vercel-labs/deepsec

This directory holds the [deepsec](https://www.npmjs.com/package/deepsec)

Or browse on [GitHub](https://github.com/vercel/deepsec/tree/main/docs).

[GitHub](https://github.com/vercel/deepsec/tree/main/docs).

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

43       ],       "snippet": "    // Convert SSH to HTTPS\n    const https = remote.replace(/^git@github\\.com:/, \"https://github.com/\").replace(/\\.git$/, \"\");\n    if (https.includes(\"github.com\")) {\n      return `${https}/blob/${b

],       "snippet": "    // Convert SSH to HTTPS\n    const https = remote.replace(/^git@github\\.com:/, \"https://github.com/\").replace(/\\.git$/, \"\");\n    if (https.includes(\"github.com\")) {\n      return `${https}/blob/${branch}`;\

"snippet": "    // Convert SSH to HTTPS\n    const https = remote.replace(/^git@github\\.com:/, \"https://github.com/\").replace(/\\.git$/, \"\");\n    if (https.includes(\"github.com\")) {\n      return `${https}/blob/${branch}`;\n    }",

158       ],       "snippet": "        ...owners.oncall.slice(0, 3).map((o) => {\n          const gh = o.github_username\n            ? ` • [@${o.github_username}](https://github.com/${o.github_username})`\n            : \"\";\n          re

],       "snippet": "        ...owners.oncall.slice(0, 3).map((o) => {\n          const gh = o.github_username\n            ? ` • [@${o.github_username}](https://github.com/${o.github_username})`\n            : \"\";\n          return `- ${

"snippet": "        ...owners.oncall.slice(0, 3).map((o) => {\n          const gh = o.github_username\n            ? ` • [@${o.github_username}](https://github.com/${o.github_username})`\n            : \"\";\n          return `- ${o.name} <

159       ],       "snippet": "        ...owners.oncall.slice(0, 3).map((o) => {\n          const gh = o.github_username\n            ? ` • [@${o.github_username}](https://github.com/${o.github_username})`\n            : \"\";\n          re

],       "snippet": "        ...owners.oncall.slice(0, 3).map((o) => {\n          const gh = o.github_username\n            ? ` • [@${o.github_username}](https://github.com/${o.github_username})`\n            : \"\";\n          return `- ${

"snippet": "        ...owners.oncall.slice(0, 3).map((o) => {\n          const gh = o.github_username\n            ? ` • [@${o.github_username}](https://github.com/${o.github_username})`\n            : \"\";\n          return `- ${o.name} <

"vulnSlug": "rce",       "title": "Shell command injection via JSON.stringify in git commit message",       "description": "Line 31 builds a shell command string with `git commit -m ${JSON.stringify(message)}` and passes it to execSync, whi

"title": "Shell command injection via JSON.stringify in git commit message",       "description": "Line 31 builds a shell command string with `git commit -m ${JSON.stringify(message)}` and passes it to execSync, which spawns a shell. JSON.s

"description": "Line 31 builds a shell command string with `git commit -m ${JSON.stringify(message)}` and passes it to execSync, which spawns a shell. JSON.stringify only escapes `\"`, `\\`, and control characters \u2014 it does NOT escape 

"description": "Line 31 builds a shell command string with `git commit -m ${JSON.stringify(message)}` and passes it to execSync, which spawns a shell. JSON.stringify only escapes `\"`, `\\`, and control characters \u2014 it does NOT escape 

"vulnSlug": "rce",       "title": "Shell command injection via DEEPSEC_DATA_BRANCH environment variable",       "description": "Lines 41 and 47 interpolate the `DATA_BRANCH` constant \u2014 read from `process.env.DEEPSEC_DATA_BRANCH` at mod

"title": "Shell command injection via DEEPSEC_DATA_BRANCH environment variable",       "description": "Lines 41 and 47 interpolate the `DATA_BRANCH` constant \u2014 read from `process.env.DEEPSEC_DATA_BRANCH` at module load (line 5) \u2014 

"description": "Lines 41 and 47 interpolate the `DATA_BRANCH` constant \u2014 read from `process.env.DEEPSEC_DATA_BRANCH` at module load (line 5) \u2014 directly into shell command strings: `git pull --rebase origin ${DATA_BRANCH}` and `git

"description": "Lines 41 and 47 interpolate the `DATA_BRANCH` constant \u2014 read from `process.env.DEEPSEC_DATA_BRANCH` at module load (line 5) \u2014 directly into shell command strings: `git pull --rebase origin ${DATA_BRANCH}` and `git

"revalidation": {         "verdict": "fixed",         "reasoning": "The current code reads DEEPSEC_DATA_BRANCH into RAW_BRANCH and validates it against /^[A-Za-z0-9._/-]+$/ before assigning DATA_BRANCH. The git pull and push operations are 

"verdict": "fixed",         "reasoning": "The current code reads DEEPSEC_DATA_BRANCH into RAW_BRANCH and validates it against /^[A-Za-z0-9._/-]+$/ before assigning DATA_BRANCH. The git pull and push operations are performed with execFileSyn

"reasoning": "The current code reads DEEPSEC_DATA_BRANCH into RAW_BRANCH and validates it against /^[A-Za-z0-9._/-]+$/ before assigning DATA_BRANCH. The git pull and push operations are performed with execFileSync argv arrays: [\"pull\", \"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

117       ],       "snippet": "//\n// The Claude Agent SDK / Codex CLI talks to us via ANTHROPIC_BASE_URL or\n// OPENAI_BASE_URL set to http://127.0.0.1:PROXY_PORT (or .../v1 for OpenAI).\n//\n// Env:",

],       "snippet": "//\n// The Claude Agent SDK / Codex CLI talks to us via ANTHROPIC_BASE_URL or\n// OPENAI_BASE_URL set to http://127.0.0.1:PROXY_PORT (or .../v1 for OpenAI).\n//\n// Env:",       "matchedPattern": "\\b(?:169\\.254\\.169\

