnerable application or deploys it. + +## Files to copy + +- `.github/workflows/codeant-security.yml`: reusable workflow, one scan followed + by three policy jobs and a staging placeholder. +- `.github/workflows/codeant-security-demo.yml`: caller; change the branch trigger + and replace the legacy secret fallback with `secrets.CODEANT_TOKEN`. +- `examples/security-pipeline/report.py` and `policy.json`: report exporter and + explicit example policy. Keep them at these paths in the calling repository. + +Create a CodeAnt API token for your organization with the **Codeant CI/CD** role +and repository scope. Store it as the calling repository's Actions secret +`CODEANT_TOKEN`. Enable secrets, SAST and SCA analysis in CodeAnt. This existing +test repo can also use its previously configured `ACCESS_TOKEN_GITHUB` secret. + +Use `mode: warn` for an initial review period and `mode: enforce` to block on +violations. Missing/incomplete results and infrastructure errors fail in both +modes. The workflow does not use `continue-on-error` to hide scan errors. + +The example policy blocks any secrets and any HIGH/CRITICAL SAST or SCA findings. +Unknown SAST/SCA severities also block. Edit `policy.json` to change the severity +selection or maximum allowed finding counts. This policy is workflow code, not +an undocumented input to the CodeAnt action. The native CodeAnt verdict is kept +in `results.json` and labeled separately in the PDF. + +## Reports and logs + +Download `codeant-security--` from the run's Artifacts section: + +- `results.json`, `codeant.sarif`, `codeant-qg.xml`: returned by CodeAnt. +- `codeant-findings.csv`, `codeant-summary.pdf`: generated by this example. +- `codeant-run.json`: scanned repository, commit, and Actions run URL. + +Reports upload before the scanner policy jobs, including when those jobs fail. +Keep the report files and GitHub's downloaded log archive for troubleshooting; +do not upload runner environment dumps, credentials, or the whole checkout. + +The action downloads its script, sends repository/commit/filter metadata and the +token to CodeAnt, then polls for results. Source analysis happens server-side; +the runner does not upload a source archive or local container image. `scanners` +selects returned result engines; repository settings control executed analyses. + +## Prevent deployment or merging + +Replace the `Staging readiness` echo step with your deployment and retain +`needs: [scan, gates]`. A deployment in the caller workflow needs `needs: security`. +Require the resulting security checks in your branch protection/ruleset to block +merges. The caller skips fork PRs because GitHub does not provide repository +secrets to them. No branch protection or real deployment is changed by this demo. + +To share the workflow across repositories, move the helper and policy to a trusted +central repository and explicitly check them out at a pinned revision. A reusable +workflow alone does not copy these files to application repositories. + +## Validate the helper + +```sh +python3 -m unittest discover -s examples/security-pipeline -p 'test_*.py' +``` + +Tests cover clean enforcement, warning versus enforcement, incomplete results, +scanner isolation, secrets, unknown severities, and CSV formula escaping. + +## Current boundaries + +The published `CodeAnt-AI/codeant-ci-scan-action@v0.0.5` has no `quality_gate` +input. This example applies its own explicit policies after collecting reports. +Native gate conditions can be enforced separately, but a native PASSED verdict +with no enabled conditions is not proof of an effective policy. + +The CodeAnt registry scanner pulls images already in a registry. This example +cannot scan a local Docker image before its first ECR push, and does not claim +to demonstrate that capability. + +ReportLab 4.5.1 is installed only to produce the example PDF. Gate evaluation uses +Python's standard library. No third-party report dependency is needed for gates. diff --git a/examples/security-pipeline/__pycache__/report.cpython-311.pyc b/examples/security-pipeline/__pycache__/report.cpython-311.pyc deleted file mode 100644 index 68619e164b34d9fbbafe2009ae2b03471cd85e2c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11605 zcmcgSZA=_VcHJ{QGd`4HwGp% zcWAST2glN~C$G%q?91F{caP2aawOVQNTevfRqoC|@}nDd8eNEiu8%vHW;M;Jv{Z;|-3DMW(#MDC=b>gQ(zM9#UhGa40Nz zTf4ktaY#b^8Xu1dEC)&IQcxI$r;+7D!7((95W*^X z1aWgUEud1lz>wN*WKiu5;Y}S+5lJGGpCV07MyJKi=x<@{oKvu_6=W!FsrSfD@foxw zQ>0*D!;>Th$J*Ox(Ep#|=|g$Ewnd{B&l_4ag$XUDl#Zd>h#Q`iKB-UYZj)TGrZ48C z{zt^4b^U&iyjPJVq1K5MrJ+U%=OvXz_=FF)tHlys`Ki1D^oK9UkYyu@SEj_X->v6ui+e zk26+Tn)ikxY%r$K!{HbMMfpTs>#6{#rM%H`9$}3M!EnqQ^yW)?BVk@pOi@`&}SI6 zScp|9Of^YG^db z3E>797iK&p#JPrvICqO53x-%I0{srggt}0;ZYUVK#m1Pr#s(OjTR|Znk2Tbz!30uQ z%Q0*;-jG{R_y(R0jdNjPs%|Vi#ztTe8aNg$P4#0_iVgL7FgJZ%B@kzWKVJrm#5A#N zcikI!M9sY`dG^bm{m(o{mpn%$Pm}CvlI+K2`|;`atjT^S@m^wfpJdu1o3_mT(UPfF zG}SIUJYvN=lH-Q#xFOOvvd+>E5_c1GwUTqU?A$%wxoj<+9sQJ&th;6F?iGSGoF{RW zPRY?FJGw-=E9)rv;O5<%a}}9$l4Gyz*gM^kEpA;QbcRk+g=u5f>Y6JTtzL-B#aqRy z_QhcU5T)V{xwu2Lb*$(K+xF+~EvQB#25Hl>vtn-Vr-voyKH0es+BP>XnEuZCx7Ni@ z>3~l@;KNxM-vO!kpj>=Vv>ja0L$T*p*L2TI7#W~H)*(q_l+6yM+8H^sU&uCveUF>b?)(jI3$nY?|g2YF<+%Vlv!641(Zxej1P<2R>nZhB48fpN|N~hf( zwG*5v6qkIZb&Q5vJNEz98f@9W5b%^wz?AD1vR0vUV?3px3_UM!oC}Cm4C7;Cpm0$f znm^8qvu?%W6ESWlqzz`}&a691bTd)GIIRj;Z6<}E^>OgDSDx52s_b;3m>rO*l zc9+cx4<>&wnX$~Dlgb<9@&?I$Kz1K^=03XQJ}SAJWOvizdC}bt@mm#sVi4Uvh${xd zRr(w!;SDpJVv7bR2lHFiYhAN9vDG^SoO}!I`uY45-e4pWpJ16&H6{+}TAULBG!P0s z2-PF(;Gklj2n(Zwv0#+tkanZ!BW$dO=E_jf?I^>j3Je5NBxeuby^YYeA5SB!++J$qWV?U?p0TOH}inN#;p z%^g{?dNWtW9YYX*sbA>)8~Yb_^-a9~om|2?BvM0ot~6qdRweX*`96RLu+mL~DHL;P z#EH-fC0Yr;S)8?d$Tth`dYzs#F#05!fYxJx7etEcwkEfq=uTP`r`jEziz>60%*5R8eTADgvn=@BAD3u`+T zadXw!Nz&`4)SNVD3XGpMyfdZRk|Y5oQC~NNbSbC>7OWOn*BV{F!LP^0fHlsnGm%Il zX5C2~gcWi^H>tlyOuz_UBS`oONd9x-CR$^0U~G(C+w)DzIX206uCM>CuoW>bZ8@eG zvGFEtY@iX9W!!J5QL>&YT%+`%K4sDHN11j^GsWttXrX}Ahg`T>l20WqO!;Hax?WVE zcC?jqHls;fk|ge(N`kK=X<)W7)mrLt|Ga=}`)0UC zbP15Dlnvx|$Hye})+wN!Cl{EV@56%1d~0b)6*0SD9Q-Mla43(101U}>e1^xVIOR?{ zzj>UJF5yT){i39+fPT=!)_hLMVot~Gj*-lsk#!>ovUaQhhkL`Q1z>cHNhkDt@5dyw z?eV_PVD@opdxGLkkeRa$;vj<5g9AQw?{FNd~X(>~uk;TjlDy|5uY1;m9-xpDs%`=9 z&=@;`>TOVlkmS8Q3g9F14tW9g9HbQ8D85T#vzK_Ep3$w})B1@AutVK*Ge~{WX)q#_ z3tLG6j4@{=?E=Rm$YDOr=rRRw`COQTb%wik%)#i~?I$=S4>dZh++eE%)Fi}oivAWm zg>4Rv;i;M#yTDP5+&F8d<_H^uJg(5_JPug+w*Vlcv!YFn3!z8*GKYWK^l{UC>rYO7 za!RT^C|4d_{fyP3UX>=54ore#91gP)hF3{Bo3nwuh#fUIrB>Thl7 z9Rx>aPgg*(0-r!IfG7yknRrxT`~>~Z$^@UTL4^mU?`+S_wwV>Xpo!2x#)nY z)!*+8a;z7LD>&7`0Y0QTdGaEM^Dr3ps6LzLF+jwyu=+xA@Ybs~H|FdUUO1sb&9Gyz z;0vsGn2Sg8NmdL9zYXo>*!;WW!3gp`kDx+1?yFCDdbOo;AHY-Z&Q%yh6$aJQiA2Aj zW#P;~b%Pgf26!02AF;~ltNm?J<=7jEkMOt@$RzX}&NYG~u{bZlAwzw_oyVCQt@<%$ z7`8iufFv<-dF|{1`TtIMC%8CtB44MFj{U2-1(?<{^Xoy)cEzrG-y^}H`bc<)>xAi7 zN;G-(JlbP74#sSMBH;#b!cC;K#wj#wrF-O89qrwOWdzk7<8yXKsn3^)x3xs-(`?zU;6k~i` z7#kP3J5W?H<&HVfkrf&r#lWLgn7fMbw4o9dhx!GpGMtg}IWN<25VQ-1>qFlS0#Zb{ zw;|0V+r;}#A?IH*s+$@22+AEm71A)cu!&}=U7|K-sU}eyv($k2?c#HLyNKg-`?A?C zI(A9s-LiT2Gjr{dxpw~0qE0l|O6C)?`NRsLH?ZX5?PXWV{mQv^$+c5P(bY0tEz;GH^NjW^(VoKXQ@ngte0xZ~9D+>A!^i+>My45&W>!oHv5H=WU*V>{ z#;`DdvoyHdHv9Bn7Gj(C;Wcq@^J0fo)h1W9Emv%LSdlsP%N<|TEOtNLD>e4XjeSyu zU#{>kS8jb+BknpT9`BJVd*#Yr@p3?_3@p3c_bbFL^$RA+)g-%`zS5Ihj%QC?K+kUS zcj)WfnfVUMby#*C{>q@+a%9CoIghRo0H!;D0)tsJZ;`02GPU&?wRefy`*Z5CW#QP9 zgW^7)w9hB+^F5`cecck(BU3#h)swY*MY~tB?~v^~z$a)gOJ5Vq4=x;C-225D$=)j4 zTSZ&jv@cs$^&t9#=!fz9@fA42x(H*4;EW}$PhZK>_77}#ZL`;AuRXdw?-utQgScQ& zpHg*`T-~&|=Sij9+%1*%$fZ3J-7C|*B92+goE}aO&t9I>%|!1-=dR7c0G@eL_S7P` z_@%0VTon-QS0w5R&|o_us?mCKx^3BBqHdWB#)X7@;2gY2C9N_*Of~eyU593>90NEC ztK2(pgki00k}I2LoN42%DNEZvu->)KUVRkG?3pkBq(R!&C~s?gViXSt7CIL?pLU8R zS0uV$ru#*@f0?$YM`j%N9BKGvZLYL$c2}kW{T73w?W|-wE8ETjm6Z8T?|Z$o&9luJ z+x+mt$l~pP`u;zB|LK%;=9+xwnpi!M_3i;m=*69jx8*Yz#p+Ah>h^4PEAVEuj|6@! zX(xdn0V3Y)Kxu%e7XWF(U`eyH{j>dZEpyz5H}2oabY;54`p&0&#LL&^^Y2KzZpgcC zWF6({FnD7tu9DB+epeg}%WvNVZgEBc8-n1Jb$Zg_M@F&w_&>HjG5*%_rA55(9qDXP zJ{y!y4#_8nr0OBb6Ouh4k-a5GZp-Y1~-V30oDR|Mf~ zM=toRp+q^>Vh zX3=s(qTZFMcg1|<-LNA4ifVD4+phm|J9Tci>C1g2zz}4w2BdYMwff~>1KjjT5^Wi| z@OYi2g0FNS3>yNYWAqF)qI+!6TA^U66Pa(WVFVw8>0|N_s6jJk#xkN~ERU^PuLN$T zfbKQ&*7>$bGf{XgW8GIB_#uq>x^O84spm^6=pA;M-h95^l(W8Zb0Qjk^(Oo98%u2<#RUr%fPxvM~1m@ zbJY{fIJK0d3`qlbSt#&ofZwc0O9ObFjY(q$*&Q1K<0_;b=qmmu>KOMUleS$Ly+6oL zoYZr>3VY0$b91C)O2FGynlcrR5L1>k0WD>SmPhOSNiZ@y*Se9^$1NJX78S3ST0gOq z5O%HA5|E*i3&Os93OvQ=G$I#M5_OK$pF&3|#GkLlR^MC}z;=&|R2#467sxh16pxWD1SO!*EF?VXmt~N-C(hTnxxb z80+eypfD@cM39RqCN>5JLx=?@!^iMdF@aVegllN3eN&E=bB@JVXL#=_riAH)7a=*N zxbxO@z;|iTf2F6V18F8bWLg8ld0q2hpHmq`*a^?W{5yl;X zbNmPi z`O!tASa(LG$|dToOq~^}v)Q$;VqHfrqVJtD)hSY)Yv1YlqYKBy+EY)aaQ(|Nbs0{@ z;9AWy>((XfR>`_ewr-nlThX}^K038I$^y zY_+njRO3`FAQqKn`(SKYBM|joXtV9T~ z)V8A(vdFNIphnRJ16T$u{wW?TRo^7s8bH2O)m>Ntsn_&LkaF-UpXQ#xEApoCzXJd> zPm)=pPbB)D6V7S;%MzAp{L2#7Y5dC)=4t%P64jzMW(kj|jag!+sEsQ|2MG+j3U*k? z5O7-otkjczNReHGwteIv(47ILkOOVv;P|D1ni&W!+HG6$fIcnp<75o2_!L+C&eTf zntKvnnzIR(=DviF=Kh4A=7B_j=3Ih<+?xufLx~VW#$Zzw>2M;%|GNM3szX!rttxo5V@!HRRq?{0P51AX9^dlJ>I*iiwV0qtF)WX&SdYn9Xr>8+vOdui zJCjjj<4JuumQj+rE^B(zFJy|IIAgPYf<6qnZ&c95VcVY@;At?IH;qn+d13%@82ac0 zeB44Z0(C$Mk5nmnrx{QQb{c^~_yGDOKR`cW1*ifCkduM{gHi}!NU8u>A%*)%1Wgy&A~J~D5@tTKfu37P&#MMPBYE7-$XC%- zR`(Ug7|9F6-R`PS4;Hn`_n2f$1sz0_%=-t5$CMa%n^}Khqyna|E#M=ZgHM+9b&td# zeVx-1fjUUQX~{R~mHd;QA-`MIUj?PniY=8awW};ys7P83vsL4lpQ4saQ#eQn7mb z=cPl5ZbQ%8b{yqsDo2Zi%27{h;(?xQ7|U8FrE5(inyO?uZ9;1j@X#10s%5i7f-Yx+ zjg6WpD2j};{>H|%D#`IGo73g==wLD>+b^93OvM78Xis8U)KxrziSpZCaa^)Js%HDd zVJV62&^S)&GOx>5bekp9**+{!BUehHtquZXOYIFTM zPAWs)y_jqon@tNzCGLmaE2jpDSs}}SQXtO`EYoWTbHe~hHaCjpv80;OG_tf9eV$%# zeoK?F)+`Pum9#K1Ff3p_*$k9O8M2V(aTQuZCNQv|=#65saX=6+%Zk*vuNf@I zWkFX}rMYRD{Cqn}POHuG6(K#Eg5H`eW?=Objibw!sF_$vK5qnV4rdgevb%N_W7Xu; zl3l7D0jo5H9#qy?l?`U)E~|3a5()*k%_SeKf92+tKV)xauXjBNues6n;W;zB*$Qtq z!kd>ofy!-*>!QZG9So>nT_4O$;+G<5x zmk?6}wE!M$-tp;sAHVmftDjt5@;Zfu>W8Gw<9zESuQO_4{D)+w$NB00&7tabH@TS& zX4O`!YO7JTb*TncPM2Q*4+%FO6Hq8yTC;NgCr_Rfh$+R~#FWrcAg~0ZL#|xLO1gpc zCx7&~mO_f2JXyJ>RhLt;y8I_4z`gQ(9p#306;$YELr2W}_m*(`5zqI*o$XQI_s!9E zCh!9n2KS{?K1aTn5fW-ZL;+cdc*0?F*_tMTzgM%WHBYX<=UtGVz3w_%>!FcbN-?&G>y{qt*| zUAsGA)*rFzkC@S;R`lq-7Lz+}amNiO;XTmR#eU)nDEt2bNO|^CtpuGMDhZ;lGA}9^ zqSbEZOFs8ELzLi!gk2ii!AWH`@dkP@iEC}PtGl!7j>q=P$`FLaHmAvBGVx6|J1$^_ z>cB6AfVh{69XA6`wcyV3UU>xyTze%>g*coX8s_QF97w5fj^I@#HNhtpmkt~&s{_x| zy`IcG0ss`Cy5`oVk2cMn_||W1=_D!EWmb1v)!oJyhc?dozyg9vsDaw;TQ~vf@lcJ4+_Z?56Y+zr6IaV znv#Gn+gDa={>u@GCD0ZCfFiAbWoCHJZ`3v4ZMfHM>^}Y3mY7+eL$;yrP4@7E&p79D?4KvK!@jhafKEncHNi@%B5$ zp>rf1OqliOt@`t3^j$0Zu5pn!xl0yz$#Bw2S>!{v4`CW|Z~%|nTHfR8MRD@#F>`4c zHA{@+ibwLe4Vn9kK{wjyX7TpK*=*&pu5*1IXHItayxFifp7q9d@6CD|_hz}*``eCt*!S<*>T z<(xR>D{$cemo0F^na-pHEqk!6IG@??C@?_l0RX11=GWkfg6+iL0leO^7_Rz#?+3kq zKJjVq$GvkMX6-(!cHctnvH99#_e8U{)v9eZ!);c$&7cXKU%oRHXAdli7(1%J@vzPD zydtD!p0`6har>DR!NWXHjv=|4!eImxBa8`o_}2swbBsF)c!Pk`1neS!czSxG!z6B_ zfZWb&UjdlPze}D9AKVtW!A6e{4sUtDF+Rcp2l&0d{YxkhLS7#U1&UyZ@eLDZ6`-H- zWobzsLWw|2^3d<`5f-lwbE_c>A>1N2U_2k+Xa{(ZyvXyIT+7;PlH@*)T%7ZmLMpjhE)nQc?zP;Y$FU5x z!xyZ>7tFv#D{yg&T@1c-W79&gVLsR}7cqlPRv)2H6=o$j5Y?~)g>8=-<~(|-V$ Cc#`)3 From 981b331f838deec26ab60329872ea347ebbcd5e2 Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 04:01:19 +0530 Subject: [PATCH 03/12] Preserve real warning and enforcement run reports and logs --- examples/security-pipeline/README.md | 20 + .../evidence/enforce/codeant-findings.csv | 49 + .../evidence/enforce/codeant-qg.xml | 6 + .../evidence/enforce/codeant-run.json | 5 + .../evidence/enforce/codeant-summary.pdf | Bin 0 -> 2385 bytes .../evidence/enforce/codeant.sarif | 1023 +++++++++++++++++ .../evidence/enforce/results.json | 417 +++++++ .../evidence/enforce/runner-output.txt | 18 + .../evidence/warn/codeant-findings.csv | 49 + .../evidence/warn/codeant-qg.xml | 6 + .../evidence/warn/codeant-run.json | 5 + .../evidence/warn/codeant-summary.pdf | Bin 0 -> 2383 bytes .../evidence/warn/codeant.sarif | 1023 +++++++++++++++++ .../evidence/warn/results.json | 417 +++++++ .../evidence/warn/runner-output.txt | 21 + 15 files changed, 3059 insertions(+) create mode 100644 examples/security-pipeline/evidence/enforce/codeant-findings.csv create mode 100644 examples/security-pipeline/evidence/enforce/codeant-qg.xml create mode 100644 examples/security-pipeline/evidence/enforce/codeant-run.json create mode 100644 examples/security-pipeline/evidence/enforce/codeant-summary.pdf create mode 100644 examples/security-pipeline/evidence/enforce/codeant.sarif create mode 100644 examples/security-pipeline/evidence/enforce/results.json create mode 100644 examples/security-pipeline/evidence/enforce/runner-output.txt create mode 100644 examples/security-pipeline/evidence/warn/codeant-findings.csv create mode 100644 examples/security-pipeline/evidence/warn/codeant-qg.xml create mode 100644 examples/security-pipeline/evidence/warn/codeant-run.json create mode 100644 examples/security-pipeline/evidence/warn/codeant-summary.pdf create mode 100644 examples/security-pipeline/evidence/warn/codeant.sarif create mode 100644 examples/security-pipeline/evidence/warn/results.json create mode 100644 examples/security-pipeline/evidence/warn/runner-output.txt diff --git a/examples/security-pipeline/README.md b/examples/security-pipeline/README.md index e5d2b19..ac9b432 100644 --- a/examples/security-pipeline/README.md +++ b/examples/security-pipeline/README.md @@ -79,3 +79,23 @@ to demonstrate that capability. ReportLab 4.5.1 is installed only to produce the example PDF. Gate evaluation uses Python's standard library. No third-party report dependency is needed for gates. + +## Real run evidence + +Both runs scanned the public repository and returned 48 findings: 1 secret, +9 SAST findings (8 HIGH/CRITICAL), and 38 SCA findings (16 HIGH/CRITICAL). + +| Mode | Run | Outcome | +| --- | --- | --- | +| Warning | [42304719043](https://github.com/codeanttesting/codeant-demo/actions/runs/42304719043) | All policy jobs recorded warnings; staging readiness ran. | +| Enforcement | [42305066053](https://github.com/codeanttesting/codeant-demo/actions/runs/42305066053) | All three policy jobs failed; staging readiness was skipped. | + +The original report files and selected runner output are preserved under +[`evidence/warn`](evidence/warn) and [`evidence/enforce`](evidence/enforce), so the +examples remain available after Actions artifacts expire. These are historical +outputs for the commits identified in `codeant-run.json`, not a claim about every +future scan. Credential/setup log lines are omitted from the saved excerpts. + +In these runs, the native verdict was PASSED with no native gate conditions +enabled. The explicit example policy still blocked enforcement, which illustrates +why a native verdict must be interpreted alongside its evaluated conditions. diff --git a/examples/security-pipeline/evidence/enforce/codeant-findings.csv b/examples/security-pipeline/evidence/enforce/codeant-findings.csv new file mode 100644 index 0000000..78df719 --- /dev/null +++ b/examples/security-pipeline/evidence/enforce/codeant-findings.csv @@ -0,0 +1,49 @@ +engine,severity,file,line,rule,message +sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,23,sql-injection-db-cursor-execute,"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." +sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,27,formatted-sql-query,Detected possible formatted SQL query. Use parameterized queries instead. +sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,34,python-subprocess-shell-true-format,"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." +sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,40,python-weak-hash-md5,Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt. +sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,48,path-traversal-open,"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." +sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,54,user-eval,"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." +sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,56,eval-detected,"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." +sast,MEDIUM,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,61,debug-endpoints-enabled,"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." +sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/feature/main2.py,30,formatted-sql-query,Detected possible formatted SQL query. Use parameterized queries instead. +sca,MEDIUM,azure-identity,,CVE-2024-35255,Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability +sca,HIGH,langchain-community,,CVE-2025-6984,Langchain Community Vulnerable to XML External Entity (XXE) Attacks +sca,MEDIUM,litellm,,CVE-2026-84377,LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters +sca,MEDIUM,litellm,,CVE-2026-59823,LiteLLM Proxy has server-side request forgery via the `user_config` request parameter +sca,LOW,litellm,,CVE-2026-12799,BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure +sca,LOW,litellm,,CVE-2026-12798,BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader +sca,LOW,litellm,,CVE-2026-12797,BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints +sca,LOW,litellm,,CVE-2026-12796,BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens +sca,MEDIUM,litellm,,CVE-2026-12795,LiteLLM: SSO Debug Flow Has Improper Authentication +sca,LOW,litellm,,CVE-2026-12770,LiteLLM: Admin Key Handler Has Improper Authorization +sca,MEDIUM,litellm,,CVE-2026-12773,LiteLLM: MCP Proxy Has Improper Authentication +sca,LOW,litellm,,CVE-2026-12771,LiteLLM: M2M JWT Handler Has Improper Authorization +sca,LOW,litellm,,CVE-2026-12772,LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration +sca,CRITICAL,litellm,,CVE-2026-37004,LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint +sca,LOW,litellm,,CVE-2026-59821,LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks +sca,HIGH,litellm,,CVE-2026-59822,LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback +sca,LOW,litellm,,CVE-2026-59819,LiteLLM: Local file read via request-supplied OIDC file references +sca,MEDIUM,litellm,,CVE-2026-59820,LiteLLM: Arbitrary file write via path traversal in Skills archive extraction +sca,HIGH,litellm,,CVE-2026-47102,LiteLLM allows a user to modify their own user_role via the /user/update endpoint +sca,HIGH,litellm,,CVE-2026-47101,LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit +sca,CRITICAL,litellm,,CVE-2026-49468,LiteLLM: Authentication Bypass via Host Header Injection +sca,CRITICAL,litellm,,CVE-2026-35030,LiteLLM: Authentication bypass via OIDC userinfo cache key collision +sca,HIGH,litellm,,CVE-2026-35029,LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint +sca,HIGH,litellm,,CVE-2025-0628,LiteLLM Has an Improper Authorization Vulnerability +sca,HIGH,litellm,,,LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` +sca,HIGH,litellm,,,LiteLLM: Password hash exposure and pass-the-hash authentication bypass +sca,HIGH,starlette,,CVE-2026-54283,Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS +sca,LOW,starlette,,CVE-2026-54282,Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname +sca,HIGH,starlette,,CVE-2026-48818,Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows +sca,MEDIUM,starlette,,CVE-2026-48817,Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` +sca,MEDIUM,starlette,,CVE-2026-48710,"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" +sca,MEDIUM,starlette,,CVE-2025-54121,Starlette has possible denial-of-service vector when parsing large files in multipart forms +sca,HIGH,starlette,,CVE-2024-47874,Starlette Denial of service (DoS) via multipart/form-data +sca,HIGH,black,,CVE-2026-114134,Black: GitHub Action installs unvalidated required-version from pyproject.toml +sca,MEDIUM,black,,CVE-2024-21503,Black vulnerable to Regular Expression Denial of Service (ReDoS) +sca,HIGH,langchain-core,,CVE-2026-34070,LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions +sca,LOW,langchain-core,,CVE-2026-26013,LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages +sca,MEDIUM,langchain-text-splitters,,CVE-2026-41481,LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass +secrets,HIGH,/mnt/lambda/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/IaC.yaml,47,generic-password,generic-password diff --git a/examples/security-pipeline/evidence/enforce/codeant-qg.xml b/examples/security-pipeline/evidence/enforce/codeant-qg.xml new file mode 100644 index 0000000..d2b053a --- /dev/null +++ b/examples/security-pipeline/evidence/enforce/codeant-qg.xml @@ -0,0 +1,6 @@ + +Quality Gate: PASSED +Total findings: 48 +By severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11 +By engine: sast=9, sca=38, secrets=1 +Ratings: sast_rating_full_code=C, sca_rating_full_code=D \ No newline at end of file diff --git a/examples/security-pipeline/evidence/enforce/codeant-run.json b/examples/security-pipeline/evidence/enforce/codeant-run.json new file mode 100644 index 0000000..ef1de3f --- /dev/null +++ b/examples/security-pipeline/evidence/enforce/codeant-run.json @@ -0,0 +1,5 @@ +{ + "repository": "codeanttesting/codeant-demo", + "commit": "d860b95a2ef978cc9bfd188a35476a6e7bdb333e", + "run_url": "https://github.com/codeanttesting/codeant-demo/actions/runs/42305066053" +} diff --git a/examples/security-pipeline/evidence/enforce/codeant-summary.pdf b/examples/security-pipeline/evidence/enforce/codeant-summary.pdf new file mode 100644 index 0000000000000000000000000000000000000000..0aa2964697b8bc4d78b00433f5d0962b80500fb0 GIT binary patch literal 2385 zcma);*_NtE7KZPAif}-2WD*opalkP}O^0;G6d^=1l^_ADPxeK>K-XQ}_p^48!zovu zUR}j<2@$d5-C! zkppcHU0od}Lkyq+Iy{HUsT%=E-kEN(!L8ux0ff4pDnh6`9clq<)11bgrs0s4%0^;e^ z%+>67$)G<3zR*43$v5bDZ2E;R7#bi0^L_N-5ZU-4=<>b-{a`O^zII0DjfQZeQNQ{p z2j<4qOD3aKb%99Vh*k z{2su}^3OPU86&FWMUs2KgZkCA{5Rm~nvJ8v%pC`BAF8dLy<5z|Qh#BV(e-_aslJ6@ zW&?t3ngnU_!S@~c4c#EGzNWUVvyWd0=Rp0o*gd^OTG7h6@CjRWU?>S+YTXmvIwiq{!ElI>RsZopM9B#EH z7(W#ByZx-qg9OsyLZunYhN!xo$pjS=4lP zH6HgQx1Zo-T}zdpD~esG(;FCDimEudcGhxURqkfhbhi>ssZ;fp==X&xx<{i*Q|~oM zXOLHHjcH8j!#YAGgwrUCQfr|5Y7GTSv{$7VS0K|qqB1J^kSV)Oo}VFj?q(c+(=~HL37%WV#Tc7 zP|PRP-Z;#Xj;hkQdh9<<48&C`&Q98z(K?&dMe22+6!iUe$|{k@TucnsOnhUt#H7sK zb)#Adb{Oi-Rvsfl*|Avfde5AGr%sCABRWz#34bz!ko3Tc=Z_LK4+2T&XNE_nDzOiKiDGS}E~a zPUeR%tMkTrCb&C3tDlCeaU>q;NEJwK8f~IrY0k#z*W6W%Q@8$^-Jj1JI zqwc<++1Yo+8iTjlwOUI)ZS1^%HOq(b(H8$D;mZ2Cmp^Ol4;LOoG!R4d&kG1V&+*_0 ze)b8tngkcHfA%pnuFl{3SX%t0k7IwG%d_}{^=&RM{;F3j;s37iH+jiWjG$j}GP;8^Vlxq>L@nj!tQg&HDm4m9TfKG0;dz_4&(`*ySm rQ9b*JKv2#mAzVq34}$WDpQqM8A*THPE!ABA9Xlh6_yk4ZPg>}|F;1ov literal 0 HcmV?d00001 diff --git a/examples/security-pipeline/evidence/enforce/codeant.sarif b/examples/security-pipeline/evidence/enforce/codeant.sarif new file mode 100644 index 0000000..465a49d --- /dev/null +++ b/examples/security-pipeline/evidence/enforce/codeant.sarif @@ -0,0 +1,1023 @@ +{ + "version": "2.1.0", + "$schema": "https://json.schemastore.org/sarif-2.1.0.json", + "runs": [ + { + "tool": { + "driver": { + "name": "CodeAnt AI", + "rules": [ + { + "id": "CVE-2024-21503", + "name": "CVE-2024-21503" + }, + { + "id": "CVE-2024-35255", + "name": "CVE-2024-35255" + }, + { + "id": "CVE-2024-47874", + "name": "CVE-2024-47874" + }, + { + "id": "CVE-2025-0628", + "name": "CVE-2025-0628" + }, + { + "id": "CVE-2025-54121", + "name": "CVE-2025-54121" + }, + { + "id": "CVE-2025-6984", + "name": "CVE-2025-6984" + }, + { + "id": "CVE-2026-114134", + "name": "CVE-2026-114134" + }, + { + "id": "CVE-2026-12770", + "name": "CVE-2026-12770" + }, + { + "id": "CVE-2026-12771", + "name": "CVE-2026-12771" + }, + { + "id": "CVE-2026-12772", + "name": "CVE-2026-12772" + }, + { + "id": "CVE-2026-12773", + "name": "CVE-2026-12773" + }, + { + "id": "CVE-2026-12795", + "name": "CVE-2026-12795" + }, + { + "id": "CVE-2026-12796", + "name": "CVE-2026-12796" + }, + { + "id": "CVE-2026-12797", + "name": "CVE-2026-12797" + }, + { + "id": "CVE-2026-12798", + "name": "CVE-2026-12798" + }, + { + "id": "CVE-2026-12799", + "name": "CVE-2026-12799" + }, + { + "id": "CVE-2026-26013", + "name": "CVE-2026-26013" + }, + { + "id": "CVE-2026-34070", + "name": "CVE-2026-34070" + }, + { + "id": "CVE-2026-35029", + "name": "CVE-2026-35029" + }, + { + "id": "CVE-2026-35030", + "name": "CVE-2026-35030" + }, + { + "id": "CVE-2026-37004", + "name": "CVE-2026-37004" + }, + { + "id": "CVE-2026-41481", + "name": "CVE-2026-41481" + }, + { + "id": "CVE-2026-47101", + "name": "CVE-2026-47101" + }, + { + "id": "CVE-2026-47102", + "name": "CVE-2026-47102" + }, + { + "id": "CVE-2026-48710", + "name": "CVE-2026-48710" + }, + { + "id": "CVE-2026-48817", + "name": "CVE-2026-48817" + }, + { + "id": "CVE-2026-48818", + "name": "CVE-2026-48818" + }, + { + "id": "CVE-2026-49468", + "name": "CVE-2026-49468" + }, + { + "id": "CVE-2026-54282", + "name": "CVE-2026-54282" + }, + { + "id": "CVE-2026-54283", + "name": "CVE-2026-54283" + }, + { + "id": "CVE-2026-59819", + "name": "CVE-2026-59819" + }, + { + "id": "CVE-2026-59820", + "name": "CVE-2026-59820" + }, + { + "id": "CVE-2026-59821", + "name": "CVE-2026-59821" + }, + { + "id": "CVE-2026-59822", + "name": "CVE-2026-59822" + }, + { + "id": "CVE-2026-59823", + "name": "CVE-2026-59823" + }, + { + "id": "CVE-2026-84377", + "name": "CVE-2026-84377" + }, + { + "id": "debug-endpoints-enabled", + "name": "debug-endpoints-enabled" + }, + { + "id": "eval-detected", + "name": "eval-detected" + }, + { + "id": "formatted-sql-query", + "name": "formatted-sql-query" + }, + { + "id": "generic-password", + "name": "generic-password" + }, + { + "id": "path-traversal-open", + "name": "path-traversal-open" + }, + { + "id": "python-subprocess-shell-true-format", + "name": "python-subprocess-shell-true-format" + }, + { + "id": "python-weak-hash-md5", + "name": "python-weak-hash-md5" + }, + { + "id": "sca", + "name": "sca" + }, + { + "id": "sql-injection-db-cursor-execute", + "name": "sql-injection-db-cursor-execute" + }, + { + "id": "user-eval", + "name": "user-eval" + } + ] + } + }, + "results": [ + { + "ruleId": "sql-injection-db-cursor-execute", + "level": "error", + "message": { + "text": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" + }, + "region": { + "startLine": 23 + } + } + } + ] + }, + { + "ruleId": "formatted-sql-query", + "level": "error", + "message": { + "text": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" + }, + "region": { + "startLine": 27 + } + } + } + ] + }, + { + "ruleId": "python-subprocess-shell-true-format", + "level": "error", + "message": { + "text": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" + }, + "region": { + "startLine": 34 + } + } + } + ] + }, + { + "ruleId": "python-weak-hash-md5", + "level": "error", + "message": { + "text": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" + }, + "region": { + "startLine": 40 + } + } + } + ] + }, + { + "ruleId": "path-traversal-open", + "level": "error", + "message": { + "text": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" + }, + "region": { + "startLine": 48 + } + } + } + ] + }, + { + "ruleId": "user-eval", + "level": "error", + "message": { + "text": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" + }, + "region": { + "startLine": 54 + } + } + } + ] + }, + { + "ruleId": "eval-detected", + "level": "error", + "message": { + "text": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" + }, + "region": { + "startLine": 56 + } + } + } + ] + }, + { + "ruleId": "debug-endpoints-enabled", + "level": "warning", + "message": { + "text": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" + }, + "region": { + "startLine": 61 + } + } + } + ] + }, + { + "ruleId": "formatted-sql-query", + "level": "error", + "message": { + "text": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/feature/main2.py" + }, + "region": { + "startLine": 30 + } + } + } + ] + }, + { + "ruleId": "CVE-2024-35255", + "level": "warning", + "message": { + "text": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "azure-identity" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-6984", + "level": "error", + "message": { + "text": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-community" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-84377", + "level": "warning", + "message": { + "text": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59823", + "level": "warning", + "message": { + "text": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12799", + "level": "note", + "message": { + "text": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12798", + "level": "note", + "message": { + "text": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12797", + "level": "note", + "message": { + "text": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12796", + "level": "note", + "message": { + "text": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12795", + "level": "warning", + "message": { + "text": "LiteLLM: SSO Debug Flow Has Improper Authentication" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12770", + "level": "note", + "message": { + "text": "LiteLLM: Admin Key Handler Has Improper Authorization" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12773", + "level": "warning", + "message": { + "text": "LiteLLM: MCP Proxy Has Improper Authentication" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12771", + "level": "note", + "message": { + "text": "LiteLLM: M2M JWT Handler Has Improper Authorization" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12772", + "level": "note", + "message": { + "text": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-37004", + "level": "error", + "message": { + "text": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59821", + "level": "note", + "message": { + "text": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59822", + "level": "error", + "message": { + "text": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59819", + "level": "note", + "message": { + "text": "LiteLLM: Local file read via request-supplied OIDC file references" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59820", + "level": "warning", + "message": { + "text": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-47102", + "level": "error", + "message": { + "text": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-47101", + "level": "error", + "message": { + "text": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-49468", + "level": "error", + "message": { + "text": "LiteLLM: Authentication Bypass via Host Header Injection" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-35030", + "level": "error", + "message": { + "text": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-35029", + "level": "error", + "message": { + "text": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-0628", + "level": "error", + "message": { + "text": "LiteLLM Has an Improper Authorization Vulnerability" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "sca", + "level": "error", + "message": { + "text": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "sca", + "level": "error", + "message": { + "text": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-54283", + "level": "error", + "message": { + "text": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-54282", + "level": "note", + "message": { + "text": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48818", + "level": "error", + "message": { + "text": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48817", + "level": "warning", + "message": { + "text": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48710", + "level": "warning", + "message": { + "text": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-54121", + "level": "warning", + "message": { + "text": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2024-47874", + "level": "error", + "message": { + "text": "Starlette Denial of service (DoS) via multipart/form-data" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-114134", + "level": "error", + "message": { + "text": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "black" + } + } + } + ] + }, + { + "ruleId": "CVE-2024-21503", + "level": "warning", + "message": { + "text": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "black" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-34070", + "level": "error", + "message": { + "text": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-core" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-26013", + "level": "note", + "message": { + "text": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-core" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-41481", + "level": "warning", + "message": { + "text": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-text-splitters" + } + } + } + ] + }, + { + "ruleId": "generic-password", + "level": "error", + "message": { + "text": "generic-password" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/IaC.yaml" + }, + "region": { + "startLine": 47 + } + } + } + ] + } + ], + "invocations": [ + { + "executionSuccessful": true + } + ], + "properties": { + "total_findings": 48, + "findings_by_severity": { + "HIGH": 19, + "CRITICAL": 6, + "MEDIUM": 12, + "LOW": 11 + }, + "findings_by_engine": { + "sast": 9, + "sca": 38, + "secrets": 1 + }, + "ratings": { + "sast_rating_full_code": "C", + "sca_rating_full_code": "D" + }, + "quality_gate_status": "PASSED" + } + } + ] +} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/enforce/results.json b/examples/security-pipeline/evidence/enforce/results.json new file mode 100644 index 0000000..8d82048 --- /dev/null +++ b/examples/security-pipeline/evidence/enforce/results.json @@ -0,0 +1,417 @@ +{ + "status": "COMPLETED", + "quality_gate_status": "PASSED", + "metrics": { + "sast_rating_full_code": "C", + "sca_rating_full_code": "D" + }, + "failed_conditions": [], + "evaluated_conditions": [ + { + "metric": "sast_rating_full_code", + "context": "CodeAnt - SAST", + "actual": "C", + "quality_gate_enabled": false, + "quality_gate_status": "PASSED", + "why": "No quality gate conditions found for metric 'sast_rating_full_code' in scope 'commit'" + }, + { + "metric": "sca_rating_full_code", + "context": "CodeAnt - SCA", + "actual": "D", + "quality_gate_enabled": false, + "quality_gate_status": "PASSED", + "why": "No quality gate conditions found for metric 'sca_rating_full_code' in scope 'commit'" + } + ], + "findings": [ + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", + "line": 23, + "rule": "sql-injection-db-cursor-execute", + "message": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", + "line": 27, + "rule": "formatted-sql-query", + "message": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", + "line": 34, + "rule": "python-subprocess-shell-true-format", + "message": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", + "line": 40, + "rule": "python-weak-hash-md5", + "message": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", + "line": 48, + "rule": "path-traversal-open", + "message": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", + "line": 54, + "rule": "user-eval", + "message": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", + "line": 56, + "rule": "eval-detected", + "message": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." + }, + { + "engine": "sast", + "severity": "MEDIUM", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", + "line": 61, + "rule": "debug-endpoints-enabled", + "message": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/feature/main2.py", + "line": 30, + "rule": "formatted-sql-query", + "message": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "azure-identity", + "line": null, + "rule": "CVE-2024-35255", + "message": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "langchain-community", + "line": null, + "rule": "CVE-2025-6984", + "message": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-84377", + "message": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59823", + "message": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12799", + "message": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12798", + "message": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12797", + "message": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12796", + "message": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12795", + "message": "LiteLLM: SSO Debug Flow Has Improper Authentication" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12770", + "message": "LiteLLM: Admin Key Handler Has Improper Authorization" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12773", + "message": "LiteLLM: MCP Proxy Has Improper Authentication" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12771", + "message": "LiteLLM: M2M JWT Handler Has Improper Authorization" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12772", + "message": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-37004", + "message": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59821", + "message": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59822", + "message": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59819", + "message": "LiteLLM: Local file read via request-supplied OIDC file references" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59820", + "message": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-47102", + "message": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-47101", + "message": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-49468", + "message": "LiteLLM: Authentication Bypass via Host Header Injection" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-35030", + "message": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-35029", + "message": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2025-0628", + "message": "LiteLLM Has an Improper Authorization Vulnerability" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "", + "message": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "", + "message": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2026-54283", + "message": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "starlette", + "line": null, + "rule": "CVE-2026-54282", + "message": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48818", + "message": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48817", + "message": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48710", + "message": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2025-54121", + "message": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2024-47874", + "message": "Starlette Denial of service (DoS) via multipart/form-data" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "black", + "line": null, + "rule": "CVE-2026-114134", + "message": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "black", + "line": null, + "rule": "CVE-2024-21503", + "message": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "langchain-core", + "line": null, + "rule": "CVE-2026-34070", + "message": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "langchain-core", + "line": null, + "rule": "CVE-2026-26013", + "message": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "langchain-text-splitters", + "line": null, + "rule": "CVE-2026-41481", + "message": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" + }, + { + "engine": "secrets", + "severity": "HIGH", + "file": "/mnt/lambda/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/IaC.yaml", + "line": 47, + "rule": "generic-password", + "message": "generic-password" + } + ], + "reports": { + "sarif": "{\n \"version\": \"2.1.0\",\n \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n \"runs\": [\n {\n \"tool\": {\n \"driver\": {\n \"name\": \"CodeAnt AI\",\n \"rules\": [\n {\n \"id\": \"CVE-2024-21503\",\n \"name\": \"CVE-2024-21503\"\n },\n {\n \"id\": \"CVE-2024-35255\",\n \"name\": \"CVE-2024-35255\"\n },\n {\n \"id\": \"CVE-2024-47874\",\n \"name\": \"CVE-2024-47874\"\n },\n {\n \"id\": \"CVE-2025-0628\",\n \"name\": \"CVE-2025-0628\"\n },\n {\n \"id\": \"CVE-2025-54121\",\n \"name\": \"CVE-2025-54121\"\n },\n {\n \"id\": \"CVE-2025-6984\",\n \"name\": \"CVE-2025-6984\"\n },\n {\n \"id\": \"CVE-2026-114134\",\n \"name\": \"CVE-2026-114134\"\n },\n {\n \"id\": \"CVE-2026-12770\",\n \"name\": \"CVE-2026-12770\"\n },\n {\n \"id\": \"CVE-2026-12771\",\n \"name\": \"CVE-2026-12771\"\n },\n {\n \"id\": \"CVE-2026-12772\",\n \"name\": \"CVE-2026-12772\"\n },\n {\n \"id\": \"CVE-2026-12773\",\n \"name\": \"CVE-2026-12773\"\n },\n {\n \"id\": \"CVE-2026-12795\",\n \"name\": \"CVE-2026-12795\"\n },\n {\n \"id\": \"CVE-2026-12796\",\n \"name\": \"CVE-2026-12796\"\n },\n {\n \"id\": \"CVE-2026-12797\",\n \"name\": \"CVE-2026-12797\"\n },\n {\n \"id\": \"CVE-2026-12798\",\n \"name\": \"CVE-2026-12798\"\n },\n {\n \"id\": \"CVE-2026-12799\",\n \"name\": \"CVE-2026-12799\"\n },\n {\n \"id\": \"CVE-2026-26013\",\n \"name\": \"CVE-2026-26013\"\n },\n {\n \"id\": \"CVE-2026-34070\",\n \"name\": \"CVE-2026-34070\"\n },\n {\n \"id\": \"CVE-2026-35029\",\n \"name\": \"CVE-2026-35029\"\n },\n {\n \"id\": \"CVE-2026-35030\",\n \"name\": \"CVE-2026-35030\"\n },\n {\n \"id\": \"CVE-2026-37004\",\n \"name\": \"CVE-2026-37004\"\n },\n {\n \"id\": \"CVE-2026-41481\",\n \"name\": \"CVE-2026-41481\"\n },\n {\n \"id\": \"CVE-2026-47101\",\n \"name\": \"CVE-2026-47101\"\n },\n {\n \"id\": \"CVE-2026-47102\",\n \"name\": \"CVE-2026-47102\"\n },\n {\n \"id\": \"CVE-2026-48710\",\n \"name\": \"CVE-2026-48710\"\n },\n {\n \"id\": \"CVE-2026-48817\",\n \"name\": \"CVE-2026-48817\"\n },\n {\n \"id\": \"CVE-2026-48818\",\n \"name\": \"CVE-2026-48818\"\n },\n {\n \"id\": \"CVE-2026-49468\",\n \"name\": \"CVE-2026-49468\"\n },\n {\n \"id\": \"CVE-2026-54282\",\n \"name\": \"CVE-2026-54282\"\n },\n {\n \"id\": \"CVE-2026-54283\",\n \"name\": \"CVE-2026-54283\"\n },\n {\n \"id\": \"CVE-2026-59819\",\n \"name\": \"CVE-2026-59819\"\n },\n {\n \"id\": \"CVE-2026-59820\",\n \"name\": \"CVE-2026-59820\"\n },\n {\n \"id\": \"CVE-2026-59821\",\n \"name\": \"CVE-2026-59821\"\n },\n {\n \"id\": \"CVE-2026-59822\",\n \"name\": \"CVE-2026-59822\"\n },\n {\n \"id\": \"CVE-2026-59823\",\n \"name\": \"CVE-2026-59823\"\n },\n {\n \"id\": \"CVE-2026-84377\",\n \"name\": \"CVE-2026-84377\"\n },\n {\n \"id\": \"debug-endpoints-enabled\",\n \"name\": \"debug-endpoints-enabled\"\n },\n {\n \"id\": \"eval-detected\",\n \"name\": \"eval-detected\"\n },\n {\n \"id\": \"formatted-sql-query\",\n \"name\": \"formatted-sql-query\"\n },\n {\n \"id\": \"generic-password\",\n \"name\": \"generic-password\"\n },\n {\n \"id\": \"path-traversal-open\",\n \"name\": \"path-traversal-open\"\n },\n {\n \"id\": \"python-subprocess-shell-true-format\",\n \"name\": \"python-subprocess-shell-true-format\"\n },\n {\n \"id\": \"python-weak-hash-md5\",\n \"name\": \"python-weak-hash-md5\"\n },\n {\n \"id\": \"sca\",\n \"name\": \"sca\"\n },\n {\n \"id\": \"sql-injection-db-cursor-execute\",\n \"name\": \"sql-injection-db-cursor-execute\"\n },\n {\n \"id\": \"user-eval\",\n \"name\": \"user-eval\"\n }\n ]\n }\n },\n \"results\": [\n {\n \"ruleId\": \"sql-injection-db-cursor-execute\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 23\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 27\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-subprocess-shell-true-format\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 34\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-weak-hash-md5\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 40\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"path-traversal-open\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 48\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"user-eval\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 54\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"eval-detected\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 56\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"debug-endpoints-enabled\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 61\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/feature/main2.py\"\n },\n \"region\": {\n \"startLine\": 30\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-35255\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"azure-identity\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-6984\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Langchain Community Vulnerable to XML External Entity (XXE) Attacks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-community\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-84377\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59823\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12799\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12798\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12797\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12796\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12795\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: SSO Debug Flow Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12770\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Admin Key Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12773\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Proxy Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12771\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: M2M JWT Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12772\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-37004\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59821\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59822\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59819\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Local file read via request-supplied OIDC file references\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59820\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Arbitrary file write via path traversal in Skills archive extraction\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47102\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows a user to modify their own user_role via the /user/update endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47101\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-49468\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication Bypass via Host Header Injection\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35030\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication bypass via OIDC userinfo cache key collision\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35029\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-0628\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM Has an Improper Authorization Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Password hash exposure and pass-the-hash authentication bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54283\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54282\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48818\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48817\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48710\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-54121\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has possible denial-of-service vector when parsing large files in multipart forms\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-47874\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette Denial of service (DoS) via multipart/form-data\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-114134\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Black: GitHub Action installs unvalidated required-version from pyproject.toml\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-21503\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Black vulnerable to Regular Expression Denial of Service (ReDoS)\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-34070\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-26013\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-41481\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-text-splitters\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"generic-password\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"generic-password\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/IaC.yaml\"\n },\n \"region\": {\n \"startLine\": 47\n }\n }\n }\n ]\n }\n ],\n \"invocations\": [\n {\n \"executionSuccessful\": true\n }\n ],\n \"properties\": {\n \"total_findings\": 48,\n \"findings_by_severity\": {\n \"HIGH\": 19,\n \"CRITICAL\": 6,\n \"MEDIUM\": 12,\n \"LOW\": 11\n },\n \"findings_by_engine\": {\n \"sast\": 9,\n \"sca\": 38,\n \"secrets\": 1\n },\n \"ratings\": {\n \"sast_rating_full_code\": \"C\",\n \"sca_rating_full_code\": \"D\"\n },\n \"quality_gate_status\": \"PASSED\"\n }\n }\n ]\n}", + "junit": "\nQuality Gate: PASSED\nTotal findings: 48\nBy severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11\nBy engine: sast=9, sca=38, secrets=1\nRatings: sast_rating_full_code=C, sca_rating_full_code=D" + } +} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/enforce/runner-output.txt b/examples/security-pipeline/evidence/enforce/runner-output.txt new file mode 100644 index 0000000..9d55239 --- /dev/null +++ b/examples/security-pipeline/evidence/enforce/runner-output.txt @@ -0,0 +1,18 @@ +Run: https://github.com/codeanttesting/codeant-demo/actions/runs/42305066053 +Selected runner output (credential and setup lines omitted): + +2026-11-06T22:29:25.8764366Z ✅ Scan started +2026-11-06T22:29:27.1959770Z 📝 Scan still running... +2026-11-06T22:29:58.6748469Z 📝 Wrote results.json, codeant.sarif, codeant-qg.xml +2026-11-06T22:29:58.6749693Z 📊 Findings: 48 +2026-11-06T22:29:58.6750544Z 🎯 Quality Gate: PASSED +2026-11-06T22:30:02.7548031Z secrets: 1 blocking findings; allowed=0 +2026-11-06T22:30:02.7548709Z sast: 8 blocking findings; allowed=0 +2026-11-06T22:30:02.7549181Z sca: 16 blocking findings; allowed=0 +2026-11-06T22:30:02.7703130Z Completed scan; wrote codeant-findings.csv, codeant-summary.pdf, codeant-run.json +2026-11-06T22:30:12.6644684Z sast: 8 blocking findings; allowed=0; mode=enforce +2026-11-06T22:30:12.6665337Z ##[error]sast: 8 blocking findings; allowed=0 +2026-11-06T22:30:12.9122548Z secrets: 1 blocking findings; allowed=0; mode=enforce +2026-11-06T22:30:12.9258255Z ##[error]secrets: 1 blocking findings; allowed=0 +2026-11-06T22:30:13.3369612Z sca: 16 blocking findings; allowed=0; mode=enforce +2026-11-06T22:30:13.3403954Z ##[error]sca: 16 blocking findings; allowed=0 diff --git a/examples/security-pipeline/evidence/warn/codeant-findings.csv b/examples/security-pipeline/evidence/warn/codeant-findings.csv new file mode 100644 index 0000000..8f98465 --- /dev/null +++ b/examples/security-pipeline/evidence/warn/codeant-findings.csv @@ -0,0 +1,49 @@ +engine,severity,file,line,rule,message +sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/feature/main2.py,30,formatted-sql-query,Detected possible formatted SQL query. Use parameterized queries instead. +sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,23,sql-injection-db-cursor-execute,"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." +sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,27,formatted-sql-query,Detected possible formatted SQL query. Use parameterized queries instead. +sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,34,python-subprocess-shell-true-format,"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." +sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,40,python-weak-hash-md5,Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt. +sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,48,path-traversal-open,"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." +sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,54,user-eval,"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." +sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,56,eval-detected,"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." +sast,MEDIUM,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,61,debug-endpoints-enabled,"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." +sca,MEDIUM,azure-identity,,CVE-2024-35255,Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability +sca,HIGH,langchain-community,,CVE-2025-6984,Langchain Community Vulnerable to XML External Entity (XXE) Attacks +sca,MEDIUM,litellm,,CVE-2026-84377,LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters +sca,MEDIUM,litellm,,CVE-2026-59823,LiteLLM Proxy has server-side request forgery via the `user_config` request parameter +sca,LOW,litellm,,CVE-2026-12799,BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure +sca,LOW,litellm,,CVE-2026-12798,BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader +sca,LOW,litellm,,CVE-2026-12797,BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints +sca,LOW,litellm,,CVE-2026-12796,BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens +sca,MEDIUM,litellm,,CVE-2026-12795,LiteLLM: SSO Debug Flow Has Improper Authentication +sca,LOW,litellm,,CVE-2026-12770,LiteLLM: Admin Key Handler Has Improper Authorization +sca,MEDIUM,litellm,,CVE-2026-12773,LiteLLM: MCP Proxy Has Improper Authentication +sca,LOW,litellm,,CVE-2026-12771,LiteLLM: M2M JWT Handler Has Improper Authorization +sca,LOW,litellm,,CVE-2026-12772,LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration +sca,CRITICAL,litellm,,CVE-2026-37004,LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint +sca,LOW,litellm,,CVE-2026-59821,LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks +sca,HIGH,litellm,,CVE-2026-59822,LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback +sca,LOW,litellm,,CVE-2026-59819,LiteLLM: Local file read via request-supplied OIDC file references +sca,MEDIUM,litellm,,CVE-2026-59820,LiteLLM: Arbitrary file write via path traversal in Skills archive extraction +sca,HIGH,litellm,,CVE-2026-47102,LiteLLM allows a user to modify their own user_role via the /user/update endpoint +sca,HIGH,litellm,,CVE-2026-47101,LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit +sca,CRITICAL,litellm,,CVE-2026-49468,LiteLLM: Authentication Bypass via Host Header Injection +sca,CRITICAL,litellm,,CVE-2026-35030,LiteLLM: Authentication bypass via OIDC userinfo cache key collision +sca,HIGH,litellm,,CVE-2026-35029,LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint +sca,HIGH,litellm,,CVE-2025-0628,LiteLLM Has an Improper Authorization Vulnerability +sca,HIGH,litellm,,,LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` +sca,HIGH,litellm,,,LiteLLM: Password hash exposure and pass-the-hash authentication bypass +sca,HIGH,starlette,,CVE-2026-54283,Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS +sca,LOW,starlette,,CVE-2026-54282,Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname +sca,HIGH,starlette,,CVE-2026-48818,Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows +sca,MEDIUM,starlette,,CVE-2026-48817,Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` +sca,MEDIUM,starlette,,CVE-2026-48710,"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" +sca,MEDIUM,starlette,,CVE-2025-54121,Starlette has possible denial-of-service vector when parsing large files in multipart forms +sca,HIGH,starlette,,CVE-2024-47874,Starlette Denial of service (DoS) via multipart/form-data +sca,HIGH,black,,CVE-2026-114134,Black: GitHub Action installs unvalidated required-version from pyproject.toml +sca,MEDIUM,black,,CVE-2024-21503,Black vulnerable to Regular Expression Denial of Service (ReDoS) +sca,MEDIUM,langchain-text-splitters,,CVE-2026-41481,LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass +sca,HIGH,langchain-core,,CVE-2026-34070,LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions +sca,LOW,langchain-core,,CVE-2026-26013,LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages +secrets,HIGH,/mnt/lambda/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/IaC.yaml,47,generic-password,generic-password diff --git a/examples/security-pipeline/evidence/warn/codeant-qg.xml b/examples/security-pipeline/evidence/warn/codeant-qg.xml new file mode 100644 index 0000000..d2b053a --- /dev/null +++ b/examples/security-pipeline/evidence/warn/codeant-qg.xml @@ -0,0 +1,6 @@ + +Quality Gate: PASSED +Total findings: 48 +By severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11 +By engine: sast=9, sca=38, secrets=1 +Ratings: sast_rating_full_code=C, sca_rating_full_code=D \ No newline at end of file diff --git a/examples/security-pipeline/evidence/warn/codeant-run.json b/examples/security-pipeline/evidence/warn/codeant-run.json new file mode 100644 index 0000000..a440155 --- /dev/null +++ b/examples/security-pipeline/evidence/warn/codeant-run.json @@ -0,0 +1,5 @@ +{ + "repository": "codeanttesting/codeant-demo", + "commit": "a342d10cc4ddf2a446e5f09d0d89d3913182effe", + "run_url": "https://github.com/codeanttesting/codeant-demo/actions/runs/42304719043" +} diff --git a/examples/security-pipeline/evidence/warn/codeant-summary.pdf b/examples/security-pipeline/evidence/warn/codeant-summary.pdf new file mode 100644 index 0000000000000000000000000000000000000000..d1aaeb7753d0d5f522009e487d2779a5a69e8939 GIT binary patch literal 2383 zcma);*_NtE7KZPAicnL?48Zfvy1!R{2x!@^Ot%jhj2L{2&mtj-!VAsJ?WFK0; zK_6)fAUn3^=*Tt!xkPru_RyalBjp6KC=JNjRrTM_xG~57xE=5PAT-}r0cP%tD96odB%A6hOvWW7pAU(8p3_ups0d{=f(aC&h%#&wK0hJ^(TX0?4W3;|0Xi z$+@f8?~*}(2z;R%M~>YNq9fWRhGICHrZ|RS3N)Rjs099f*?kCHZSM>< zWFV-&OFY51e>kr00Rr3MIR8ot)6=gS#KHWT;Q>YgsjlL_fh>@2GCOb)P{Ij!fErGE ziTEDC9QhUwzJ(Dr@FKMaz=PV=MgAM`G{weIVdm#E-acekvAkQ%!BT%=ZaLTYB_^K` zewkMgWYaWAix0l<$ZzNddG$55i!2|%5YC6jtTh-E**3&`DA*7d=K9&dN&>V^e-C($ z3WPi#!#{<3ieE`8TL-~-qwXG$sYzYpT%nmguSt6;La_k(L}z`-m){rQp+9^U zK-9S(HwfpjoZnfQ?oK9KY?`y!k+Dmr=MJIv8plhVPV$pgVTXDQuMTH8>B?z&=j16{ z8}f^IAw^%)S(3ckwHG~>TgcO=*<+r*Yoc&bl-7Cm_#le%#8FEJArpaDPM?bz^uGr(JsOERiad>~ciT=!Bf6kP~Ls^=z&()q%UzO3|JccUN;!;cA4$H|EQ$E$sMKM{= z8qCh34y`#?-30wU!+{O4^_#O_R5lTE+sZn$wsTN zz)x4b;TGje)Ld9n^Te!|Q1n-}Jz&<{*l9DJ8)8U-QxFck#+fhF%%;A=HhEwzIh&p<&mLZ(#`7m!4HpB?^dXXtglbm~gp^fx` zkgfE1N?YDU@Mrahd<=1`yLCpFrG4?d7|QL8vg@Z?=cz{#ReBf}x9POju6L)W=i@_4 zs5Nj@!$NM9mtHzng-E&Uy!GUxjkp=yrTQs*5>MTmge70hXoX}OmHtDro7g0ty0i5d z3XKnW&GMT(oZj{$N8x>?~L}FMTU}jDf(hoi%UD1 zd{Kv$YGkxcHJ$uL6LlhSy%bD^wl-Pe5zdv~azo_r9lLTER7dr694!`G%Xr*X;EG=_ zQUrTf6I;)QUzP{uQ}@|o9^7(7D$=C%uPUyqpF8=p!v1if5uyMeqJCb0W7!-F4Dhp$ z!?h&1fc>+Nrf_Zk*2hr%FMT=Y*SRc%KUd%8viz@l#Ud`s-|YDOjh*i*$b#Wr?bMy^O}9M8Z4qf$zaR-nqMtg0K;zqXJ=v76(J`M-}d*(}fzE^FToHX(9g p8x9DH*))XfsN;j6IO69S`X|Jc-@l}a>%U{Cd7cTyVjZy?`Y&ENuc-h4 literal 0 HcmV?d00001 diff --git a/examples/security-pipeline/evidence/warn/codeant.sarif b/examples/security-pipeline/evidence/warn/codeant.sarif new file mode 100644 index 0000000..70e7d61 --- /dev/null +++ b/examples/security-pipeline/evidence/warn/codeant.sarif @@ -0,0 +1,1023 @@ +{ + "version": "2.1.0", + "$schema": "https://json.schemastore.org/sarif-2.1.0.json", + "runs": [ + { + "tool": { + "driver": { + "name": "CodeAnt AI", + "rules": [ + { + "id": "CVE-2024-21503", + "name": "CVE-2024-21503" + }, + { + "id": "CVE-2024-35255", + "name": "CVE-2024-35255" + }, + { + "id": "CVE-2024-47874", + "name": "CVE-2024-47874" + }, + { + "id": "CVE-2025-0628", + "name": "CVE-2025-0628" + }, + { + "id": "CVE-2025-54121", + "name": "CVE-2025-54121" + }, + { + "id": "CVE-2025-6984", + "name": "CVE-2025-6984" + }, + { + "id": "CVE-2026-114134", + "name": "CVE-2026-114134" + }, + { + "id": "CVE-2026-12770", + "name": "CVE-2026-12770" + }, + { + "id": "CVE-2026-12771", + "name": "CVE-2026-12771" + }, + { + "id": "CVE-2026-12772", + "name": "CVE-2026-12772" + }, + { + "id": "CVE-2026-12773", + "name": "CVE-2026-12773" + }, + { + "id": "CVE-2026-12795", + "name": "CVE-2026-12795" + }, + { + "id": "CVE-2026-12796", + "name": "CVE-2026-12796" + }, + { + "id": "CVE-2026-12797", + "name": "CVE-2026-12797" + }, + { + "id": "CVE-2026-12798", + "name": "CVE-2026-12798" + }, + { + "id": "CVE-2026-12799", + "name": "CVE-2026-12799" + }, + { + "id": "CVE-2026-26013", + "name": "CVE-2026-26013" + }, + { + "id": "CVE-2026-34070", + "name": "CVE-2026-34070" + }, + { + "id": "CVE-2026-35029", + "name": "CVE-2026-35029" + }, + { + "id": "CVE-2026-35030", + "name": "CVE-2026-35030" + }, + { + "id": "CVE-2026-37004", + "name": "CVE-2026-37004" + }, + { + "id": "CVE-2026-41481", + "name": "CVE-2026-41481" + }, + { + "id": "CVE-2026-47101", + "name": "CVE-2026-47101" + }, + { + "id": "CVE-2026-47102", + "name": "CVE-2026-47102" + }, + { + "id": "CVE-2026-48710", + "name": "CVE-2026-48710" + }, + { + "id": "CVE-2026-48817", + "name": "CVE-2026-48817" + }, + { + "id": "CVE-2026-48818", + "name": "CVE-2026-48818" + }, + { + "id": "CVE-2026-49468", + "name": "CVE-2026-49468" + }, + { + "id": "CVE-2026-54282", + "name": "CVE-2026-54282" + }, + { + "id": "CVE-2026-54283", + "name": "CVE-2026-54283" + }, + { + "id": "CVE-2026-59819", + "name": "CVE-2026-59819" + }, + { + "id": "CVE-2026-59820", + "name": "CVE-2026-59820" + }, + { + "id": "CVE-2026-59821", + "name": "CVE-2026-59821" + }, + { + "id": "CVE-2026-59822", + "name": "CVE-2026-59822" + }, + { + "id": "CVE-2026-59823", + "name": "CVE-2026-59823" + }, + { + "id": "CVE-2026-84377", + "name": "CVE-2026-84377" + }, + { + "id": "debug-endpoints-enabled", + "name": "debug-endpoints-enabled" + }, + { + "id": "eval-detected", + "name": "eval-detected" + }, + { + "id": "formatted-sql-query", + "name": "formatted-sql-query" + }, + { + "id": "generic-password", + "name": "generic-password" + }, + { + "id": "path-traversal-open", + "name": "path-traversal-open" + }, + { + "id": "python-subprocess-shell-true-format", + "name": "python-subprocess-shell-true-format" + }, + { + "id": "python-weak-hash-md5", + "name": "python-weak-hash-md5" + }, + { + "id": "sca", + "name": "sca" + }, + { + "id": "sql-injection-db-cursor-execute", + "name": "sql-injection-db-cursor-execute" + }, + { + "id": "user-eval", + "name": "user-eval" + } + ] + } + }, + "results": [ + { + "ruleId": "formatted-sql-query", + "level": "error", + "message": { + "text": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/feature/main2.py" + }, + "region": { + "startLine": 30 + } + } + } + ] + }, + { + "ruleId": "sql-injection-db-cursor-execute", + "level": "error", + "message": { + "text": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" + }, + "region": { + "startLine": 23 + } + } + } + ] + }, + { + "ruleId": "formatted-sql-query", + "level": "error", + "message": { + "text": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" + }, + "region": { + "startLine": 27 + } + } + } + ] + }, + { + "ruleId": "python-subprocess-shell-true-format", + "level": "error", + "message": { + "text": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" + }, + "region": { + "startLine": 34 + } + } + } + ] + }, + { + "ruleId": "python-weak-hash-md5", + "level": "error", + "message": { + "text": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" + }, + "region": { + "startLine": 40 + } + } + } + ] + }, + { + "ruleId": "path-traversal-open", + "level": "error", + "message": { + "text": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" + }, + "region": { + "startLine": 48 + } + } + } + ] + }, + { + "ruleId": "user-eval", + "level": "error", + "message": { + "text": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" + }, + "region": { + "startLine": 54 + } + } + } + ] + }, + { + "ruleId": "eval-detected", + "level": "error", + "message": { + "text": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" + }, + "region": { + "startLine": 56 + } + } + } + ] + }, + { + "ruleId": "debug-endpoints-enabled", + "level": "warning", + "message": { + "text": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" + }, + "region": { + "startLine": 61 + } + } + } + ] + }, + { + "ruleId": "CVE-2024-35255", + "level": "warning", + "message": { + "text": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "azure-identity" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-6984", + "level": "error", + "message": { + "text": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-community" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-84377", + "level": "warning", + "message": { + "text": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59823", + "level": "warning", + "message": { + "text": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12799", + "level": "note", + "message": { + "text": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12798", + "level": "note", + "message": { + "text": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12797", + "level": "note", + "message": { + "text": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12796", + "level": "note", + "message": { + "text": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12795", + "level": "warning", + "message": { + "text": "LiteLLM: SSO Debug Flow Has Improper Authentication" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12770", + "level": "note", + "message": { + "text": "LiteLLM: Admin Key Handler Has Improper Authorization" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12773", + "level": "warning", + "message": { + "text": "LiteLLM: MCP Proxy Has Improper Authentication" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12771", + "level": "note", + "message": { + "text": "LiteLLM: M2M JWT Handler Has Improper Authorization" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12772", + "level": "note", + "message": { + "text": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-37004", + "level": "error", + "message": { + "text": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59821", + "level": "note", + "message": { + "text": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59822", + "level": "error", + "message": { + "text": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59819", + "level": "note", + "message": { + "text": "LiteLLM: Local file read via request-supplied OIDC file references" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59820", + "level": "warning", + "message": { + "text": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-47102", + "level": "error", + "message": { + "text": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-47101", + "level": "error", + "message": { + "text": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-49468", + "level": "error", + "message": { + "text": "LiteLLM: Authentication Bypass via Host Header Injection" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-35030", + "level": "error", + "message": { + "text": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-35029", + "level": "error", + "message": { + "text": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-0628", + "level": "error", + "message": { + "text": "LiteLLM Has an Improper Authorization Vulnerability" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "sca", + "level": "error", + "message": { + "text": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "sca", + "level": "error", + "message": { + "text": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-54283", + "level": "error", + "message": { + "text": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-54282", + "level": "note", + "message": { + "text": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48818", + "level": "error", + "message": { + "text": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48817", + "level": "warning", + "message": { + "text": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48710", + "level": "warning", + "message": { + "text": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-54121", + "level": "warning", + "message": { + "text": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2024-47874", + "level": "error", + "message": { + "text": "Starlette Denial of service (DoS) via multipart/form-data" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-114134", + "level": "error", + "message": { + "text": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "black" + } + } + } + ] + }, + { + "ruleId": "CVE-2024-21503", + "level": "warning", + "message": { + "text": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "black" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-41481", + "level": "warning", + "message": { + "text": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-text-splitters" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-34070", + "level": "error", + "message": { + "text": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-core" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-26013", + "level": "note", + "message": { + "text": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-core" + } + } + } + ] + }, + { + "ruleId": "generic-password", + "level": "error", + "message": { + "text": "generic-password" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/IaC.yaml" + }, + "region": { + "startLine": 47 + } + } + } + ] + } + ], + "invocations": [ + { + "executionSuccessful": true + } + ], + "properties": { + "total_findings": 48, + "findings_by_severity": { + "HIGH": 19, + "CRITICAL": 6, + "MEDIUM": 12, + "LOW": 11 + }, + "findings_by_engine": { + "sast": 9, + "sca": 38, + "secrets": 1 + }, + "ratings": { + "sast_rating_full_code": "C", + "sca_rating_full_code": "D" + }, + "quality_gate_status": "PASSED" + } + } + ] +} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/warn/results.json b/examples/security-pipeline/evidence/warn/results.json new file mode 100644 index 0000000..bef8d3c --- /dev/null +++ b/examples/security-pipeline/evidence/warn/results.json @@ -0,0 +1,417 @@ +{ + "status": "COMPLETED", + "quality_gate_status": "PASSED", + "metrics": { + "sast_rating_full_code": "C", + "sca_rating_full_code": "D" + }, + "failed_conditions": [], + "evaluated_conditions": [ + { + "metric": "sast_rating_full_code", + "context": "CodeAnt - SAST", + "actual": "C", + "quality_gate_enabled": false, + "quality_gate_status": "PASSED", + "why": "No quality gate conditions found for metric 'sast_rating_full_code' in scope 'commit'" + }, + { + "metric": "sca_rating_full_code", + "context": "CodeAnt - SCA", + "actual": "D", + "quality_gate_enabled": false, + "quality_gate_status": "PASSED", + "why": "No quality gate conditions found for metric 'sca_rating_full_code' in scope 'commit'" + } + ], + "findings": [ + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/feature/main2.py", + "line": 30, + "rule": "formatted-sql-query", + "message": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", + "line": 23, + "rule": "sql-injection-db-cursor-execute", + "message": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", + "line": 27, + "rule": "formatted-sql-query", + "message": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", + "line": 34, + "rule": "python-subprocess-shell-true-format", + "message": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", + "line": 40, + "rule": "python-weak-hash-md5", + "message": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", + "line": 48, + "rule": "path-traversal-open", + "message": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", + "line": 54, + "rule": "user-eval", + "message": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", + "line": 56, + "rule": "eval-detected", + "message": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." + }, + { + "engine": "sast", + "severity": "MEDIUM", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", + "line": 61, + "rule": "debug-endpoints-enabled", + "message": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "azure-identity", + "line": null, + "rule": "CVE-2024-35255", + "message": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "langchain-community", + "line": null, + "rule": "CVE-2025-6984", + "message": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-84377", + "message": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59823", + "message": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12799", + "message": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12798", + "message": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12797", + "message": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12796", + "message": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12795", + "message": "LiteLLM: SSO Debug Flow Has Improper Authentication" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12770", + "message": "LiteLLM: Admin Key Handler Has Improper Authorization" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12773", + "message": "LiteLLM: MCP Proxy Has Improper Authentication" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12771", + "message": "LiteLLM: M2M JWT Handler Has Improper Authorization" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12772", + "message": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-37004", + "message": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59821", + "message": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59822", + "message": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59819", + "message": "LiteLLM: Local file read via request-supplied OIDC file references" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59820", + "message": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-47102", + "message": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-47101", + "message": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-49468", + "message": "LiteLLM: Authentication Bypass via Host Header Injection" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-35030", + "message": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-35029", + "message": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2025-0628", + "message": "LiteLLM Has an Improper Authorization Vulnerability" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "", + "message": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "", + "message": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2026-54283", + "message": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "starlette", + "line": null, + "rule": "CVE-2026-54282", + "message": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48818", + "message": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48817", + "message": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48710", + "message": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2025-54121", + "message": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2024-47874", + "message": "Starlette Denial of service (DoS) via multipart/form-data" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "black", + "line": null, + "rule": "CVE-2026-114134", + "message": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "black", + "line": null, + "rule": "CVE-2024-21503", + "message": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "langchain-text-splitters", + "line": null, + "rule": "CVE-2026-41481", + "message": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "langchain-core", + "line": null, + "rule": "CVE-2026-34070", + "message": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "langchain-core", + "line": null, + "rule": "CVE-2026-26013", + "message": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" + }, + { + "engine": "secrets", + "severity": "HIGH", + "file": "/mnt/lambda/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/IaC.yaml", + "line": 47, + "rule": "generic-password", + "message": "generic-password" + } + ], + "reports": { + "sarif": "{\n \"version\": \"2.1.0\",\n \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n \"runs\": [\n {\n \"tool\": {\n \"driver\": {\n \"name\": \"CodeAnt AI\",\n \"rules\": [\n {\n \"id\": \"CVE-2024-21503\",\n \"name\": \"CVE-2024-21503\"\n },\n {\n \"id\": \"CVE-2024-35255\",\n \"name\": \"CVE-2024-35255\"\n },\n {\n \"id\": \"CVE-2024-47874\",\n \"name\": \"CVE-2024-47874\"\n },\n {\n \"id\": \"CVE-2025-0628\",\n \"name\": \"CVE-2025-0628\"\n },\n {\n \"id\": \"CVE-2025-54121\",\n \"name\": \"CVE-2025-54121\"\n },\n {\n \"id\": \"CVE-2025-6984\",\n \"name\": \"CVE-2025-6984\"\n },\n {\n \"id\": \"CVE-2026-114134\",\n \"name\": \"CVE-2026-114134\"\n },\n {\n \"id\": \"CVE-2026-12770\",\n \"name\": \"CVE-2026-12770\"\n },\n {\n \"id\": \"CVE-2026-12771\",\n \"name\": \"CVE-2026-12771\"\n },\n {\n \"id\": \"CVE-2026-12772\",\n \"name\": \"CVE-2026-12772\"\n },\n {\n \"id\": \"CVE-2026-12773\",\n \"name\": \"CVE-2026-12773\"\n },\n {\n \"id\": \"CVE-2026-12795\",\n \"name\": \"CVE-2026-12795\"\n },\n {\n \"id\": \"CVE-2026-12796\",\n \"name\": \"CVE-2026-12796\"\n },\n {\n \"id\": \"CVE-2026-12797\",\n \"name\": \"CVE-2026-12797\"\n },\n {\n \"id\": \"CVE-2026-12798\",\n \"name\": \"CVE-2026-12798\"\n },\n {\n \"id\": \"CVE-2026-12799\",\n \"name\": \"CVE-2026-12799\"\n },\n {\n \"id\": \"CVE-2026-26013\",\n \"name\": \"CVE-2026-26013\"\n },\n {\n \"id\": \"CVE-2026-34070\",\n \"name\": \"CVE-2026-34070\"\n },\n {\n \"id\": \"CVE-2026-35029\",\n \"name\": \"CVE-2026-35029\"\n },\n {\n \"id\": \"CVE-2026-35030\",\n \"name\": \"CVE-2026-35030\"\n },\n {\n \"id\": \"CVE-2026-37004\",\n \"name\": \"CVE-2026-37004\"\n },\n {\n \"id\": \"CVE-2026-41481\",\n \"name\": \"CVE-2026-41481\"\n },\n {\n \"id\": \"CVE-2026-47101\",\n \"name\": \"CVE-2026-47101\"\n },\n {\n \"id\": \"CVE-2026-47102\",\n \"name\": \"CVE-2026-47102\"\n },\n {\n \"id\": \"CVE-2026-48710\",\n \"name\": \"CVE-2026-48710\"\n },\n {\n \"id\": \"CVE-2026-48817\",\n \"name\": \"CVE-2026-48817\"\n },\n {\n \"id\": \"CVE-2026-48818\",\n \"name\": \"CVE-2026-48818\"\n },\n {\n \"id\": \"CVE-2026-49468\",\n \"name\": \"CVE-2026-49468\"\n },\n {\n \"id\": \"CVE-2026-54282\",\n \"name\": \"CVE-2026-54282\"\n },\n {\n \"id\": \"CVE-2026-54283\",\n \"name\": \"CVE-2026-54283\"\n },\n {\n \"id\": \"CVE-2026-59819\",\n \"name\": \"CVE-2026-59819\"\n },\n {\n \"id\": \"CVE-2026-59820\",\n \"name\": \"CVE-2026-59820\"\n },\n {\n \"id\": \"CVE-2026-59821\",\n \"name\": \"CVE-2026-59821\"\n },\n {\n \"id\": \"CVE-2026-59822\",\n \"name\": \"CVE-2026-59822\"\n },\n {\n \"id\": \"CVE-2026-59823\",\n \"name\": \"CVE-2026-59823\"\n },\n {\n \"id\": \"CVE-2026-84377\",\n \"name\": \"CVE-2026-84377\"\n },\n {\n \"id\": \"debug-endpoints-enabled\",\n \"name\": \"debug-endpoints-enabled\"\n },\n {\n \"id\": \"eval-detected\",\n \"name\": \"eval-detected\"\n },\n {\n \"id\": \"formatted-sql-query\",\n \"name\": \"formatted-sql-query\"\n },\n {\n \"id\": \"generic-password\",\n \"name\": \"generic-password\"\n },\n {\n \"id\": \"path-traversal-open\",\n \"name\": \"path-traversal-open\"\n },\n {\n \"id\": \"python-subprocess-shell-true-format\",\n \"name\": \"python-subprocess-shell-true-format\"\n },\n {\n \"id\": \"python-weak-hash-md5\",\n \"name\": \"python-weak-hash-md5\"\n },\n {\n \"id\": \"sca\",\n \"name\": \"sca\"\n },\n {\n \"id\": \"sql-injection-db-cursor-execute\",\n \"name\": \"sql-injection-db-cursor-execute\"\n },\n {\n \"id\": \"user-eval\",\n \"name\": \"user-eval\"\n }\n ]\n }\n },\n \"results\": [\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/feature/main2.py\"\n },\n \"region\": {\n \"startLine\": 30\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sql-injection-db-cursor-execute\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 23\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 27\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-subprocess-shell-true-format\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 34\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-weak-hash-md5\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 40\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"path-traversal-open\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 48\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"user-eval\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 54\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"eval-detected\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 56\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"debug-endpoints-enabled\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 61\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-35255\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"azure-identity\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-6984\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Langchain Community Vulnerable to XML External Entity (XXE) Attacks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-community\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-84377\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59823\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12799\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12798\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12797\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12796\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12795\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: SSO Debug Flow Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12770\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Admin Key Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12773\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Proxy Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12771\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: M2M JWT Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12772\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-37004\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59821\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59822\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59819\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Local file read via request-supplied OIDC file references\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59820\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Arbitrary file write via path traversal in Skills archive extraction\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47102\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows a user to modify their own user_role via the /user/update endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47101\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-49468\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication Bypass via Host Header Injection\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35030\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication bypass via OIDC userinfo cache key collision\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35029\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-0628\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM Has an Improper Authorization Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Password hash exposure and pass-the-hash authentication bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54283\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54282\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48818\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48817\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48710\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-54121\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has possible denial-of-service vector when parsing large files in multipart forms\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-47874\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette Denial of service (DoS) via multipart/form-data\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-114134\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Black: GitHub Action installs unvalidated required-version from pyproject.toml\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-21503\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Black vulnerable to Regular Expression Denial of Service (ReDoS)\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-41481\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-text-splitters\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-34070\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-26013\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"generic-password\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"generic-password\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/IaC.yaml\"\n },\n \"region\": {\n \"startLine\": 47\n }\n }\n }\n ]\n }\n ],\n \"invocations\": [\n {\n \"executionSuccessful\": true\n }\n ],\n \"properties\": {\n \"total_findings\": 48,\n \"findings_by_severity\": {\n \"HIGH\": 19,\n \"CRITICAL\": 6,\n \"MEDIUM\": 12,\n \"LOW\": 11\n },\n \"findings_by_engine\": {\n \"sast\": 9,\n \"sca\": 38,\n \"secrets\": 1\n },\n \"ratings\": {\n \"sast_rating_full_code\": \"C\",\n \"sca_rating_full_code\": \"D\"\n },\n \"quality_gate_status\": \"PASSED\"\n }\n }\n ]\n}", + "junit": "\nQuality Gate: PASSED\nTotal findings: 48\nBy severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11\nBy engine: sast=9, sca=38, secrets=1\nRatings: sast_rating_full_code=C, sca_rating_full_code=D" + } +} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/warn/runner-output.txt b/examples/security-pipeline/evidence/warn/runner-output.txt new file mode 100644 index 0000000..bd88e2c --- /dev/null +++ b/examples/security-pipeline/evidence/warn/runner-output.txt @@ -0,0 +1,21 @@ +Run: https://github.com/codeanttesting/codeant-demo/actions/runs/42304719043 +Selected runner output (credential and setup lines omitted): + +2026-11-06T22:26:35.1682180Z ✅ Scan started +2026-11-06T22:26:36.9446510Z 📝 Scan still running... +2026-11-06T22:27:08.3939138Z 📝 Wrote results.json, codeant.sarif, codeant-qg.xml +2026-11-06T22:27:08.3940289Z 📊 Findings: 48 +2026-11-06T22:27:08.3940773Z 🎯 Quality Gate: PASSED +2026-11-06T22:27:11.9412824Z secrets: 1 blocking findings; allowed=0 +2026-11-06T22:27:11.9413390Z sast: 8 blocking findings; allowed=0 +2026-11-06T22:27:11.9414082Z sca: 16 blocking findings; allowed=0 +2026-11-06T22:27:11.9414829Z Completed scan; wrote codeant-findings.csv, codeant-summary.pdf, codeant-run.json +2026-11-06T22:27:21.1388826Z sca: 16 blocking findings; allowed=0; mode=warn +2026-11-06T22:27:21.1415297Z ##[warning]sca: 16 blocking findings; allowed=0 +2026-11-06T22:27:21.3946451Z secrets: 1 blocking findings; allowed=0; mode=warn +2026-11-06T22:27:21.3978301Z ##[warning]secrets: 1 blocking findings; allowed=0 +2026-11-06T22:27:23.0314518Z sast: 8 blocking findings; allowed=0; mode=warn +2026-11-06T22:27:23.0334923Z ##[warning]sast: 8 blocking findings; allowed=0 +2026-11-06T22:27:29.1438204Z ##[group]Run echo 'Security jobs passed. Replace this step with your staging deployment.' +2026-11-06T22:27:29.1439834Z echo 'Security jobs passed. Replace this step with your staging deployment.' +2026-11-06T22:27:29.2164577Z Security jobs passed. Replace this step with your staging deployment. From ed6a2f3e27ef742f7972b0072a3195543e3f93aa Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 04:23:25 +0530 Subject: [PATCH 04/12] Use configured CodeAnt gates in a single self-contained workflow --- .github/workflows/codeant-security-demo.yml | 32 - .github/workflows/codeant-security.yml | 105 +- examples/security-pipeline/.gitignore | 1 - examples/security-pipeline/README.md | 129 +-- .../evidence/enforce/codeant-findings.csv | 49 - .../evidence/enforce/codeant-qg.xml | 6 - .../evidence/enforce/codeant-run.json | 5 - .../evidence/enforce/codeant-summary.pdf | Bin 2385 -> 0 bytes .../evidence/enforce/codeant.sarif | 1023 ----------------- .../evidence/enforce/results.json | 417 ------- .../evidence/enforce/runner-output.txt | 18 - .../evidence/warn/codeant-findings.csv | 49 - .../evidence/warn/codeant-qg.xml | 6 - .../evidence/warn/codeant-run.json | 5 - .../evidence/warn/codeant-summary.pdf | Bin 2383 -> 0 bytes .../evidence/warn/codeant.sarif | 1023 ----------------- .../evidence/warn/results.json | 417 ------- .../evidence/warn/runner-output.txt | 21 - examples/security-pipeline/policy.json | 5 - examples/security-pipeline/report.py | 120 -- examples/security-pipeline/test_report.py | 64 -- 21 files changed, 69 insertions(+), 3426 deletions(-) delete mode 100644 .github/workflows/codeant-security-demo.yml delete mode 100644 examples/security-pipeline/.gitignore delete mode 100644 examples/security-pipeline/evidence/enforce/codeant-findings.csv delete mode 100644 examples/security-pipeline/evidence/enforce/codeant-qg.xml delete mode 100644 examples/security-pipeline/evidence/enforce/codeant-run.json delete mode 100644 examples/security-pipeline/evidence/enforce/codeant-summary.pdf delete mode 100644 examples/security-pipeline/evidence/enforce/codeant.sarif delete mode 100644 examples/security-pipeline/evidence/enforce/results.json delete mode 100644 examples/security-pipeline/evidence/enforce/runner-output.txt delete mode 100644 examples/security-pipeline/evidence/warn/codeant-findings.csv delete mode 100644 examples/security-pipeline/evidence/warn/codeant-qg.xml delete mode 100644 examples/security-pipeline/evidence/warn/codeant-run.json delete mode 100644 examples/security-pipeline/evidence/warn/codeant-summary.pdf delete mode 100644 examples/security-pipeline/evidence/warn/codeant.sarif delete mode 100644 examples/security-pipeline/evidence/warn/results.json delete mode 100644 examples/security-pipeline/evidence/warn/runner-output.txt delete mode 100644 examples/security-pipeline/policy.json delete mode 100644 examples/security-pipeline/report.py delete mode 100644 examples/security-pipeline/test_report.py diff --git a/.github/workflows/codeant-security-demo.yml b/.github/workflows/codeant-security-demo.yml deleted file mode 100644 index 2da1d0b..0000000 --- a/.github/workflows/codeant-security-demo.yml +++ /dev/null @@ -1,32 +0,0 @@ -name: CodeAnt security example - -on: - push: - branches: [examples/security-pipeline] - pull_request: - branches: [main] - workflow_dispatch: - inputs: - mode: - description: Policy rollout mode - type: choice - options: [enforce, warn] - default: enforce - -permissions: - contents: read - -concurrency: - group: codeant-security-${{ github.ref }} - cancel-in-progress: false - -jobs: - security: - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} - uses: ./.github/workflows/codeant-security.yml - with: - mode: ${{ inputs.mode || 'enforce' }} - secrets: - # This demo already has a legacy provider-token secret. New integrations - # should create a scoped CodeAnt token and use secrets.CODEANT_TOKEN. - CODEANT_TOKEN: ${{ secrets.CODEANT_TOKEN || secrets.ACCESS_TOKEN_GITHUB }} diff --git a/.github/workflows/codeant-security.yml b/.github/workflows/codeant-security.yml index 8169699..e9707b0 100644 --- a/.github/workflows/codeant-security.yml +++ b/.github/workflows/codeant-security.yml @@ -1,89 +1,66 @@ -name: Reusable CodeAnt security pipeline +name: CodeAnt security pipeline on: - workflow_call: - inputs: - mode: - description: warn records policy failures; enforce blocks the caller - type: string - default: enforce - secrets: - CODEANT_TOKEN: - required: true + push: + branches: [main, examples/security-pipeline] + pull_request: + branches: [main] + workflow_dispatch: permissions: contents: read +concurrency: + group: codeant-security-${{ github.event.pull_request.head.sha || github.sha }} + cancel-in-progress: false + +env: + ENFORCE_SECURITY: 'false' + jobs: - scan: - name: Full repository scan + security: + if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} runs-on: ubuntu-latest timeout-minutes: 25 steps: - - uses: actions/checkout@v4 - with: - ref: ${{ github.event.pull_request.head.sha || github.sha }} - persist-credentials: false - - name: Check pipeline configuration - env: - CODEANT_TOKEN: ${{ secrets.CODEANT_TOKEN }} - MODE: ${{ inputs.mode }} - run: | - test -n "$CODEANT_TOKEN" || { echo '::error::CODEANT_TOKEN is missing'; exit 1; } - case "$MODE" in warn|enforce) ;; *) echo '::error::mode must be warn or enforce'; exit 1 ;; esac - - name: Run full repository scan + - name: Scan repository uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.5 with: - access_token: ${{ secrets.CODEANT_TOKEN }} + access_token: ${{ secrets.CODEANT_TOKEN || secrets.ACCESS_TOKEN_GITHUB }} scanners: sast,sca,secrets scan_timeout: '1200' - - name: Install PDF report dependency - run: python3 -m pip install reportlab==4.5.1 - - name: Export CSV and PDF; require completed results - env: - SCAN_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }} - run: python3 examples/security-pipeline/report.py export - - name: Preserve reports even when a later gate fails + - name: Save reports if: ${{ always() }} uses: actions/upload-artifact@v4 with: - name: codeant-security-${{ github.run_id }}-${{ github.run_attempt }} - retention-days: 14 + name: codeant-results if-no-files-found: error path: | results.json codeant.sarif codeant-qg.xml - codeant-findings.csv - codeant-summary.pdf - codeant-run.json - - gates: - name: ${{ matrix.scanner }} policy - needs: scan - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - scanner: [secrets, sast, sca] - steps: - - uses: actions/checkout@v4 - with: - ref: ${{ github.event.pull_request.head.sha || github.sha }} - persist-credentials: false - - uses: actions/download-artifact@v4 - with: - name: codeant-security-${{ github.run_id }}-${{ github.run_attempt }} - - name: Evaluate example policy - env: - SCANNER: ${{ matrix.scanner }} - MODE: ${{ inputs.mode }} - run: python3 examples/security-pipeline/report.py gate --scanner "$SCANNER" --mode "$MODE" + - name: Check security gates + run: | + python3 - <<'PY' + import json, os + from pathlib import Path + result = json.loads(Path('results.json').read_text()) + if result.get('status') != 'COMPLETED': + raise SystemExit('Scan did not complete') + enabled = {c['metric'] for c in result.get('evaluated_conditions', []) + if c.get('quality_gate_enabled')} + required = {'sast_rating_full_code', 'sca_rating_full_code'} + if not required.issubset(enabled): + raise SystemExit('Configure full-code SAST and SCA gates in CodeAnt') + secrets = sum(f['engine'] == 'secrets' for f in result['findings']) + if result.get('quality_gate_status') != 'PASSED' or secrets: + if os.environ['ENFORCE_SECURITY'] == 'true': + raise SystemExit('Security gate failed') + print('::warning::Security gate failed; warning mode is enabled') + PY - staging: - name: Staging readiness - needs: [scan, gates] + deploy: + needs: security runs-on: ubuntu-latest steps: - - name: Demonstrate the deployment dependency - run: echo 'Security jobs passed. Replace this step with your staging deployment.' + - run: echo 'Replace this step with your deployment command' diff --git a/examples/security-pipeline/.gitignore b/examples/security-pipeline/.gitignore deleted file mode 100644 index c18dd8d..0000000 --- a/examples/security-pipeline/.gitignore +++ /dev/null @@ -1 +0,0 @@ -__pycache__/ diff --git a/examples/security-pipeline/README.md b/examples/security-pipeline/README.md index ac9b432..e54f040 100644 --- a/examples/security-pipeline/README.md +++ b/examples/security-pipeline/README.md @@ -1,101 +1,28 @@ -# CodeAnt security pipeline example - -Scan a full repository before staging, preserve findings, and evaluate secrets, -SAST, and SCA in separate jobs. This demo repository intentionally contains -vulnerabilities. The workflow never runs the vulnerable application or deploys it. - -## Files to copy - -- `.github/workflows/codeant-security.yml`: reusable workflow, one scan followed - by three policy jobs and a staging placeholder. -- `.github/workflows/codeant-security-demo.yml`: caller; change the branch trigger - and replace the legacy secret fallback with `secrets.CODEANT_TOKEN`. -- `examples/security-pipeline/report.py` and `policy.json`: report exporter and - explicit example policy. Keep them at these paths in the calling repository. - -Create a CodeAnt API token for your organization with the **Codeant CI/CD** role -and repository scope. Store it as the calling repository's Actions secret -`CODEANT_TOKEN`. Enable secrets, SAST and SCA analysis in CodeAnt. This existing -test repo can also use its previously configured `ACCESS_TOKEN_GITHUB` secret. - -Use `mode: warn` for an initial review period and `mode: enforce` to block on -violations. Missing/incomplete results and infrastructure errors fail in both -modes. The workflow does not use `continue-on-error` to hide scan errors. - -The example policy blocks any secrets and any HIGH/CRITICAL SAST or SCA findings. -Unknown SAST/SCA severities also block. Edit `policy.json` to change the severity -selection or maximum allowed finding counts. This policy is workflow code, not -an undocumented input to the CodeAnt action. The native CodeAnt verdict is kept -in `results.json` and labeled separately in the PDF. - -## Reports and logs - -Download `codeant-security--` from the run's Artifacts section: - -- `results.json`, `codeant.sarif`, `codeant-qg.xml`: returned by CodeAnt. -- `codeant-findings.csv`, `codeant-summary.pdf`: generated by this example. -- `codeant-run.json`: scanned repository, commit, and Actions run URL. - -Reports upload before the scanner policy jobs, including when those jobs fail. -Keep the report files and GitHub's downloaded log archive for troubleshooting; -do not upload runner environment dumps, credentials, or the whole checkout. - -The action downloads its script, sends repository/commit/filter metadata and the -token to CodeAnt, then polls for results. Source analysis happens server-side; -the runner does not upload a source archive or local container image. `scanners` -selects returned result engines; repository settings control executed analyses. - -## Prevent deployment or merging - -Replace the `Staging readiness` echo step with your deployment and retain -`needs: [scan, gates]`. A deployment in the caller workflow needs `needs: security`. -Require the resulting security checks in your branch protection/ruleset to block -merges. The caller skips fork PRs because GitHub does not provide repository -secrets to them. No branch protection or real deployment is changed by this demo. - -To share the workflow across repositories, move the helper and policy to a trusted -central repository and explicitly check them out at a pinned revision. A reusable -workflow alone does not copy these files to application repositories. - -## Validate the helper - -```sh -python3 -m unittest discover -s examples/security-pipeline -p 'test_*.py' -``` - -Tests cover clean enforcement, warning versus enforcement, incomplete results, -scanner isolation, secrets, unknown severities, and CSV formula escaping. - -## Current boundaries - -The published `CodeAnt-AI/codeant-ci-scan-action@v0.0.5` has no `quality_gate` -input. This example applies its own explicit policies after collecting reports. -Native gate conditions can be enforced separately, but a native PASSED verdict -with no enabled conditions is not proof of an effective policy. - -The CodeAnt registry scanner pulls images already in a registry. This example -cannot scan a local Docker image before its first ECR push, and does not claim -to demonstrate that capability. - -ReportLab 4.5.1 is installed only to produce the example PDF. Gate evaluation uses -Python's standard library. No third-party report dependency is needed for gates. - -## Real run evidence - -Both runs scanned the public repository and returned 48 findings: 1 secret, -9 SAST findings (8 HIGH/CRITICAL), and 38 SCA findings (16 HIGH/CRITICAL). - -| Mode | Run | Outcome | -| --- | --- | --- | -| Warning | [42304719043](https://github.com/codeanttesting/codeant-demo/actions/runs/42304719043) | All policy jobs recorded warnings; staging readiness ran. | -| Enforcement | [42305066053](https://github.com/codeanttesting/codeant-demo/actions/runs/42305066053) | All three policy jobs failed; staging readiness was skipped. | - -The original report files and selected runner output are preserved under -[`evidence/warn`](evidence/warn) and [`evidence/enforce`](evidence/enforce), so the -examples remain available after Actions artifacts expire. These are historical -outputs for the commits identified in `codeant-run.json`, not a claim about every -future scan. Credential/setup log lines are omitted from the saved excerpts. - -In these runs, the native verdict was PASSED with no native gate conditions -enabled. The explicit example policy still blocked enforcement, which illustrates -why a native verdict must be interpreted alongside its evaluated conditions. +# CI security pipeline + +Copy [the workflow](../../.github/workflows/codeant-security.yml). No helper script, +policy file, or extra package is required. + +1. Enable secrets, SAST, and SCA analysis in CodeAnt. +2. Open **Settings → Code Analysis → Quality Gates**, select your repository, + and turn **Quality Gate** **On**. +3. Add **Full Code** conditions for **SAST Security Rating** and **SCA Security + Rating**, using **Less Than or Equals → C**. Changes save automatically. +4. Store a CodeAnt token with the **Codeant CI/CD** role as the Actions secret + `CODEANT_TOKEN`. This test repository also accepts its existing legacy secret. +5. Replace the workflow's branch triggers with your target branch and run it. + +`ENFORCE_SECURITY: 'false'` warns on findings. Set it to `'true'` to fail the job +and skip deployment. Missing results or native gate conditions fail in both modes. + +Thresholds are evaluated by CodeAnt. The inline gate step also checks for zero +reported secrets, because the native full-code response has no secrets gate metric. +The published action collects results but does not expose a `quality_gate` input. + +Download **codeant-results** from the run's **Artifacts** section. It contains +native `results.json`, `codeant.sarif`, and `codeant-qg.xml`. The action does not +produce CSV or PDF. Do not upload credentials or environment dumps as artifacts. + +The deployment step is a placeholder. Replace it with your deployment command and +keep `needs: security`. To block merges, require the check in branch protection. +The workflow skips fork PRs, which do not receive repository secrets. diff --git a/examples/security-pipeline/evidence/enforce/codeant-findings.csv b/examples/security-pipeline/evidence/enforce/codeant-findings.csv deleted file mode 100644 index 78df719..0000000 --- a/examples/security-pipeline/evidence/enforce/codeant-findings.csv +++ /dev/null @@ -1,49 +0,0 @@ -engine,severity,file,line,rule,message -sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,23,sql-injection-db-cursor-execute,"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." -sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,27,formatted-sql-query,Detected possible formatted SQL query. Use parameterized queries instead. -sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,34,python-subprocess-shell-true-format,"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." -sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,40,python-weak-hash-md5,Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt. -sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,48,path-traversal-open,"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." -sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,54,user-eval,"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." -sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,56,eval-detected,"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." -sast,MEDIUM,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,61,debug-endpoints-enabled,"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." -sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/feature/main2.py,30,formatted-sql-query,Detected possible formatted SQL query. Use parameterized queries instead. -sca,MEDIUM,azure-identity,,CVE-2024-35255,Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability -sca,HIGH,langchain-community,,CVE-2025-6984,Langchain Community Vulnerable to XML External Entity (XXE) Attacks -sca,MEDIUM,litellm,,CVE-2026-84377,LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters -sca,MEDIUM,litellm,,CVE-2026-59823,LiteLLM Proxy has server-side request forgery via the `user_config` request parameter -sca,LOW,litellm,,CVE-2026-12799,BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure -sca,LOW,litellm,,CVE-2026-12798,BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader -sca,LOW,litellm,,CVE-2026-12797,BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints -sca,LOW,litellm,,CVE-2026-12796,BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens -sca,MEDIUM,litellm,,CVE-2026-12795,LiteLLM: SSO Debug Flow Has Improper Authentication -sca,LOW,litellm,,CVE-2026-12770,LiteLLM: Admin Key Handler Has Improper Authorization -sca,MEDIUM,litellm,,CVE-2026-12773,LiteLLM: MCP Proxy Has Improper Authentication -sca,LOW,litellm,,CVE-2026-12771,LiteLLM: M2M JWT Handler Has Improper Authorization -sca,LOW,litellm,,CVE-2026-12772,LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration -sca,CRITICAL,litellm,,CVE-2026-37004,LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint -sca,LOW,litellm,,CVE-2026-59821,LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks -sca,HIGH,litellm,,CVE-2026-59822,LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback -sca,LOW,litellm,,CVE-2026-59819,LiteLLM: Local file read via request-supplied OIDC file references -sca,MEDIUM,litellm,,CVE-2026-59820,LiteLLM: Arbitrary file write via path traversal in Skills archive extraction -sca,HIGH,litellm,,CVE-2026-47102,LiteLLM allows a user to modify their own user_role via the /user/update endpoint -sca,HIGH,litellm,,CVE-2026-47101,LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit -sca,CRITICAL,litellm,,CVE-2026-49468,LiteLLM: Authentication Bypass via Host Header Injection -sca,CRITICAL,litellm,,CVE-2026-35030,LiteLLM: Authentication bypass via OIDC userinfo cache key collision -sca,HIGH,litellm,,CVE-2026-35029,LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint -sca,HIGH,litellm,,CVE-2025-0628,LiteLLM Has an Improper Authorization Vulnerability -sca,HIGH,litellm,,,LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` -sca,HIGH,litellm,,,LiteLLM: Password hash exposure and pass-the-hash authentication bypass -sca,HIGH,starlette,,CVE-2026-54283,Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS -sca,LOW,starlette,,CVE-2026-54282,Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname -sca,HIGH,starlette,,CVE-2026-48818,Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows -sca,MEDIUM,starlette,,CVE-2026-48817,Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` -sca,MEDIUM,starlette,,CVE-2026-48710,"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" -sca,MEDIUM,starlette,,CVE-2025-54121,Starlette has possible denial-of-service vector when parsing large files in multipart forms -sca,HIGH,starlette,,CVE-2024-47874,Starlette Denial of service (DoS) via multipart/form-data -sca,HIGH,black,,CVE-2026-114134,Black: GitHub Action installs unvalidated required-version from pyproject.toml -sca,MEDIUM,black,,CVE-2024-21503,Black vulnerable to Regular Expression Denial of Service (ReDoS) -sca,HIGH,langchain-core,,CVE-2026-34070,LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions -sca,LOW,langchain-core,,CVE-2026-26013,LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages -sca,MEDIUM,langchain-text-splitters,,CVE-2026-41481,LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass -secrets,HIGH,/mnt/lambda/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/IaC.yaml,47,generic-password,generic-password diff --git a/examples/security-pipeline/evidence/enforce/codeant-qg.xml b/examples/security-pipeline/evidence/enforce/codeant-qg.xml deleted file mode 100644 index d2b053a..0000000 --- a/examples/security-pipeline/evidence/enforce/codeant-qg.xml +++ /dev/null @@ -1,6 +0,0 @@ - -Quality Gate: PASSED -Total findings: 48 -By severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11 -By engine: sast=9, sca=38, secrets=1 -Ratings: sast_rating_full_code=C, sca_rating_full_code=D \ No newline at end of file diff --git a/examples/security-pipeline/evidence/enforce/codeant-run.json b/examples/security-pipeline/evidence/enforce/codeant-run.json deleted file mode 100644 index ef1de3f..0000000 --- a/examples/security-pipeline/evidence/enforce/codeant-run.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "repository": "codeanttesting/codeant-demo", - "commit": "d860b95a2ef978cc9bfd188a35476a6e7bdb333e", - "run_url": "https://github.com/codeanttesting/codeant-demo/actions/runs/42305066053" -} diff --git a/examples/security-pipeline/evidence/enforce/codeant-summary.pdf b/examples/security-pipeline/evidence/enforce/codeant-summary.pdf deleted file mode 100644 index 0aa2964697b8bc4d78b00433f5d0962b80500fb0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2385 zcma);*_NtE7KZPAif}-2WD*opalkP}O^0;G6d^=1l^_ADPxeK>K-XQ}_p^48!zovu zUR}j<2@$d5-C! zkppcHU0od}Lkyq+Iy{HUsT%=E-kEN(!L8ux0ff4pDnh6`9clq<)11bgrs0s4%0^;e^ z%+>67$)G<3zR*43$v5bDZ2E;R7#bi0^L_N-5ZU-4=<>b-{a`O^zII0DjfQZeQNQ{p z2j<4qOD3aKb%99Vh*k z{2su}^3OPU86&FWMUs2KgZkCA{5Rm~nvJ8v%pC`BAF8dLy<5z|Qh#BV(e-_aslJ6@ zW&?t3ngnU_!S@~c4c#EGzNWUVvyWd0=Rp0o*gd^OTG7h6@CjRWU?>S+YTXmvIwiq{!ElI>RsZopM9B#EH z7(W#ByZx-qg9OsyLZunYhN!xo$pjS=4lP zH6HgQx1Zo-T}zdpD~esG(;FCDimEudcGhxURqkfhbhi>ssZ;fp==X&xx<{i*Q|~oM zXOLHHjcH8j!#YAGgwrUCQfr|5Y7GTSv{$7VS0K|qqB1J^kSV)Oo}VFj?q(c+(=~HL37%WV#Tc7 zP|PRP-Z;#Xj;hkQdh9<<48&C`&Q98z(K?&dMe22+6!iUe$|{k@TucnsOnhUt#H7sK zb)#Adb{Oi-Rvsfl*|Avfde5AGr%sCABRWz#34bz!ko3Tc=Z_LK4+2T&XNE_nDzOiKiDGS}E~a zPUeR%tMkTrCb&C3tDlCeaU>q;NEJwK8f~IrY0k#z*W6W%Q@8$^-Jj1JI zqwc<++1Yo+8iTjlwOUI)ZS1^%HOq(b(H8$D;mZ2Cmp^Ol4;LOoG!R4d&kG1V&+*_0 ze)b8tngkcHfA%pnuFl{3SX%t0k7IwG%d_}{^=&RM{;F3j;s37iH+jiWjG$j}GP;8^Vlxq>L@nj!tQg&HDm4m9TfKG0;dz_4&(`*ySm rQ9b*JKv2#mAzVq34}$WDpQqM8A*THPE!ABA9Xlh6_yk4ZPg>}|F;1ov diff --git a/examples/security-pipeline/evidence/enforce/codeant.sarif b/examples/security-pipeline/evidence/enforce/codeant.sarif deleted file mode 100644 index 465a49d..0000000 --- a/examples/security-pipeline/evidence/enforce/codeant.sarif +++ /dev/null @@ -1,1023 +0,0 @@ -{ - "version": "2.1.0", - "$schema": "https://json.schemastore.org/sarif-2.1.0.json", - "runs": [ - { - "tool": { - "driver": { - "name": "CodeAnt AI", - "rules": [ - { - "id": "CVE-2024-21503", - "name": "CVE-2024-21503" - }, - { - "id": "CVE-2024-35255", - "name": "CVE-2024-35255" - }, - { - "id": "CVE-2024-47874", - "name": "CVE-2024-47874" - }, - { - "id": "CVE-2025-0628", - "name": "CVE-2025-0628" - }, - { - "id": "CVE-2025-54121", - "name": "CVE-2025-54121" - }, - { - "id": "CVE-2025-6984", - "name": "CVE-2025-6984" - }, - { - "id": "CVE-2026-114134", - "name": "CVE-2026-114134" - }, - { - "id": "CVE-2026-12770", - "name": "CVE-2026-12770" - }, - { - "id": "CVE-2026-12771", - "name": "CVE-2026-12771" - }, - { - "id": "CVE-2026-12772", - "name": "CVE-2026-12772" - }, - { - "id": "CVE-2026-12773", - "name": "CVE-2026-12773" - }, - { - "id": "CVE-2026-12795", - "name": "CVE-2026-12795" - }, - { - "id": "CVE-2026-12796", - "name": "CVE-2026-12796" - }, - { - "id": "CVE-2026-12797", - "name": "CVE-2026-12797" - }, - { - "id": "CVE-2026-12798", - "name": "CVE-2026-12798" - }, - { - "id": "CVE-2026-12799", - "name": "CVE-2026-12799" - }, - { - "id": "CVE-2026-26013", - "name": "CVE-2026-26013" - }, - { - "id": "CVE-2026-34070", - "name": "CVE-2026-34070" - }, - { - "id": "CVE-2026-35029", - "name": "CVE-2026-35029" - }, - { - "id": "CVE-2026-35030", - "name": "CVE-2026-35030" - }, - { - "id": "CVE-2026-37004", - "name": "CVE-2026-37004" - }, - { - "id": "CVE-2026-41481", - "name": "CVE-2026-41481" - }, - { - "id": "CVE-2026-47101", - "name": "CVE-2026-47101" - }, - { - "id": "CVE-2026-47102", - "name": "CVE-2026-47102" - }, - { - "id": "CVE-2026-48710", - "name": "CVE-2026-48710" - }, - { - "id": "CVE-2026-48817", - "name": "CVE-2026-48817" - }, - { - "id": "CVE-2026-48818", - "name": "CVE-2026-48818" - }, - { - "id": "CVE-2026-49468", - "name": "CVE-2026-49468" - }, - { - "id": "CVE-2026-54282", - "name": "CVE-2026-54282" - }, - { - "id": "CVE-2026-54283", - "name": "CVE-2026-54283" - }, - { - "id": "CVE-2026-59819", - "name": "CVE-2026-59819" - }, - { - "id": "CVE-2026-59820", - "name": "CVE-2026-59820" - }, - { - "id": "CVE-2026-59821", - "name": "CVE-2026-59821" - }, - { - "id": "CVE-2026-59822", - "name": "CVE-2026-59822" - }, - { - "id": "CVE-2026-59823", - "name": "CVE-2026-59823" - }, - { - "id": "CVE-2026-84377", - "name": "CVE-2026-84377" - }, - { - "id": "debug-endpoints-enabled", - "name": "debug-endpoints-enabled" - }, - { - "id": "eval-detected", - "name": "eval-detected" - }, - { - "id": "formatted-sql-query", - "name": "formatted-sql-query" - }, - { - "id": "generic-password", - "name": "generic-password" - }, - { - "id": "path-traversal-open", - "name": "path-traversal-open" - }, - { - "id": "python-subprocess-shell-true-format", - "name": "python-subprocess-shell-true-format" - }, - { - "id": "python-weak-hash-md5", - "name": "python-weak-hash-md5" - }, - { - "id": "sca", - "name": "sca" - }, - { - "id": "sql-injection-db-cursor-execute", - "name": "sql-injection-db-cursor-execute" - }, - { - "id": "user-eval", - "name": "user-eval" - } - ] - } - }, - "results": [ - { - "ruleId": "sql-injection-db-cursor-execute", - "level": "error", - "message": { - "text": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" - }, - "region": { - "startLine": 23 - } - } - } - ] - }, - { - "ruleId": "formatted-sql-query", - "level": "error", - "message": { - "text": "Detected possible formatted SQL query. Use parameterized queries instead." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" - }, - "region": { - "startLine": 27 - } - } - } - ] - }, - { - "ruleId": "python-subprocess-shell-true-format", - "level": "error", - "message": { - "text": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" - }, - "region": { - "startLine": 34 - } - } - } - ] - }, - { - "ruleId": "python-weak-hash-md5", - "level": "error", - "message": { - "text": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" - }, - "region": { - "startLine": 40 - } - } - } - ] - }, - { - "ruleId": "path-traversal-open", - "level": "error", - "message": { - "text": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" - }, - "region": { - "startLine": 48 - } - } - } - ] - }, - { - "ruleId": "user-eval", - "level": "error", - "message": { - "text": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" - }, - "region": { - "startLine": 54 - } - } - } - ] - }, - { - "ruleId": "eval-detected", - "level": "error", - "message": { - "text": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" - }, - "region": { - "startLine": 56 - } - } - } - ] - }, - { - "ruleId": "debug-endpoints-enabled", - "level": "warning", - "message": { - "text": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py" - }, - "region": { - "startLine": 61 - } - } - } - ] - }, - { - "ruleId": "formatted-sql-query", - "level": "error", - "message": { - "text": "Detected possible formatted SQL query. Use parameterized queries instead." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/feature/main2.py" - }, - "region": { - "startLine": 30 - } - } - } - ] - }, - { - "ruleId": "CVE-2024-35255", - "level": "warning", - "message": { - "text": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "azure-identity" - } - } - } - ] - }, - { - "ruleId": "CVE-2025-6984", - "level": "error", - "message": { - "text": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "langchain-community" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-84377", - "level": "warning", - "message": { - "text": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-59823", - "level": "warning", - "message": { - "text": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12799", - "level": "note", - "message": { - "text": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12798", - "level": "note", - "message": { - "text": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12797", - "level": "note", - "message": { - "text": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12796", - "level": "note", - "message": { - "text": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12795", - "level": "warning", - "message": { - "text": "LiteLLM: SSO Debug Flow Has Improper Authentication" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12770", - "level": "note", - "message": { - "text": "LiteLLM: Admin Key Handler Has Improper Authorization" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12773", - "level": "warning", - "message": { - "text": "LiteLLM: MCP Proxy Has Improper Authentication" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12771", - "level": "note", - "message": { - "text": "LiteLLM: M2M JWT Handler Has Improper Authorization" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12772", - "level": "note", - "message": { - "text": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-37004", - "level": "error", - "message": { - "text": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-59821", - "level": "note", - "message": { - "text": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-59822", - "level": "error", - "message": { - "text": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-59819", - "level": "note", - "message": { - "text": "LiteLLM: Local file read via request-supplied OIDC file references" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-59820", - "level": "warning", - "message": { - "text": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-47102", - "level": "error", - "message": { - "text": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-47101", - "level": "error", - "message": { - "text": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-49468", - "level": "error", - "message": { - "text": "LiteLLM: Authentication Bypass via Host Header Injection" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-35030", - "level": "error", - "message": { - "text": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-35029", - "level": "error", - "message": { - "text": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2025-0628", - "level": "error", - "message": { - "text": "LiteLLM Has an Improper Authorization Vulnerability" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "sca", - "level": "error", - "message": { - "text": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "sca", - "level": "error", - "message": { - "text": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-54283", - "level": "error", - "message": { - "text": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-54282", - "level": "note", - "message": { - "text": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-48818", - "level": "error", - "message": { - "text": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-48817", - "level": "warning", - "message": { - "text": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-48710", - "level": "warning", - "message": { - "text": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2025-54121", - "level": "warning", - "message": { - "text": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2024-47874", - "level": "error", - "message": { - "text": "Starlette Denial of service (DoS) via multipart/form-data" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-114134", - "level": "error", - "message": { - "text": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "black" - } - } - } - ] - }, - { - "ruleId": "CVE-2024-21503", - "level": "warning", - "message": { - "text": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "black" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-34070", - "level": "error", - "message": { - "text": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "langchain-core" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-26013", - "level": "note", - "message": { - "text": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "langchain-core" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-41481", - "level": "warning", - "message": { - "text": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "langchain-text-splitters" - } - } - } - ] - }, - { - "ruleId": "generic-password", - "level": "error", - "message": { - "text": "generic-password" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/IaC.yaml" - }, - "region": { - "startLine": 47 - } - } - } - ] - } - ], - "invocations": [ - { - "executionSuccessful": true - } - ], - "properties": { - "total_findings": 48, - "findings_by_severity": { - "HIGH": 19, - "CRITICAL": 6, - "MEDIUM": 12, - "LOW": 11 - }, - "findings_by_engine": { - "sast": 9, - "sca": 38, - "secrets": 1 - }, - "ratings": { - "sast_rating_full_code": "C", - "sca_rating_full_code": "D" - }, - "quality_gate_status": "PASSED" - } - } - ] -} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/enforce/results.json b/examples/security-pipeline/evidence/enforce/results.json deleted file mode 100644 index 8d82048..0000000 --- a/examples/security-pipeline/evidence/enforce/results.json +++ /dev/null @@ -1,417 +0,0 @@ -{ - "status": "COMPLETED", - "quality_gate_status": "PASSED", - "metrics": { - "sast_rating_full_code": "C", - "sca_rating_full_code": "D" - }, - "failed_conditions": [], - "evaluated_conditions": [ - { - "metric": "sast_rating_full_code", - "context": "CodeAnt - SAST", - "actual": "C", - "quality_gate_enabled": false, - "quality_gate_status": "PASSED", - "why": "No quality gate conditions found for metric 'sast_rating_full_code' in scope 'commit'" - }, - { - "metric": "sca_rating_full_code", - "context": "CodeAnt - SCA", - "actual": "D", - "quality_gate_enabled": false, - "quality_gate_status": "PASSED", - "why": "No quality gate conditions found for metric 'sca_rating_full_code' in scope 'commit'" - } - ], - "findings": [ - { - "engine": "sast", - "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", - "line": 23, - "rule": "sql-injection-db-cursor-execute", - "message": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." - }, - { - "engine": "sast", - "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", - "line": 27, - "rule": "formatted-sql-query", - "message": "Detected possible formatted SQL query. Use parameterized queries instead." - }, - { - "engine": "sast", - "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", - "line": 34, - "rule": "python-subprocess-shell-true-format", - "message": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." - }, - { - "engine": "sast", - "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", - "line": 40, - "rule": "python-weak-hash-md5", - "message": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." - }, - { - "engine": "sast", - "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", - "line": 48, - "rule": "path-traversal-open", - "message": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." - }, - { - "engine": "sast", - "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", - "line": 54, - "rule": "user-eval", - "message": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." - }, - { - "engine": "sast", - "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", - "line": 