All pull requests

Pull requests

• Python: model glob patterns as path-injection sinks (CWE-288 API-key auth bypass)

  #198·felickz with CopilotAI opened Oct 16, 2026·9 of 12 tasks·

  ·
  1

  2

  

• [NEW QUERY] Python: py/custom/weak-crypto-randomness (CWE-338)

  #197·felickz with CopilotAI opened Oct 16, 2026·8 of 9 tasks·

  ·
  1

  

• [NEW QUERY] Python: py/file-upload-resource-handling (CWE-377, CWE-400)

  #195·felickz with CopilotAI opened Oct 16, 2026·8 of 9 tasks·

  ·
  1

  

• [NEW QUERY] Python CWE-532: clear-text logging of sensitive AWS Lambda events

  #193·felickz with CopilotAI opened Oct 16, 2026·8 of 9 tasks·

  ·
  1

  

• [NEW DATA EXTENSION] Python: boto3 DynamoDB database sources for py/unsafe-deserialization (CWE-502)

  #192·felickz with CopilotAI opened Oct 16, 2026·9 of 12 tasks·

  ·
  1

  

• [NEW QUERY] Ruby: rb/weak-crypto-randomness, hard-coded IV passed to OpenSSL::Cipher (CWE-329)

  #190·felickz with CopilotAI opened Oct 16, 2026·9 tasks done·

  ·
  1

  

• [NEW DATA EXTENSION] Ruby: taint summaries for String#to_sym/#intern (rb/sql-injection gap)

  #187·felickz with CopilotAI opened Oct 16, 2026·11 of 12 tasks·

  ·
  1

  1

  

• [WIP] Fix critical CWE findings in JavaScript data extension

  #184·felickz with CopilotAI opened Oct 16, 2026·6 tasks·

  ·
  1

  

• [UPDATE QUERY] js/missing-token-validation: cover session-guarded routes, express-unless and client-sessions

  #183·felickz with CopilotAI opened Oct 16, 2026·

  ·
  1

  

• [UPDATE QUERY] java/xxe: add regression test showing existing coverage of Spring @RequestBody XXE through a shared StAX helper

  #181·felickz with CopilotAI opened Oct 16, 2026·6 of 8 tasks·

  ·
  1

  1

  

• [NEW QUERY] Java: unrestricted file upload to web-accessible directory (CWE-434)

  #180·felickz with CopilotAI opened Oct 16, 2026·8 of 9 tasks·

  ·
  1

  3

  

• [NEW QUERY] Java: java/weak-pbkdf2-iteration-count (low PBKDF2 iteration count, CWE-327/916)

  #177·felickz with CopilotAI opened Oct 16, 2026·8 of 9 tasks·

  ·
  1

  1

  

• [UPDATE QUERY] java/path-injection: add regression test for Android content display-name path traversal (CWE-22)

  #175·felickz with CopilotAI opened Oct 16, 2026·6 of 8 tasks·

  ·
  1

  4

  

• [NEW QUERY] AngularJS client-side template injection (js/angularjs-client-side-template-injection, CWE-1336)

  #172·felickz with CopilotAI opened Oct 16, 2026·7 of 9 tasks·

  ·
  1

  

• [UPDATE QUERY] Detect SQL injection in JSP scriptlets (new js/jsp-sql-injection)

  #171·felickz with CopilotAI opened Oct 16, 2026·

  ·
  1

  

• [NEW QUERY] Go: go/insecure-randomness-key-material (CWE-338)

  #169·felickz with CopilotAI opened Oct 16, 2026·8 of 9 tasks·

  ·
  1

  1

  

• [UPDATE QUERY] cs/xml/insecure-dtd-handling: triage of CWE-611 gap (no query change, false positive)

  #166·felickz with CopilotAI opened Oct 16, 2026·8 tasks·

  ·
  1

  

• [UPDATE QUERY] C#: regression test for cs/sql-injection on EF Core ExecuteSqlCommand(Async); reported gap is a false positive

  #165·felickz with CopilotAI opened Oct 16, 2026·6 of 8 tasks·

  ·
  1

  7

  

• [NEW QUERY] C#: IDOR without ownership check (CWE-566/639) and CORS credentials with any origin (CWE-942)

  #163·felickz with CopilotAI opened Oct 16, 2026·9 tasks done·

  ·
  1

  2

  

• [NEW QUERY] C#: predictable session tokens (CWE-330), Base64-only stored passwords (CWE-261), reverse DNS access decisions (CWE-350)

  #160·felickz with CopilotAI opened Oct 16, 2026·9 tasks done·

  ·
  1

  9

  

• [NEW QUERY] C#: cs/file-upload-resource-handling (CWE-15/400/427/434/789)

  #159·felickz with CopilotAI opened Oct 16, 2026·8 of 9 tasks·

  ·
  1

  2

  

• [NEW QUERY] C/C++: cpp/untrusted-search-path (CWE-426)

  #157·felickz with CopilotAI opened Oct 16, 2026·8 of 9 tasks·

  ·
  1

  1

  

• [NEW QUERY] cpp/credential-and-data-exposure: plaintext password read from a file and used for authentication (CWE-256)

  #156·felickz with CopilotAI opened Oct 16, 2026·4 of 9 tasks·

  ·
  1

  

• [NEW QUERY] C/C++: insecure handling of security-sensitive resources (CWE-15, 114, 247, 428, 535)

  #153·felickz with CopilotAI opened Oct 16, 2026·8 of 9 tasks·

  ·
  1

  2

  

• [NEW QUERY] Ruby: rb/stored-request-forgery for SSRF via stored ActiveRecord fields (CWE-918)

  #150·felickz with CopilotAI opened Oct 16, 2026·8 of 9 tasks·

  ·
  1

  5