"snippet": "//\n// The Claude Agent SDK / Codex CLI talks to us via ANTHROPIC_BASE_URL or\n// OPENAI_BASE_URL set to http://127.0.0.1:PROXY_PORT (or .../v1 for OpenAI).\n//\n// Env:",

81       ],       "snippet": "    const url = UPSTREAM + req.url;\n    const up = await fetch(url, {\n      method: req.method,\n      headers,",

],       "snippet": "    const url = UPSTREAM + req.url;\n    const up = await fetch(url, {\n      method: req.method,\n      headers,",       "matchedPattern": "fetch(url) — default redirect: follow + caller-style URL"

"snippet": "    const url = UPSTREAM + req.url;\n    const up = await fetch(url, {\n      method: req.method,\n      headers,",

"matchedPattern": "fetch(url) — default redirect: follow + caller-style URL"

[Credential-related source omitted]

489       ],       "snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub.

],       "snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub...\"\n  rm

"snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub...\"\n  rm -rf /tmp

"snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub...\"\n  rm -rf /tmp

338       ],       "snippet": "\nconst PROXY_PORT = 8787;\nconst PROXY_URL = `http://127.0.0.1:${PROXY_PORT}`;\n// Path differs by upload mode (see DeepsecMode):\n//   dev       — uploaded source workspace, proxy lives at its source locatio

],       "snippet": "\nconst PROXY_PORT = 8787;\nconst PROXY_URL = `http://127.0.0.1:${PROXY_PORT}`;\n// Path differs by upload mode (see DeepsecMode):\n//   dev       — uploaded source workspace, proxy lives at its source location",       

"snippet": "\nconst PROXY_PORT = 8787;\nconst PROXY_URL = `http://127.0.0.1:${PROXY_PORT}`;\n// Path differs by upload mode (see DeepsecMode):\n//   dev       — uploaded source workspace, proxy lives at its source location",

560       ],       "snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub.

],       "snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub...\"\n  rm

"snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub...\"\n  rm -rf /tmp

"snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub...\"\n  rm -rf /tmp

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

409       ],       "snippet": "\nconst PROXY_PORT = 8787;\nconst PROXY_URL = `http://127.0.0.1:${PROXY_PORT}`;\n// Path differs by upload mode (see DeepsecMode):\n//   dev       — uploaded source workspace, proxy lives at its source locatio

],       "snippet": "\nconst PROXY_PORT = 8787;\nconst PROXY_URL = `http://127.0.0.1:${PROXY_PORT}`;\n// Path differs by upload mode (see DeepsecMode):\n//   dev       — uploaded source workspace, proxy lives at its source location",       

"snippet": "\nconst PROXY_PORT = 8787;\nconst PROXY_URL = `http://127.0.0.1:${PROXY_PORT}`;\n// Path differs by upload mode (see DeepsecMode):\n//   dev       — uploaded source workspace, proxy lives at its source location",

583       ],       "snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub.

],       "snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub...\"\n  rm

"snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub...\"\n  rm -rf /tmp

"snippet": "  esac\n  local rel=\"14.1.1\"\n  local url=\"https://github.com/BurntSushi/ripgrep/releases/download/\\${rel}/ripgrep-\\${rel}-\\${arch}.tar.gz\"\n  log \"Downloading ripgrep \\${rel} (\\${arch}) from GitHub...\"\n  rm -rf /tmp

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"vulnSlug": "rce",       "title": "Command injection via file.filePath in revalidation git log",       "description": "`buildRevalidatePrompt` runs ``execSync(`git log --oneline --since=\"3 months ago\" -n 10 -- \"${file.filePath}\"`, { cwd

"title": "Command injection via file.filePath in revalidation git log",       "description": "`buildRevalidatePrompt` runs ``execSync(`git log --oneline --since=\"3 months ago\" -n 10 -- \"${file.filePath}\"`, { cwd: projectRoot, … })`` to 

"description": "`buildRevalidatePrompt` runs ``execSync(`git log --oneline --since=\"3 months ago\" -n 10 -- \"${file.filePath}\"`, { cwd: projectRoot, … })`` to gather git history for the prompt. `file.filePath` comes from a `FileRecord`, 

39       ],       "snippet": "    // HTTPS: https://github.com/owner/repo.git\n    const httpsMatch = url.match(/github\\.com\\/(.+?)(?:\\.git)?$/);\n    if (httpsMatch) return httpsMatch[1];\n",

],       "snippet": "    // HTTPS: https://github.com/owner/repo.git\n    const httpsMatch = url.match(/github\\.com\\/(.+?)(?:\\.git)?$/);\n    if (httpsMatch) return httpsMatch[1];\n",       "matchedPattern": "URL validation regex with gr

"snippet": "    // HTTPS: https://github.com/owner/repo.git\n    const httpsMatch = url.match(/github\\.com\\/(.+?)(?:\\.git)?$/);\n    if (httpsMatch) return httpsMatch[1];\n",

[Credential-related source omitted]

"snippet": "    `const t = createTool({ name: \"x\", execute: async () => ({}) });`,\n    `const t = defineTool({ name: \"x\" });`,\n    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs 

26       ],       "snippet": "    `const t = defineTool({ name: \"x\" });`,\n    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n  

],       "snippet": "    `const t = defineTool({ name: \"x\" });`,\n    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await 

"snippet": "    `const t = defineTool({ name: \"x\" });`,\n    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url

"snippet": "    `const t = defineTool({ name: \"x\" });`,\n    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url

"snippet": "    `const t = createTool({ name: \"x\", execute: async () => ({}) });`,\n    `const t = defineTool({ name: \"x\" });`,\n    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs 

"snippet": "    `const myTool = tool({\\n  description: \"do thing\",\\n  parameters: z.object({}),\\n  execute: async () => ({}),\\n});`,\n    `const t = createTool({ name: \"x\", execute: async () => ({}) });`,\n    `const t = defineTool(