56, - "rule": "eval-detected", - "message": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." - }, - { - "engine": "sast", - "severity": "MEDIUM", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py", - "line": 61, - "rule": "debug-endpoints-enabled", - "message": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." - }, - { - "engine": "sast", - "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/feature/main2.py", - "line": 30, - "rule": "formatted-sql-query", - "message": "Detected possible formatted SQL query. Use parameterized queries instead." - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "azure-identity", - "line": null, - "rule": "CVE-2024-35255", - "message": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "langchain-community", - "line": null, - "rule": "CVE-2025-6984", - "message": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "litellm", - "line": null, - "rule": "CVE-2026-84377", - "message": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "litellm", - "line": null, - "rule": "CVE-2026-59823", - "message": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12799", - "message": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12798", - "message": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12797", - "message": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12796", - "message": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12795", - "message": "LiteLLM: SSO Debug Flow Has Improper Authentication" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12770", - "message": "LiteLLM: Admin Key Handler Has Improper Authorization" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12773", - "message": "LiteLLM: MCP Proxy Has Improper Authentication" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12771", - "message": "LiteLLM: M2M JWT Handler Has Improper Authorization" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12772", - "message": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" - }, - { - "engine": "sca", - "severity": "CRITICAL", - "file": "litellm", - "line": null, - "rule": "CVE-2026-37004", - "message": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-59821", - "message": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "CVE-2026-59822", - "message": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-59819", - "message": "LiteLLM: Local file read via request-supplied OIDC file references" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "litellm", - "line": null, - "rule": "CVE-2026-59820", - "message": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "CVE-2026-47102", - "message": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "CVE-2026-47101", - "message": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" - }, - { - "engine": "sca", - "severity": "CRITICAL", - "file": "litellm", - "line": null, - "rule": "CVE-2026-49468", - "message": "LiteLLM: Authentication Bypass via Host Header Injection" - }, - { - "engine": "sca", - "severity": "CRITICAL", - "file": "litellm", - "line": null, - "rule": "CVE-2026-35030", - "message": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "CVE-2026-35029", - "message": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "CVE-2025-0628", - "message": "LiteLLM Has an Improper Authorization Vulnerability" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "", - "message": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "", - "message": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "starlette", - "line": null, - "rule": "CVE-2026-54283", - "message": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "starlette", - "line": null, - "rule": "CVE-2026-54282", - "message": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "starlette", - "line": null, - "rule": "CVE-2026-48818", - "message": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "starlette", - "line": null, - "rule": "CVE-2026-48817", - "message": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "starlette", - "line": null, - "rule": "CVE-2026-48710", - "message": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "starlette", - "line": null, - "rule": "CVE-2025-54121", - "message": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "starlette", - "line": null, - "rule": "CVE-2024-47874", - "message": "Starlette Denial of service (DoS) via multipart/form-data" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "black", - "line": null, - "rule": "CVE-2026-114134", - "message": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "black", - "line": null, - "rule": "CVE-2024-21503", - "message": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "langchain-core", - "line": null, - "rule": "CVE-2026-34070", - "message": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "langchain-core", - "line": null, - "rule": "CVE-2026-26013", - "message": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "langchain-text-splitters", - "line": null, - "rule": "CVE-2026-41481", - "message": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" - }, - { - "engine": "secrets", - "severity": "HIGH", - "file": "/mnt/lambda/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/IaC.yaml", - "line": 47, - "rule": "generic-password", - "message": "generic-password" - } - ], - "reports": { - "sarif": "{\n \"version\": \"2.1.0\",\n \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n \"runs\": [\n {\n \"tool\": {\n \"driver\": {\n \"name\": \"CodeAnt AI\",\n \"rules\": [\n {\n \"id\": \"CVE-2024-21503\",\n \"name\": \"CVE-2024-21503\"\n },\n {\n \"id\": \"CVE-2024-35255\",\n \"name\": \"CVE-2024-35255\"\n },\n {\n \"id\": \"CVE-2024-47874\",\n \"name\": \"CVE-2024-47874\"\n },\n {\n \"id\": \"CVE-2025-0628\",\n \"name\": \"CVE-2025-0628\"\n },\n {\n \"id\": \"CVE-2025-54121\",\n \"name\": \"CVE-2025-54121\"\n },\n {\n \"id\": \"CVE-2025-6984\",\n \"name\": \"CVE-2025-6984\"\n },\n {\n \"id\": \"CVE-2026-114134\",\n \"name\": \"CVE-2026-114134\"\n },\n {\n \"id\": \"CVE-2026-12770\",\n \"name\": \"CVE-2026-12770\"\n },\n {\n \"id\": \"CVE-2026-12771\",\n \"name\": \"CVE-2026-12771\"\n },\n {\n \"id\": \"CVE-2026-12772\",\n \"name\": \"CVE-2026-12772\"\n },\n {\n \"id\": \"CVE-2026-12773\",\n \"name\": \"CVE-2026-12773\"\n },\n {\n \"id\": \"CVE-2026-12795\",\n \"name\": \"CVE-2026-12795\"\n },\n {\n \"id\": \"CVE-2026-12796\",\n \"name\": \"CVE-2026-12796\"\n },\n {\n \"id\": \"CVE-2026-12797\",\n \"name\": \"CVE-2026-12797\"\n },\n {\n \"id\": \"CVE-2026-12798\",\n \"name\": \"CVE-2026-12798\"\n },\n {\n \"id\": \"CVE-2026-12799\",\n \"name\": \"CVE-2026-12799\"\n },\n {\n \"id\": \"CVE-2026-26013\",\n \"name\": \"CVE-2026-26013\"\n },\n {\n \"id\": \"CVE-2026-34070\",\n \"name\": \"CVE-2026-34070\"\n },\n {\n \"id\": \"CVE-2026-35029\",\n \"name\": \"CVE-2026-35029\"\n },\n {\n \"id\": \"CVE-2026-35030\",\n \"name\": \"CVE-2026-35030\"\n },\n {\n \"id\": \"CVE-2026-37004\",\n \"name\": \"CVE-2026-37004\"\n },\n {\n \"id\": \"CVE-2026-41481\",\n \"name\": \"CVE-2026-41481\"\n },\n {\n \"id\": \"CVE-2026-47101\",\n \"name\": \"CVE-2026-47101\"\n },\n {\n \"id\": \"CVE-2026-47102\",\n \"name\": \"CVE-2026-47102\"\n },\n {\n \"id\": \"CVE-2026-48710\",\n \"name\": \"CVE-2026-48710\"\n },\n {\n \"id\": \"CVE-2026-48817\",\n \"name\": \"CVE-2026-48817\"\n },\n {\n \"id\": \"CVE-2026-48818\",\n \"name\": \"CVE-2026-48818\"\n },\n {\n \"id\": \"CVE-2026-49468\",\n \"name\": \"CVE-2026-49468\"\n },\n {\n \"id\": \"CVE-2026-54282\",\n \"name\": \"CVE-2026-54282\"\n },\n {\n \"id\": \"CVE-2026-54283\",\n \"name\": \"CVE-2026-54283\"\n },\n {\n \"id\": \"CVE-2026-59819\",\n \"name\": \"CVE-2026-59819\"\n },\n {\n \"id\": \"CVE-2026-59820\",\n \"name\": \"CVE-2026-59820\"\n },\n {\n \"id\": \"CVE-2026-59821\",\n \"name\": \"CVE-2026-59821\"\n },\n {\n \"id\": \"CVE-2026-59822\",\n \"name\": \"CVE-2026-59822\"\n },\n {\n \"id\": \"CVE-2026-59823\",\n \"name\": \"CVE-2026-59823\"\n },\n {\n \"id\": \"CVE-2026-84377\",\n \"name\": \"CVE-2026-84377\"\n },\n {\n \"id\": \"debug-endpoints-enabled\",\n \"name\": \"debug-endpoints-enabled\"\n },\n {\n \"id\": \"eval-detected\",\n \"name\": \"eval-detected\"\n },\n {\n \"id\": \"formatted-sql-query\",\n \"name\": \"formatted-sql-query\"\n },\n {\n \"id\": \"generic-password\",\n \"name\": \"generic-password\"\n },\n {\n \"id\": \"path-traversal-open\",\n \"name\": \"path-traversal-open\"\n },\n {\n \"id\": \"python-subprocess-shell-true-format\",\n \"name\": \"python-subprocess-shell-true-format\"\n },\n {\n \"id\": \"python-weak-hash-md5\",\n \"name\": \"python-weak-hash-md5\"\n },\n {\n \"id\": \"sca\",\n \"name\": \"sca\"\n },\n {\n \"id\": \"sql-injection-db-cursor-execute\",\n \"name\": \"sql-injection-db-cursor-execute\"\n },\n {\n \"id\": \"user-eval\",\n \"name\": \"user-eval\"\n }\n ]\n }\n },\n \"results\": [\n {\n \"ruleId\": \"sql-injection-db-cursor-execute\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 23\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 27\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-subprocess-shell-true-format\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 34\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-weak-hash-md5\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 40\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"path-traversal-open\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 48\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"user-eval\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 54\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"eval-detected\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 56\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"debug-endpoints-enabled\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 61\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/feature/main2.py\"\n },\n \"region\": {\n \"startLine\": 30\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-35255\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"azure-identity\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-6984\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Langchain Community Vulnerable to XML External Entity (XXE) Attacks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-community\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-84377\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59823\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12799\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12798\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12797\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12796\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12795\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: SSO Debug Flow Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12770\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Admin Key Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12773\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Proxy Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12771\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: M2M JWT Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12772\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-37004\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59821\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59822\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59819\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Local file read via request-supplied OIDC file references\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59820\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Arbitrary file write via path traversal in Skills archive extraction\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47102\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows a user to modify their own user_role via the /user/update endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47101\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-49468\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication Bypass via Host Header Injection\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35030\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication bypass via OIDC userinfo cache key collision\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35029\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-0628\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM Has an Improper Authorization Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Password hash exposure and pass-the-hash authentication bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54283\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54282\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48818\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48817\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48710\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-54121\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has possible denial-of-service vector when parsing large files in multipart forms\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-47874\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette Denial of service (DoS) via multipart/form-data\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-114134\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Black: GitHub Action installs unvalidated required-version from pyproject.toml\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-21503\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Black vulnerable to Regular Expression Denial of Service (ReDoS)\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-34070\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-26013\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-41481\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-text-splitters\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"generic-password\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"generic-password\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/IaC.yaml\"\n },\n \"region\": {\n \"startLine\": 47\n }\n }\n }\n ]\n }\n ],\n \"invocations\": [\n {\n \"executionSuccessful\": true\n }\n ],\n \"properties\": {\n \"total_findings\": 48,\n \"findings_by_severity\": {\n \"HIGH\": 19,\n \"CRITICAL\": 6,\n \"MEDIUM\": 12,\n \"LOW\": 11\n },\n \"findings_by_engine\": {\n \"sast\": 9,\n \"sca\": 38,\n \"secrets\": 1\n },\n \"ratings\": {\n \"sast_rating_full_code\": \"C\",\n \"sca_rating_full_code\": \"D\"\n },\n \"quality_gate_status\": \"PASSED\"\n }\n }\n ]\n}", - "junit": "\nQuality Gate: PASSED\nTotal findings: 48\nBy severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11\nBy engine: sast=9, sca=38, secrets=1\nRatings: sast_rating_full_code=C, sca_rating_full_code=D" - } -} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/enforce/runner-output.txt b/examples/security-pipeline/evidence/enforce/runner-output.txt deleted file mode 100644 index 9d55239..0000000 --- a/examples/security-pipeline/evidence/enforce/runner-output.txt +++ /dev/null @@ -1,18 +0,0 @@ -Run: https://github.com/codeanttesting/codeant-demo/actions/runs/42305066053 -Selected runner output (credential and setup lines omitted): - -2026-11-06T22:29:25.8764366Z ✅ Scan started -2026-11-06T22:29:27.1959770Z 📝 Scan still running... -2026-11-06T22:29:58.6748469Z 📝 Wrote results.json, codeant.sarif, codeant-qg.xml -2026-11-06T22:29:58.6749693Z 📊 Findings: 48 -2026-11-06T22:29:58.6750544Z 🎯 Quality Gate: PASSED -2026-11-06T22:30:02.7548031Z secrets: 1 blocking findings; allowed=0 -2026-11-06T22:30:02.7548709Z sast: 8 blocking findings; allowed=0 -2026-11-06T22:30:02.7549181Z sca: 16 blocking findings; allowed=0 -2026-11-06T22:30:02.7703130Z Completed scan; wrote codeant-findings.csv, codeant-summary.pdf, codeant-run.json -2026-11-06T22:30:12.6644684Z sast: 8 blocking findings; allowed=0; mode=enforce -2026-11-06T22:30:12.6665337Z ##[error]sast: 8 blocking findings; allowed=0 -2026-11-06T22:30:12.9122548Z secrets: 1 blocking findings; allowed=0; mode=enforce -2026-11-06T22:30:12.9258255Z ##[error]secrets: 1 blocking findings; allowed=0 -2026-11-06T22:30:13.3369612Z sca: 16 blocking findings; allowed=0; mode=enforce -2026-11-06T22:30:13.3403954Z ##[error]sca: 16 blocking findings; allowed=0 diff --git a/examples/security-pipeline/evidence/warn/codeant-findings.csv b/examples/security-pipeline/evidence/warn/codeant-findings.csv deleted file mode 100644 index 8f98465..0000000 --- a/examples/security-pipeline/evidence/warn/codeant-findings.csv +++ /dev/null @@ -1,49 +0,0 @@ -engine,severity,file,line,rule,message -sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/feature/main2.py,30,formatted-sql-query,Detected possible formatted SQL query. Use parameterized queries instead. -sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,23,sql-injection-db-cursor-execute,"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." -sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,27,formatted-sql-query,Detected possible formatted SQL query. Use parameterized queries instead. -sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,34,python-subprocess-shell-true-format,"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." -sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,40,python-weak-hash-md5,Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt. -sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,48,path-traversal-open,"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." -sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,54,user-eval,"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." -sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,56,eval-detected,"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." -sast,MEDIUM,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py,61,debug-endpoints-enabled,"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." -sca,MEDIUM,azure-identity,,CVE-2024-35255,Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability -sca,HIGH,langchain-community,,CVE-2025-6984,Langchain Community Vulnerable to XML External Entity (XXE) Attacks -sca,MEDIUM,litellm,,CVE-2026-84377,LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters -sca,MEDIUM,litellm,,CVE-2026-59823,LiteLLM Proxy has server-side request forgery via the `user_config` request parameter -sca,LOW,litellm,,CVE-2026-12799,BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure -sca,LOW,litellm,,CVE-2026-12798,BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader -sca,LOW,litellm,,CVE-2026-12797,BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints -sca,LOW,litellm,,CVE-2026-12796,BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens -sca,MEDIUM,litellm,,CVE-2026-12795,LiteLLM: SSO Debug Flow Has Improper Authentication -sca,LOW,litellm,,CVE-2026-12770,LiteLLM: Admin Key Handler Has Improper Authorization -sca,MEDIUM,litellm,,CVE-2026-12773,LiteLLM: MCP Proxy Has Improper Authentication -sca,LOW,litellm,,CVE-2026-12771,LiteLLM: M2M JWT Handler Has Improper Authorization -sca,LOW,litellm,,CVE-2026-12772,LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration -sca,CRITICAL,litellm,,CVE-2026-37004,LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint -sca,LOW,litellm,,CVE-2026-59821,LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks -sca,HIGH,litellm,,CVE-2026-59822,LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback -sca,LOW,litellm,,CVE-2026-59819,LiteLLM: Local file read via request-supplied OIDC file references -sca,MEDIUM,litellm,,CVE-2026-59820,LiteLLM: Arbitrary file write via path traversal in Skills archive extraction -sca,HIGH,litellm,,CVE-2026-47102,LiteLLM allows a user to modify their own user_role via the /user/update endpoint -sca,HIGH,litellm,,CVE-2026-47101,LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit -sca,CRITICAL,litellm,,CVE-2026-49468,LiteLLM: Authentication Bypass via Host Header Injection -sca,CRITICAL,litellm,,CVE-2026-35030,LiteLLM: Authentication bypass via OIDC userinfo cache key collision -sca,HIGH,litellm,,CVE-2026-35029,LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint -sca,HIGH,litellm,,CVE-2025-0628,LiteLLM Has an Improper Authorization Vulnerability -sca,HIGH,litellm,,,LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` -sca,HIGH,litellm,,,LiteLLM: Password hash exposure and pass-the-hash authentication bypass -sca,HIGH,starlette,,CVE-2026-54283,Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS -sca,LOW,starlette,,CVE-2026-54282,Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname -sca,HIGH,starlette,,CVE-2026-48818,Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows -sca,MEDIUM,starlette,,CVE-2026-48817,Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` -sca,MEDIUM,starlette,,CVE-2026-48710,"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" -sca,MEDIUM,starlette,,CVE-2025-54121,Starlette has possible denial-of-service vector when parsing large files in multipart forms -sca,HIGH,starlette,,CVE-2024-47874,Starlette Denial of service (DoS) via multipart/form-data -sca,HIGH,black,,CVE-2026-114134,Black: GitHub Action installs unvalidated required-version from pyproject.toml -sca,MEDIUM,black,,CVE-2024-21503,Black vulnerable to Regular Expression Denial of Service (ReDoS) -sca,MEDIUM,langchain-text-splitters,,CVE-2026-41481,LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass -sca,HIGH,langchain-core,,CVE-2026-34070,LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions -sca,LOW,langchain-core,,CVE-2026-26013,LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages -secrets,HIGH,/mnt/lambda/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/IaC.yaml,47,generic-password,generic-password diff --git a/examples/security-pipeline/evidence/warn/codeant-qg.xml b/examples/security-pipeline/evidence/warn/codeant-qg.xml deleted file mode 100644 index d2b053a..0000000 --- a/examples/security-pipeline/evidence/warn/codeant-qg.xml +++ /dev/null @@ -1,6 +0,0 @@ - -Quality Gate: PASSED -Total findings: 48 -By severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11 -By engine: sast=9, sca=38, secrets=1 -Ratings: sast_rating_full_code=C, sca_rating_full_code=D \ No newline at end of file diff --git a/examples/security-pipeline/evidence/warn/codeant-run.json b/examples/security-pipeline/evidence/warn/codeant-run.json deleted file mode 100644 index a440155..0000000 --- a/examples/security-pipeline/evidence/warn/codeant-run.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "repository": "codeanttesting/codeant-demo", - "commit": "a342d10cc4ddf2a446e5f09d0d89d3913182effe", - "run_url": "https://github.com/codeanttesting/codeant-demo/actions/runs/42304719043" -} diff --git a/examples/security-pipeline/evidence/warn/codeant-summary.pdf b/examples/security-pipeline/evidence/warn/codeant-summary.pdf deleted file mode 100644 index d1aaeb7753d0d5f522009e487d2779a5a69e8939..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2383 zcma);*_NtE7KZPAicnL?48Zfvy1!R{2x!@^Ot%jhj2L{2&mtj-!VAsJ?WFK0; zK_6)fAUn3^=*Tt!xkPru_RyalBjp6KC=JNjRrTM_xG~57xE=5PAT-}r0cP%tD96odB%A6hOvWW7pAU(8p3_ups0d{=f(aC&h%#&wK0hJ^(TX0?4W3;|0Xi z$+@f8?~*}(2z;R%M~>YNq9fWRhGICHrZ|RS3N)Rjs099f*?kCHZSM>< zWFV-&OFY51e>kr00Rr3MIR8ot)6=gS#KHWT;Q>YgsjlL_fh>@2GCOb)P{Ij!fErGE ziTEDC9QhUwzJ(Dr@FKMaz=PV=MgAM`G{weIVdm#E-acekvAkQ%!BT%=ZaLTYB_^K` zewkMgWYaWAix0l<$ZzNddG$55i!2|%5YC6jtTh-E**3&`DA*7d=K9&dN&>V^e-C($ z3WPi#!#{<3ieE`8TL-~-qwXG$sYzYpT%nmguSt6;La_k(L}z`-m){rQp+9^U zK-9S(HwfpjoZnfQ?oK9KY?`y!k+Dmr=MJIv8plhVPV$pgVTXDQuMTH8>B?z&=j16{ z8}f^IAw^%)S(3ckwHG~>TgcO=*<+r*Yoc&bl-7Cm_#le%#8FEJArpaDPM?bz^uGr(JsOERiad>~ciT=!Bf6kP~Ls^=z&()q%UzO3|JccUN;!;cA4$H|EQ$E$sMKM{= z8qCh34y`#?-30wU!+{O4^_#O_R5lTE+sZn$wsTN zz)x4b;TGje)Ld9n^Te!|Q1n-}Jz&<{*l9DJ8)8U-QxFck#+fhF%%;A=HhEwzIh&p<&mLZ(#`7m!4HpB?^dXXtglbm~gp^fx` zkgfE1N?YDU@Mrahd<=1`yLCpFrG4?d7|QL8vg@Z?=cz{#ReBf}x9POju6L)W=i@_4 zs5Nj@!$NM9mtHzng-E&Uy!GUxjkp=yrTQs*5>MTmge70hXoX}OmHtDro7g0ty0i5d z3XKnW&GMT(oZj{$N8x>?~L}FMTU}jDf(hoi%UD1 zd{Kv$YGkxcHJ$uL6LlhSy%bD^wl-Pe5zdv~azo_r9lLTER7dr694!`G%Xr*X;EG=_ zQUrTf6I;)QUzP{uQ}@|o9^7(7D$=C%uPUyqpF8=p!v1if5uyMeqJCb0W7!-F4Dhp$ z!?h&1fc>+Nrf_Zk*2hr%FMT=Y*SRc%KUd%8viz@l#Ud`s-|YDOjh*i*$b#Wr?bMy^O}9M8Z4qf$zaR-nqMtg0K;zqXJ=v76(J`M-}d*(}fzE^FToHX(9g p8x9DH*))XfsN;j6IO69S`X|Jc-@l}a>%U{Cd7cTyVjZy?`Y&ENuc-h4 diff --git a/examples/security-pipeline/evidence/warn/codeant.sarif b/examples/security-pipeline/evidence/warn/codeant.sarif deleted file mode 100644 index 70e7d61..0000000 --- a/examples/security-pipeline/evidence/warn/codeant.sarif +++ /dev/null @@ -1,1023 +0,0 @@ -{ - "version": "2.1.0", - "$schema": "https://json.schemastore.org/sarif-2.1.0.json", - "runs": [ - { - "tool": { - "driver": { - "name": "CodeAnt AI", - "rules": [ - { - "id": "CVE-2024-21503", - "name": "CVE-2024-21503" - }, - { - "id": "CVE-2024-35255", - "name": "CVE-2024-35255" - }, - { - "id": "CVE-2024-47874", - "name": "CVE-2024-47874" - }, - { - "id": "CVE-2025-0628", - "name": "CVE-2025-0628" - }, - { - "id": "CVE-2025-54121", - "name": "CVE-2025-54121" - }, - { - "id": "CVE-2025-6984", - "name": "CVE-2025-6984" - }, - { - "id": "CVE-2026-114134", - "name": "CVE-2026-114134" - }, - { - "id": "CVE-2026-12770", - "name": "CVE-2026-12770" - }, - { - "id": "CVE-2026-12771", - "name": "CVE-2026-12771" - }, - { - "id": "CVE-2026-12772", - "name": "CVE-2026-12772" - }, - { - "id": "CVE-2026-12773", - "name": "CVE-2026-12773" - }, - { - "id": "CVE-2026-12795", - "name": "CVE-2026-12795" - }, - { - "id": "CVE-2026-12796", - "name": "CVE-2026-12796" - }, - { - "id": "CVE-2026-12797", - "name": "CVE-2026-12797" - }, - { - "id": "CVE-2026-12798", - "name": "CVE-2026-12798" - }, - { - "id": "CVE-2026-12799", - "name": "CVE-2026-12799" - }, - { - "id": "CVE-2026-26013", - "name": "CVE-2026-26013" - }, - { - "id": "CVE-2026-34070", - "name": "CVE-2026-34070" - }, - { - "id": "CVE-2026-35029", - "name": "CVE-2026-35029" - }, - { - "id": "CVE-2026-35030", - "name": "CVE-2026-35030" - }, - { - "id": "CVE-2026-37004", - "name": "CVE-2026-37004" - }, - { - "id": "CVE-2026-41481", - "name": "CVE-2026-41481" - }, - { - "id": "CVE-2026-47101", - "name": "CVE-2026-47101" - }, - { - "id": "CVE-2026-47102", - "name": "CVE-2026-47102" - }, - { - "id": "CVE-2026-48710", - "name": "CVE-2026-48710" - }, - { - "id": "CVE-2026-48817", - "name": "CVE-2026-48817" - }, - { - "id": "CVE-2026-48818", - "name": "CVE-2026-48818" - }, - { - "id": "CVE-2026-49468", - "name": "CVE-2026-49468" - }, - { - "id": "CVE-2026-54282", - "name": "CVE-2026-54282" - }, - { - "id": "CVE-2026-54283", - "name": "CVE-2026-54283" - }, - { - "id": "CVE-2026-59819", - "name": "CVE-2026-59819" - }, - { - "id": "CVE-2026-59820", - "name": "CVE-2026-59820" - }, - { - "id": "CVE-2026-59821", - "name": "CVE-2026-59821" - }, - { - "id": "CVE-2026-59822", - "name": "CVE-2026-59822" - }, - { - "id": "CVE-2026-59823", - "name": "CVE-2026-59823" - }, - { - "id": "CVE-2026-84377", - "name": "CVE-2026-84377" - }, - { - "id": "debug-endpoints-enabled", - "name": "debug-endpoints-enabled" - }, - { - "id": "eval-detected", - "name": "eval-detected" - }, - { - "id": "formatted-sql-query", - "name": "formatted-sql-query" - }, - { - "id": "generic-password", - "name": "generic-password" - }, - { - "id": "path-traversal-open", - "name": "path-traversal-open" - }, - { - "id": "python-subprocess-shell-true-format", - "name": "python-subprocess-shell-true-format" - }, - { - "id": "python-weak-hash-md5", - "name": "python-weak-hash-md5" - }, - { - "id": "sca", - "name": "sca" - }, - { - "id": "sql-injection-db-cursor-execute", - "name": "sql-injection-db-cursor-execute" - }, - { - "id": "user-eval", - "name": "user-eval" - } - ] - } - }, - "results": [ - { - "ruleId": "formatted-sql-query", - "level": "error", - "message": { - "text": "Detected possible formatted SQL query. Use parameterized queries instead." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/feature/main2.py" - }, - "region": { - "startLine": 30 - } - } - } - ] - }, - { - "ruleId": "sql-injection-db-cursor-execute", - "level": "error", - "message": { - "text": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" - }, - "region": { - "startLine": 23 - } - } - } - ] - }, - { - "ruleId": "formatted-sql-query", - "level": "error", - "message": { - "text": "Detected possible formatted SQL query. Use parameterized queries instead." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" - }, - "region": { - "startLine": 27 - } - } - } - ] - }, - { - "ruleId": "python-subprocess-shell-true-format", - "level": "error", - "message": { - "text": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" - }, - "region": { - "startLine": 34 - } - } - } - ] - }, - { - "ruleId": "python-weak-hash-md5", - "level": "error", - "message": { - "text": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" - }, - "region": { - "startLine": 40 - } - } - } - ] - }, - { - "ruleId": "path-traversal-open", - "level": "error", - "message": { - "text": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" - }, - "region": { - "startLine": 48 - } - } - } - ] - }, - { - "ruleId": "user-eval", - "level": "error", - "message": { - "text": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" - }, - "region": { - "startLine": 54 - } - } - } - ] - }, - { - "ruleId": "eval-detected", - "level": "error", - "message": { - "text": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" - }, - "region": { - "startLine": 56 - } - } - } - ] - }, - { - "ruleId": "debug-endpoints-enabled", - "level": "warning", - "message": { - "text": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py" - }, - "region": { - "startLine": 61 - } - } - } - ] - }, - { - "ruleId": "CVE-2024-35255", - "level": "warning", - "message": { - "text": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "azure-identity" - } - } - } - ] - }, - { - "ruleId": "CVE-2025-6984", - "level": "error", - "message": { - "text": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "langchain-community" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-84377", - "level": "warning", - "message": { - "text": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-59823", - "level": "warning", - "message": { - "text": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12799", - "level": "note", - "message": { - "text": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12798", - "level": "note", - "message": { - "text": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12797", - "level": "note", - "message": { - "text": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12796", - "level": "note", - "message": { - "text": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12795", - "level": "warning", - "message": { - "text": "LiteLLM: SSO Debug Flow Has Improper Authentication" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12770", - "level": "note", - "message": { - "text": "LiteLLM: Admin Key Handler Has Improper Authorization" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12773", - "level": "warning", - "message": { - "text": "LiteLLM: MCP Proxy Has Improper Authentication" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12771", - "level": "note", - "message": { - "text": "LiteLLM: M2M JWT Handler Has Improper Authorization" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-12772", - "level": "note", - "message": { - "text": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-37004", - "level": "error", - "message": { - "text": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-59821", - "level": "note", - "message": { - "text": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-59822", - "level": "error", - "message": { - "text": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-59819", - "level": "note", - "message": { - "text": "LiteLLM: Local file read via request-supplied OIDC file references" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-59820", - "level": "warning", - "message": { - "text": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-47102", - "level": "error", - "message": { - "text": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-47101", - "level": "error", - "message": { - "text": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-49468", - "level": "error", - "message": { - "text": "LiteLLM: Authentication Bypass via Host Header Injection" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-35030", - "level": "error", - "message": { - "text": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-35029", - "level": "error", - "message": { - "text": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2025-0628", - "level": "error", - "message": { - "text": "LiteLLM Has an Improper Authorization Vulnerability" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "sca", - "level": "error", - "message": { - "text": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "sca", - "level": "error", - "message": { - "text": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "litellm" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-54283", - "level": "error", - "message": { - "text": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-54282", - "level": "note", - "message": { - "text": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-48818", - "level": "error", - "message": { - "text": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-48817", - "level": "warning", - "message": { - "text": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-48710", - "level": "warning", - "message": { - "text": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2025-54121", - "level": "warning", - "message": { - "text": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2024-47874", - "level": "error", - "message": { - "text": "Starlette Denial of service (DoS) via multipart/form-data" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "starlette" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-114134", - "level": "error", - "message": { - "text": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "black" - } - } - } - ] - }, - { - "ruleId": "CVE-2024-21503", - "level": "warning", - "message": { - "text": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "black" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-41481", - "level": "warning", - "message": { - "text": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "langchain-text-splitters" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-34070", - "level": "error", - "message": { - "text": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "langchain-core" - } - } - } - ] - }, - { - "ruleId": "CVE-2026-26013", - "level": "note", - "message": { - "text": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "langchain-core" - } - } - } - ] - }, - { - "ruleId": "generic-password", - "level": "error", - "message": { - "text": "generic-password" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/IaC.yaml" - }, - "region": { - "startLine": 47 - } - } - } - ] - } - ], - "invocations": [ - { - "executionSuccessful": true - } - ], - "properties": { - "total_findings": 48, - "findings_by_severity": { - "HIGH": 19, - "CRITICAL": 6, - "MEDIUM": 12, - "LOW": 11 - }, - "findings_by_engine": { - "sast": 9, - "sca": 38, - "secrets": 1 - }, - "ratings": { - "sast_rating_full_code": "C", - "sca_rating_full_code": "D" - }, - "quality_gate_status": "PASSED" - } - } - ] -} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/warn/results.json b/examples/security-pipeline/evidence/warn/results.json deleted file mode 100644 index bef8d3c..0000000 --- a/examples/security-pipeline/evidence/warn/results.json +++ /dev/null @@ -1,417 +0,0 @@ -{ - "status": "COMPLETED", - "quality_gate_status": "PASSED", - "metrics": { - "sast_rating_full_code": "C", - "sca_rating_full_code": "D" - }, - "failed_conditions": [], - "evaluated_conditions": [ - { - "metric": "sast_rating_full_code", - "context": "CodeAnt - SAST", - "actual": "C", - "quality_gate_enabled": false, - "quality_gate_status": "PASSED", - "why": "No quality gate conditions found for metric 'sast_rating_full_code' in scope 'commit'" - }, - { - "metric": "sca_rating_full_code", - "context": "CodeAnt - SCA", - "actual": "D", - "quality_gate_enabled": false, - "quality_gate_status": "PASSED", - "why": "No quality gate conditions found for metric 'sca_rating_full_code' in scope 'commit'" - } - ], - "findings": [ - { - "engine": "sast", - "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/feature/main2.py", - "line": 30, - "rule": "formatted-sql-query", - "message": "Detected possible formatted SQL query. Use parameterized queries instead." - }, - { - "engine": "sast", - "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", - "line": 23, - "rule": "sql-injection-db-cursor-execute", - "message": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." - }, - { - "engine": "sast", - "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", - "line": 27, - "rule": "formatted-sql-query", - "message": "Detected possible formatted SQL query. Use parameterized queries instead." - }, - { - "engine": "sast", - "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", - "line": 34, - "rule": "python-subprocess-shell-true-format", - "message": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." - }, - { - "engine": "sast", - "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", - "line": 40, - "rule": "python-weak-hash-md5", - "message": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." - }, - { - "engine": "sast", - "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", - "line": 48, - "rule": "path-traversal-open", - "message": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." - }, - { - "engine": "sast", - "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", - "line": 54, - "rule": "user-eval", - "message": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." - }, - { - "engine": "sast", - "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", - "line": 56, - "rule": "eval-detected", - "message": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." - }, - { - "engine": "sast", - "severity": "MEDIUM", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py", - "line": 61, - "rule": "debug-endpoints-enabled", - "message": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "azure-identity", - "line": null, - "rule": "CVE-2024-35255", - "message": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "langchain-community", - "line": null, - "rule": "CVE-2025-6984", - "message": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "litellm", - "line": null, - "rule": "CVE-2026-84377", - "message": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "litellm", - "line": null, - "rule": "CVE-2026-59823", - "message": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12799", - "message": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12798", - "message": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12797", - "message": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12796", - "message": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12795", - "message": "LiteLLM: SSO Debug Flow Has Improper Authentication" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12770", - "message": "LiteLLM: Admin Key Handler Has Improper Authorization" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12773", - "message": "LiteLLM: MCP Proxy Has Improper Authentication" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12771", - "message": "LiteLLM: M2M JWT Handler Has Improper Authorization" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-12772", - "message": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" - }, - { - "engine": "sca", - "severity": "CRITICAL", - "file": "litellm", - "line": null, - "rule": "CVE-2026-37004", - "message": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-59821", - "message": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "CVE-2026-59822", - "message": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "litellm", - "line": null, - "rule": "CVE-2026-59819", - "message": "LiteLLM: Local file read via request-supplied OIDC file references" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "litellm", - "line": null, - "rule": "CVE-2026-59820", - "message": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "CVE-2026-47102", - "message": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "CVE-2026-47101", - "message": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" - }, - { - "engine": "sca", - "severity": "CRITICAL", - "file": "litellm", - "line": null, - "rule": "CVE-2026-49468", - "message": "LiteLLM: Authentication Bypass via Host Header Injection" - }, - { - "engine": "sca", - "severity": "CRITICAL", - "file": "litellm", - "line": null, - "rule": "CVE-2026-35030", - "message": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "CVE-2026-35029", - "message": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "CVE-2025-0628", - "message": "LiteLLM