"snippet": "    `const t = createTool({ name: \"x\", execute: async () => ({}) });`,\n    `const t = defineTool({ name: \"x\" });`,\n    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs 

25       ],       "snippet": "    `const t = defineTool({ name: \"x\" });`,\n    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n  

],       "snippet": "    `const t = defineTool({ name: \"x\" });`,\n    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await 

"snippet": "    `const t = defineTool({ name: \"x\" });`,\n    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url

"snippet": "    `const t = defineTool({ name: \"x\" });`,\n    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url

26       ],       "snippet": "    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox }

],       "snippet": "    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"s

"snippet": "    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";

"snippet": "    `import { exec } from \"child_process\";\\nexec(userInput);`,\n    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";

27       ],       "snippet": "    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { 

],       "snippet": "    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTo

"snippet": "    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTool } from

"snippet": "    `eval(userInput);`,\n    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTool } from

28       ],       "snippet": "    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTool } from \"lang

],       "snippet": "    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTool } from \"langchain/too

"snippet": "    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTool } from \"langchain/tools\";\\nc

29       ],       "snippet": "    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTool } from \"langchain/tools\";\\nconst t = new DynamicTool({ name: \"x\" });`,\n  ],\

],       "snippet": "    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTool } from \"langchain/tools\";\\nconst t = new DynamicTool({ name: \"x\" });`,\n  ],\n  match(

"snippet": "    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTool } from \"langchain/tools\";\\nconst t = new DynamicTool({ name: \"x\" });`,\n  ],\n  match(content, 

28       ],       "snippet": "    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTool } from \"lang

],       "snippet": "    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTool } from \"langchain/too

"snippet": "    `import fs from \"fs\";\\nfs.writeFile(path, data, () => {});`,\n    `await fetch(url);`,\n    `import { sandbox } from \"sandbox\";\\nawait sandbox.runCode(code);`,\n    `import { DynamicTool } from \"langchain/tools\";\\nc

"matchedPattern": "fetch(url) — default redirect: follow + caller-style URL"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

13       ],       "snippet": "  noiseTier: \"precise\" as const,\n  slug: \"dockerfile-curl-pipe-unverified\",\n  description: \"RUN curl|wget piped to shell/tar without checksum verification\",\n  filePatterns: [\"**/Dockerfile\", \"**/Doc

],       "snippet": "  noiseTier: \"precise\" as const,\n  slug: \"dockerfile-curl-pipe-unverified\",\n  description: \"RUN curl|wget piped to shell/tar without checksum verification\",\n  filePatterns: [\"**/Dockerfile\", \"**/Dockerfile.*

"snippet": "  noiseTier: \"precise\" as const,\n  slug: \"dockerfile-curl-pipe-unverified\",\n  description: \"RUN curl|wget piped to shell/tar without checksum verification\",\n  filePatterns: [\"**/Dockerfile\", \"**/Dockerfile.*\", \"**/

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

71       ],       "snippet": "  return anthropic.completions.create({ model: \"claude\", prompt: \"x\" });\n}`,\n    `export async function POST() {\n  await fetch(\"https://ai-gateway.vercel.sh/v1/chat\", { method: \"POST\" });\n  return n

],       "snippet": "  return anthropic.completions.create({ model: \"claude\", prompt: \"x\" });\n}`,\n    `export async function POST() {\n  await fetch(\"https://ai-gateway.vercel.sh/v1/chat\", { method: \"POST\" });\n  return new Respon

"snippet": "  return anthropic.completions.create({ model: \"claude\", prompt: \"x\" });\n}`,\n    `export async function POST() {\n  await fetch(\"https://ai-gateway.vercel.sh/v1/chat\", { method: \"POST\" });\n  return new Response(\"ok\"

75       ],       "snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/chat/completions\", { method: \"POST\" });\n  return new Response(\"ok\");",

],       "snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/chat/completions\", { method: \"POST\" });\n  return new Response(\"ok\");",       "matchedPattern": "H

"snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/chat/completions\", { method: \"POST\" });\n  return new Response(\"ok\");",

79       ],       "snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/completions\", { method: \"POST\" });\n  return new Response(\"ok\");",

],       "snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/completions\", { method: \"POST\" });\n  return new Response(\"ok\");",       "matchedPattern": "HTTP e

"snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/completions\", { method: \"POST\" });\n  return new Response(\"ok\");",

83       ],       "snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/embeddings\", { method: \"POST\" });\n  return new Response(\"ok\");",

],       "snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/embeddings\", { method: \"POST\" });\n  return new Response(\"ok\");",       "matchedPattern": "HTTP en

"snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/embeddings\", { method: \"POST\" });\n  return new Response(\"ok\");",

87       ],       "snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/images/generations\", { method: \"POST\" });\n  return new Response(\"ok\");",

],       "snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/images/generations\", { method: \"POST\" });\n  return new Response(\"ok\");",       "matchedPattern": 

"snippet": "  return new Response(\"ok\");\n}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/images/generations\", { method: \"POST\" });\n  return new Response(\"ok\");",

72       ],       "snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://ai-gateway.vercel.sh/v1/chat\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",

],       "snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://ai-gateway.vercel.sh/v1/chat\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",       "matchedPattern": "Expensive API call: Vercel AI Gate

"snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://ai-gateway.vercel.sh/v1/chat\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",

76       ],       "snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/chat/completions\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",

],       "snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/chat/completions\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",       "matchedPattern": "Expensive API call: Chat com

"snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/chat/completions\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",

80       ],       "snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/completions\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",

],       "snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/completions\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",       "matchedPattern": "Expensive API call: Completions A

"snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/completions\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",

84       ],       "snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/embeddings\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",

],       "snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/embeddings\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",       "matchedPattern": "Expensive API call: Embeddings API

"snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/embeddings\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",

88       ],       "snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/images/generations\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",

],       "snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/images/generations\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",       "matchedPattern": "Expensive API call: Image 

"snippet": "}`,\n    `export async function POST() {\n  await fetch(\"https://api.openai.com/v1/images/generations\", { method: \"POST\" });\n  return new Response(\"ok\");\n}`,",

12       ],       "snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `const url = \\`https://api.github.com/repos/\\${owner}/\\${repo}\\`;`,\n    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n

],       "snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `const url = \\`https://api.github.com/repos/\\${owner}/\\${repo}\\`;`,\n    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n    `cons

"snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `const url = \\`https://api.github.com/repos/\\${owner}/\\${repo}\\`;`,\n    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n    `const link = 

13       ],       "snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `const url = \\`https://api.github.com/repos/\\${owner}/\\${repo}\\`;`,\n    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n

],       "snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `const url = \\`https://api.github.com/repos/\\${owner}/\\${repo}\\`;`,\n    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n    `cons

"snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `const url = \\`https://api.github.com/repos/\\${owner}/\\${repo}\\`;`,\n    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n    `const link = 

14       ],       "snippet": "    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n    `const link = \\`https://github.com/\\${user}/\\${repo}/commits\\`;`,\n    `const url = \\`https://gitlab.com/api/v4/projects/\\${id}

],       "snippet": "    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n    `const link = \\`https://github.com/\\${user}/\\${repo}/commits\\`;`,\n    `const url = \\`https://gitlab.com/api/v4/projects/\\${id}\\`;`,\n 

"snippet": "    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n    `const link = \\`https://github.com/\\${user}/\\${repo}/commits\\`;`,\n    `const url = \\`https://gitlab.com/api/v4/projects/\\${id}\\`;`,\n    `const

15       ],       "snippet": "    `const link = \\`https://github.com/\\${user}/\\${repo}/commits\\`;`,\n    `const url = \\`https://gitlab.com/api/v4/projects/\\${id}\\`;`,\n    `const url = \\`https://bitbucket.org/api/2.0/repositories/\\

],       "snippet": "    `const link = \\`https://github.com/\\${user}/\\${repo}/commits\\`;`,\n    `const url = \\`https://gitlab.com/api/v4/projects/\\${id}\\`;`,\n    `const url = \\`https://bitbucket.org/api/2.0/repositories/\\${slug}\\

"snippet": "    `const link = \\`https://github.com/\\${user}/\\${repo}/commits\\`;`,\n    `const url = \\`https://gitlab.com/api/v4/projects/\\${id}\\`;`,\n    `const url = \\`https://bitbucket.org/api/2.0/repositories/\\${slug}\\`;`,\n   

16       ],       "snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `const url = \\`https://api.github.com/repos/\\${owner}/\\${repo}\\`;`,\n    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n

],       "snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `const url = \\`https://api.github.com/repos/\\${owner}/\\${repo}\\`;`,\n    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n    `cons

"snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `const url = \\`https://api.github.com/repos/\\${owner}/\\${repo}\\`;`,\n    `await fetch(\\`https://api.github.com/orgs/\\${org}/members\\`);`,\n    `const link = 

15       ],       "snippet": "    `router.get(\"/users\", (ctx) => {})`,\n    `router.post('/api/users', createUser)`,\n    `router.use(authMiddleware)`,\n    `router.delete(\"/u/:id\", removeUser)`,\n    `import { Application, Router } fro

],       "snippet": "    `router.get(\"/users\", (ctx) => {})`,\n    `router.post('/api/users', createUser)`,\n    `router.use(authMiddleware)`,\n    `router.delete(\"/u/:id\", removeUser)`,\n    `import { Application, Router } from \"https

"snippet": "    `router.get(\"/users\", (ctx) => {})`,\n    `router.post('/api/users', createUser)`,\n    `router.use(authMiddleware)`,\n    `router.delete(\"/u/:id\", removeUser)`,\n    `import { Application, Router } from \"https://deno.l

23       ],       "snippet": "  requires: { tech: [\"nextjs\"] },\n  examples: [\n    `import { Elysia } from 'elysia';\\nconst app = new Elysia();\\nexport const GET = app.handle;`,\n    `import { Hono } from 'hono';\\nconst app = new Hono

],       "snippet": "  requires: { tech: [\"nextjs\"] },\n  examples: [\n    `import { Elysia } from 'elysia';\\nconst app = new Elysia();\\nexport const GET = app.handle;`,\n    `import { Hono } from 'hono';\\nconst app = new Hono();\\nexp

"snippet": "  requires: { tech: [\"nextjs\"] },\n  examples: [\n    `import { Elysia } from 'elysia';\\nconst app = new Elysia();\\nexport const GET = app.handle;`,\n    `import { Hono } from 'hono';\\nconst app = new Hono();\\nexport const

24       ],       "snippet": "  examples: [\n    `import { Elysia } from 'elysia';\\nconst app = new Elysia();\\nexport const GET = app.handle;`,\n    `import { Hono } from 'hono';\\nconst app = new Hono();\\nexport const GET = (req) => app

],       "snippet": "  examples: [\n    `import { Elysia } from 'elysia';\\nconst app = new Elysia();\\nexport const GET = app.handle;`,\n    `import { Hono } from 'hono';\\nconst app = new Hono();\\nexport const GET = (req) => app.fetch(re

"snippet": "  examples: [\n    `import { Elysia } from 'elysia';\\nconst app = new Elysia();\\nexport const GET = app.handle;`,\n    `import { Hono } from 'hono';\\nconst app = new Hono();\\nexport const GET = (req) => app.fetch(req);`,\n  

25       ],       "snippet": "    `import { Elysia } from 'elysia';\\nconst app = new Elysia();\\nexport const GET = app.handle;`,\n    `import { Hono } from 'hono';\\nconst app = new Hono();\\nexport const GET = (req) => app.fetch(req);`,\

],       "snippet": "    `import { Elysia } from 'elysia';\\nconst app = new Elysia();\\nexport const GET = app.handle;`,\n    `import { Hono } from 'hono';\\nconst app = new Hono();\\nexport const GET = (req) => app.fetch(req);`,\n    `imp

"snippet": "    `import { Elysia } from 'elysia';\\nconst app = new Elysia();\\nexport const GET = app.handle;`,\n    `import { Hono } from 'hono';\\nconst app = new Hono();\\nexport const GET = (req) => app.fetch(req);`,\n    `import expre

26       ],       "snippet": "    `import { Hono } from 'hono';\\nconst app = new Hono();\\nexport const GET = (req) => app.fetch(req);`,\n    `import express from 'express';\\nconst app = express();\\nexport const POST = (req) => app(req);

],       "snippet": "    `import { Hono } from 'hono';\\nconst app = new Hono();\\nexport const GET = (req) => app.fetch(req);`,\n    `import express from 'express';\\nconst app = express();\\nexport const POST = (req) => app(req);`,\n    `

"snippet": "    `import { Hono } from 'hono';\\nconst app = new Hono();\\nexport const GET = (req) => app.fetch(req);`,\n    `import express from 'express';\\nconst app = express();\\nexport const POST = (req) => app(req);`,\n    `import { 

"snippet": "  examples: [\n    `const fn = new Function('a', 'return a + 1');`,\n    `const result = eval(userCode);`,\n    `await context.evaluate(moduleSource);`,\n    `const script = new vm.Script(code);`,",

"snippet": "  requires: { tech: [\"nextjs\"] },\n  examples: [\n    `const fn = new Function('a', 'return a + 1');`,\n    `const result = eval(userCode);`,\n    `await context.evaluate(moduleSource);`,",

12       ],       "snippet": "  requires: { tech: [\"nextjs\"] },\n  examples: [\n    `export default async function Page({ searchParams }) {\\n  const id = searchParams.get('id');\\n  const data = await fetch('/api/x?id=' + id);\\n  return

],       "snippet": "  requires: { tech: [\"nextjs\"] },\n  examples: [\n    `export default async function Page({ searchParams }) {\\n  const id = searchParams.get('id');\\n  const data = await fetch('/api/x?id=' + id);\\n  return null\\n}

"snippet": "  requires: { tech: [\"nextjs\"] },\n  examples: [\n    `export default async function Page({ searchParams }) {\\n  const id = searchParams.get('id');\\n  const data = await fetch('/api/x?id=' + id);\\n  return null\\n}`,\n    `

13       ],       "snippet": "  examples: [\n    `export default async function Page({ searchParams }) {\\n  const id = searchParams.get('id');\\n  const data = await fetch('/api/x?id=' + id);\\n  return null\\n}`,\n    `export default asyn

],       "snippet": "  examples: [\n    `export default async function Page({ searchParams }) {\\n  const id = searchParams.get('id');\\n  const data = await fetch('/api/x?id=' + id);\\n  return null\\n}`,\n    `export default async functio

"snippet": "  examples: [\n    `export default async function Page({ searchParams }) {\\n  const id = searchParams.get('id');\\n  const data = await fetch('/api/x?id=' + id);\\n  return null\\n}`,\n    `export default async function Page({ 

14       ],       "snippet": "    `export default async function Page({ searchParams }) {\\n  const id = searchParams.get('id');\\n  const data = await fetch('/api/x?id=' + id);\\n  return null\\n}`,\n    `export default async function Page

],       "snippet": "    `export default async function Page({ searchParams }) {\\n  const id = searchParams.get('id');\\n  const data = await fetch('/api/x?id=' + id);\\n  return null\\n}`,\n    `export default async function Page({ params

"snippet": "    `export default async function Page({ searchParams }) {\\n  const id = searchParams.get('id');\\n  const data = await fetch('/api/x?id=' + id);\\n  return null\\n}`,\n    `export default async function Page({ params }) {\\n 

23       ],       "snippet": "    `const url = req.url;\\nconst res = await fetch(url);`,\n    `const target = request.headers.get('x-target');\\nconst data = await fetch(target);`,\n    `const u = new URL(req.url);\\nawait fetch(u.searchPa

],       "snippet": "    `const url = req.url;\\nconst res = await fetch(url);`,\n    `const target = request.headers.get('x-target');\\nconst data = await fetch(target);`,\n    `const u = new URL(req.url);\\nawait fetch(u.searchParams.get(

"snippet": "    `const url = req.url;\\nconst res = await fetch(url);`,\n    `const target = request.headers.get('x-target');\\nconst data = await fetch(target);`,\n    `const u = new URL(req.url);\\nawait fetch(u.searchParams.get('href'));

48       ],       "snippet": "    `const u = new URL(req.url);\\nawait fetch(u.searchParams.get('href'));`,\n    `const upstream = req.query.upstream;\\nawait globalThis.fetch(upstream);`,\n    `const path = request.nextUrl.searchParams.get

],       "snippet": "    `const u = new URL(req.url);\\nawait fetch(u.searchParams.get('href'));`,\n    `const upstream = req.query.upstream;\\nawait globalThis.fetch(upstream);`,\n    `const path = request.nextUrl.searchParams.get('path');

"snippet": "    `const u = new URL(req.url);\\nawait fetch(u.searchParams.get('href'));`,\n    `const upstream = req.query.upstream;\\nawait globalThis.fetch(upstream);`,\n    `const path = request.nextUrl.searchParams.get('path');\\nconst 

23       ],       "snippet": "    `const target = request.headers.get('x-target');\\nconst data = await fetch(target);`,\n    `const u = new URL(req.url);\\nawait fetch(u.searchParams.get('href'));`,\n    `const upstream = req.query.upstrea