Has an Improper Authorization Vulnerability" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "", - "message": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "litellm", - "line": null, - "rule": "", - "message": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "starlette", - "line": null, - "rule": "CVE-2026-54283", - "message": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "starlette", - "line": null, - "rule": "CVE-2026-54282", - "message": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "starlette", - "line": null, - "rule": "CVE-2026-48818", - "message": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "starlette", - "line": null, - "rule": "CVE-2026-48817", - "message": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "starlette", - "line": null, - "rule": "CVE-2026-48710", - "message": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "starlette", - "line": null, - "rule": "CVE-2025-54121", - "message": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "starlette", - "line": null, - "rule": "CVE-2024-47874", - "message": "Starlette Denial of service (DoS) via multipart/form-data" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "black", - "line": null, - "rule": "CVE-2026-114134", - "message": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "black", - "line": null, - "rule": "CVE-2024-21503", - "message": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" - }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "langchain-text-splitters", - "line": null, - "rule": "CVE-2026-41481", - "message": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" - }, - { - "engine": "sca", - "severity": "HIGH", - "file": "langchain-core", - "line": null, - "rule": "CVE-2026-34070", - "message": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" - }, - { - "engine": "sca", - "severity": "LOW", - "file": "langchain-core", - "line": null, - "rule": "CVE-2026-26013", - "message": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" - }, - { - "engine": "secrets", - "severity": "HIGH", - "file": "/mnt/lambda/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/IaC.yaml", - "line": 47, - "rule": "generic-password", - "message": "generic-password" - } - ], - "reports": { - "sarif": "{\n \"version\": \"2.1.0\",\n \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n \"runs\": [\n {\n \"tool\": {\n \"driver\": {\n \"name\": \"CodeAnt AI\",\n \"rules\": [\n {\n \"id\": \"CVE-2024-21503\",\n \"name\": \"CVE-2024-21503\"\n },\n {\n \"id\": \"CVE-2024-35255\",\n \"name\": \"CVE-2024-35255\"\n },\n {\n \"id\": \"CVE-2024-47874\",\n \"name\": \"CVE-2024-47874\"\n },\n {\n \"id\": \"CVE-2025-0628\",\n \"name\": \"CVE-2025-0628\"\n },\n {\n \"id\": \"CVE-2025-54121\",\n \"name\": \"CVE-2025-54121\"\n },\n {\n \"id\": \"CVE-2025-6984\",\n \"name\": \"CVE-2025-6984\"\n },\n {\n \"id\": \"CVE-2026-114134\",\n \"name\": \"CVE-2026-114134\"\n },\n {\n \"id\": \"CVE-2026-12770\",\n \"name\": \"CVE-2026-12770\"\n },\n {\n \"id\": \"CVE-2026-12771\",\n \"name\": \"CVE-2026-12771\"\n },\n {\n \"id\": \"CVE-2026-12772\",\n \"name\": \"CVE-2026-12772\"\n },\n {\n \"id\": \"CVE-2026-12773\",\n \"name\": \"CVE-2026-12773\"\n },\n {\n \"id\": \"CVE-2026-12795\",\n \"name\": \"CVE-2026-12795\"\n },\n {\n \"id\": \"CVE-2026-12796\",\n \"name\": \"CVE-2026-12796\"\n },\n {\n \"id\": \"CVE-2026-12797\",\n \"name\": \"CVE-2026-12797\"\n },\n {\n \"id\": \"CVE-2026-12798\",\n \"name\": \"CVE-2026-12798\"\n },\n {\n \"id\": \"CVE-2026-12799\",\n \"name\": \"CVE-2026-12799\"\n },\n {\n \"id\": \"CVE-2026-26013\",\n \"name\": \"CVE-2026-26013\"\n },\n {\n \"id\": \"CVE-2026-34070\",\n \"name\": \"CVE-2026-34070\"\n },\n {\n \"id\": \"CVE-2026-35029\",\n \"name\": \"CVE-2026-35029\"\n },\n {\n \"id\": \"CVE-2026-35030\",\n \"name\": \"CVE-2026-35030\"\n },\n {\n \"id\": \"CVE-2026-37004\",\n \"name\": \"CVE-2026-37004\"\n },\n {\n \"id\": \"CVE-2026-41481\",\n \"name\": \"CVE-2026-41481\"\n },\n {\n \"id\": \"CVE-2026-47101\",\n \"name\": \"CVE-2026-47101\"\n },\n {\n \"id\": \"CVE-2026-47102\",\n \"name\": \"CVE-2026-47102\"\n },\n {\n \"id\": \"CVE-2026-48710\",\n \"name\": \"CVE-2026-48710\"\n },\n {\n \"id\": \"CVE-2026-48817\",\n \"name\": \"CVE-2026-48817\"\n },\n {\n \"id\": \"CVE-2026-48818\",\n \"name\": \"CVE-2026-48818\"\n },\n {\n \"id\": \"CVE-2026-49468\",\n \"name\": \"CVE-2026-49468\"\n },\n {\n \"id\": \"CVE-2026-54282\",\n \"name\": \"CVE-2026-54282\"\n },\n {\n \"id\": \"CVE-2026-54283\",\n \"name\": \"CVE-2026-54283\"\n },\n {\n \"id\": \"CVE-2026-59819\",\n \"name\": \"CVE-2026-59819\"\n },\n {\n \"id\": \"CVE-2026-59820\",\n \"name\": \"CVE-2026-59820\"\n },\n {\n \"id\": \"CVE-2026-59821\",\n \"name\": \"CVE-2026-59821\"\n },\n {\n \"id\": \"CVE-2026-59822\",\n \"name\": \"CVE-2026-59822\"\n },\n {\n \"id\": \"CVE-2026-59823\",\n \"name\": \"CVE-2026-59823\"\n },\n {\n \"id\": \"CVE-2026-84377\",\n \"name\": \"CVE-2026-84377\"\n },\n {\n \"id\": \"debug-endpoints-enabled\",\n \"name\": \"debug-endpoints-enabled\"\n },\n {\n \"id\": \"eval-detected\",\n \"name\": \"eval-detected\"\n },\n {\n \"id\": \"formatted-sql-query\",\n \"name\": \"formatted-sql-query\"\n },\n {\n \"id\": \"generic-password\",\n \"name\": \"generic-password\"\n },\n {\n \"id\": \"path-traversal-open\",\n \"name\": \"path-traversal-open\"\n },\n {\n \"id\": \"python-subprocess-shell-true-format\",\n \"name\": \"python-subprocess-shell-true-format\"\n },\n {\n \"id\": \"python-weak-hash-md5\",\n \"name\": \"python-weak-hash-md5\"\n },\n {\n \"id\": \"sca\",\n \"name\": \"sca\"\n },\n {\n \"id\": \"sql-injection-db-cursor-execute\",\n \"name\": \"sql-injection-db-cursor-execute\"\n },\n {\n \"id\": \"user-eval\",\n \"name\": \"user-eval\"\n }\n ]\n }\n },\n \"results\": [\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/feature/main2.py\"\n },\n \"region\": {\n \"startLine\": 30\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sql-injection-db-cursor-execute\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 23\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 27\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-subprocess-shell-true-format\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 34\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-weak-hash-md5\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 40\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"path-traversal-open\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 48\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"user-eval\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 54\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"eval-detected\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 56\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"debug-endpoints-enabled\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 61\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-35255\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"azure-identity\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-6984\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Langchain Community Vulnerable to XML External Entity (XXE) Attacks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-community\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-84377\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59823\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12799\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12798\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12797\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12796\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12795\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: SSO Debug Flow Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12770\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Admin Key Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12773\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Proxy Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12771\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: M2M JWT Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12772\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-37004\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59821\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59822\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59819\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Local file read via request-supplied OIDC file references\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59820\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Arbitrary file write via path traversal in Skills archive extraction\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47102\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows a user to modify their own user_role via the /user/update endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47101\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-49468\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication Bypass via Host Header Injection\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35030\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication bypass via OIDC userinfo cache key collision\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35029\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-0628\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM Has an Improper Authorization Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Password hash exposure and pass-the-hash authentication bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54283\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54282\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48818\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48817\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48710\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-54121\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has possible denial-of-service vector when parsing large files in multipart forms\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-47874\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette Denial of service (DoS) via multipart/form-data\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-114134\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Black: GitHub Action installs unvalidated required-version from pyproject.toml\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-21503\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Black vulnerable to Regular Expression Denial of Service (ReDoS)\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-41481\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-text-splitters\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-34070\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-26013\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"generic-password\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"generic-password\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/codeanttesting/codeant-demo/a342d10cc4ddf2a446e5f09d0d89d3913182effe/IaC.yaml\"\n },\n \"region\": {\n \"startLine\": 47\n }\n }\n }\n ]\n }\n ],\n \"invocations\": [\n {\n \"executionSuccessful\": true\n }\n ],\n \"properties\": {\n \"total_findings\": 48,\n \"findings_by_severity\": {\n \"HIGH\": 19,\n \"CRITICAL\": 6,\n \"MEDIUM\": 12,\n \"LOW\": 11\n },\n \"findings_by_engine\": {\n \"sast\": 9,\n \"sca\": 38,\n \"secrets\": 1\n },\n \"ratings\": {\n \"sast_rating_full_code\": \"C\",\n \"sca_rating_full_code\": \"D\"\n },\n \"quality_gate_status\": \"PASSED\"\n }\n }\n ]\n}", - "junit": "\nQuality Gate: PASSED\nTotal findings: 48\nBy severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11\nBy engine: sast=9, sca=38, secrets=1\nRatings: sast_rating_full_code=C, sca_rating_full_code=D" - } -} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/warn/runner-output.txt b/examples/security-pipeline/evidence/warn/runner-output.txt deleted file mode 100644 index bd88e2c..0000000 --- a/examples/security-pipeline/evidence/warn/runner-output.txt +++ /dev/null @@ -1,21 +0,0 @@ -Run: https://github.com/codeanttesting/codeant-demo/actions/runs/42304719043 -Selected runner output (credential and setup lines omitted): - -2026-11-06T22:26:35.1682180Z ✅ Scan started -2026-11-06T22:26:36.9446510Z 📝 Scan still running... -2026-11-06T22:27:08.3939138Z 📝 Wrote results.json, codeant.sarif, codeant-qg.xml -2026-11-06T22:27:08.3940289Z 📊 Findings: 48 -2026-11-06T22:27:08.3940773Z 🎯 Quality Gate: PASSED -2026-11-06T22:27:11.9412824Z secrets: 1 blocking findings; allowed=0 -2026-11-06T22:27:11.9413390Z sast: 8 blocking findings; allowed=0 -2026-11-06T22:27:11.9414082Z sca: 16 blocking findings; allowed=0 -2026-11-06T22:27:11.9414829Z Completed scan; wrote codeant-findings.csv, codeant-summary.pdf, codeant-run.json -2026-11-06T22:27:21.1388826Z sca: 16 blocking findings; allowed=0; mode=warn -2026-11-06T22:27:21.1415297Z ##[warning]sca: 16 blocking findings; allowed=0 -2026-11-06T22:27:21.3946451Z secrets: 1 blocking findings; allowed=0; mode=warn -2026-11-06T22:27:21.3978301Z ##[warning]secrets: 1 blocking findings; allowed=0 -2026-11-06T22:27:23.0314518Z sast: 8 blocking findings; allowed=0; mode=warn -2026-11-06T22:27:23.0334923Z ##[warning]sast: 8 blocking findings; allowed=0 -2026-11-06T22:27:29.1438204Z ##[group]Run echo 'Security jobs passed. Replace this step with your staging deployment.' -2026-11-06T22:27:29.1439834Z echo 'Security jobs passed. Replace this step with your staging deployment.' -2026-11-06T22:27:29.2164577Z Security jobs passed. Replace this step with your staging deployment. diff --git a/examples/security-pipeline/policy.json b/examples/security-pipeline/policy.json deleted file mode 100644 index 9487670..0000000 --- a/examples/security-pipeline/policy.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "secrets": {"severities": ["*"], "max_findings": 0}, - "sast": {"severities": ["HIGH", "CRITICAL"], "max_findings": 0}, - "sca": {"severities": ["HIGH", "CRITICAL"], "max_findings": 0} -} diff --git a/examples/security-pipeline/report.py b/examples/security-pipeline/report.py deleted file mode 100644 index 2d3b7f5..0000000 --- a/examples/security-pipeline/report.py +++ /dev/null @@ -1,120 +0,0 @@ -"""Export completed CodeAnt results and apply the example's explicit CI policy.""" - -import argparse -import csv -import json -import os -from collections import Counter -from pathlib import Path -from xml.sax.saxutils import escape - - -def load_results(): - result = json.loads(Path("results.json").read_text()) - if result.get("status") != "COMPLETED": - raise ValueError("Scan did not complete; refusing to treat missing results as clean") - findings = result.get("findings") - if not isinstance(findings, list): - raise ValueError("Completed result must contain a findings list") - metrics = result.get("metrics", {}) - for metric in ("sast_rating_full_code", "sca_rating_full_code"): - if metric not in metrics: - raise ValueError(f"Missing required scan metric: {metric}") - for finding in findings: - if not isinstance(finding, dict) or not finding.get("engine"): - raise ValueError("Malformed finding") - return result - - -def policy_result(result, scanner): - policy = json.loads(Path(__file__).with_name("policy.json").read_text())[scanner] - selected = [item for item in result["findings"] if item["engine"] == scanner] - severities = policy["severities"] - # An unknown severity must not silently evade an enforcement policy. - known = {"INFO", "INFORMATIONAL", "LOW", "MEDIUM", "MODERATE", "HIGH", "CRITICAL"} - blocking = [item for item in selected if "*" in severities - or str(item.get("severity", "")).upper() in severities - or str(item.get("severity", "")).upper() not in known] - limit = policy["max_findings"] - return len(blocking) > limit, f"{scanner}: {len(blocking)} blocking findings; allowed={limit}" - - -def csv_cell(value): - text = "" if value is None else str(value) - # Findings are untrusted content; prevent spreadsheet formula evaluation. - return "'" + text if text.lstrip().startswith(("=", "+", "-", "@")) else text - - -def export(result): - from reportlab.lib import colors - from reportlab.lib.styles import getSampleStyleSheet - from reportlab.platypus import SimpleDocTemplate, Paragraph, Spacer, Table, TableStyle - - fields = ["engine", "severity", "file", "line", "rule", "message"] - with Path("codeant-findings.csv").open("w", newline="") as output: - writer = csv.writer(output) - writer.writerow(fields) - writer.writerows([csv_cell(item.get(key)) for key in fields] for item in result["findings"]) - - context = {"repository": os.getenv("GITHUB_REPOSITORY", "local"), - "commit": os.getenv("SCAN_COMMIT", os.getenv("GITHUB_SHA", "local")), - "run_url": os.getenv("GITHUB_SERVER_URL", "https://github.com") + "/" - + os.getenv("GITHUB_REPOSITORY", "local") + "/actions/runs/" - + os.getenv("GITHUB_RUN_ID", "local")} - Path("codeant-run.json").write_text(json.dumps(context, indent=2) + "\n") - styles = getSampleStyleSheet() - story = [Paragraph("CodeAnt CI security scan", styles["Title"])] - for key, value in context.items(): - story.append(Paragraph(escape(f"{key}: {value}"), styles["BodyText"])) - story += [Spacer(1, 16), Paragraph("Example policy results", styles["Heading2"])] - rows = [["Scanner", "Total findings", "Policy verdict"]] - counts = Counter(item["engine"] for item in result["findings"]) - for scanner in ("secrets", "sast", "sca"): - failed, message = policy_result(result, scanner) - rows.append([scanner, str(counts[scanner]), "FAILED" if failed else "PASSED"]) - print(message) - table = Table(rows, colWidths=[140, 140, 160], repeatRows=1) - table.setStyle(TableStyle([("BACKGROUND", (0, 0), (-1, 0), colors.HexColor("#e9e9ff")), - ("GRID", (0, 0), (-1, -1), 0.5, colors.lightgrey), - ("BOTTOMPADDING", (0, 0), (-1, -1), 10), - ("TOPPADDING", (0, 0), (-1, -1), 10)])) - story += [table, Spacer(1, 16), Paragraph("Scope and interpretation", styles["Heading2"]), - Paragraph("Full repository results for secrets, SAST and SCA. This summary and the CSV " - "are generated by the example workflow. The policy is defined in policy.json; " - "it is separate from the native CodeAnt quality-gate verdict.", styles["BodyText"]), - Paragraph(escape("Native CodeAnt verdict: " + str(result.get("quality_gate_status"))), styles["BodyText"]), - Paragraph("See codeant-findings.csv for all findings and the Actions logs for runner diagnostics.", styles["BodyText"])] - SimpleDocTemplate("codeant-summary.pdf", title="CodeAnt CI security scan").build(story) - print("Completed scan; wrote codeant-findings.csv, codeant-summary.pdf, codeant-run.json") - - -def main(): - parser = argparse.ArgumentParser(description=__doc__) - parser.add_argument("operation", choices=["export", "gate"]) - parser.add_argument("--scanner", choices=["secrets", "sast", "sca"]) - parser.add_argument("--mode", choices=["warn", "enforce"], default="enforce") - args = parser.parse_args() - try: - result = load_results() - if args.operation == "export": - export(result) - return 0 - if not args.scanner: - parser.error("gate requires --scanner") - failed, message = policy_result(result, args.scanner) - print(f"{message}; mode={args.mode}") - summary = os.getenv("GITHUB_STEP_SUMMARY") - if summary: - with open(summary, "a") as output: - output.write(f"### {args.scanner} policy\n\n{message}; mode={args.mode}\n") - if failed: - level = "warning" if args.mode == "warn" else "error" - print(f"::{level}::{message}") - return int(failed and args.mode == "enforce") - except (OSError, ValueError, KeyError, TypeError) as error: - print(f"::error::Invalid or missing scan results: {error}") - return 1 - - -if __name__ == "__main__": - raise SystemExit(main()) diff --git a/examples/security-pipeline/test_report.py b/examples/security-pipeline/test_report.py deleted file mode 100644 index b63154b..0000000 --- a/examples/security-pipeline/test_report.py +++ /dev/null @@ -1,64 +0,0 @@ -"""Checks for deployment bypasses and report export safety. Run with unittest.""" - -import contextlib -import importlib.util -import io -import json -import os -import tempfile -import unittest -from pathlib import Path -from unittest.mock import patch - -spec = importlib.util.spec_from_file_location("report", Path(__file__).with_name("report.py")) -report = importlib.util.module_from_spec(spec) -spec.loader.exec_module(report) - - -class PipelinePolicyTests(unittest.TestCase): - def run_gate(self, result, mode="enforce", scanner="sast"): - with tempfile.TemporaryDirectory() as directory: - previous = Path.cwd() - os.chdir(directory) - try: - if result is not None: - Path("results.json").write_text(json.dumps(result)) - with patch("sys.argv", ["report.py", "gate", "--scanner", scanner, "--mode", mode]): - with contextlib.redirect_stdout(io.StringIO()): - return report.main() - finally: - os.chdir(previous) - - def completed(self, findings): - return {"status": "COMPLETED", "metrics": {"sast_rating_full_code": "S", "sca_rating_full_code": "S"}, - "findings": findings} - - def test_clean_completed_scan_passes_enforcement(self): - self.assertEqual(self.run_gate(self.completed([])), 0) - - def test_high_sast_blocks_only_in_enforcement(self): - result = self.completed([{"engine": "sast", "severity": "HIGH"}]) - self.assertEqual(self.run_gate(result, "warn"), 0) - self.assertEqual(self.run_gate(result), 1) - - def test_missing_or_incomplete_results_fail_even_in_warning_mode(self): - for result in [None, {"status": "done"}, {"status": "PENDING"}, {"status": "COMPLETED"}]: - with self.subTest(result=result): - self.assertEqual(self.run_gate(result, "warn"), 1) - - def test_scanner_jobs_do_not_block_on_other_engines(self): - self.assertEqual(self.run_gate(self.completed([{"engine": "sca", "severity": "CRITICAL"}])), 0) - - def test_secrets_block_regardless_of_severity(self): - self.assertEqual(self.run_gate(self.completed([{"engine": "secrets", "severity": "LOW"}]), scanner="secrets"), 1) - - def test_unknown_severity_is_not_silently_allowed(self): - self.assertEqual(self.run_gate(self.completed([{"engine": "sast", "severity": ""}])), 1) - - def test_csv_does_not_execute_formulas(self): - for value in ["=HYPERLINK(1)", " +1", "-1", "@SUM(A1)"]: - self.assertTrue(report.csv_cell(value).startswith("'")) - - -if __name__ == "__main__": - unittest.main() From 98de6cf502674ba7971d363cafcc2730ff8ba204 Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 04:25:07 +0530 Subject: [PATCH 05/12] Enable native quality gate enforcement in the public demo --- .github/workflows/codeant-security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeant-security.yml b/.github/workflows/codeant-security.yml index e9707b0..3f6f6df 100644 --- a/.github/workflows/codeant-security.yml +++ b/.github/workflows/codeant-security.yml @@ -15,7 +15,7 @@ concurrency: cancel-in-progress: false env: - ENFORCE_SECURITY: 'false' + ENFORCE_SECURITY: 'true' jobs: security: From 2cd6121a53fccf0a4871b2744ca14877379e68c9 Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 04:26:36 +0530 Subject: [PATCH 06/12] Exercise native security gates against the vulnerable source fixture --- security_vulns.py | 1 + 1 file changed, 1 insertion(+) diff --git a/security_vulns.py b/security_vulns.py index 35182ca..7031602 100644 --- a/security_vulns.py +++ b/security_vulns.py @@ -4,6 +4,7 @@ DO NOT use this code in production. """ +# CI fixture: native full-repository quality gate enforcement. import os import subprocess import sqlite3 From 349b1b959042f3e882150bf72a8d088a5787e354 Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 04:29:03 +0530 Subject: [PATCH 07/12] Preserve native quality-gate run evidence [skip ci] --- examples/security-pipeline/README.md | 14 + .../__pycache__/report.cpython-311.pyc | Bin 0 -> 11605 bytes .../__pycache__/test_report.cpython-311.pyc | Bin 0 -> 7078 bytes .../evidence/enforce/codeant-qg.xml | 6 + .../evidence/enforce/codeant.sarif | 1023 +++++++++++++++++ .../evidence/enforce/results.json | 434 +++++++ .../evidence/enforce/runner-output.txt | 9 + .../evidence/warn/codeant-qg.xml | 6 + .../evidence/warn/codeant.sarif | 1023 +++++++++++++++++ .../evidence/warn/results.json | 434 +++++++ .../evidence/warn/runner-output.txt | 8 + 11 files changed, 2957 insertions(+) create mode 100644 examples/security-pipeline/__pycache__/report.cpython-311.pyc create mode 100644 examples/security-pipeline/__pycache__/test_report.cpython-311.pyc create mode 100644 examples/security-pipeline/evidence/enforce/codeant-qg.xml create mode 100644 examples/security-pipeline/evidence/enforce/codeant.sarif create mode 100644 examples/security-pipeline/evidence/enforce/results.json create mode 100644 examples/security-pipeline/evidence/enforce/runner-output.txt create mode 100644 examples/security-pipeline/evidence/warn/codeant-qg.xml create mode 100644 examples/security-pipeline/evidence/warn/codeant.sarif create mode 100644 examples/security-pipeline/evidence/warn/results.json create mode 100644 examples/security-pipeline/evidence/warn/runner-output.txt diff --git a/examples/security-pipeline/README.md b/examples/security-pipeline/README.md index e54f040..e1e1c55 100644 --- a/examples/security-pipeline/README.md +++ b/examples/security-pipeline/README.md @@ -26,3 +26,17 @@ produce CSV or PDF. Do not upload credentials or environment dumps as artifacts. The deployment step is a placeholder. Replace it with your deployment command and keep `needs: security`. To block merges, require the check in branch protection. The workflow skips fork PRs, which do not receive repository secrets. + +## Real native-gate runs + +Both runs evaluated enabled full-code conditions: SAST was C and SCA was D, so +CodeAnt returned FAILED. Each returned 48 findings. + +| Mode | Run | Result | +| --- | --- | --- | +| Warning | [42308035025](https://github.com/codeanttesting/codeant-demo/actions/runs/42308035025) | Native gate failed; workflow warned and deployment placeholder ran. | +| Enforcement | [42308406392](https://github.com/codeanttesting/codeant-demo/actions/runs/42308406392) | Native gate failed; security job failed and deployment was skipped. | + +Original native reports and selected runner output are saved in +[`evidence/warn`](evidence/warn) and [`evidence/enforce`](evidence/enforce). +They are historical outputs for these runs; future scans may differ. diff --git a/examples/security-pipeline/__pycache__/report.cpython-311.pyc b/examples/security-pipeline/__pycache__/report.cpython-311.pyc new file mode 100644 index 0000000000000000000000000000000000000000..68619e164b34d9fbbafe2009ae2b03471cd85e2c GIT binary patch literal 11605 zcmcgSZA=_VcHJ{QGd`4HwGp% zcWAST2glN~C$G%q?91F{caP2aawOVQNTevfRqoC|@}nDd8eNEiu8%vHW;M;Jv{Z;|-3DMW(#MDC=b>gQ(zM9#UhGa40Nz zTf4ktaY#b^8Xu1dEC)&IQcxI$r;+7D!7((95W*^X z1aWgUEud1lz>wN*WKiu5;Y}S+5lJGGpCV07MyJKi=x<@{oKvu_6=W!FsrSfD@foxw zQ>0*D!;>Th$J*Ox(Ep#|=|g$Ewnd{B&l_4ag$XUDl#Zd>h#Q`iKB-UYZj)TGrZ48C z{zt^4b^U&iyjPJVq1K5MrJ+U%=OvXz_=FF)tHlys`Ki1D^oK9UkYyu@SEj_X->v6ui+e zk26+Tn)ikxY%r$K!{HbMMfpTs>#6{#rM%H`9$}3M!EnqQ^yW)?BVk@pOi@`&}SI6 zScp|9Of^YG^db z3E>797iK&p#JPrvICqO53x-%I0{srggt}0;ZYUVK#m1Pr#s(OjTR|Znk2Tbz!30uQ z%Q0*;-jG{R_y(R0jdNjPs%|Vi#ztTe8aNg$P4#0_iVgL7FgJZ%B@kzWKVJrm#5A#N zcikI!M9sY`dG^bm{m(o{mpn%$Pm}CvlI+K2`|;`atjT^S@m^wfpJdu1o3_mT(UPfF zG}SIUJYvN=lH-Q#xFOOvvd+>E5_c1GwUTqU?A$%wxoj<+9sQJ&th;6F?iGSGoF{RW zPRY?FJGw-=E9)rv;O5<%a}}9$l4Gyz*gM^kEpA;QbcRk+g=u5f>Y6JTtzL-B#aqRy z_QhcU5T)V{xwu2Lb*$(K+xF+~EvQB#25Hl>vtn-Vr-voyKH0es+BP>XnEuZCx7Ni@ z>3~l@;KNxM-vO!kpj>=Vv>ja0L$T*p*L2TI7#W~H)*(q_l+6yM+8H^sU&uCveUF>b?)(jI3$nY?|g2YF<+%Vlv!641(Zxej1P<2R>nZhB48fpN|N~hf( zwG*5v6qkIZb&Q5vJNEz98f@9W5b%^wz?AD1vR0vUV?3px3_UM!oC}Cm4C7;Cpm0$f znm^8qvu?%W6ESWlqzz`}&a691bTd)GIIRj;Z6<}E^>OgDSDx52s_b;3m>rO*l zc9+cx4<>&wnX$~Dlgb<9@&?I$Kz1K^=03XQJ}SAJWOvizdC}bt@mm#sVi4Uvh${xd zRr(w!;SDpJVv7bR2lHFiYhAN9vDG^SoO}!I`uY45-e4pWpJ16&H6{+}TAULBG!P0s z2-PF(;Gklj2n(Zwv0#+tkanZ!BW$dO=E_jf?I^>j3Je5NBxeuby^YYeA5SB!++J$qWV?U?p0TOH}inN#;p z%^g{?dNWtW9YYX*sbA>)8~Yb_^-a9~om|2?BvM0ot~6qdRweX*`96RLu+mL~DHL;P z#EH-fC0Yr;S)8?d$Tth`dYzs#F#05!fYxJx7etEcwkEfq=uTP`r`jEziz>60%*5R8eTADgvn=@BAD3u`+T zadXw!Nz&`4)SNVD3XGpMyfdZRk|Y5oQC~NNbSbC>7OWOn*BV{F!LP^0fHlsnGm%Il zX5C2~gcWi^H>tlyOuz_UBS`oONd9x-CR$^0U~G(C+w)DzIX206uCM>CuoW>bZ8@eG zvGFEtY@iX9W!!J5QL>&YT%+`%K4sDHN11j^GsWttXrX}Ahg`T>l20WqO!;Hax?WVE zcC?jqHls;fk|ge(N`kK=X<)W7)mrLt|Ga=}`)0UC zbP15Dlnvx|$Hye})+wN!Cl{EV@56%1d~0b)6*0SD9Q-Mla43(101U}>e1^xVIOR?{ zzj>UJF5yT){i39+fPT=!)_hLMVot~Gj*-lsk#!>ovUaQhhkL`Q1z>cHNhkDt@5dyw z?eV_PVD@opdxGLkkeRa$;vj<5g9AQw?{FNd~X(>~uk;TjlDy|5uY1;m9-xpDs%`=9 z&=@;`>TOVlkmS8Q3g9F14tW9g9HbQ8D85T#vzK_Ep3$w})B1@AutVK*Ge~{WX)q#_ z3tLG6j4@{=?E=Rm$YDOr=rRRw`COQTb%wik%)#i~?I$=S4>dZh++eE%)Fi}oivAWm zg>4Rv;i;M#yTDP5+&F8d<_H^uJg(5_JPug+w*Vlcv!YFn3!z8*GKYWK^l{UC>rYO7 za!RT^C|4d_{fyP3UX>=54ore#91gP)hF3{Bo3nwuh#fUIrB>Thl7 z9Rx>aPgg*(0-r!IfG7yknRrxT`~>~Z$^@UTL4^mU?`+S_wwV>Xpo!2x#)nY z)!*+8a;z7LD>&7`0Y0QTdGaEM^Dr3ps6LzLF+jwyu=+xA@Ybs~H|FdUUO1sb&9Gyz z;0vsGn2Sg8NmdL9zYXo>*!;WW!3gp`kDx+1?yFCDdbOo;AHY-Z&Q%yh6$aJQiA2Aj zW#P;~b%Pgf26!02AF;~ltNm?J<=7jEkMOt@$RzX}&NYG~u{bZlAwzw_oyVCQt@<%$ z7`8iufFv<-dF|{1`TtIMC%8CtB44MFj{U2-1(?<{^Xoy)cEzrG-y^}H`bc<)>xAi7 zN;G-(JlbP74#sSMBH;#b!cC;K#wj#wrF-O89qrwOWdzk7<8yXKsn3^)x3xs-(`?zU;6k~i` z7#kP3J5W?H<&HVfkrf&r#lWLgn7fMbw4o9dhx!GpGMtg}IWN<25VQ-1>qFlS0#Zb{ zw;|0V+r;}#A?IH*s+$@22+AEm71A)cu!&}=U7|K-sU}eyv($k2?c#HLyNKg-`?A?C zI(A9s-LiT2Gjr{dxpw~0qE0l|O6C)?`NRsLH?ZX5?PXWV{mQv^$+c5P(bY0tEz;GH^NjW^(VoKXQ@ngte0xZ~9D+>A!^i+>My45&W>!oHv5H=WU*V>{ z#;`DdvoyHdHv9Bn7Gj(C;Wcq@^J0fo)h1W9Emv%LSdlsP%N<|TEOtNLD>e4XjeSyu zU#{>kS8jb+BknpT9`BJVd*#Yr@p3?_3@p3c_bbFL^$RA+)g-%`zS5Ihj%QC?K+kUS zcj)WfnfVUMby#*C{>q@+a%9CoIghRo0H!;D0)tsJZ;`02GPU&?wRefy`*Z5CW#QP9 zgW^7)w9hB+^F5`cecck(BU3#h)swY*MY~tB?~v^~z$a)gOJ5Vq4=x;C-225D$=)j4 zTSZ&jv@cs$^&t9#=!fz9@fA42x(H*4;EW}$PhZK>_77}#ZL`;AuRXdw?-utQgScQ& zpHg*`T-~&|=Sij9+%1*%$fZ3J-7C|*B92+goE}aO&t9I>%|!1-=dR7c0G@eL_S7P` z_@%0VTon-QS0w5R&|o_us?mCKx^3BBqHdWB#)X7@;2gY2C9N_*Of~eyU593>90NEC ztK2(pgki00k}I2LoN42%DNEZvu->)KUVRkG?3pkBq(R!&C~s?gViXSt7CIL?pLU8R zS0uV$ru#*@f0?$YM`j%N9BKGvZLYL$c2}kW{T73w?W|-wE8ETjm6Z8T?|Z$o&9luJ z+x+mt$l~pP`u;zB|LK%;=9+xwnpi!M_3i;m=*69jx8*Yz#p+Ah>h^4PEAVEuj|6@! zX(xdn0V3Y)Kxu%e7XWF(U`eyH{j>dZEpyz5H}2oabY;54`p&0&#LL&^^Y2KzZpgcC zWF6({FnD7tu9DB+epeg}%WvNVZgEBc8-n1Jb$Zg_M@F&w_&>HjG5*%_rA55(9qDXP zJ{y!y4#_8nr0OBb6Ouh4k-a5GZp-Y1~-V30oDR|Mf~ zM=toRp+q^>Vh zX3=s(qTZFMcg1|<-LNA4ifVD4+phm|J9Tci>C1g2zz}4w2BdYMwff~>1KjjT5^Wi| z@OYi2g0FNS3>yNYWAqF)qI+!6TA^U66Pa(WVFVw8>0|N_s6jJk#xkN~ERU^PuLN$T zfbKQ&*7>$bGf{XgW8GIB_#uq>x^O84spm^6=pA;M-h95^l(W8Zb0Qjk^(Oo98%u2<#RUr%fPxvM~1m@ zbJY{fIJK0d3`qlbSt#&ofZwc0O9ObFjY(q$*&Q1K<0_;b=qmmu>KOMUleS$Ly+6oL zoYZr>3VY0$b91C)O2FGynlcrR5L1>k0WD>SmPhOSNiZ@y*Se9^$1NJX78S3ST0gOq z5O%HA5|E*i3&Os93OvQ=G$I#M5_OK$pF&3|#GkLlR^MC}z;=&|R2#467sxh16pxWD1SO!*EF?VXmt~N-C(hTnxxb z80+eypfD@cM39RqCN>5JLx=?@!^iMdF@aVegllN3eN&E=bB@JVXL#=_riAH)7a=*N zxbxO@z;|iTf2F6V18F8bWLg8ld0q2hpHmq`*a^?W{5yl;X zbNmPi z`O!tASa(LG$|dToOq~^}v)Q$;VqHfrqVJtD)hSY)Yv1YlqYKBy+EY)aaQ(|Nbs0{@ z;9AWy>((XfR>`_ewr-nlThX}^K038I$^y zY_+njRO3`FAQqKn`(SKYBM|joXtV9T~ z)V8A(vdFNIphnRJ16T$u{wW?TRo^7s8bH2O)m>Ntsn_&LkaF-UpXQ#xEApoCzXJd> zPm)=pPbB)D6V7S;%MzAp{L2#7Y5dC)=4t%P64jzMW(kj|jag!+sEsQ|2MG+j3U*k? z5O7-otkjczNReHGwteIv(47ILkOOVv;P|D1ni&W!+HG6$fIcnp<75o2_!L+C&eTf zntKvnnzIR(=DviF=Kh4A=7B_j=3Ih<+?xufLx~VW#$Zzw>2M;%|GNM3szX!rttxo5V@!HRRq?{0P51AX9^dlJ>I*iiwV0qtF)WX&SdYn9Xr>8+vOdui zJCjjj<4JuumQj+rE^B(zFJy|IIAgPYf<6qnZ&c95VcVY@;At?IH;qn+d13%@82ac0 zeB44Z0(C$Mk5nmnrx{QQb{c^~_yGDOKR`cW1*ifCkduM{gHi}!NU8u>A%*)%1Wgy&A~J~D5@tTKfu37P&#MMPBYE7-$XC%- zR`(Ug7|9F6-R`PS4;Hn`_n2f$1sz0_%=-t5$CMa%n^}Khqyna|E#M=ZgHM+9b&td# zeVx-1fjUUQX~{R~mHd;QA-`MIUj?PniY=8awW};ys7P83vsL4lpQ4saQ#eQn7mb z=cPl5ZbQ%8b{yqsDo2Zi%27{h;(?xQ7|U8FrE5(inyO?uZ9;1j@X#10s%5i7f-Yx+ zjg6WpD2j};{>H|%D#`IGo73g==wLD>+b^93OvM78Xis8U)KxrziSpZCaa^)Js%HDd zVJV62&^S)&GOx>5bekp9**+{!BUehHtquZXOYIFTM zPAWs)y_jqon@tNzCGLmaE2jpDSs}}SQXtO`EYoWTbHe~hHaCjpv80;OG_tf9eV$%# zeoK?F)+`Pum9#K1Ff3p_*$k9O8M2V(aTQuZCNQv|=#65saX=6+%Zk*vuNf@I zWkFX}rMYRD{Cqn}POHuG6(K#Eg5H`eW?=Objibw!sF_$vK5qnV4rdgevb%N_W7Xu; zl3l7D0jo5H9#qy?l?`U)E~|3a5()*k%_SeKf92+tKV)xauXjBNues6n;W;zB*$Qtq z!kd>ofy!-*>!QZG9So>nT_4O$;+G<5x zmk?6}wE!M$-tp;sAHVmftDjt5@;Zfu>W8Gw<9zESuQO_4{D)+w$NB00&7tabH@TS& zX4O`!YO7JTb*TncPM2Q*4+%FO6Hq8yTC;NgCr_Rfh$+R~#FWrcAg~0ZL#|xLO1gpc zCx7&~mO_f2JXyJ>RhLt;y8I_4z`gQ(9p#306;$YELr2W}_m*(`5zqI*o$XQI_s!9E zCh!9n2KS{?K1aTn5fW-ZL;+cdc*0?F*_tMTzgM%WHBYX<=UtGVz3w_%>!FcbN-?&G>y{qt*| zUAsGA)*rFzkC@S;R`lq-7Lz+}amNiO;XTmR#eU)nDEt2bNO|^CtpuGMDhZ;lGA}9^ zqSbEZOFs8ELzLi!gk2ii!AWH`@dkP@iEC}PtGl!7j>q=P$`FLaHmAvBGVx6|J1$^_ z>cB6AfVh{69XA6`wcyV3UU>xyTze%>g*coX8s_QF97w5fj^I@#HNhtpmkt~&s{_x| zy`IcG0ss`Cy5`oVk2cMn_||W1=_D!EWmb1v)!oJyhc?dozyg9vsDaw;TQ~vf@lcJ4+_Z?56Y+zr6IaV znv#Gn+gDa={>u@GCD0ZCfFiAbWoCHJZ`3v4ZMfHM>^}Y3mY7+eL$;yrP4@7E&p79D?4KvK!@jhafKEncHNi@%B5$ zp>rf1OqliOt@`t3^j$0Zu5pn!xl0yz$#Bw2S>!{v4`CW|Z~%|nTHfR8MRD@#F>`4c zHA{@+ibwLe4Vn9kK{wjyX7TpK*=*&pu5*1IXHItayxFifp7q9d@6CD|_hz}*``eCt*!S<*>T z<(xR>D{$cemo0F^na-pHEqk!6IG@??C@?_l0RX11=GWkfg6+iL0leO^7_Rz#?+3kq zKJjVq$GvkMX6-(!cHctnvH99#_e8U{)v9eZ!);c$&7cXKU%oRHXAdli7(1%J@vzPD zydtD!p0`6har>DR!NWXHjv=|4!eImxBa8`o_}2swbBsF)c!Pk`1neS!czSxG!z6B_ zfZWb&UjdlPze}D9AKVtW!A6e{4sUtDF+Rcp2l&0d{YxkhLS7#U1&UyZ@eLDZ6`-H- zWobzsLWw|2^3d<`5f-lwbE_c>A>1N2U_2k+Xa{(ZyvXyIT+7;PlH@*)T%7ZmLMpjhE)nQc?zP;Y$FU5x z!xyZ>7tFv#D{yg&T@1c-W79&gVLsR}7cqlPRv)2H6=o$j5Y?~)g>8=-<~(|-V$ Cc#`)3 literal 0 HcmV?d00001 diff --git a/examples/security-pipeline/evidence/enforce/codeant-qg.xml b/examples/security-pipeline/evidence/enforce/codeant-qg.xml new file mode 100644 index 0000000..8e6d2a9 --- /dev/null +++ b/examples/security-pipeline/evidence/enforce/codeant-qg.xml @@ -0,0 +1,6 @@ + +Quality Gate: FAILED +Total findings: 48 +By severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11 +By engine: sast=9, sca=38, secrets=1 +Ratings: sast_rating_full_code=C, sca_rating_full_code=D \ No newline at end of file diff --git a/examples/security-pipeline/evidence/enforce/codeant.sarif b/examples/security-pipeline/evidence/enforce/codeant.sarif new file mode 100644 index 0000000..9291e84 --- /dev/null +++ b/examples/security-pipeline/evidence/enforce/codeant.sarif @@ -0,0 +1,1023 @@ +{ + "version": "2.1.0", + "$schema": "https://json.schemastore.org/sarif-2.1.0.json", + "runs": [ + { + "tool": { + "driver": { + "name": "CodeAnt AI", + "rules": [ + { + "id": "CVE-2024-21503", + "name": "CVE-2024-21503" + }, + { + "id": "CVE-2024-35255", + "name": "CVE-2024-35255" + }, + { + "id": "CVE-2024-47874", + "name": "CVE-2024-47874" + }, + { + "id": "CVE-2025-0628", + "name": "CVE-2025-0628" + }, + { + "id": "CVE-2025-54121", + "name": "CVE-2025-54121" + }, + { + "id": "CVE-2025-6984", + "name": "CVE-2025-6984" + }, + { + "id": "CVE-2026-114134", + "name": "CVE-2026-114134" + }, + { + "id": "CVE-2026-12770", + "name": "CVE-2026-12770" + }, + { + "id": "CVE-2026-12771", + "name": "CVE-2026-12771" + }, + { + "id": "CVE-2026-12772", + "name": "CVE-2026-12772" + }, + { + "id": "CVE-2026-12773", + "name": "CVE-2026-12773" + }, + { + "id": "CVE-2026-12795", + "name": "CVE-2026-12795" + }, + { + "id": "CVE-2026-12796", + "name": "CVE-2026-12796" + }, + { + "id": "CVE-2026-12797", + "name": "CVE-2026-12797" + }, + { + "id": "CVE-2026-12798", + "name": "CVE-2026-12798" + }, + { + "id": "CVE-2026-12799", + "name": "CVE-2026-12799" + }, + { + "id": "CVE-2026-26013", + "name": "CVE-2026-26013" + }, + { + "id": "CVE-2026-34070", + "name": "CVE-2026-34070" + }, + { + "id": "CVE-2026-35029", + "name": "CVE-2026-35029" + }, + { + "id": "CVE-2026-35030", + "name": "CVE-2026-35030" + }, + { + "id": "CVE-2026-37004", + "name": "CVE-2026-37004" + }, + { + "id": "CVE-2026-41481", + "name": "CVE-2026-41481" + }, + { + "id": "CVE-2026-47101", + "name": "CVE-2026-47101" + }, + { + "id": "CVE-2026-47102", + "name": "CVE-2026-47102" + }, + { + "id": "CVE-2026-48710", + "name": "CVE-2026-48710" + }, + { + "id": "CVE-2026-48817", + "name": "CVE-2026-48817" + }, + { + "id": "CVE-2026-48818", + "name": "CVE-2026-48818" + }, + { + "id": "CVE-2026-49468", + "name": "CVE-2026-49468" + }, + { + "id": "CVE-2026-54282", + "name": "CVE-2026-54282" + }, + { + "id": "CVE-2026-54283", + "name": "CVE-2026-54283" + }, + { + "id": "CVE-2026-59819", + "name": "CVE-2026-59819" + }, + { + "id": "CVE-2026-59820", + "name": "CVE-2026-59820" + }, + { + "id": "CVE-2026-59821", + "name": "CVE-2026-59821" + }, + { + "id": "CVE-2026-59822", + "name": "CVE-2026-59822" + }, + { + "id": "CVE-2026-59823", + "name": "CVE-2026-59823" + }, + { + "id": "CVE-2026-84377", + "name": "CVE-2026-84377" + }, + { + "id": "debug-endpoints-enabled", + "name": "debug-endpoints-enabled" + }, + { + "id": "eval-detected", + "name": "eval-detected" + }, + { + "id": "formatted-sql-query", + "name": "formatted-sql-query" + }, + { + "id": "generic-password", + "name": "generic-password" + }, + { + "id": "path-traversal-open", + "name": "path-traversal-open" + }, + { + "id": "python-subprocess-shell-true-format", + "name": "python-subprocess-shell-true-format" + }, + { + "id": "python-weak-hash-md5", + "name": "python-weak-hash-md5" + }, + { + "id": "sca", + "name": "sca" + }, + { + "id": "sql-injection-db-cursor-execute", + "name": "sql-injection-db-cursor-execute" + }, + { + "id": "user-eval", + "name": "user-eval" + } + ] + } + }, + "results": [ + { + "ruleId": "formatted-sql-query", + "level": "error", + "message": { + "text": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/feature/main2.py" + }, + "region": { + "startLine": 30 + } + } + } + ] + }, + { + "ruleId": "sql-injection-db-cursor-execute", + "level": "error", + "message": { + "text": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + }, + "region": { + "startLine": 24 + } + } + } + ] + }, + { + "ruleId": "formatted-sql-query", + "level": "error", + "message": { + "text": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + }, + "region": { + "startLine": 28 + } + } + } + ] + }, + { + "ruleId": "python-subprocess-shell-true-format", + "level": "error", + "message": { + "text": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + }, + "region": { + "startLine": 35 + } + } + } + ] + }, + { + "ruleId": "python-weak-hash-md5", + "level": "error", + "message": { + "text": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + }, + "region": { + "startLine": 41 + } + } + } + ] + }, + { + "ruleId": "path-traversal-open", + "level": "error", + "message": { + "text": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + }, + "region": { + "startLine": 49 + } + } + } + ] + }, + { + "ruleId": "user-eval", + "level": "error", + "message": { + "text": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + }, + "region": { + "startLine": 55 + } + } + } + ] + }, + { + "ruleId": "eval-detected", + "level": "error", + "message": { + "text": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + }, + "region": { + "startLine": 57 + } + } + } + ] + }, + { + "ruleId": "debug-endpoints-enabled", + "level": "warning", + "message": { + "text": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + }, + "region": { + "startLine": 62 + } + } + } + ] + }, + { + "ruleId": "CVE-2024-35255", + "level": "warning", + "message": { + "text": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "azure-identity" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-6984", + "level": "error", + "message": { + "text": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-community" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-84377", + "level": "warning", + "message": { + "text": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59823", + "level": "warning", + "message": { + "text": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12799", + "level": "note", + "message": { + "text": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12798", + "level": "note", + "message": { + "text": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12797", + "level": "note", + "message": { + "text": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12796", + "level": "note", + "message": { + "text": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12795", + "level": "warning", + "message": { + "text": "LiteLLM: SSO Debug Flow Has Improper Authentication" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12770", + "level": "note", + "message": { + "text": "LiteLLM: Admin Key Handler Has Improper Authorization" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12773", + "level": "warning", + "message": { + "text": "LiteLLM: MCP Proxy Has Improper Authentication" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12771", + "level": "note", + "message": { + "text": "LiteLLM: M2M JWT Handler Has Improper