],       "snippet": "    `const target = request.headers.get('x-target');\\nconst data = await fetch(target);`,\n    `const u = new URL(req.url);\\nawait fetch(u.searchParams.get('href'));`,\n    `const upstream = req.query.upstream;\\nawai

"snippet": "    `const target = request.headers.get('x-target');\\nconst data = await fetch(target);`,\n    `const u = new URL(req.url);\\nawait fetch(u.searchParams.get('href'));`,\n    `const upstream = req.query.upstream;\\nawait globalT

21       ],       "snippet": "  examples: [\n    `const url = req.url;\\nconst res = await fetch(url);`,\n    `const target = request.headers.get('x-target');\\nconst data = await fetch(target);`,\n    `const u = new URL(req.url);\\nawait f

],       "snippet": "  examples: [\n    `const url = req.url;\\nconst res = await fetch(url);`,\n    `const target = request.headers.get('x-target');\\nconst data = await fetch(target);`,\n    `const u = new URL(req.url);\\nawait fetch(u.se

"snippet": "  examples: [\n    `const url = req.url;\\nconst res = await fetch(url);`,\n    `const target = request.headers.get('x-target');\\nconst data = await fetch(target);`,\n    `const u = new URL(req.url);\\nawait fetch(u.searchParam

"matchedPattern": "fetch(url) — default redirect: follow + caller-style URL"

"snippet": "    `jdbcTemplate.update(\"UPDATE users SET role = '\" + role + \"' WHERE id = \" + id)`,\n    `@Select(\"SELECT * FROM users WHERE id = \\${id}\")`,\n    `val rows = exec(\"SELECT * FROM users WHERE name = '\\${name}'\")`,\n   

"snippet": "    `em.createQuery(\"FROM User u WHERE u.name = '\" + name + \"'\")`,\n    `session.createSQLQuery(\"SELECT * FROM x WHERE col = '\" + col + \"'\")`,\n    `jdbcTemplate.query(\"SELECT * FROM users WHERE id = \" + id, mapper)`,\

"snippet": "    `session.createSQLQuery(\"SELECT * FROM x WHERE col = '\" + col + \"'\")`,\n    `jdbcTemplate.query(\"SELECT * FROM users WHERE id = \" + id, mapper)`,\n    `jdbcTemplate.update(\"UPDATE users SET role = '\" + role + \"' WHE

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

15       ],       "snippet": "  filePatterns: [\"**/*.lua\"],\n  examples: [\n    `ngx.exec(\"/internal/\" .. user_path)`,\n    `ngx.redirect(\"https://example.com/\" .. target)`,\n    `os.execute(\"rm -rf \" .. dir)`,",

],       "snippet": "  filePatterns: [\"**/*.lua\"],\n  examples: [\n    `ngx.exec(\"/internal/\" .. user_path)`,\n    `ngx.redirect(\"https://example.com/\" .. target)`,\n    `os.execute(\"rm -rf \" .. dir)`,",       "matchedPattern": "exe

"snippet": "  filePatterns: [\"**/*.lua\"],\n  examples: [\n    `ngx.exec(\"/internal/\" .. user_path)`,\n    `ngx.redirect(\"https://example.com/\" .. target)`,\n    `os.execute(\"rm -rf \" .. dir)`,",

"snippet": "  filePatterns: [\"**/*.lua\"],\n  examples: [\n    `ngx.exec(\"/internal/\" .. user_path)`,\n    `ngx.redirect(\"https://example.com/\" .. target)`,\n    `os.execute(\"rm -rf \" .. dir)`,",

"snippet": "  examples: [\n    `<?php\\n$result = $pdo->query(\"SELECT * FROM users WHERE id = \" . $id);`,\n    `$pdo->exec(\"DELETE FROM users WHERE name = '\" . $name . \"'\");`,\n    `$stmt = $pdo->prepare(\"SELECT * FROM t WHERE col = 

"snippet": "  examples: [\n    `<?php\\n$result = $pdo->query(\"SELECT * FROM users WHERE id = \" . $id);`,\n    `$pdo->exec(\"DELETE FROM users WHERE name = '\" . $name . \"'\");`,\n    `$stmt = $pdo->prepare(\"SELECT * FROM t WHERE col = 

"snippet": "    `$pdo->exec(\"DELETE FROM users WHERE name = '\" . $name . \"'\");`,\n    `$stmt = $pdo->prepare(\"SELECT * FROM t WHERE col = '\" . $col . \"'\");`,\n    `mysqli_query($conn, \"SELECT * FROM users WHERE id = \" . $userId);`

17       ],       "snippet": "};`,\n    `frame.onmessage = function (e) { dispatch(e.data); };`,\n    `addEventListener(\"message\", function (event) {\n  if (event.origin !== \"https://trusted.example\") return;\n  doStuff(event.data);\n})

],       "snippet": "};`,\n    `frame.onmessage = function (e) { dispatch(e.data); };`,\n    `addEventListener(\"message\", function (event) {\n  if (event.origin !== \"https://trusted.example\") return;\n  doStuff(event.data);\n});`,",    

"snippet": "};`,\n    `frame.onmessage = function (e) { dispatch(e.data); };`,\n    `addEventListener(\"message\", function (event) {\n  if (event.origin !== \"https://trusted.example\") return;\n  doStuff(event.data);\n});`,",

18       ],       "snippet": "    `frame.onmessage = function (e) { dispatch(e.data); };`,\n    `addEventListener(\"message\", function (event) {\n  if (event.origin !== \"https://trusted.example\") return;\n  doStuff(event.data);\n});`,\n 

],       "snippet": "    `frame.onmessage = function (e) { dispatch(e.data); };`,\n    `addEventListener(\"message\", function (event) {\n  if (event.origin !== \"https://trusted.example\") return;\n  doStuff(event.data);\n});`,\n  ],",    

"snippet": "    `frame.onmessage = function (e) { dispatch(e.data); };`,\n    `addEventListener(\"message\", function (event) {\n  if (event.origin !== \"https://trusted.example\") return;\n  doStuff(event.data);\n});`,\n  ],",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

24       ],       "snippet": "    `DB.fetch(\"SELECT * FROM t WHERE col = '#{val}'\")`,\n    `Sequel.lit(\"name = '#{user_input}'\")`,\n    `conn.exec(\"SELECT * FROM users WHERE id = #{user_id}\")`,\n  ],\n  match(content, filePath) {",

],       "snippet": "    `DB.fetch(\"SELECT * FROM t WHERE col = '#{val}'\")`,\n    `Sequel.lit(\"name = '#{user_input}'\")`,\n    `conn.exec(\"SELECT * FROM users WHERE id = #{user_id}\")`,\n  ],\n  match(content, filePath) {",       "matc

"snippet": "    `DB.fetch(\"SELECT * FROM t WHERE col = '#{val}'\")`,\n    `Sequel.lit(\"name = '#{user_input}'\")`,\n    `conn.exec(\"SELECT * FROM users WHERE id = #{user_id}\")`,\n  ],\n  match(content, filePath) {",

"snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `child_process.exec(cmd);`,\n    `exec(\\`ls \\${dir}\\`);`,\n    `execSync(\"whoami\");`,",

"snippet": "    `child_process.exec(cmd);`,\n    `exec(\\`ls \\${dir}\\`);`,\n    `execSync(\"whoami\");`,\n    `spawn(\"sh\", [\"-c\", cmd]);`,\n    `spawnSync(\"git\", [\"status\"]);`,",

"snippet": "    `exec(\\`ls \\${dir}\\`);`,\n    `execSync(\"whoami\");`,\n    `spawn(\"sh\", [\"-c\", cmd]);`,\n    `spawnSync(\"git\", [\"status\"]);`,\n    `eval(userInput);`,",

"snippet": "    `execSync(\"whoami\");`,\n    `spawn(\"sh\", [\"-c\", cmd]);`,\n    `spawnSync(\"git\", [\"status\"]);`,\n    `eval(userInput);`,\n    `new Function(\"return \" + body)();`,",

"snippet": "    `spawn(\"sh\", [\"-c\", cmd]);`,\n    `spawnSync(\"git\", [\"status\"]);`,\n    `eval(userInput);`,\n    `new Function(\"return \" + body)();`,\n    `const cp = require(\"child_process\");`,",

"snippet": "    `spawnSync(\"git\", [\"status\"]);`,\n    `eval(userInput);`,\n    `new Function(\"return \" + body)();`,\n    `const cp = require(\"child_process\");`,\n    `import { exec } from \"child_process\";`,",

"snippet": "    `eval(userInput);`,\n    `new Function(\"return \" + body)();`,\n    `const cp = require(\"child_process\");`,\n    `import { exec } from \"child_process\";`,\n    `vm.runInNewContext(code, ctx);`,",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

11       ],       "snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `fetch(req.body.url);`,\n    `fetch(query.target);`,\n    `axios.get(req.body.endpoint);`,",

],       "snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `fetch(req.body.url);`,\n    `fetch(query.target);`,\n    `axios.get(req.body.endpoint);`,",       "matchedPattern": "fetch with request-derived URL"

"snippet": "  filePatterns: [\"**/*.{ts,tsx,js,jsx}\"],\n  examples: [\n    `fetch(req.body.url);`,\n    `fetch(query.target);`,\n    `axios.get(req.body.endpoint);`,",

13       ],       "snippet": "    `fetch(req.body.url);`,\n    `fetch(query.target);`,\n    `axios.get(req.body.endpoint);`,\n    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",",

],       "snippet": "    `fetch(req.body.url);`,\n    `fetch(query.target);`,\n    `axios.get(req.body.endpoint);`,\n    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",",       "matchedPattern": "ax

"snippet": "    `fetch(req.body.url);`,\n    `fetch(query.target);`,\n    `axios.get(req.body.endpoint);`,\n    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",",

14       ],       "snippet": "    `axios.get(req.body.endpoint);`,\n    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",",

],       "snippet": "    `axios.get(req.body.endpoint);`,\n    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",",       "match

"snippet": "    `axios.get(req.body.endpoint);`,\n    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",",

15       ],       "snippet": "    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",\n  ],",

],       "snippet": "    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",\n  ],",       "matchedPattern": "new URL from reques

"snippet": "    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",\n  ],",

16       ],       "snippet": "    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",\n  ],\n  match(content, filePath) {",

],       "snippet": "    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",\n  ],\n  match(content, filePath) {",       "matchedPattern": "fetch with interpolated URL

"snippet": "    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",\n  ],\n  match(content, filePath) {",

15       ],       "snippet": "    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",\n  ],",

],       "snippet": "    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",\n  ],",       "matchedPattern": "new URL() from request input without hostname validation"

"snippet": "    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,\n    \"fetch(`${userBase}/items`);\",\n  ],",

10       ],       "snippet": "  examples: [\n    `fetch(req.body.url);`,\n    `fetch(query.target);`,\n    `axios.get(req.body.endpoint);`,",

],       "snippet": "  examples: [\n    `fetch(req.body.url);`,\n    `fetch(query.target);`,\n    `axios.get(req.body.endpoint);`,",       "matchedPattern": "fetch(req.body.url) — default redirect: follow + caller-style URL"

"snippet": "  examples: [\n    `fetch(req.body.url);`,\n    `fetch(query.target);`,\n    `axios.get(req.body.endpoint);`,",

"matchedPattern": "fetch(req.body.url) — default redirect: follow + caller-style URL"

13       ],       "snippet": "    `axios.get(req.body.endpoint);`,\n    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,",

],       "snippet": "    `axios.get(req.body.endpoint);`,\n    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,",       "matchedPattern": "fetch(params.url) — defau

"snippet": "    `axios.get(req.body.endpoint);`,\n    `axios.post(params.url, data);`,\n    \"https.request(`https://api/${req.body.host}`);\",\n    `new URL(req.query.target);`,",       "matchedPattern": "fetch(params.url) — default redire