Authorization" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12772", + "level": "note", + "message": { + "text": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-37004", + "level": "error", + "message": { + "text": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59821", + "level": "note", + "message": { + "text": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59822", + "level": "error", + "message": { + "text": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59819", + "level": "note", + "message": { + "text": "LiteLLM: Local file read via request-supplied OIDC file references" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59820", + "level": "warning", + "message": { + "text": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-47102", + "level": "error", + "message": { + "text": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-47101", + "level": "error", + "message": { + "text": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-49468", + "level": "error", + "message": { + "text": "LiteLLM: Authentication Bypass via Host Header Injection" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-35030", + "level": "error", + "message": { + "text": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-35029", + "level": "error", + "message": { + "text": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-0628", + "level": "error", + "message": { + "text": "LiteLLM Has an Improper Authorization Vulnerability" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "sca", + "level": "error", + "message": { + "text": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "sca", + "level": "error", + "message": { + "text": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-54283", + "level": "error", + "message": { + "text": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-54282", + "level": "note", + "message": { + "text": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48818", + "level": "error", + "message": { + "text": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48817", + "level": "warning", + "message": { + "text": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48710", + "level": "warning", + "message": { + "text": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-54121", + "level": "warning", + "message": { + "text": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2024-47874", + "level": "error", + "message": { + "text": "Starlette Denial of service (DoS) via multipart/form-data" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-114134", + "level": "error", + "message": { + "text": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "black" + } + } + } + ] + }, + { + "ruleId": "CVE-2024-21503", + "level": "warning", + "message": { + "text": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "black" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-41481", + "level": "warning", + "message": { + "text": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-text-splitters" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-34070", + "level": "error", + "message": { + "text": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-core" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-26013", + "level": "note", + "message": { + "text": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-core" + } + } + } + ] + }, + { + "ruleId": "generic-password", + "level": "error", + "message": { + "text": "generic-password" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/IaC.yaml" + }, + "region": { + "startLine": 47 + } + } + } + ] + } + ], + "invocations": [ + { + "executionSuccessful": true + } + ], + "properties": { + "total_findings": 48, + "findings_by_severity": { + "HIGH": 19, + "CRITICAL": 6, + "MEDIUM": 12, + "LOW": 11 + }, + "findings_by_engine": { + "sast": 9, + "sca": 38, + "secrets": 1 + }, + "ratings": { + "sast_rating_full_code": "C", + "sca_rating_full_code": "D" + }, + "quality_gate_status": "FAILED" + } + } + ] +} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/enforce/results.json b/examples/security-pipeline/evidence/enforce/results.json new file mode 100644 index 0000000..2107cc2 --- /dev/null +++ b/examples/security-pipeline/evidence/enforce/results.json @@ -0,0 +1,434 @@ +{ + "status": "COMPLETED", + "quality_gate_status": "FAILED", + "metrics": { + "sast_rating_full_code": "C", + "sca_rating_full_code": "D" + }, + "failed_conditions": [ + { + "metric": "sast_rating_full_code", + "context": "CodeAnt - SAST", + "actual": "C", + "quality_gate_enabled": true, + "quality_gate_status": "FAILED", + "why": "sast_rating_full_code is C (same or worse than threshold C)" + }, + { + "metric": "sca_rating_full_code", + "context": "CodeAnt - SCA", + "actual": "D", + "quality_gate_enabled": true, + "quality_gate_status": "FAILED", + "why": "sca_rating_full_code is D (same or worse than threshold C)" + } + ], + "evaluated_conditions": [ + { + "metric": "sast_rating_full_code", + "context": "CodeAnt - SAST", + "actual": "C", + "quality_gate_enabled": true, + "quality_gate_status": "FAILED", + "why": "sast_rating_full_code is C (same or worse than threshold C)" + }, + { + "metric": "sca_rating_full_code", + "context": "CodeAnt - SCA", + "actual": "D", + "quality_gate_enabled": true, + "quality_gate_status": "FAILED", + "why": "sca_rating_full_code is D (same or worse than threshold C)" + } + ], + "findings": [ + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/feature/main2.py", + "line": 30, + "rule": "formatted-sql-query", + "message": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "line": 24, + "rule": "sql-injection-db-cursor-execute", + "message": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "line": 28, + "rule": "formatted-sql-query", + "message": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "line": 35, + "rule": "python-subprocess-shell-true-format", + "message": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "line": 41, + "rule": "python-weak-hash-md5", + "message": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "line": 49, + "rule": "path-traversal-open", + "message": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "line": 55, + "rule": "user-eval", + "message": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "line": 57, + "rule": "eval-detected", + "message": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." + }, + { + "engine": "sast", + "severity": "MEDIUM", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "line": 62, + "rule": "debug-endpoints-enabled", + "message": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "azure-identity", + "line": null, + "rule": "CVE-2024-35255", + "message": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "langchain-community", + "line": null, + "rule": "CVE-2025-6984", + "message": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-84377", + "message": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59823", + "message": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12799", + "message": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12798", + "message": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12797", + "message": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12796", + "message": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12795", + "message": "LiteLLM: SSO Debug Flow Has Improper Authentication" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12770", + "message": "LiteLLM: Admin Key Handler Has Improper Authorization" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12773", + "message": "LiteLLM: MCP Proxy Has Improper Authentication" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12771", + "message": "LiteLLM: M2M JWT Handler Has Improper Authorization" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12772", + "message": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-37004", + "message": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59821", + "message": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59822", + "message": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59819", + "message": "LiteLLM: Local file read via request-supplied OIDC file references" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59820", + "message": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-47102", + "message": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-47101", + "message": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-49468", + "message": "LiteLLM: Authentication Bypass via Host Header Injection" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-35030", + "message": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-35029", + "message": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2025-0628", + "message": "LiteLLM Has an Improper Authorization Vulnerability" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "", + "message": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "", + "message": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2026-54283", + "message": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "starlette", + "line": null, + "rule": "CVE-2026-54282", + "message": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48818", + "message": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48817", + "message": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48710", + "message": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2025-54121", + "message": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2024-47874", + "message": "Starlette Denial of service (DoS) via multipart/form-data" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "black", + "line": null, + "rule": "CVE-2026-114134", + "message": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "black", + "line": null, + "rule": "CVE-2024-21503", + "message": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "langchain-text-splitters", + "line": null, + "rule": "CVE-2026-41481", + "message": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "langchain-core", + "line": null, + "rule": "CVE-2026-34070", + "message": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "langchain-core", + "line": null, + "rule": "CVE-2026-26013", + "message": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" + }, + { + "engine": "secrets", + "severity": "HIGH", + "file": "/mnt/lambda/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/IaC.yaml", + "line": 47, + "rule": "generic-password", + "message": "generic-password" + } + ], + "reports": { + "sarif": "{\n \"version\": \"2.1.0\",\n \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n \"runs\": [\n {\n \"tool\": {\n \"driver\": {\n \"name\": \"CodeAnt AI\",\n \"rules\": [\n {\n \"id\": \"CVE-2024-21503\",\n \"name\": \"CVE-2024-21503\"\n },\n {\n \"id\": \"CVE-2024-35255\",\n \"name\": \"CVE-2024-35255\"\n },\n {\n \"id\": \"CVE-2024-47874\",\n \"name\": \"CVE-2024-47874\"\n },\n {\n \"id\": \"CVE-2025-0628\",\n \"name\": \"CVE-2025-0628\"\n },\n {\n \"id\": \"CVE-2025-54121\",\n \"name\": \"CVE-2025-54121\"\n },\n {\n \"id\": \"CVE-2025-6984\",\n \"name\": \"CVE-2025-6984\"\n },\n {\n \"id\": \"CVE-2026-114134\",\n \"name\": \"CVE-2026-114134\"\n },\n {\n \"id\": \"CVE-2026-12770\",\n \"name\": \"CVE-2026-12770\"\n },\n {\n \"id\": \"CVE-2026-12771\",\n \"name\": \"CVE-2026-12771\"\n },\n {\n \"id\": \"CVE-2026-12772\",\n \"name\": \"CVE-2026-12772\"\n },\n {\n \"id\": \"CVE-2026-12773\",\n \"name\": \"CVE-2026-12773\"\n },\n {\n \"id\": \"CVE-2026-12795\",\n \"name\": \"CVE-2026-12795\"\n },\n {\n \"id\": \"CVE-2026-12796\",\n \"name\": \"CVE-2026-12796\"\n },\n {\n \"id\": \"CVE-2026-12797\",\n \"name\": \"CVE-2026-12797\"\n },\n {\n \"id\": \"CVE-2026-12798\",\n \"name\": \"CVE-2026-12798\"\n },\n {\n \"id\": \"CVE-2026-12799\",\n \"name\": \"CVE-2026-12799\"\n },\n {\n \"id\": \"CVE-2026-26013\",\n \"name\": \"CVE-2026-26013\"\n },\n {\n \"id\": \"CVE-2026-34070\",\n \"name\": \"CVE-2026-34070\"\n },\n {\n \"id\": \"CVE-2026-35029\",\n \"name\": \"CVE-2026-35029\"\n },\n {\n \"id\": \"CVE-2026-35030\",\n \"name\": \"CVE-2026-35030\"\n },\n {\n \"id\": \"CVE-2026-37004\",\n \"name\": \"CVE-2026-37004\"\n },\n {\n \"id\": \"CVE-2026-41481\",\n \"name\": \"CVE-2026-41481\"\n },\n {\n \"id\": \"CVE-2026-47101\",\n \"name\": \"CVE-2026-47101\"\n },\n {\n \"id\": \"CVE-2026-47102\",\n \"name\": \"CVE-2026-47102\"\n },\n {\n \"id\": \"CVE-2026-48710\",\n \"name\": \"CVE-2026-48710\"\n },\n {\n \"id\": \"CVE-2026-48817\",\n \"name\": \"CVE-2026-48817\"\n },\n {\n \"id\": \"CVE-2026-48818\",\n \"name\": \"CVE-2026-48818\"\n },\n {\n \"id\": \"CVE-2026-49468\",\n \"name\": \"CVE-2026-49468\"\n },\n {\n \"id\": \"CVE-2026-54282\",\n \"name\": \"CVE-2026-54282\"\n },\n {\n \"id\": \"CVE-2026-54283\",\n \"name\": \"CVE-2026-54283\"\n },\n {\n \"id\": \"CVE-2026-59819\",\n \"name\": \"CVE-2026-59819\"\n },\n {\n \"id\": \"CVE-2026-59820\",\n \"name\": \"CVE-2026-59820\"\n },\n {\n \"id\": \"CVE-2026-59821\",\n \"name\": \"CVE-2026-59821\"\n },\n {\n \"id\": \"CVE-2026-59822\",\n \"name\": \"CVE-2026-59822\"\n },\n {\n \"id\": \"CVE-2026-59823\",\n \"name\": \"CVE-2026-59823\"\n },\n {\n \"id\": \"CVE-2026-84377\",\n \"name\": \"CVE-2026-84377\"\n },\n {\n \"id\": \"debug-endpoints-enabled\",\n \"name\": \"debug-endpoints-enabled\"\n },\n {\n \"id\": \"eval-detected\",\n \"name\": \"eval-detected\"\n },\n {\n \"id\": \"formatted-sql-query\",\n \"name\": \"formatted-sql-query\"\n },\n {\n \"id\": \"generic-password\",\n \"name\": \"generic-password\"\n },\n {\n \"id\": \"path-traversal-open\",\n \"name\": \"path-traversal-open\"\n },\n {\n \"id\": \"python-subprocess-shell-true-format\",\n \"name\": \"python-subprocess-shell-true-format\"\n },\n {\n \"id\": \"python-weak-hash-md5\",\n \"name\": \"python-weak-hash-md5\"\n },\n {\n \"id\": \"sca\",\n \"name\": \"sca\"\n },\n {\n \"id\": \"sql-injection-db-cursor-execute\",\n \"name\": \"sql-injection-db-cursor-execute\"\n },\n {\n \"id\": \"user-eval\",\n \"name\": \"user-eval\"\n }\n ]\n }\n },\n \"results\": [\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/feature/main2.py\"\n },\n \"region\": {\n \"startLine\": 30\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sql-injection-db-cursor-execute\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 24\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 28\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-subprocess-shell-true-format\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 35\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-weak-hash-md5\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 41\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"path-traversal-open\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 49\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"user-eval\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 55\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"eval-detected\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 57\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"debug-endpoints-enabled\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 62\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-35255\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"azure-identity\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-6984\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Langchain Community Vulnerable to XML External Entity (XXE) Attacks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-community\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-84377\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59823\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12799\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12798\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12797\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12796\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12795\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: SSO Debug Flow Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12770\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Admin Key Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12773\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Proxy Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12771\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: M2M JWT Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12772\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-37004\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59821\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59822\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59819\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Local file read via request-supplied OIDC file references\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59820\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Arbitrary file write via path traversal in Skills archive extraction\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47102\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows a user to modify their own user_role via the /user/update endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47101\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-49468\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication Bypass via Host Header Injection\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35030\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication bypass via OIDC userinfo cache key collision\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35029\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-0628\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM Has an Improper Authorization Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Password hash exposure and pass-the-hash authentication bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54283\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54282\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48818\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48817\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48710\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-54121\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has possible denial-of-service vector when parsing large files in multipart forms\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-47874\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette Denial of service (DoS) via multipart/form-data\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-114134\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Black: GitHub Action installs unvalidated required-version from pyproject.toml\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-21503\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Black vulnerable to Regular Expression Denial of Service (ReDoS)\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-41481\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-text-splitters\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-34070\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-26013\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"generic-password\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"generic-password\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/IaC.yaml\"\n },\n \"region\": {\n \"startLine\": 47\n }\n }\n }\n ]\n }\n ],\n \"invocations\": [\n {\n \"executionSuccessful\": true\n }\n ],\n \"properties\": {\n \"total_findings\": 48,\n \"findings_by_severity\": {\n \"HIGH\": 19,\n \"CRITICAL\": 6,\n \"MEDIUM\": 12,\n \"LOW\": 11\n },\n \"findings_by_engine\": {\n \"sast\": 9,\n \"sca\": 38,\n \"secrets\": 1\n },\n \"ratings\": {\n \"sast_rating_full_code\": \"C\",\n \"sca_rating_full_code\": \"D\"\n },\n \"quality_gate_status\": \"FAILED\"\n }\n }\n ]\n}", + "junit": "\nQuality Gate: FAILED\nTotal findings: 48\nBy severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11\nBy engine: sast=9, sca=38, secrets=1\nRatings: sast_rating_full_code=C, sca_rating_full_code=D" + } +} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/enforce/runner-output.txt b/examples/security-pipeline/evidence/enforce/runner-output.txt new file mode 100644 index 0000000..433af5a --- /dev/null +++ b/examples/security-pipeline/evidence/enforce/runner-output.txt @@ -0,0 +1,9 @@ +Run: https://github.com/codeanttesting/codeant-demo/actions/runs/42308406392 +Selected output (setup and credential lines omitted): + +2026-11-06T22:57:55.1339842Z 📊 Findings: 48 +2026-11-06T22:57:55.1340079Z 🎯 Quality Gate: FAILED +2026-11-06T22:57:55.1340536Z CodeAnt - SAST sast_rating_full_code C FAILED sast_rating_full_code is C (same or worse than threshold C) +2026-11-06T22:57:55.1341148Z CodeAnt - SCA sca_rating_full_code D FAILED sca_rating_full_code is D (same or worse than threshold C) +2026-11-06T22:57:56.3709030Z Security gate failed +2026-11-06T22:57:56.3741179Z ##[error]Process completed with exit code 1. diff --git a/examples/security-pipeline/evidence/warn/codeant-qg.xml b/examples/security-pipeline/evidence/warn/codeant-qg.xml new file mode 100644 index 0000000..8e6d2a9 --- /dev/null +++ b/examples/security-pipeline/evidence/warn/codeant-qg.xml @@ -0,0 +1,6 @@ + +Quality Gate: FAILED +Total findings: 48 +By severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11 +By engine: sast=9, sca=38, secrets=1 +Ratings: sast_rating_full_code=C, sca_rating_full_code=D \ No newline at end of file diff --git a/examples/security-pipeline/evidence/warn/codeant.sarif b/examples/security-pipeline/evidence/warn/codeant.sarif new file mode 100644 index 0000000..4cf75f5 --- /dev/null +++ b/examples/security-pipeline/evidence/warn/codeant.sarif @@ -0,0 +1,1023 @@ +{ + "version": "2.1.0", + "$schema": "https://json.schemastore.org/sarif-2.1.0.json", + "runs": [ + { + "tool": { + "driver": { + "name": "CodeAnt AI", + "rules": [ + { + "id": "CVE-2024-21503", + "name": "CVE-2024-21503" + }, + { + "id": "CVE-2024-35255", + "name": "CVE-2024-35255" + }, + { + "id": "CVE-2024-47874", + "name": "CVE-2024-47874" + }, + { + "id": "CVE-2025-0628", + "name": "CVE-2025-0628" + }, + { + "id": "CVE-2025-54121", + "name": "CVE-2025-54121" + }, + { + "id": "CVE-2025-6984", + "name": "CVE-2025-6984" + }, + { + "id": "CVE-2026-114134", + "name": "CVE-2026-114134" + }, + { + "id": "CVE-2026-12770", + "name": "CVE-2026-12770" + }, + { + "id": "CVE-2026-12771", + "name": "CVE-2026-12771" + }, + { + "id": "CVE-2026-12772", + "name": "CVE-2026-12772" + }, + { + "id": "CVE-2026-12773", + "name": "CVE-2026-12773" + }, + { + "id": "CVE-2026-12795", + "name": "CVE-2026-12795" + }, + { + "id": "CVE-2026-12796", + "name": "CVE-2026-12796" + }, + { + "id": "CVE-2026-12797", + "name": "CVE-2026-12797" + }, + { + "id": "CVE-2026-12798", + "name": "CVE-2026-12798" + }, + { + "id": "CVE-2026-12799", + "name": "CVE-2026-12799" + }, + { + "id": "CVE-2026-26013", + "name": "CVE-2026-26013" + }, + { + "id": "CVE-2026-34070", + "name": "CVE-2026-34070" + }, + { + "id": "CVE-2026-35029", + "name": "CVE-2026-35029" + }, + { + "id": "CVE-2026-35030", + "name": "CVE-2026-35030" + }, + { + "id": "CVE-2026-37004", + "name": "CVE-2026-37004" + }, + { + "id": "CVE-2026-41481", + "name": "CVE-2026-41481" + }, + { + "id": "CVE-2026-47101", + "name": "CVE-2026-47101" + }, + { + "id": "CVE-2026-47102", + "name": "CVE-2026-47102" + }, + { + "id": "CVE-2026-48710", + "name": "CVE-2026-48710" + }, + { + "id": "CVE-2026-48817", + "name": "CVE-2026-48817" + }, + { + "id": "CVE-2026-48818", + "name": "CVE-2026-48818" + }, + { + "id": "CVE-2026-49468", + "name": "CVE-2026-49468" + }, + { + "id": "CVE-2026-54282", + "name": "CVE-2026-54282" + }, + { + "id": "CVE-2026-54283", + "name": "CVE-2026-54283" + }, + { + "id": "CVE-2026-59819", + "name": "CVE-2026-59819" + }, + { + "id": "CVE-2026-59820", + "name": "CVE-2026-59820" + }, + { + "id": "CVE-2026-59821", + "name": "CVE-2026-59821" + }, + { + "id": "CVE-2026-59822", + "name": "CVE-2026-59822" + }, + { + "id": "CVE-2026-59823", + "name": "CVE-2026-59823" + }, + { + "id": "CVE-2026-84377", + "name": "CVE-2026-84377" + }, + { + "id": "debug-endpoints-enabled", + "name": "debug-endpoints-enabled" + }, + { + "id": "eval-detected", + "name": "eval-detected" + }, + { + "id": "formatted-sql-query", + "name": "formatted-sql-query" + }, + { + "id": "generic-password", + "name": "generic-password" + }, + { + "id": "path-traversal-open", + "name": "path-traversal-open" + }, + { + "id": "python-subprocess-shell-true-format", + "name": "python-subprocess-shell-true-format" + }, + { + "id": "python-weak-hash-md5", + "name": "python-weak-hash-md5" + }, + { + "id": "sca", + "name": "sca" + }, + { + "id": "sql-injection-db-cursor-execute", + "name": "sql-injection-db-cursor-execute" + }, + { + "id": "user-eval", + "name": "user-eval" + } + ] + } + }, + "results": [ + { + "ruleId": "sql-injection-db-cursor-execute", + "level": "error", + "message": { + "text": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + }, + "region": { + "startLine": 23 + } + } + } + ] + }, + { + "ruleId": "formatted-sql-query", + "level": "error", + "message": { + "text": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + }, + "region": { + "startLine": 27 + } + } + } + ] + }, + { + "ruleId": "python-subprocess-shell-true-format", + "level": "error", + "message": { + "text": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + }, + "region": { + "startLine": 34 + } + } + } + ] + }, + { + "ruleId": "python-weak-hash-md5", + "level": "error", + "message": { + "text": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + }, + "region": { + "startLine": 40 + } + } + } + ] + }, + { + "ruleId": "path-traversal-open", + "level": "error", + "message": { + "text": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + }, + "region": { + "startLine": 48 + } + } + } + ] + }, + { + "ruleId": "user-eval", + "level": "error", + "message": { + "text": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + }, + "region": { + "startLine": 54 + } + } + } + ] + }, + { + "ruleId": "eval-detected", + "level": "error", + "message": { + "text": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + }, + "region": { + "startLine": 56 + } + } + } + ] + }, + { + "ruleId": "debug-endpoints-enabled", + "level": "warning", + "message": { + "text": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + }, + "region": { + "startLine": 61 + } + } + } + ] + }, + { + "ruleId": "formatted-sql-query", + "level": "error", + "message": { + "text": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/feature/main2.py" + }, + "region": { + "startLine": 30 + } + } + } + ] + }, + { + "ruleId": "CVE-2024-35255", + "level": "warning", + "message": { + "text": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "azure-identity" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-6984", + "level": "error", + "message": { + "text": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-community" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-84377", + "level": "warning", + "message": { + "text": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59823", + "level": "warning", + "message": { + "text": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12799", + "level": "note", + "message": { + "text": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12798", + "level": "note", + "message": { + "text": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12797", + "level": "note", + "message": { + "text": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12796", + "level": "note", + "message": { + "text": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12795", + "level": "warning", + "message": { + "text": "LiteLLM: SSO Debug Flow Has Improper Authentication" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12770", + "level": "note", + "message": { + "text": "LiteLLM: Admin Key Handler Has Improper Authorization" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12773", + "level": "warning", + "message": { + "text": "LiteLLM: MCP Proxy Has Improper Authentication" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12771", + "level": "note", + "message": { + "text": "LiteLLM: M2M JWT Handler Has Improper Authorization" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-12772", + "level": "note", + "message": { + "text": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-37004", + "level": "error", + "message": { + "text": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59821", + "level": "note", + "message": { + "text": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59822", + "level": "error", + "message": { + "text": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59819", + "level": "note", + "message": { + "text": "LiteLLM: Local file read via request-supplied OIDC file references" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-59820", + "level": "warning", + "message": { + "text": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-47102", + "level": "error", + "message": { + "text": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-47101", + "level": "error", + "message": { + "text": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-49468", + "level": "error", + "message": { + "text": "LiteLLM: Authentication Bypass via Host Header Injection" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-35030", + "level": "error", + "message": { + "text": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-35029", + "level": "error", + "message": { + "text": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-0628", + "level": "error", + "message": { + "text": "LiteLLM Has an Improper Authorization Vulnerability" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "sca", + "level": "error", + "message": { + "text": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "sca", + "level": "error", + "message": { + "text": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "litellm" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-54283", + "level": "error", + "message": { + "text": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-54282", + "level": "note", + "message": { + "text": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48818", + "level": "error", + "message": { + "text": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48817", + "level": "warning", + "message": { + "text": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-48710", + "level": "warning", + "message": { + "text": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2025-54121", + "level": "warning", + "message": { + "text": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2024-47874", + "level": "error", + "message": { + "text": "Starlette Denial of service (DoS) via multipart/form-data" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "starlette" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-114134", + "level": "error", + "message": { + "text": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "black" + } + } + } + ] + }, + { + "ruleId": "CVE-2024-21503", + "level": "warning", + "message": { + "text": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "black" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-41481", + "level": "warning", + "message": { + "text": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-text-splitters" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-34070", + "level": "error", + "message": { + "text": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-core" + } + } + } + ] + }, + { + "ruleId": "CVE-2026-26013", + "level": "note", + "message": { + "text": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "langchain-core" + } + } + } + ] + }, + { + "ruleId": "generic-password", + "level": "error", + "message": { + "text": "generic-password" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/IaC.yaml" + }, + "region": { + "startLine": 47 + } + } + } + ] + } + ], + "invocations": [ + { + "executionSuccessful": true + } + ], + "properties": { + "total_findings": 48, + "findings_by_severity": { + "HIGH": 19, + "CRITICAL": 6, + "MEDIUM": 12, + "LOW": 11 + }, + "findings_by_engine": { + "sast": 9, + "sca": 38, + "secrets": 1 + }, + "ratings": { + "sast_rating_full_code": "C", + "sca_rating_full_code": "D" + }, + "quality_gate_status": "FAILED" + } + } + ] +} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/warn/results.json b/examples/security-pipeline/evidence/warn/results.json new file mode 100644 index 0000000..9bfb291 --- /dev/null +++ b/examples/security-pipeline/evidence/warn/results.json @@ -0,0 +1,434 @@ +{ + "status": "COMPLETED", + "quality_gate_status": "FAILED", + "metrics": { + "sast_rating_full_code": "C", + "sca_rating_full_code": "D" + }, + "failed_conditions": [ + { + "metric": "sast_rating_full_code", + "context": "CodeAnt - SAST", + "actual": "C", + "quality_gate_enabled": true, + "quality_gate_status": "FAILED", + "why": "sast_rating_full_code is C (same or worse than threshold C)" + }, + { + "metric": "sca_rating_full_code", + "context": "CodeAnt - SCA", + "actual": "D", + "quality_gate_enabled": true, + "quality_gate_status": "FAILED", + "why": "sca_rating_full_code is D (same or worse than threshold C)" + } + ], + "evaluated_conditions": [ + { + "metric": "sast_rating_full_code", + "context": "CodeAnt - SAST", + "actual": "C", + "quality_gate_enabled": true, + "quality_gate_status": "FAILED", + "why": "sast_rating_full_code is C (same or worse than threshold C)" + }, + { + "metric": "sca_rating_full_code", + "context": "CodeAnt - SCA", + "actual": "D", + "quality_gate_enabled": true, + "quality_gate_status": "FAILED", + "why": "sca_rating_full_code is D (same or worse than threshold C)" + } + ], + "findings": [ + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", + "line": 23, + "rule": "sql-injection-db-cursor-execute", + "message": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", + "line": 27, + "rule": "formatted-sql-query", + "message": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", + "line": 34, + "rule": "python-subprocess-shell-true-format", + "message": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", + "line": 40, + "rule": "python-weak-hash-md5", + "message": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", + "line": 48, + "rule": "path-traversal-open", + "message": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", + "line": 54, + "rule": "user-eval", + "message": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." + }, + { + "engine": "sast", + "severity": "CRITICAL", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", + "line": 56, + "rule": "eval-detected", + "message": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." + }, + { + "engine": "sast", + "severity": "MEDIUM", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", + "line": 61, + "rule": "debug-endpoints-enabled", + "message": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/feature/main2.py", + "line": 30, + "rule": "formatted-sql-query", + "message": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "azure-identity", + "line": null, + "rule": "CVE-2024-35255", + "message": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "langchain-community", + "line": null, + "rule": "CVE-2025-6984", + "message": "Langchain Community Vulnerable to XML External Entity (XXE) Attacks" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-84377", + "message": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59823", + "message": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12799", + "message": "BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12798", + "message": "BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12797", + "message": "BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12796", + "message": "BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12795", + "message": "LiteLLM: SSO Debug Flow Has Improper Authentication" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12770", + "message": "LiteLLM: Admin Key Handler Has Improper Authorization" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12773", + "message": "LiteLLM: MCP Proxy Has Improper Authentication" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12771", + "message": "LiteLLM: M2M JWT Handler Has Improper Authorization" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-12772", + "message": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-37004", + "message": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59821", + "message": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59822", + "message": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59819", + "message": "LiteLLM: Local file read via request-supplied OIDC file references" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "litellm", + "line": null, + "rule": "CVE-2026-59820", + "message": "LiteLLM: Arbitrary file write via path traversal in Skills archive extraction" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-47102", + "message": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-47101", + "message": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-49468", + "message": "LiteLLM: Authentication Bypass via Host Header Injection" + }, + { + "engine": "sca", + "severity": "CRITICAL", + "file": "litellm", + "line": null, + "rule": "CVE-2026-35030", + "message": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2026-35029", + "message": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "CVE-2025-0628", + "message": "LiteLLM Has an Improper Authorization Vulnerability" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "", + "message": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "litellm", + "line": null, + "rule": "", + "message": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2026-54283", + "message": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "starlette", + "line": null, + "rule": "CVE-2026-54282", + "message": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48818", + "message": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48817", + "message": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2026-48710", + "message": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "starlette", + "line": null, + "rule": "CVE-2025-54121", + "message": "Starlette has possible denial-of-service vector when parsing large files in multipart forms" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "starlette", + "line": null, + "rule": "CVE-2024-47874", + "message": "Starlette Denial of service (DoS) via multipart/form-data" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "black", + "line": null, + "rule": "CVE-2026-114134", + "message": "Black: GitHub Action installs unvalidated required-version from pyproject.toml" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "black", + "line": null, + "rule": "CVE-2024-21503", + "message": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" + }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "langchain-text-splitters", + "line": null, + "rule": "CVE-2026-41481", + "message": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" + }, + { + "engine": "sca", + "severity": "HIGH", + "file": "langchain-core", + "line": null, + "rule": "CVE-2026-34070", + "message": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" + }, + { + "engine": "sca", + "severity": "LOW", + "file": "langchain-core", + "line": null, + "rule": "CVE-2026-26013", + "message": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" + }, + { + "engine": "secrets", + "severity": "HIGH", + "file": "/mnt/lambda/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/IaC.yaml", + "line": 47, + "rule": "generic-password", + "message": "generic-password" + } + ], + "reports": { + "sarif": "{\n \"version\": \"2.1.0\",\n \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n \"runs\": [\n {\n \"tool\": {\n \"driver\": {\n \"name\": \"CodeAnt AI\",\n \"rules\": [\n {\n \"id\": \"CVE-2024-21503\",\n \"name\": \"CVE-2024-21503\"\n },\n {\n \"id\": \"CVE-2024-35255\",\n \"name\": \"CVE-2024-35255\"\n },\n {\n \"id\": \"CVE-2024-47874\",\n \"name\": \"CVE-2024-47874\"\n },\n {\n \"id\": \"CVE-2025-0628\",\n \"name\": \"CVE-2025-0628\"\n },\n {\n \"id\": \"CVE-2025-54121\",\n \"name\": \"CVE-2025-54121\"\n },\n {\n \"id\": \"CVE-2025-6984\",\n \"name\": \"CVE-2025-6984\"\n },\n {\n \"id\": \"CVE-2026-114134\",\n \"name\": \"CVE-2026-114134\"\n },\n {\n \"id\": \"CVE-2026-12770\",\n \"name\": \"CVE-2026-12770\"\n },\n {\n \"id\": \"CVE-2026-12771\",\n \"name\": \"CVE-2026-12771\"\n },\n {\n \"id\": \"CVE-2026-12772\",\n \"name\": \"CVE-2026-12772\"\n },\n {\n \"id\": \"CVE-2026-12773\",\n \"name\": \"CVE-2026-12773\"\n },\n {\n \"id\": \"CVE-2026-12795\",\n \"name\": \"CVE-2026-12795\"\n },\n {\n \"id\": \"CVE-2026-12796\",\n \"name\": \"CVE-2026-12796\"\n },\n {\n \"id\": \"CVE-2026-12797\",\n \"name\": \"CVE-2026-12797\"\n },\n {\n \"id\": \"CVE-2026-12798\",\n \"name\": \"CVE-2026-12798\"\n },\n {\n \"id\": \"CVE-2026-12799\",\n \"name\": \"CVE-2026-12799\"\n },\n {\n \"id\": \"CVE-2026-26013\",\n \"name\": \"CVE-2026-26013\"\n },\n {\n \"id\": \"CVE-2026-34070\",\n \"name\": \"CVE-2026-34070\"\n },\n {\n \"id\": \"CVE-2026-35029\",\n \"name\": \"CVE-2026-35029\"\n },\n {\n \"id\": \"CVE-2026-35030\",\n \"name\": \"CVE-2026-35030\"\n },\n {\n \"id\": \"CVE-2026-37004\",\n \"name\": \"CVE-2026-37004\"\n },\n {\n \"id\": \"CVE-2026-41481\",\n \"name\": \"CVE-2026-41481\"\n },\n {\n \"id\": \"CVE-2026-47101\",\n \"name\": \"CVE-2026-47101\"\n },\n {\n \"id\": \"CVE-2026-47102\",\n \"name\": \"CVE-2026-47102\"\n },\n {\n \"id\": \"CVE-2026-48710\",\n \"name\": \"CVE-2026-48710\"\n },\n {\n \"id\": \"CVE-2026-48817\",\n \"name\": \"CVE-2026-48817\"\n },\n {\n \"id\": \"CVE-2026-48818\",\n \"name\": \"CVE-2026-48818\"\n },\n {\n \"id\": \"CVE-2026-49468\",\n \"name\": \"CVE-2026-49468\"\n },\n {\n \"id\": \"CVE-2026-54282\",\n \"name\": \"CVE-2026-54282\"\n },\n {\n \"id\": \"CVE-2026-54283\",\n \"name\": \"CVE-2026-54283\"\n },\n {\n \"id\": \"CVE-2026-59819\",\n \"name\": \"CVE-2026-59819\"\n },\n {\n \"id\": \"CVE-2026-59820\",\n \"name\": \"CVE-2026-59820\"\n },\n {\n \"id\": \"CVE-2026-59821\",\n \"name\": \"CVE-2026-59821\"\n },\n {\n \"id\": \"CVE-2026-59822\",\n \"name\": \"CVE-2026-59822\"\n },\n {\n \"id\": \"CVE-2026-59823\",\n \"name\": \"CVE-2026-59823\"\n },\n {\n \"id\": \"CVE-2026-84377\",\n \"name\": \"CVE-2026-84377\"\n },\n {\n \"id\": \"debug-endpoints-enabled\",\n \"name\": \"debug-endpoints-enabled\"\n },\n {\n \"id\": \"eval-detected\",\n \"name\": \"eval-detected\"\n },\n {\n \"id\": \"formatted-sql-query\",\n \"name\": \"formatted-sql-query\"\n },\n {\n \"id\": \"generic-password\",\n \"name\": \"generic-password\"\n },\n {\n \"id\": \"path-traversal-open\",\n \"name\": \"path-traversal-open\"\n },\n {\n \"id\": \"python-subprocess-shell-true-format\",\n \"name\": \"python-subprocess-shell-true-format\"\n },\n {\n \"id\": \"python-weak-hash-md5\",\n \"name\": \"python-weak-hash-md5\"\n },\n {\n \"id\": \"sca\",\n \"name\": \"sca\"\n },\n {\n \"id\": \"sql-injection-db-cursor-execute\",\n \"name\": \"sql-injection-db-cursor-execute\"\n },\n {\n \"id\": \"user-eval\",\n \"name\": \"user-eval\"\n }\n ]\n }\n },\n \"results\": [\n {\n \"ruleId\": \"sql-injection-db-cursor-execute\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 23\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 27\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-subprocess-shell-true-format\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 34\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-weak-hash-md5\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 40\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"path-traversal-open\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 48\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"user-eval\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 54\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"eval-detected\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 56\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"debug-endpoints-enabled\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 61\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/feature/main2.py\"\n },\n \"region\": {\n \"startLine\": 30\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-35255\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"azure-identity\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-6984\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Langchain Community Vulnerable to XML External Entity (XXE) Attacks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-community\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-84377\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59823\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12799\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12798\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12797\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12796\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12795\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: SSO Debug Flow Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12770\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Admin Key Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12773\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Proxy Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12771\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: M2M JWT Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12772\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-37004\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59821\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59822\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59819\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Local file read via request-supplied OIDC file references\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59820\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Arbitrary file write via path traversal in Skills archive extraction\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47102\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows a user to modify their own user_role via the /user/update endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47101\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-49468\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication Bypass via Host Header Injection\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35030\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication bypass via OIDC userinfo cache key collision\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35029\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-0628\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM Has an Improper Authorization Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Password hash exposure and pass-the-hash authentication bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54283\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54282\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48818\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48817\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48710\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-54121\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has possible denial-of-service vector when parsing large files in multipart forms\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-47874\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette Denial of service (DoS) via multipart/form-data\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-114134\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Black: GitHub Action installs unvalidated required-version from pyproject.toml\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-21503\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Black vulnerable to Regular Expression Denial of Service (ReDoS)\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-41481\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-text-splitters\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-34070\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-26013\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"generic-password\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"generic-password\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/IaC.yaml\"\n },\n \"region\": {\n \"startLine\": 47\n }\n }\n }\n ]\n }\n ],\n \"invocations\": [\n {\n \"executionSuccessful\": true\n }\n ],\n \"properties\": {\n \"total_findings\": 48,\n \"findings_by_severity\": {\n \"HIGH\": 19,\n \"CRITICAL\": 6,\n \"MEDIUM\": 12,\n \"LOW\": 11\n },\n \"findings_by_engine\": {\n \"sast\": 9,\n \"sca\": 38,\n \"secrets\": 1\n },\n \"ratings\": {\n \"sast_rating_full_code\": \"C\",\n \"sca_rating_full_code\": \"D\"\n },\n \"quality_gate_status\": \"FAILED\"\n }\n }\n ]\n}", + "junit": "\nQuality Gate: FAILED\nTotal findings: 48\nBy severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11\nBy engine: sast=9, sca=38, secrets=1\nRatings: sast_rating_full_code=C, sca_rating_full_code=D" + } +} \ No newline at end of file diff --git a/examples/security-pipeline/evidence/warn/runner-output.txt b/examples/security-pipeline/evidence/warn/runner-output.txt new file mode 100644 index 0000000..5f2f088 --- /dev/null +++ b/examples/security-pipeline/evidence/warn/runner-output.txt @@ -0,0 +1,8 @@ +Run: https://github.com/codeanttesting/codeant-demo/actions/runs/42308035025 +Selected output (setup and credential lines omitted): + +2026-11-06T22:54:15.0435683Z 📊 Findings: 48 +2026-11-06T22:54:15.0436263Z 🎯 Quality Gate: FAILED +2026-11-06T22:54:15.0437216Z CodeAnt - SAST sast_rating_full_code C FAILED sast_rating_full_code is C (same or worse than threshold C) +2026-11-06T22:54:15.0439250Z CodeAnt - SCA sca_rating_full_code D FAILED sca_rating_full_code is D (same or worse than threshold C) +2026-11-06T22:54:16.7456100Z ##[warning]Security gate failed; warning mode is enabled From 83ec4d1f0075e977163564cbbb660a5b17b3cbcd Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 04:29:24 +0530 Subject: [PATCH 08/12] Remove stale demo bytecode [skip ci] --- .../__pycache__/report.cpython-311.pyc | Bin 11605 -> 0 bytes .../__pycache__/test_report.cpython-311.pyc | Bin 7078 -> 0 bytes 2 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 examples/security-pipeline/__pycache__/report.cpython-311.pyc delete mode 100644 examples/security-pipeline/__pycache__/test_report.cpython-311.pyc diff --git a/examples/security-pipeline/__pycache__/report.cpython-311.pyc b/examples/security-pipeline/__pycache__/report.cpython-311.pyc deleted file mode 100644 index 68619e164b34d9fbbafe2009ae2b03471cd85e2c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11605 zcmcgSZA=_VcHJ{QGd`4HwGp% zcWAST2glN~C$G%q?91F{caP2aawOVQNTevfRqoC|@}nDd8eNEiu8%vHW;M;Jv{Z;|-3DMW(#MDC=b>gQ(zM9#UhGa40Nz zTf4ktaY#b^8Xu1dEC)&IQcxI$r;+7D!7((95W*^X z1aWgUEud1lz>wN*WKiu5;Y}S+5lJGGpCV07MyJKi=x<@{oKvu_6=W!FsrSfD@foxw zQ>0*D!;>Th$J*Ox(Ep#|=|g$Ewnd{B&l_4ag$XUDl#Zd>h#Q`iKB-UYZj)TGrZ48C z{zt^4b^U&iyjPJVq1K5MrJ+U%=OvXz_=FF)tHlys`Ki1D^oK9UkYyu@SEj_X->v6ui+e zk26+Tn)ikxY%r$K!{HbMMfpTs>#6{#rM%H`9$}3M!EnqQ^yW)?BVk@pOi@`&}SI6 zScp|9Of^YG^db z3E>797iK&p#JPrvICqO53x-%I0{srggt}0;ZYUVK#m1Pr#s(OjTR|Znk2Tbz!30uQ z%Q0*;-jG{R_y(R0jdNjPs%|Vi#ztTe8aNg$P4#0_iVgL7FgJZ%B@kzWKVJrm#5A#N zcikI!M9sY`dG^bm{m(o{mpn%$Pm}CvlI+K2`|;`atjT^S@m^wfpJdu1o3_mT(UPfF zG}SIUJYvN=lH-Q#xFOOvvd+>E5_c1GwUTqU?A$%wxoj<+9sQJ&th;6F?iGSGoF{RW zPRY?FJGw-=E9)rv;O5<%a}}9$l4Gyz*gM^kEpA;QbcRk+g=u5f>Y6JTtzL-B#aqRy z_QhcU5T)V{xwu2Lb*$(K+xF+~EvQB#25Hl>vtn-Vr-voyKH0es+BP>XnEuZCx7Ni@ z>3~l@;KNxM-vO!kpj>=Vv>ja0L$T*p*L2TI7#W~H)*(q_l+6yM+8H^sU&uCveUF>b?)(jI3$nY?|g2YF<+%Vlv!641(Zxej1P<2R>nZhB48fpN|N~hf( zwG*5v6qkIZb&Q5vJNEz98f@9W5b%^wz?AD1vR0vUV?3px3_UM!oC}Cm4C7;Cpm0$f znm^8qvu?%W6ESWlqzz`}&a691bTd)GIIRj;Z6<}E^>OgDSDx52s_b;3m>rO*l zc9+cx4<>&wnX$~Dlgb<9@&?I$Kz1K^=03XQJ}SAJWOvizdC}bt@mm#sVi4Uvh${xd zRr(w!;SDpJVv7bR2lHFiYhAN9vDG^SoO}!I`uY45-e4pWpJ16&H6{+}TAULBG!P0s z2-PF(;Gklj2n(Zwv0#+tkanZ!BW$dO=E_jf?I^>j3Je5NBxeuby^YYeA5SB!++J$qWV?U?p0TOH}inN#;p z%^g{?dNWtW9YYX*sbA>)8~Yb_^-a9~om|2?BvM0ot~6qdRweX*`96RLu+mL~DHL;P z#EH-fC0Yr;S)8?d$Tth`dYzs#F#05!fYxJx7etEcwkEfq=uTP`r`jEziz>60%*5R8eTADgvn=@BAD3u`+T zadXw!Nz&`4)SNVD3XGpMyfdZRk|Y5oQC~NNbSbC>7OWOn*BV{F!LP^0fHlsnGm%Il zX5C2~gcWi^H>tlyOuz_UBS`oONd9x-CR$^0U~G(C+w)DzIX206uCM>CuoW>bZ8@eG zvGFEtY@iX9W!!J5QL>&YT%+`%K4sDHN11j^GsWttXrX}Ahg`T>l20WqO!;Hax?WVE zcC?jqHls;fk|ge(N`kK=X<)W7)mrLt|Ga=}`)0UC zbP15Dlnvx|$Hye})+wN!Cl{EV@56%1d~0b)6*0SD9Q-Mla43(101U}>e1^xVIOR?{ zzj>UJF5yT){i39+fPT=!)_hLMVot~Gj*-lsk#!>ovUaQhhkL`Q1z>cHNhkDt@5dyw z?eV_PVD@opdxGLkkeRa$;vj<5g9AQw?{FNd~X(>~uk;TjlDy|5uY1;m9-xpDs%`=9 z&=@;`>TOVlkmS8Q3g9F14tW9g9HbQ8D85T#vzK_Ep3$w})B1@AutVK*Ge~{WX)q#_ z3tLG6j4@{=?E=Rm$YDOr=rRRw`COQTb%wik%)#i~?I$=S4>dZh++eE%)Fi}oivAWm zg>4Rv;i;M#yTDP5+&F8d<_H^uJg(5_JPug+w*Vlcv!YFn3!z8*GKYWK^l{UC>rYO7 za!RT^C|4d_{fyP3UX>=54ore#91gP)hF3{Bo3nwuh#fUIrB>Thl7 z9Rx>aPgg*(0-r!IfG7yknRrxT`~>~Z$^@UTL4^mU?`+S_wwV>Xpo!2x#)nY z)!*+8a;z7LD>&7`0Y0QTdGaEM^Dr3ps6LzLF+jwyu=+xA@Ybs~H|FdUUO1sb&9Gyz z;0vsGn2Sg8NmdL9zYXo>*!;WW!3gp`kDx+1?yFCDdbOo;AHY-Z&Q%yh6$aJQiA2Aj zW#P;~b%Pgf26!02AF;~ltNm?J<=7jEkMOt@$RzX}&NYG~u{bZlAwzw_oyVCQt@<%$ z7`8iufFv<-dF|{1`TtIMC%8CtB44MFj{U2-1(?<{^Xoy)cEzrG-y^}H`bc<)>xAi7 zN;G-(JlbP74#sSMBH;#b!cC;K#wj#wrF-O89qrwOWdzk7<8yXKsn3^)x3xs-(`?zU;6k~i` z7#kP3J5W?H<&HVfkrf&r#lWLgn7fMbw4o9dhx!GpGMtg}IWN<25VQ-1>qFlS0#Zb{ zw;|0V+r;}#A?IH*s+$@22+AEm71A)cu!&}=U7|K-sU}eyv($k2?c#HLyNKg-`?A?C zI(A9s-LiT2Gjr{dxpw~0qE0l|O6C)?`NRsLH?ZX5?PXWV{mQv^$+c5P(bY0tEz;GH^NjW^(VoKXQ@ngte0xZ~9D+>A!^i+>My45&W>!oHv5H=WU*V>{ z#;`DdvoyHdHv9Bn7Gj(C;Wcq@^J0fo)h1W9Emv%LSdlsP%N<|TEOtNLD>e4XjeSyu zU#{>kS8jb+BknpT9`BJVd*#Yr@p3?_3@p3c_bbFL^$RA+)g-%`zS5Ihj%QC?K+kUS zcj)WfnfVUMby#*C{>q@+a%9CoIghRo0H!;D0)tsJZ;`02GPU&?wRefy`*Z5CW#QP9 zgW^7)w9hB+^F5`cecck(BU3#h)swY*MY~tB?~v^~z$a)gOJ5Vq4=x;C-225D$=)j4 zTSZ&jv@cs$^&t9#=!fz9@fA42x(H*4;EW}$PhZK>_77}#ZL`;AuRXdw?-utQgScQ& zpHg*`T-~&|=Sij9+%1*%$fZ3J-7C|*B92+goE}aO&t9I>%|!1-=dR7c0G@eL_S7P` z_@%0VTon-QS0w5R&|o_us?mCKx^3BBqHdWB#)X7@;2gY2C9N_*Of~eyU593>90NEC ztK2(pgki00k}I2LoN42%DNEZvu->)KUVRkG?3pkBq(R!&C~s?gViXSt7CIL?pLU8R zS0uV$ru#*@f0?$YM`j%N9BKGvZLYL$c2}kW{T73w?W|-wE8ETjm6Z8T?|Z$o&9luJ z+x+mt$l~pP`u;zB|LK%;=9+xwnpi!M_3i;m=*69jx8*Yz#p+Ah>h^4PEAVEuj|6@! zX(xdn0V3Y)Kxu%e7XWF(U`eyH{j>dZEpyz5H}2oabY;54`p&0&#LL&^^Y2KzZpgcC zWF6({FnD7tu9DB+epeg}%WvNVZgEBc8-n1Jb$Zg_M@F&w_&>HjG5*%_rA55(9qDXP zJ{y!y4#_8nr0OBb6Ouh4k-a5GZp-Y1~-V30oDR|Mf~ zM=toRp+q^>Vh zX3=s(qTZFMcg1|<-LNA4ifVD4+phm|J9Tci>C1g2zz}4w2BdYMwff~>1KjjT5^Wi| z@OYi2g0FNS3>yNYWAqF)qI+!6TA^U66Pa(WVFVw8>0|N_s6jJk#xkN~ERU^PuLN$T zfbKQ&*7>$bGf{XgW8GIB_#uq>x^O84spm^6=pA;M-h95^l(W8Zb0Qjk^(Oo98%u2<#RUr%fPxvM~1m@ zbJY{fIJK0d3`qlbSt#&ofZwc0O9ObFjY(q$*&Q1K<0_;b=qmmu>KOMUleS$Ly+6oL zoYZr>3VY0$b91C)O2FGynlcrR5L1>k0WD>SmPhOSNiZ@y*Se9^$1NJX78S3ST0gOq z5O%HA5|E*i3&Os93OvQ=G$I#M5_OK$pF&3|#GkLlR^MC}z;=&|R2#467sxh16pxWD1SO!*EF?VXmt~N-C(hTnxxb z80+eypfD@cM39RqCN>5JLx=?@!^iMdF@aVegllN3eN&E=bB@JVXL#=_riAH)7a=*N zxbxO@z;|iTf2F6V18F8bWLg8ld0q2hpHmq`*a^?W{5yl;X zbNmPi z`O!tASa(LG$|dToOq~^}v)Q$;VqHfrqVJtD)hSY)Yv1YlqYKBy+EY)aaQ(|Nbs0{@ z;9AWy>((XfR>`_ewr-nlThX}^K038I$^y zY_+njRO3`FAQqKn`(SKYBM|joXtV9T~ z)V8A(vdFNIphnRJ16T$u{wW?TRo^7s8bH2O)m>Ntsn_&LkaF-UpXQ#xEApoCzXJd> zPm)=pPbB)D6V7S;%MzAp{L2#7Y5dC)=4t%P64jzMW(kj|jag!+sEsQ|2MG+j3U*k? z5O7-otkjczNReHGwteIv(47ILkOOVv;P|D1ni&W!+HG6$fIcnp<75o2_!L+C&eTf zntKvnnzIR(=DviF=Kh4A=7B_j=3Ih<+?xufLx~VW#$Zzw>2M;%|GNM3szX!rttxo5V@!HRRq?{0P51AX9^dlJ>I*iiwV0qtF)WX&SdYn9Xr>8+vOdui zJCjjj<4JuumQj+rE^B(zFJy|IIAgPYf<6qnZ&c95VcVY@;At?IH;qn+d13%@82ac0 zeB44Z0(C$Mk5nmnrx{QQb{c^~_yGDOKR`cW1*ifCkduM{gHi}!NU8u>A%*)%1Wgy&A~J~D5@tTKfu37P&#MMPBYE7-$XC%- zR`(Ug7|9F6-R`PS4;Hn`_n2f$1sz0_%=-t5$CMa%n^}Khqyna|E#M=ZgHM+9b&td# zeVx-1fjUUQX~{R~mHd;QA-`MIUj?PniY=8awW};ys7P83vsL4lpQ4saQ#eQn7mb z=cPl5ZbQ%8b{yqsDo2Zi%27{h;(?xQ7|U8FrE5(inyO?uZ9;1j@X#10s%5i7f-Yx+ zjg6WpD2j};{>H|%D#`IGo73g==wLD>+b^93OvM78Xis8U)KxrziSpZCaa^)Js%HDd zVJV62&^S)&GOx>5bekp9**+{!BUehHtquZXOYIFTM zPAWs)y_jqon@tNzCGLmaE2jpDSs}}SQXtO`EYoWTbHe~hHaCjpv80;OG_tf9eV$%# zeoK?F)+`Pum9#K1Ff3p_*$k9O8M2V(aTQuZCNQv|=#65saX=6+%Zk*vuNf@I zWkFX}rMYRD{Cqn}POHuG6(K#Eg5H`eW?=Objibw!sF_$vK5qnV4rdgevb%N_W7Xu; zl3l7D0jo5H9#qy?l?`U)E~|3a5()*k%_SeKf92+tKV)xauXjBNues6n;W;zB*$Qtq z!kd>ofy!-*>!QZG9So>nT_4O$;+G<5x zmk?6}wE!M$-tp;sAHVmftDjt5@;Zfu>W8Gw<9zESuQO_4{D)+w$NB00&7tabH@TS& zX4O`!YO7JTb*TncPM2Q*4+%FO6Hq8yTC;NgCr_Rfh$+R~#FWrcAg~0ZL#|xLO1gpc zCx7&~mO_f2JXyJ>RhLt;y8I_4z`gQ(9p#306;$YELr2W}_m*(`5zqI*o$XQI_s!9E zCh!9n2KS{?K1aTn5fW-ZL;+cdc*0?F*_tMTzgM%WHBYX<=UtGVz3w_%>!FcbN-?&G>y{qt*| zUAsGA)*rFzkC@S;R`lq-7Lz+}amNiO;XTmR#eU)nDEt2bNO|^CtpuGMDhZ;lGA}9^ zqSbEZOFs8ELzLi!gk2ii!AWH`@dkP@iEC}PtGl!7j>q=P$`FLaHmAvBGVx6|J1$^_ z>cB6AfVh{69XA6`wcyV3UU>xyTze%>g*coX8s_QF97w5fj^I@#HNhtpmkt~&s{_x| zy`IcG0ss`Cy5`oVk2cMn_||W1=_D!EWmb1v)!oJyhc?dozyg9vsDaw;TQ~vf@lcJ4+_Z?56Y+zr6IaV znv#Gn+gDa={>u@GCD0ZCfFiAbWoCHJZ`3v4ZMfHM>^}Y3mY7+eL$;yrP4@7E&p79D?4KvK!@jhafKEncHNi@%B5$ zp>rf1OqliOt@`t3^j$0Zu5pn!xl0yz$#Bw2S>!{v4`CW|Z~%|nTHfR8MRD@#F>`4c zHA{@+ibwLe4Vn9kK{wjyX7TpK*=*&pu5*1IXHItayxFifp7q9d@6CD|_hz}*``eCt*!S<*>T z<(xR>D{$cemo0F^na-pHEqk!6IG@??C@?_l0RX11=GWkfg6+iL0leO^7_Rz#?+3kq zKJjVq$GvkMX6-(!cHctnvH99#_e8U{)v9eZ!);c$&7cXKU%oRHXAdli7(1%J@vzPD zydtD!p0`6har>DR!NWXHjv=|4!eImxBa8`o_}2swbBsF)c!Pk`1neS!czSxG!z6B_ zfZWb&UjdlPze}D9AKVtW!A6e{4sUtDF+Rcp2l&0d{YxkhLS7#U1&UyZ@eLDZ6`-H- zWobzsLWw|2^3d<`5f-lwbE_c>A>1N2U_2k+Xa{(ZyvXyIT+7;PlH@*)T%7ZmLMpjhE)nQc?zP;Y$FU5x z!xyZ>7tFv#D{yg&T@1c-W79&gVLsR}7cqlPRv)2H6=o$j5Y?~)g>8=-<~(|-V$ Cc#`)3 From b5cedf7a812cb395e914381f92dc64f94fee39bd Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 04:38:49 +0530 Subject: [PATCH 09/12] Use the action quality_gate input without a custom gate script --- .github/workflows/codeant-security.yml | 25 ++----------------------- security_vulns.py | 2 +- 2 files changed, 3 insertions(+), 24 deletions(-) diff --git a/.github/workflows/codeant-security.yml b/.github/workflows/codeant-security.yml index 3f6f6df..c91bdb4 100644 --- a/.github/workflows/codeant-security.yml +++ b/.github/workflows/codeant-security.yml @@ -14,9 +14,6 @@ concurrency: group: codeant-security-${{ github.event.pull_request.head.sha || github.sha }} cancel-in-progress: false -env: - ENFORCE_SECURITY: 'true' - jobs: security: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} @@ -24,11 +21,12 @@ jobs: timeout-minutes: 25 steps: - name: Scan repository - uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.5 + uses: CodeAnt-AI/codeant-ci-scan-action@d4e7f37809f110ab9216766e53fbad0061393e27 with: access_token: ${{ secrets.CODEANT_TOKEN || secrets.ACCESS_TOKEN_GITHUB }} scanners: sast,sca,secrets scan_timeout: '1200' + quality_gate: 'false' - name: Save reports if: ${{ always() }} uses: actions/upload-artifact@v4 @@ -39,25 +37,6 @@ jobs: results.json codeant.sarif codeant-qg.xml - - name: Check security gates - run: | - python3 - <<'PY' - import json, os - from pathlib import Path - result = json.loads(Path('results.json').read_text()) - if result.get('status') != 'COMPLETED': - raise SystemExit('Scan did not complete') - enabled = {c['metric'] for c in result.get('evaluated_conditions', []) - if c.get('quality_gate_enabled')} - required = {'sast_rating_full_code', 'sca_rating_full_code'} - if not required.issubset(enabled): - raise SystemExit('Configure full-code SAST and SCA gates in CodeAnt') - secrets = sum(f['engine'] == 'secrets' for f in result['findings']) - if result.get('quality_gate_status') != 'PASSED' or secrets: - if os.environ['ENFORCE_SECURITY'] == 'true': - raise SystemExit('Security gate failed') - print('::warning::Security gate failed; warning mode is enabled') - PY deploy: needs: security diff --git a/security_vulns.py b/security_vulns.py index 7031602..80a9e89 100644 --- a/security_vulns.py +++ b/security_vulns.py @@ -4,7 +4,7 @@ DO NOT use this code in production. """ -# CI fixture: native full-repository quality gate enforcement. +# CI fixture: validate the action quality_gate input against vulnerable code. import os import subprocess import sqlite3 From 55abb4578c64c89f7a4b1e7efea665e5c78ec461 Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 04:41:43 +0530 Subject: [PATCH 10/12] Verify native action enforcement with quality_gate enabled --- .github/workflows/codeant-security.yml | 2 +- security_vulns.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeant-security.yml b/.github/workflows/codeant-security.yml index c91bdb4..6148a89 100644 --- a/.github/workflows/codeant-security.yml +++ b/.github/workflows/codeant-security.yml @@ -26,7 +26,7 @@ jobs: access_token: ${{ secrets.CODEANT_TOKEN || secrets.ACCESS_TOKEN_GITHUB }} scanners: sast,sca,secrets scan_timeout: '1200' - quality_gate: 'false' + quality_gate: 'true' - name: Save reports if: ${{ always() }} uses: actions/upload-artifact@v4 diff --git a/security_vulns.py b/security_vulns.py index 80a9e89..a8d763b 100644 --- a/security_vulns.py +++ b/security_vulns.py @@ -4,7 +4,7 @@ DO NOT use this code in production. """ -# CI fixture: validate the action quality_gate input against vulnerable code. +# CI fixture: verify quality_gate=true blocks this vulnerable repository. import os import subprocess import sqlite3 From 324b7d7af9e58e4ab1d2e1aaef94f857b7a6b0a6 Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 04:44:02 +0530 Subject: [PATCH 11/12] Document and preserve native action flag verification [skip ci] --- examples/security-pipeline/README.md | 38 +++++----- .../evidence/enforce/codeant.sarif | 42 +++++------ .../evidence/enforce/results.json | 38 +++++----- .../evidence/enforce/runner-output.txt | 18 ++--- .../{warn => report-only}/codeant-qg.xml | 0 .../{warn => report-only}/codeant.sarif | 72 +++++++++---------- .../{warn => report-only}/results.json | 52 +++++++------- .../evidence/report-only/runner-output.txt | 9 +++ .../evidence/warn/runner-output.txt | 8 --- 9 files changed, 139 insertions(+), 138 deletions(-) rename examples/security-pipeline/evidence/{warn => report-only}/codeant-qg.xml (100%) rename examples/security-pipeline/evidence/{warn => report-only}/codeant.sarif (96%) rename examples/security-pipeline/evidence/{warn => report-only}/results.json (83%) create mode 100644 examples/security-pipeline/evidence/report-only/runner-output.txt delete mode 100644 examples/security-pipeline/evidence/warn/runner-output.txt diff --git a/examples/security-pipeline/README.md b/examples/security-pipeline/README.md index e1e1c55..b211882 100644 --- a/examples/security-pipeline/README.md +++ b/examples/security-pipeline/README.md @@ -1,7 +1,6 @@ # CI security pipeline -Copy [the workflow](../../.github/workflows/codeant-security.yml). No helper script, -policy file, or extra package is required. +Copy [the workflow](../../.github/workflows/codeant-security.yml), then: 1. Enable secrets, SAST, and SCA analysis in CodeAnt. 2. Open **Settings → Code Analysis → Quality Gates**, select your repository, @@ -12,31 +11,30 @@ policy file, or extra package is required. `CODEANT_TOKEN`. This test repository also accepts its existing legacy secret. 5. Replace the workflow's branch triggers with your target branch and run it. -`ENFORCE_SECURITY: 'false'` warns on findings. Set it to `'true'` to fail the job -and skip deployment. Missing results or native gate conditions fail in both modes. +Set `quality_gate: 'true'` to fail the action on a failed native verdict or results +timeout. Set it to `'false'` for report-only runs. The pinned action revision +supports this input; `v0.0.5` does not. See [action PR #5](https://github.com/CodeAnt-AI/codeant-ci-scan-action/pull/5). -Thresholds are evaluated by CodeAnt. The inline gate step also checks for zero -reported secrets, because the native full-code response has no secrets gate metric. -The published action collects results but does not expose a `quality_gate` input. +Configure thresholds before enforcing: without conditions, CodeAnt can return +PASSED. Native full-code gates cover SAST/SCA/IaC ratings and duplicate code. +Secrets appear in reports but have no native full-code gate metric. Download **codeant-results** from the run's **Artifacts** section. It contains native `results.json`, `codeant.sarif`, and `codeant-qg.xml`. The action does not -produce CSV or PDF. Do not upload credentials or environment dumps as artifacts. +generate CSV/PDF. Reports upload even when the scan step fails. -The deployment step is a placeholder. Replace it with your deployment command and -keep `needs: security`. To block merges, require the check in branch protection. -The workflow skips fork PRs, which do not receive repository secrets. +Replace the deployment placeholder with your command and keep `needs: security`. +Require the check in branch protection to block merges. Fork PRs are skipped +because they do not receive repository secrets. -## Real native-gate runs +## Verified action runs -Both runs evaluated enabled full-code conditions: SAST was C and SCA was D, so -CodeAnt returned FAILED. Each returned 48 findings. +Both runs returned 48 findings and a native FAILED verdict (SAST C, SCA D). -| Mode | Run | Result | +| Input | Run | Result | | --- | --- | --- | -| Warning | [42308035025](https://github.com/codeanttesting/codeant-demo/actions/runs/42308035025) | Native gate failed; workflow warned and deployment placeholder ran. | -| Enforcement | [42308406392](https://github.com/codeanttesting/codeant-demo/actions/runs/42308406392) | Native gate failed; security job failed and deployment was skipped. | +| `quality_gate: 'false'` | [42309878084](https://github.com/codeanttesting/codeant-demo/actions/runs/42309878084) | Scan succeeded; deployment placeholder ran. | +| `quality_gate: 'true'` | [42310207026](https://github.com/codeanttesting/codeant-demo/actions/runs/42310207026) | Scan step failed; deployment was skipped; reports uploaded. | -Original native reports and selected runner output are saved in -[`evidence/warn`](evidence/warn) and [`evidence/enforce`](evidence/enforce). -They are historical outputs for these runs; future scans may differ. +Native reports and selected logs are preserved in [`evidence/report-only`](evidence/report-only) +and [`evidence/enforce`](evidence/enforce). Future finding counts may differ. diff --git a/examples/security-pipeline/evidence/enforce/codeant.sarif b/examples/security-pipeline/evidence/enforce/codeant.sarif index 9291e84..9937d48 100644 --- a/examples/security-pipeline/evidence/enforce/codeant.sarif +++ b/examples/security-pipeline/evidence/enforce/codeant.sarif @@ -205,7 +205,7 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/feature/main2.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/feature/main2.py" }, "region": { "startLine": 30 @@ -224,7 +224,7 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py" }, "region": { "startLine": 24 @@ -243,7 +243,7 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py" }, "region": { "startLine": 28 @@ -262,7 +262,7 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py" }, "region": { "startLine": 35 @@ -281,7 +281,7 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py" }, "region": { "startLine": 41 @@ -300,7 +300,7 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py" }, "region": { "startLine": 49 @@ -319,7 +319,7 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py" }, "region": { "startLine": 55 @@ -338,7 +338,7 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py" }, "region": { "startLine": 57 @@ -357,7 +357,7 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py" }, "region": { "startLine": 62 @@ -927,26 +927,26 @@ ] }, { - "ruleId": "CVE-2026-41481", - "level": "warning", + "ruleId": "CVE-2026-34070", + "level": "error", "message": { - "text": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" + "text": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" }, "locations": [ { "physicalLocation": { "artifactLocation": { - "uri": "langchain-text-splitters" + "uri": "langchain-core" } } } ] }, { - "ruleId": "CVE-2026-34070", - "level": "error", + "ruleId": "CVE-2026-26013", + "level": "note", "message": { - "text": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions" + "text": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" }, "locations": [ { @@ -959,16 +959,16 @@ ] }, { - "ruleId": "CVE-2026-26013", - "level": "note", + "ruleId": "CVE-2026-41481", + "level": "warning", "message": { - "text": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" + "text": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" }, "locations": [ { "physicalLocation": { "artifactLocation": { - "uri": "langchain-core" + "uri": "langchain-text-splitters" } } } @@ -984,7 +984,7 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/IaC.yaml" + "uri": "/mnt/lambda/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/IaC.yaml" }, "region": { "startLine": 47 diff --git a/examples/security-pipeline/evidence/enforce/results.json b/examples/security-pipeline/evidence/enforce/results.json index 2107cc2..eaee8a1 100644 --- a/examples/security-pipeline/evidence/enforce/results.json +++ b/examples/security-pipeline/evidence/enforce/results.json @@ -45,7 +45,7 @@ { "engine": "sast", "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/feature/main2.py", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/feature/main2.py", "line": 30, "rule": "formatted-sql-query", "message": "Detected possible formatted SQL query. Use parameterized queries instead." @@ -53,7 +53,7 @@ { "engine": "sast", "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py", "line": 24, "rule": "sql-injection-db-cursor-execute", "message": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." @@ -61,7 +61,7 @@ { "engine": "sast", "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py", "line": 28, "rule": "formatted-sql-query", "message": "Detected possible formatted SQL query. Use parameterized queries instead." @@ -69,7 +69,7 @@ { "engine": "sast", "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py", "line": 35, "rule": "python-subprocess-shell-true-format", "message": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." @@ -77,7 +77,7 @@ { "engine": "sast", "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py", "line": 41, "rule": "python-weak-hash-md5", "message": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." @@ -85,7 +85,7 @@ { "engine": "sast", "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py", "line": 49, "rule": "path-traversal-open", "message": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." @@ -93,7 +93,7 @@ { "engine": "sast", "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py", "line": 55, "rule": "user-eval", "message": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." @@ -101,7 +101,7 @@ { "engine": "sast", "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py", "line": 57, "rule": "eval-detected", "message": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." @@ -109,7 +109,7 @@ { "engine": "sast", "severity": "MEDIUM", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py", "line": 62, "rule": "debug-endpoints-enabled", "message": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." @@ -394,14 +394,6 @@ "rule": "CVE-2024-21503", "message": "Black vulnerable to Regular Expression Denial of Service (ReDoS)" }, - { - "engine": "sca", - "severity": "MEDIUM", - "file": "langchain-text-splitters", - "line": null, - "rule": "CVE-2026-41481", - "message": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" - }, { "engine": "sca", "severity": "HIGH", @@ -418,17 +410,25 @@ "rule": "CVE-2026-26013", "message": "LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages" }, + { + "engine": "sca", + "severity": "MEDIUM", + "file": "langchain-text-splitters", + "line": null, + "rule": "CVE-2026-41481", + "message": "LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass" + }, { "engine": "secrets", "severity": "HIGH", - "file": "/mnt/lambda/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/IaC.yaml", + "file": "/mnt/lambda/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/IaC.yaml", "line": 47, "rule": "generic-password", "message": "generic-password" } ], "reports": { - "sarif": "{\n \"version\": \"2.1.0\",\n \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n \"runs\": [\n {\n \"tool\": {\n \"driver\": {\n \"name\": \"CodeAnt AI\",\n \"rules\": [\n {\n \"id\": \"CVE-2024-21503\",\n \"name\": \"CVE-2024-21503\"\n },\n {\n \"id\": \"CVE-2024-35255\",\n \"name\": \"CVE-2024-35255\"\n },\n {\n \"id\": \"CVE-2024-47874\",\n \"name\": \"CVE-2024-47874\"\n },\n {\n \"id\": \"CVE-2025-0628\",\n \"name\": \"CVE-2025-0628\"\n },\n {\n \"id\": \"CVE-2025-54121\",\n \"name\": \"CVE-2025-54121\"\n },\n {\n \"id\": \"CVE-2025-6984\",\n \"name\": \"CVE-2025-6984\"\n },\n {\n \"id\": \"CVE-2026-114134\",\n \"name\": \"CVE-2026-114134\"\n },\n {\n \"id\": \"CVE-2026-12770\",\n \"name\": \"CVE-2026-12770\"\n },\n {\n \"id\": \"CVE-2026-12771\",\n \"name\": \"CVE-2026-12771\"\n },\n {\n \"id\": \"CVE-2026-12772\",\n \"name\": \"CVE-2026-12772\"\n },\n {\n \"id\": \"CVE-2026-12773\",\n \"name\": \"CVE-2026-12773\"\n },\n {\n \"id\": \"CVE-2026-12795\",\n \"name\": \"CVE-2026-12795\"\n },\n {\n \"id\": \"CVE-2026-12796\",\n \"name\": \"CVE-2026-12796\"\n },\n {\n \"id\": \"CVE-2026-12797\",\n \"name\": \"CVE-2026-12797\"\n },\n {\n \"id\": \"CVE-2026-12798\",\n \"name\": \"CVE-2026-12798\"\n },\n {\n \"id\": \"CVE-2026-12799\",\n \"name\": \"CVE-2026-12799\"\n },\n {\n \"id\": \"CVE-2026-26013\",\n \"name\": \"CVE-2026-26013\"\n },\n {\n \"id\": \"CVE-2026-34070\",\n \"name\": \"CVE-2026-34070\"\n },\n {\n \"id\": \"CVE-2026-35029\",\n \"name\": \"CVE-2026-35029\"\n },\n {\n \"id\": \"CVE-2026-35030\",\n \"name\": \"CVE-2026-35030\"\n },\n {\n \"id\": \"CVE-2026-37004\",\n \"name\": \"CVE-2026-37004\"\n },\n {\n \"id\": \"CVE-2026-41481\",\n \"name\": \"CVE-2026-41481\"\n },\n {\n \"id\": \"CVE-2026-47101\",\n \"name\": \"CVE-2026-47101\"\n },\n {\n \"id\": \"CVE-2026-47102\",\n \"name\": \"CVE-2026-47102\"\n },\n {\n \"id\": \"CVE-2026-48710\",\n \"name\": \"CVE-2026-48710\"\n },\n {\n \"id\": \"CVE-2026-48817\",\n \"name\": \"CVE-2026-48817\"\n },\n {\n \"id\": \"CVE-2026-48818\",\n \"name\": \"CVE-2026-48818\"\n },\n {\n \"id\": \"CVE-2026-49468\",\n \"name\": \"CVE-2026-49468\"\n },\n {\n \"id\": \"CVE-2026-54282\",\n \"name\": \"CVE-2026-54282\"\n },\n {\n \"id\": \"CVE-2026-54283\",\n \"name\": \"CVE-2026-54283\"\n },\n {\n \"id\": \"CVE-2026-59819\",\n \"name\": \"CVE-2026-59819\"\n },\n {\n \"id\": \"CVE-2026-59820\",\n \"name\": \"CVE-2026-59820\"\n },\n {\n \"id\": \"CVE-2026-59821\",\n \"name\": \"CVE-2026-59821\"\n },\n {\n \"id\": \"CVE-2026-59822\",\n \"name\": \"CVE-2026-59822\"\n },\n {\n \"id\": \"CVE-2026-59823\",\n \"name\": \"CVE-2026-59823\"\n },\n {\n \"id\": \"CVE-2026-84377\",\n \"name\": \"CVE-2026-84377\"\n },\n {\n \"id\": \"debug-endpoints-enabled\",\n \"name\": \"debug-endpoints-enabled\"\n },\n {\n \"id\": \"eval-detected\",\n \"name\": \"eval-detected\"\n },\n {\n \"id\": \"formatted-sql-query\",\n \"name\": \"formatted-sql-query\"\n },\n {\n \"id\": \"generic-password\",\n \"name\": \"generic-password\"\n },\n {\n \"id\": \"path-traversal-open\",\n \"name\": \"path-traversal-open\"\n },\n {\n \"id\": \"python-subprocess-shell-true-format\",\n \"name\": \"python-subprocess-shell-true-format\"\n },\n {\n \"id\": \"python-weak-hash-md5\",\n \"name\": \"python-weak-hash-md5\"\n },\n {\n \"id\": \"sca\",\n \"name\": \"sca\"\n },\n {\n \"id\": \"sql-injection-db-cursor-execute\",\n \"name\": \"sql-injection-db-cursor-execute\"\n },\n {\n \"id\": \"user-eval\",\n \"name\": \"user-eval\"\n }\n ]\n }\n },\n \"results\": [\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/feature/main2.py\"\n },\n \"region\": {\n \"startLine\": 30\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sql-injection-db-cursor-execute\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 24\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 28\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-subprocess-shell-true-format\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 35\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-weak-hash-md5\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 41\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"path-traversal-open\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 49\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"user-eval\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 55\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"eval-detected\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 57\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"debug-endpoints-enabled\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 62\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-35255\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"azure-identity\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-6984\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Langchain Community Vulnerable to XML External Entity (XXE) Attacks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-community\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-84377\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59823\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12799\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12798\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12797\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12796\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12795\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: SSO Debug Flow Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12770\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Admin Key Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12773\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Proxy Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12771\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: M2M JWT Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12772\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-37004\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59821\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59822\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59819\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Local file read via request-supplied OIDC file references\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59820\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Arbitrary file write via path traversal in Skills archive extraction\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47102\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows a user to modify their own user_role via the /user/update endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47101\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-49468\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication Bypass via Host Header Injection\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35030\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication bypass via OIDC userinfo cache key collision\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35029\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-0628\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM Has an Improper Authorization Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Password hash exposure and pass-the-hash authentication bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54283\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54282\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48818\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48817\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48710\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-54121\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has possible denial-of-service vector when parsing large files in multipart forms\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-47874\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette Denial of service (DoS) via multipart/form-data\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-114134\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Black: GitHub Action installs unvalidated required-version from pyproject.toml\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-21503\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Black vulnerable to Regular Expression Denial of Service (ReDoS)\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-41481\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-text-splitters\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-34070\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-26013\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"generic-password\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"generic-password\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/codeanttesting/codeant-demo/2cd6121a53fccf0a4871b2744ca14877379e68c9/IaC.yaml\"\n },\n \"region\": {\n \"startLine\": 47\n }\n }\n }\n ]\n }\n ],\n \"invocations\": [\n {\n \"executionSuccessful\": true\n }\n ],\n \"properties\": {\n \"total_findings\": 48,\n \"findings_by_severity\": {\n \"HIGH\": 19,\n \"CRITICAL\": 6,\n \"MEDIUM\": 12,\n \"LOW\": 11\n },\n \"findings_by_engine\": {\n \"sast\": 9,\n \"sca\": 38,\n \"secrets\": 1\n },\n \"ratings\": {\n \"sast_rating_full_code\": \"C\",\n \"sca_rating_full_code\": \"D\"\n },\n \"quality_gate_status\": \"FAILED\"\n }\n }\n ]\n}", + "sarif": "{\n \"version\": \"2.1.0\",\n \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n \"runs\": [\n {\n \"tool\": {\n \"driver\": {\n \"name\": \"CodeAnt AI\",\n \"rules\": [\n {\n \"id\": \"CVE-2024-21503\",\n \"name\": \"CVE-2024-21503\"\n },\n {\n \"id\": \"CVE-2024-35255\",\n \"name\": \"CVE-2024-35255\"\n },\n {\n \"id\": \"CVE-2024-47874\",\n \"name\": \"CVE-2024-47874\"\n },\n {\n \"id\": \"CVE-2025-0628\",\n \"name\": \"CVE-2025-0628\"\n },\n {\n \"id\": \"CVE-2025-54121\",\n \"name\": \"CVE-2025-54121\"\n },\n {\n \"id\": \"CVE-2025-6984\",\n \"name\": \"CVE-2025-6984\"\n },\n {\n \"id\": \"CVE-2026-114134\",\n \"name\": \"CVE-2026-114134\"\n },\n {\n \"id\": \"CVE-2026-12770\",\n \"name\": \"CVE-2026-12770\"\n },\n {\n \"id\": \"CVE-2026-12771\",\n \"name\": \"CVE-2026-12771\"\n },\n {\n \"id\": \"CVE-2026-12772\",\n \"name\": \"CVE-2026-12772\"\n },\n {\n \"id\": \"CVE-2026-12773\",\n \"name\": \"CVE-2026-12773\"\n },\n {\n \"id\": \"CVE-2026-12795\",\n \"name\": \"CVE-2026-12795\"\n },\n {\n \"id\": \"CVE-2026-12796\",\n \"name\": \"CVE-2026-12796\"\n },\n {\n \"id\": \"CVE-2026-12797\",\n \"name\": \"CVE-2026-12797\"\n },\n {\n \"id\": \"CVE-2026-12798\",\n \"name\": \"CVE-2026-12798\"\n },\n {\n \"id\": \"CVE-2026-12799\",\n \"name\": \"CVE-2026-12799\"\n },\n {\n \"id\": \"CVE-2026-26013\",\n \"name\": \"CVE-2026-26013\"\n },\n {\n \"id\": \"CVE-2026-34070\",\n \"name\": \"CVE-2026-34070\"\n },\n {\n \"id\": \"CVE-2026-35029\",\n \"name\": \"CVE-2026-35029\"\n },\n {\n \"id\": \"CVE-2026-35030\",\n \"name\": \"CVE-2026-35030\"\n },\n {\n \"id\": \"CVE-2026-37004\",\n \"name\": \"CVE-2026-37004\"\n },\n {\n \"id\": \"CVE-2026-41481\",\n \"name\": \"CVE-2026-41481\"\n },\n {\n \"id\": \"CVE-2026-47101\",\n \"name\": \"CVE-2026-47101\"\n },\n {\n \"id\": \"CVE-2026-47102\",\n \"name\": \"CVE-2026-47102\"\n },\n {\n \"id\": \"CVE-2026-48710\",\n \"name\": \"CVE-2026-48710\"\n },\n {\n \"id\": \"CVE-2026-48817\",\n \"name\": \"CVE-2026-48817\"\n },\n {\n \"id\": \"CVE-2026-48818\",\n \"name\": \"CVE-2026-48818\"\n },\n {\n \"id\": \"CVE-2026-49468\",\n \"name\": \"CVE-2026-49468\"\n },\n {\n \"id\": \"CVE-2026-54282\",\n \"name\": \"CVE-2026-54282\"\n },\n {\n \"id\": \"CVE-2026-54283\",\n \"name\": \"CVE-2026-54283\"\n },\n {\n \"id\": \"CVE-2026-59819\",\n \"name\": \"CVE-2026-59819\"\n },\n {\n \"id\": \"CVE-2026-59820\",\n \"name\": \"CVE-2026-59820\"\n },\n {\n \"id\": \"CVE-2026-59821\",\n \"name\": \"CVE-2026-59821\"\n },\n {\n \"id\": \"CVE-2026-59822\",\n \"name\": \"CVE-2026-59822\"\n },\n {\n \"id\": \"CVE-2026-59823\",\n \"name\": \"CVE-2026-59823\"\n },\n {\n \"id\": \"CVE-2026-84377\",\n \"name\": \"CVE-2026-84377\"\n },\n {\n \"id\": \"debug-endpoints-enabled\",\n \"name\": \"debug-endpoints-enabled\"\n },\n {\n \"id\": \"eval-detected\",\n \"name\": \"eval-detected\"\n },\n {\n \"id\": \"formatted-sql-query\",\n \"name\": \"formatted-sql-query\"\n },\n {\n \"id\": \"generic-password\",\n \"name\": \"generic-password\"\n },\n {\n \"id\": \"path-traversal-open\",\n \"name\": \"path-traversal-open\"\n },\n {\n \"id\": \"python-subprocess-shell-true-format\",\n \"name\": \"python-subprocess-shell-true-format\"\n },\n {\n \"id\": \"python-weak-hash-md5\",\n \"name\": \"python-weak-hash-md5\"\n },\n {\n \"id\": \"sca\",\n \"name\": \"sca\"\n },\n {\n \"id\": \"sql-injection-db-cursor-execute\",\n \"name\": \"sql-injection-db-cursor-execute\"\n },\n {\n \"id\": \"user-eval\",\n \"name\": \"user-eval\"\n }\n ]\n }\n },\n \"results\": [\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/feature/main2.py\"\n },\n \"region\": {\n \"startLine\": 30\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sql-injection-db-cursor-execute\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 24\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 28\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-subprocess-shell-true-format\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 35\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-weak-hash-md5\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 41\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"path-traversal-open\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 49\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"user-eval\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 55\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"eval-detected\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 57\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"debug-endpoints-enabled\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 62\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-35255\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"azure-identity\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-6984\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Langchain Community Vulnerable to XML External Entity (XXE) Attacks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-community\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-84377\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59823\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12799\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12798\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12797\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12796\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12795\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: SSO Debug Flow Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12770\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Admin Key Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12773\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Proxy Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12771\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: M2M JWT Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12772\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-37004\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59821\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59822\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59819\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Local file read via request-supplied OIDC file references\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59820\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Arbitrary file write via path traversal in Skills archive extraction\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47102\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows a user to modify their own user_role via the /user/update endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47101\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-49468\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication Bypass via Host Header Injection\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35030\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication bypass via OIDC userinfo cache key collision\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35029\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-0628\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM Has an Improper Authorization Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Password hash exposure and pass-the-hash authentication bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54283\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54282\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48818\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48817\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48710\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-54121\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has possible denial-of-service vector when parsing large files in multipart forms\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-47874\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette Denial of service (DoS) via multipart/form-data\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-114134\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Black: GitHub Action installs unvalidated required-version from pyproject.toml\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-21503\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Black vulnerable to Regular Expression Denial of Service (ReDoS)\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-34070\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-26013\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-41481\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-text-splitters\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"generic-password\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"generic-password\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/codeanttesting/codeant-demo/55abb4578c64c89f7a4b1e7efea665e5c78ec461/IaC.yaml\"\n },\n \"region\": {\n \"startLine\": 47\n }\n }\n }\n ]\n }\n ],\n \"invocations\": [\n {\n \"executionSuccessful\": true\n }\n ],\n \"properties\": {\n \"total_findings\": 48,\n \"findings_by_severity\": {\n \"HIGH\": 19,\n \"CRITICAL\": 6,\n \"MEDIUM\": 12,\n \"LOW\": 11\n },\n \"findings_by_engine\": {\n \"sast\": 9,\n \"sca\": 38,\n \"secrets\": 1\n },\n \"ratings\": {\n \"sast_rating_full_code\": \"C\",\n \"sca_rating_full_code\": \"D\"\n },\n \"quality_gate_status\": \"FAILED\"\n }\n }\n ]\n}", "junit": "\nQuality Gate: FAILED\nTotal findings: 48\nBy severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11\nBy engine: sast=9, sca=38, secrets=1\nRatings: sast_rating_full_code=C, sca_rating_full_code=D" } } \ No newline at end of file diff --git a/examples/security-pipeline/evidence/enforce/runner-output.txt b/examples/security-pipeline/evidence/enforce/runner-output.txt index 433af5a..be1a589 100644 --- a/examples/security-pipeline/evidence/enforce/runner-output.txt +++ b/examples/security-pipeline/evidence/enforce/runner-output.txt @@ -1,9 +1,11 @@ -Run: https://github.com/codeanttesting/codeant-demo/actions/runs/42308406392 -Selected output (setup and credential lines omitted): +Run: https://github.com/codeanttesting/codeant-demo/actions/runs/42310207026 +Commit: 55abb4578c64c89f7a4b1e7efea665e5c78ec461 +Selected output (credential/setup lines omitted): -2026-11-06T22:57:55.1339842Z 📊 Findings: 48 -2026-11-06T22:57:55.1340079Z 🎯 Quality Gate: FAILED -2026-11-06T22:57:55.1340536Z CodeAnt - SAST sast_rating_full_code C FAILED sast_rating_full_code is C (same or worse than threshold C) -2026-11-06T22:57:55.1341148Z CodeAnt - SCA sca_rating_full_code D FAILED sca_rating_full_code is D (same or worse than threshold C) -2026-11-06T22:57:56.3709030Z Security gate failed -2026-11-06T22:57:56.3741179Z ##[error]Process completed with exit code 1. +2026-11-06T23:11:51.0788127Z QUALITY_GATE: true +2026-11-06T23:12:27.9309233Z 📊 Findings: 48 +2026-11-06T23:12:27.9309569Z 🎯 Quality Gate: FAILED +2026-11-06T23:12:27.9310244Z CodeAnt - SAST sast_rating_full_code C FAILED sast_rating_full_code is C (same or worse than threshold C) +2026-11-06T23:12:27.9311251Z CodeAnt - SCA sca_rating_full_code D FAILED sca_rating_full_code is D (same or worse than threshold C) +2026-11-06T23:12:27.9312186Z ❌ Quality gate FAILED +2026-11-06T23:12:27.9400091Z ##[error]Process completed with exit code 1. diff --git a/examples/security-pipeline/evidence/warn/codeant-qg.xml b/examples/security-pipeline/evidence/report-only/codeant-qg.xml similarity index 100% rename from examples/security-pipeline/evidence/warn/codeant-qg.xml rename to examples/security-pipeline/evidence/report-only/codeant-qg.xml diff --git a/examples/security-pipeline/evidence/warn/codeant.sarif b/examples/security-pipeline/evidence/report-only/codeant.sarif similarity index 96% rename from examples/security-pipeline/evidence/warn/codeant.sarif rename to examples/security-pipeline/evidence/report-only/codeant.sarif index 4cf75f5..c975fa3 100644 --- a/examples/security-pipeline/evidence/warn/codeant.sarif +++ b/examples/security-pipeline/evidence/report-only/codeant.sarif @@ -195,6 +195,25 @@ } }, "results": [ + { + "ruleId": "formatted-sql-query", + "level": "error", + "message": { + "text": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/feature/main2.py" + }, + "region": { + "startLine": 30 + } + } + } + ] + }, { "ruleId": "sql-injection-db-cursor-execute", "level": "error", @@ -205,10 +224,10 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py" }, "region": { - "startLine": 23 + "startLine": 24 } } } @@ -224,10 +243,10 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py" }, "region": { - "startLine": 27 + "startLine": 28 } } } @@ -243,10 +262,10 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py" }, "region": { - "startLine": 34 + "startLine": 35 } } } @@ -262,10 +281,10 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py" }, "region": { - "startLine": 40 + "startLine": 41 } } } @@ -281,10 +300,10 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py" }, "region": { - "startLine": 48 + "startLine": 49 } } } @@ -300,10 +319,10 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py" }, "region": { - "startLine": 54 + "startLine": 55 } } } @@ -319,10 +338,10 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py" }, "region": { - "startLine": 56 + "startLine": 57 } } } @@ -338,29 +357,10 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py" + "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py" }, "region": { - "startLine": 61 - } - } - } - ] - }, - { - "ruleId": "formatted-sql-query", - "level": "error", - "message": { - "text": "Detected possible formatted SQL query. Use parameterized queries instead." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/feature/main2.py" - }, - "region": { - "startLine": 30 + "startLine": 62 } } } @@ -984,7 +984,7 @@ { "physicalLocation": { "artifactLocation": { - "uri": "/mnt/lambda/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/IaC.yaml" + "uri": "/mnt/lambda/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/IaC.yaml" }, "region": { "startLine": 47 diff --git a/examples/security-pipeline/evidence/warn/results.json b/examples/security-pipeline/evidence/report-only/results.json similarity index 83% rename from examples/security-pipeline/evidence/warn/results.json rename to examples/security-pipeline/evidence/report-only/results.json index 9bfb291..fd2c2d3 100644 --- a/examples/security-pipeline/evidence/warn/results.json +++ b/examples/security-pipeline/evidence/report-only/results.json @@ -45,75 +45,75 @@ { "engine": "sast", "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", - "line": 23, + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/feature/main2.py", + "line": 30, + "rule": "formatted-sql-query", + "message": "Detected possible formatted SQL query. Use parameterized queries instead." + }, + { + "engine": "sast", + "severity": "HIGH", + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py", + "line": 24, "rule": "sql-injection-db-cursor-execute", "message": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`." }, { "engine": "sast", "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", - "line": 27, + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py", + "line": 28, "rule": "formatted-sql-query", "message": "Detected possible formatted SQL query. Use parameterized queries instead." }, { "engine": "sast", "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", - "line": 34, + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py", + "line": 35, "rule": "python-subprocess-shell-true-format", "message": "Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs." }, { "engine": "sast", "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", - "line": 40, + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py", + "line": 41, "rule": "python-weak-hash-md5", "message": "Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt." }, { "engine": "sast", "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", - "line": 48, + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py", + "line": 49, "rule": "path-traversal-open", "message": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks." }, { "engine": "sast", "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", - "line": 54, + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py", + "line": 55, "rule": "user-eval", "message": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need." }, { "engine": "sast", "severity": "CRITICAL", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", - "line": 56, + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py", + "line": 57, "rule": "eval-detected", "message": "Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources." }, { "engine": "sast", "severity": "MEDIUM", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py", - "line": 61, + "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py", + "line": 62, "rule": "debug-endpoints-enabled", "message": "Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments." }, - { - "engine": "sast", - "severity": "HIGH", - "file": "/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/feature/main2.py", - "line": 30, - "rule": "formatted-sql-query", - "message": "Detected possible formatted SQL query. Use parameterized queries instead." - }, { "engine": "sca", "severity": "MEDIUM", @@ -421,14 +421,14 @@ { "engine": "secrets", "severity": "HIGH", - "file": "/mnt/lambda/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/IaC.yaml", + "file": "/mnt/lambda/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/IaC.yaml", "line": 47, "rule": "generic-password", "message": "generic-password" } ], "reports": { - "sarif": "{\n \"version\": \"2.1.0\",\n \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n \"runs\": [\n {\n \"tool\": {\n \"driver\": {\n \"name\": \"CodeAnt AI\",\n \"rules\": [\n {\n \"id\": \"CVE-2024-21503\",\n \"name\": \"CVE-2024-21503\"\n },\n {\n \"id\": \"CVE-2024-35255\",\n \"name\": \"CVE-2024-35255\"\n },\n {\n \"id\": \"CVE-2024-47874\",\n \"name\": \"CVE-2024-47874\"\n },\n {\n \"id\": \"CVE-2025-0628\",\n \"name\": \"CVE-2025-0628\"\n },\n {\n \"id\": \"CVE-2025-54121\",\n \"name\": \"CVE-2025-54121\"\n },\n {\n \"id\": \"CVE-2025-6984\",\n \"name\": \"CVE-2025-6984\"\n },\n {\n \"id\": \"CVE-2026-114134\",\n \"name\": \"CVE-2026-114134\"\n },\n {\n \"id\": \"CVE-2026-12770\",\n \"name\": \"CVE-2026-12770\"\n },\n {\n \"id\": \"CVE-2026-12771\",\n \"name\": \"CVE-2026-12771\"\n },\n {\n \"id\": \"CVE-2026-12772\",\n \"name\": \"CVE-2026-12772\"\n },\n {\n \"id\": \"CVE-2026-12773\",\n \"name\": \"CVE-2026-12773\"\n },\n {\n \"id\": \"CVE-2026-12795\",\n \"name\": \"CVE-2026-12795\"\n },\n {\n \"id\": \"CVE-2026-12796\",\n \"name\": \"CVE-2026-12796\"\n },\n {\n \"id\": \"CVE-2026-12797\",\n \"name\": \"CVE-2026-12797\"\n },\n {\n \"id\": \"CVE-2026-12798\",\n \"name\": \"CVE-2026-12798\"\n },\n {\n \"id\": \"CVE-2026-12799\",\n \"name\": \"CVE-2026-12799\"\n },\n {\n \"id\": \"CVE-2026-26013\",\n \"name\": \"CVE-2026-26013\"\n },\n {\n \"id\": \"CVE-2026-34070\",\n \"name\": \"CVE-2026-34070\"\n },\n {\n \"id\": \"CVE-2026-35029\",\n \"name\": \"CVE-2026-35029\"\n },\n {\n \"id\": \"CVE-2026-35030\",\n \"name\": \"CVE-2026-35030\"\n },\n {\n \"id\": \"CVE-2026-37004\",\n \"name\": \"CVE-2026-37004\"\n },\n {\n \"id\": \"CVE-2026-41481\",\n \"name\": \"CVE-2026-41481\"\n },\n {\n \"id\": \"CVE-2026-47101\",\n \"name\": \"CVE-2026-47101\"\n },\n {\n \"id\": \"CVE-2026-47102\",\n \"name\": \"CVE-2026-47102\"\n },\n {\n \"id\": \"CVE-2026-48710\",\n \"name\": \"CVE-2026-48710\"\n },\n {\n \"id\": \"CVE-2026-48817\",\n \"name\": \"CVE-2026-48817\"\n },\n {\n \"id\": \"CVE-2026-48818\",\n \"name\": \"CVE-2026-48818\"\n },\n {\n \"id\": \"CVE-2026-49468\",\n \"name\": \"CVE-2026-49468\"\n },\n {\n \"id\": \"CVE-2026-54282\",\n \"name\": \"CVE-2026-54282\"\n },\n {\n \"id\": \"CVE-2026-54283\",\n \"name\": \"CVE-2026-54283\"\n },\n {\n \"id\": \"CVE-2026-59819\",\n \"name\": \"CVE-2026-59819\"\n },\n {\n \"id\": \"CVE-2026-59820\",\n \"name\": \"CVE-2026-59820\"\n },\n {\n \"id\": \"CVE-2026-59821\",\n \"name\": \"CVE-2026-59821\"\n },\n {\n \"id\": \"CVE-2026-59822\",\n \"name\": \"CVE-2026-59822\"\n },\n {\n \"id\": \"CVE-2026-59823\",\n \"name\": \"CVE-2026-59823\"\n },\n {\n \"id\": \"CVE-2026-84377\",\n \"name\": \"CVE-2026-84377\"\n },\n {\n \"id\": \"debug-endpoints-enabled\",\n \"name\": \"debug-endpoints-enabled\"\n },\n {\n \"id\": \"eval-detected\",\n \"name\": \"eval-detected\"\n },\n {\n \"id\": \"formatted-sql-query\",\n \"name\": \"formatted-sql-query\"\n },\n {\n \"id\": \"generic-password\",\n \"name\": \"generic-password\"\n },\n {\n \"id\": \"path-traversal-open\",\n \"name\": \"path-traversal-open\"\n },\n {\n \"id\": \"python-subprocess-shell-true-format\",\n \"name\": \"python-subprocess-shell-true-format\"\n },\n {\n \"id\": \"python-weak-hash-md5\",\n \"name\": \"python-weak-hash-md5\"\n },\n {\n \"id\": \"sca\",\n \"name\": \"sca\"\n },\n {\n \"id\": \"sql-injection-db-cursor-execute\",\n \"name\": \"sql-injection-db-cursor-execute\"\n },\n {\n \"id\": \"user-eval\",\n \"name\": \"user-eval\"\n }\n ]\n }\n },\n \"results\": [\n {\n \"ruleId\": \"sql-injection-db-cursor-execute\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 23\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 27\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-subprocess-shell-true-format\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 34\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-weak-hash-md5\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 40\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"path-traversal-open\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 48\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"user-eval\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 54\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"eval-detected\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 56\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"debug-endpoints-enabled\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 61\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/feature/main2.py\"\n },\n \"region\": {\n \"startLine\": 30\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-35255\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"azure-identity\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-6984\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Langchain Community Vulnerable to XML External Entity (XXE) Attacks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-community\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-84377\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59823\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12799\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12798\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12797\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12796\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12795\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: SSO Debug Flow Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12770\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Admin Key Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12773\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Proxy Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12771\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: M2M JWT Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12772\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-37004\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59821\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59822\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59819\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Local file read via request-supplied OIDC file references\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59820\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Arbitrary file write via path traversal in Skills archive extraction\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47102\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows a user to modify their own user_role via the /user/update endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47101\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-49468\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication Bypass via Host Header Injection\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35030\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication bypass via OIDC userinfo cache key collision\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35029\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-0628\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM Has an Improper Authorization Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Password hash exposure and pass-the-hash authentication bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54283\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54282\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48818\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48817\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48710\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-54121\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has possible denial-of-service vector when parsing large files in multipart forms\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-47874\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette Denial of service (DoS) via multipart/form-data\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-114134\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Black: GitHub Action installs unvalidated required-version from pyproject.toml\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-21503\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Black vulnerable to Regular Expression Denial of Service (ReDoS)\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-41481\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-text-splitters\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-34070\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-26013\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"generic-password\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"generic-password\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/codeanttesting/codeant-demo/ed6a2f3e27ef742f7972b0072a3195543e3f93aa/IaC.yaml\"\n },\n \"region\": {\n \"startLine\": 47\n }\n }\n }\n ]\n }\n ],\n \"invocations\": [\n {\n \"executionSuccessful\": true\n }\n ],\n \"properties\": {\n \"total_findings\": 48,\n \"findings_by_severity\": {\n \"HIGH\": 19,\n \"CRITICAL\": 6,\n \"MEDIUM\": 12,\n \"LOW\": 11\n },\n \"findings_by_engine\": {\n \"sast\": 9,\n \"sca\": 38,\n \"secrets\": 1\n },\n \"ratings\": {\n \"sast_rating_full_code\": \"C\",\n \"sca_rating_full_code\": \"D\"\n },\n \"quality_gate_status\": \"FAILED\"\n }\n }\n ]\n}", + "sarif": "{\n \"version\": \"2.1.0\",\n \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n \"runs\": [\n {\n \"tool\": {\n \"driver\": {\n \"name\": \"CodeAnt AI\",\n \"rules\": [\n {\n \"id\": \"CVE-2024-21503\",\n \"name\": \"CVE-2024-21503\"\n },\n {\n \"id\": \"CVE-2024-35255\",\n \"name\": \"CVE-2024-35255\"\n },\n {\n \"id\": \"CVE-2024-47874\",\n \"name\": \"CVE-2024-47874\"\n },\n {\n \"id\": \"CVE-2025-0628\",\n \"name\": \"CVE-2025-0628\"\n },\n {\n \"id\": \"CVE-2025-54121\",\n \"name\": \"CVE-2025-54121\"\n },\n {\n \"id\": \"CVE-2025-6984\",\n \"name\": \"CVE-2025-6984\"\n },\n {\n \"id\": \"CVE-2026-114134\",\n \"name\": \"CVE-2026-114134\"\n },\n {\n \"id\": \"CVE-2026-12770\",\n \"name\": \"CVE-2026-12770\"\n },\n {\n \"id\": \"CVE-2026-12771\",\n \"name\": \"CVE-2026-12771\"\n },\n {\n \"id\": \"CVE-2026-12772\",\n \"name\": \"CVE-2026-12772\"\n },\n {\n \"id\": \"CVE-2026-12773\",\n \"name\": \"CVE-2026-12773\"\n },\n {\n \"id\": \"CVE-2026-12795\",\n \"name\": \"CVE-2026-12795\"\n },\n {\n \"id\": \"CVE-2026-12796\",\n \"name\": \"CVE-2026-12796\"\n },\n {\n \"id\": \"CVE-2026-12797\",\n \"name\": \"CVE-2026-12797\"\n },\n {\n \"id\": \"CVE-2026-12798\",\n \"name\": \"CVE-2026-12798\"\n },\n {\n \"id\": \"CVE-2026-12799\",\n \"name\": \"CVE-2026-12799\"\n },\n {\n \"id\": \"CVE-2026-26013\",\n \"name\": \"CVE-2026-26013\"\n },\n {\n \"id\": \"CVE-2026-34070\",\n \"name\": \"CVE-2026-34070\"\n },\n {\n \"id\": \"CVE-2026-35029\",\n \"name\": \"CVE-2026-35029\"\n },\n {\n \"id\": \"CVE-2026-35030\",\n \"name\": \"CVE-2026-35030\"\n },\n {\n \"id\": \"CVE-2026-37004\",\n \"name\": \"CVE-2026-37004\"\n },\n {\n \"id\": \"CVE-2026-41481\",\n \"name\": \"CVE-2026-41481\"\n },\n {\n \"id\": \"CVE-2026-47101\",\n \"name\": \"CVE-2026-47101\"\n },\n {\n \"id\": \"CVE-2026-47102\",\n \"name\": \"CVE-2026-47102\"\n },\n {\n \"id\": \"CVE-2026-48710\",\n \"name\": \"CVE-2026-48710\"\n },\n {\n \"id\": \"CVE-2026-48817\",\n \"name\": \"CVE-2026-48817\"\n },\n {\n \"id\": \"CVE-2026-48818\",\n \"name\": \"CVE-2026-48818\"\n },\n {\n \"id\": \"CVE-2026-49468\",\n \"name\": \"CVE-2026-49468\"\n },\n {\n \"id\": \"CVE-2026-54282\",\n \"name\": \"CVE-2026-54282\"\n },\n {\n \"id\": \"CVE-2026-54283\",\n \"name\": \"CVE-2026-54283\"\n },\n {\n \"id\": \"CVE-2026-59819\",\n \"name\": \"CVE-2026-59819\"\n },\n {\n \"id\": \"CVE-2026-59820\",\n \"name\": \"CVE-2026-59820\"\n },\n {\n \"id\": \"CVE-2026-59821\",\n \"name\": \"CVE-2026-59821\"\n },\n {\n \"id\": \"CVE-2026-59822\",\n \"name\": \"CVE-2026-59822\"\n },\n {\n \"id\": \"CVE-2026-59823\",\n \"name\": \"CVE-2026-59823\"\n },\n {\n \"id\": \"CVE-2026-84377\",\n \"name\": \"CVE-2026-84377\"\n },\n {\n \"id\": \"debug-endpoints-enabled\",\n \"name\": \"debug-endpoints-enabled\"\n },\n {\n \"id\": \"eval-detected\",\n \"name\": \"eval-detected\"\n },\n {\n \"id\": \"formatted-sql-query\",\n \"name\": \"formatted-sql-query\"\n },\n {\n \"id\": \"generic-password\",\n \"name\": \"generic-password\"\n },\n {\n \"id\": \"path-traversal-open\",\n \"name\": \"path-traversal-open\"\n },\n {\n \"id\": \"python-subprocess-shell-true-format\",\n \"name\": \"python-subprocess-shell-true-format\"\n },\n {\n \"id\": \"python-weak-hash-md5\",\n \"name\": \"python-weak-hash-md5\"\n },\n {\n \"id\": \"sca\",\n \"name\": \"sca\"\n },\n {\n \"id\": \"sql-injection-db-cursor-execute\",\n \"name\": \"sql-injection-db-cursor-execute\"\n },\n {\n \"id\": \"user-eval\",\n \"name\": \"user-eval\"\n }\n ]\n }\n },\n \"results\": [\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/feature/main2.py\"\n },\n \"region\": {\n \"startLine\": 30\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sql-injection-db-cursor-execute\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 24\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"formatted-sql-query\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected possible formatted SQL query. Use parameterized queries instead.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 28\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-subprocess-shell-true-format\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 35\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"python-weak-hash-md5\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 41\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"path-traversal-open\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 49\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"user-eval\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 55\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"eval-detected\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 57\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"debug-endpoints-enabled\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments.\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/github/github.com/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/security_vulns.py\"\n },\n \"region\": {\n \"startLine\": 62\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-35255\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"azure-identity\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-6984\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Langchain Community Vulnerable to XML External Entity (XXE) Attacks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-community\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-84377\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59823\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12799\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12798\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12797\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12796\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12795\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: SSO Debug Flow Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12770\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Admin Key Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12773\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Proxy Has Improper Authentication\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12771\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: M2M JWT Handler Has Improper Authorization\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-12772\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-37004\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59821\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59822\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59819\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LiteLLM: Local file read via request-supplied OIDC file references\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-59820\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LiteLLM: Arbitrary file write via path traversal in Skills archive extraction\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47102\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows a user to modify their own user_role via the /user/update endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-47101\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-49468\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication Bypass via Host Header Injection\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35030\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Authentication bypass via OIDC userinfo cache key collision\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-35029\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-0628\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM Has an Improper Authorization Vulnerability\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"sca\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LiteLLM: Password hash exposure and pass-the-hash authentication bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"litellm\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54283\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-54282\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48818\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48817\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-48710\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2025-54121\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Starlette has possible denial-of-service vector when parsing large files in multipart forms\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-47874\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Starlette Denial of service (DoS) via multipart/form-data\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"starlette\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-114134\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"Black: GitHub Action installs unvalidated required-version from pyproject.toml\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2024-21503\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"Black vulnerable to Regular Expression Denial of Service (ReDoS)\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"black\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-41481\",\n \"level\": \"warning\",\n \"message\": {\n \"text\": \"LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-text-splitters\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-34070\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"CVE-2026-26013\",\n \"level\": \"note\",\n \"message\": {\n \"text\": \"LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"langchain-core\"\n }\n }\n }\n ]\n },\n {\n \"ruleId\": \"generic-password\",\n \"level\": \"error\",\n \"message\": {\n \"text\": \"generic-password\"\n },\n \"locations\": [\n {\n \"physicalLocation\": {\n \"artifactLocation\": {\n \"uri\": \"/mnt/lambda/codeanttesting/codeant-demo/b5cedf7a812cb395e914381f92dc64f94fee39bd/IaC.yaml\"\n },\n \"region\": {\n \"startLine\": 47\n }\n }\n }\n ]\n }\n ],\n \"invocations\": [\n {\n \"executionSuccessful\": true\n }\n ],\n \"properties\": {\n \"total_findings\": 48,\n \"findings_by_severity\": {\n \"HIGH\": 19,\n \"CRITICAL\": 6,\n \"MEDIUM\": 12,\n \"LOW\": 11\n },\n \"findings_by_engine\": {\n \"sast\": 9,\n \"sca\": 38,\n \"secrets\": 1\n },\n \"ratings\": {\n \"sast_rating_full_code\": \"C\",\n \"sca_rating_full_code\": \"D\"\n },\n \"quality_gate_status\": \"FAILED\"\n }\n }\n ]\n}", "junit": "\nQuality Gate: FAILED\nTotal findings: 48\nBy severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11\nBy engine: sast=9, sca=38, secrets=1\nRatings: sast_rating_full_code=C, sca_rating_full_code=D" } } \ No newline at end of file diff --git a/examples/security-pipeline/evidence/report-only/runner-output.txt b/examples/security-pipeline/evidence/report-only/runner-output.txt new file mode 100644 index 0000000..ada73cb --- /dev/null +++ b/examples/security-pipeline/evidence/report-only/runner-output.txt @@ -0,0 +1,9 @@ +Run: https://github.com/codeanttesting/codeant-demo/actions/runs/42309878084 +Commit: b5cedf7a812cb395e914381f92dc64f94fee39bd +Selected output (credential/setup lines omitted): + +2026-11-06T23:08:59.1663217Z QUALITY_GATE: false +2026-11-06T23:10:40.0905720Z 📊 Findings: 48 +2026-11-06T23:10:40.0906160Z 🎯 Quality Gate: FAILED +2026-11-06T23:10:40.0907105Z CodeAnt - SAST sast_rating_full_code C FAILED sast_rating_full_code is C (same or worse than threshold C) +2026-11-06T23:10:40.0908346Z CodeAnt - SCA sca_rating_full_code D FAILED sca_rating_full_code is D (same or worse than threshold C) diff --git a/examples/security-pipeline/evidence/warn/runner-output.txt b/examples/security-pipeline/evidence/warn/runner-output.txt deleted file mode 100644 index 5f2f088..0000000 --- a/examples/security-pipeline/evidence/warn/runner-output.txt +++ /dev/null @@ -1,8 +0,0 @@ -Run: https://github.com/codeanttesting/codeant-demo/actions/runs/42308035025 -Selected output (setup and credential lines omitted): - -2026-11-06T22:54:15.0435683Z 📊 Findings: 48 -2026-11-06T22:54:15.0436263Z 🎯 Quality Gate: FAILED -2026-11-06T22:54:15.0437216Z CodeAnt - SAST sast_rating_full_code C FAILED sast_rating_full_code is C (same or worse than threshold C) -2026-11-06T22:54:15.0439250Z CodeAnt - SCA sca_rating_full_code D FAILED sca_rating_full_code is D (same or worse than threshold C) -2026-11-06T22:54:16.7456100Z ##[warning]Security gate failed; warning mode is enabled From 45aaf87471e403df23a96adb71203079b143f223 Mon Sep 17 00:00:00 2001 From: Chinmay Pramod Bharti Date: Sat, 7 Nov 2026 05:11:30 +0530 Subject: [PATCH 12/12] Use released v0.0.6 action in security pipeline example --- .github/workflows/codeant-security.yml | 2 +- examples/security-pipeline/README.md | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeant-security.yml b/.github/workflows/codeant-security.yml index 6148a89..a41127b 100644 --- a/.github/workflows/codeant-security.yml +++ b/.github/workflows/codeant-security.yml @@ -21,7 +21,7 @@ jobs: timeout-minutes: 25 steps: - name: Scan repository - uses: CodeAnt-AI/codeant-ci-scan-action@d4e7f37809f110ab9216766e53fbad0061393e27 + uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6 with: access_token: ${{ secrets.CODEANT_TOKEN || secrets.ACCESS_TOKEN_GITHUB }} scanners: sast,sca,secrets diff --git a/examples/security-pipeline/README.md b/examples/security-pipeline/README.md index b211882..5326bd8 100644 --- a/examples/security-pipeline/README.md +++ b/examples/security-pipeline/README.md @@ -12,8 +12,8 @@ Copy [the workflow](../../.github/workflows/codeant-security.yml), then: 5. Replace the workflow's branch triggers with your target branch and run it. Set `quality_gate: 'true'` to fail the action on a failed native verdict or results -timeout. Set it to `'false'` for report-only runs. The pinned action revision -supports this input; `v0.0.5` does not. See [action PR #5](https://github.com/CodeAnt-AI/codeant-ci-scan-action/pull/5). +timeout. Set it to `'false'` for report-only runs. The workflow uses +[v0.0.6](https://github.com/CodeAnt-AI/codeant-ci-scan-action/releases/tag/v0.0.6). Configure thresholds before enforcing: without conditions, CodeAnt can return PASSED. Native full-code gates cover SAST/SCA/IaC ratings and duplicate code. @@ -29,7 +29,7 @@ because they do not receive repository secrets. ## Verified action runs -Both runs returned 48 findings and a native FAILED verdict (SAST C, SCA D). +These pre-release runs returned 48 findings and a native FAILED verdict (SAST C, SCA D). | Input | Run | Result | | --- | --- | --- |