"matchedPattern": "fetch(params.url) — default redirect: follow + caller-style URL"

28       ],       "snippet": "    `const r = await client.chat.completions.create({ model, messages, stream: true });`,\n    `fetch(\"/api/chat\", { method: \"POST\" });`,\n    `app.post(\"/api/completion\", handler);`,\n    `await fetch(\"

],       "snippet": "    `const r = await client.chat.completions.create({ model, messages, stream: true });`,\n    `fetch(\"/api/chat\", { method: \"POST\" });`,\n    `app.post(\"/api/completion\", handler);`,\n    `await fetch(\"/api/gene

"snippet": "    `const r = await client.chat.completions.create({ model, messages, stream: true });`,\n    `fetch(\"/api/chat\", { method: \"POST\" });`,\n    `app.post(\"/api/completion\", handler);`,\n    `await fetch(\"/api/generate\", {

[Credential-related source omitted]

[Credential-related source omitted]

"snippet": "    `const payload = JSON.parse(await req.text());`,\n    `const data = JSON.parse(await request.text());`,\n    `eval(JSON.parse(input));`,\n    `const fn = new Function(JSON.parse(spec));`,\n    `const config = yaml.load(rawYa

"snippet": "    `const data = JSON.parse(await request.text());`,\n    `eval(JSON.parse(input));`,\n    `const fn = new Function(JSON.parse(spec));`,\n    `const config = yaml.load(rawYaml);`,\n    `const cfg = safeLoad(input);`,",

"snippet": "    `const out = JSON.parse(params.payload);`,\n    `const filter = JSON.parse(query.filter);`,\n    `const payload = JSON.parse(await req.text());`,\n    `const data = JSON.parse(await request.text());`,\n    `eval(JSON.parse(i

"snippet": "    `const payload = JSON.parse(await req.text());`,\n    `const data = JSON.parse(await request.text());`,\n    `eval(JSON.parse(input));`,\n    `const fn = new Function(JSON.parse(spec));`,\n    `const config = yaml.load(rawYa

"snippet": "    `const data = JSON.parse(await request.text());`,\n    `eval(JSON.parse(input));`,\n    `const fn = new Function(JSON.parse(spec));`,\n    `const config = yaml.load(rawYaml);`,\n    `const cfg = safeLoad(input);`,",

"snippet": "    `eval(JSON.parse(input));`,\n    `const fn = new Function(JSON.parse(spec));`,\n    `const config = yaml.load(rawYaml);`,\n    `const cfg = safeLoad(input);`,\n  ],",

7       ],       "snippet": " * Server-side fetch following redirects across hosts. Common SSRF bypass:\n *   - Host validation runs against the request URL (\"https://allowed.com/...\")\n *   - The fetch follows a 30x to \"https://169.254.

],       "snippet": " * Server-side fetch following redirects across hosts. Common SSRF bypass:\n *   - Host validation runs against the request URL (\"https://allowed.com/...\")\n *   - The fetch follows a 30x to \"https://169.254.169.254/

"snippet": " * Server-side fetch following redirects across hosts. Common SSRF bypass:\n *   - Host validation runs against the request URL (\"https://allowed.com/...\")\n *   - The fetch follows a 30x to \"https://169.254.169.254/...\", \"

16       ],       "snippet": " *\n * Flags `fetch(url)` / `axios.get(url)` / `got(url)` calls in server-side\n * files where the URL likely derives from caller input. Also flags\n * explicit `redirect: 'follow'` and absence of `redirect:` s

],       "snippet": " *\n * Flags `fetch(url)` / `axios.get(url)` / `got(url)` calls in server-side\n * files where the URL likely derives from caller input. Also flags\n * explicit `redirect: 'follow'` and absence of `redirect:` setting in

"snippet": " *\n * Flags `fetch(url)` / `axios.get(url)` / `got(url)` calls in server-side\n * files where the URL likely derives from caller input. Also flags\n * explicit `redirect: 'follow'` and absence of `redirect:` setting in",

"matchedPattern": "fetch(url) — default redirect: follow + caller-style URL"

18       ],       "snippet": " * Flags `fetch(url)` / `axios.get(url)` / `got(url)` calls in server-side\n * files where the URL likely derives from caller input. Also flags\n * explicit `redirect: 'follow'` and absence of `redirect:` setti

],       "snippet": " * Flags `fetch(url)` / `axios.get(url)` / `got(url)` calls in server-side\n * files where the URL likely derives from caller input. Also flags\n * explicit `redirect: 'follow'` and absence of `redirect:` setting in\n *

"snippet": " * Flags `fetch(url)` / `axios.get(url)` / `got(url)` calls in server-side\n * files where the URL likely derives from caller input. Also flags\n * explicit `redirect: 'follow'` and absence of `redirect:` setting in\n * suspicio

58       ],       "snippet": "\n      // fetch(url) call where `url` is a caller-style variable\n      const m = line.match(\n        /\\b(?:fetch|axios\\.\\s*(?:get|post|put|delete|head)|got|got\\.\\s*(?:get|post))\\s*\\(\\s*([^,)]+)/,",

],       "snippet": "\n      // fetch(url) call where `url` is a caller-style variable\n      const m = line.match(\n        /\\b(?:fetch|axios\\.\\s*(?:get|post|put|delete|head)|got|got\\.\\s*(?:get|post))\\s*\\(\\s*([^,)]+)/,",       "mat

"snippet": "\n      // fetch(url) call where `url` is a caller-style variable\n      const m = line.match(\n        /\\b(?:fetch|axios\\.\\s*(?:get|post|put|delete|head)|got|got\\.\\s*(?:get|post))\\s*\\(\\s*([^,)]+)/,",

"matchedPattern": "fetch(url) — default redirect: follow + caller-style URL"

51       ],       "snippet": "    `await fetch(targetUrl, { redirect: \"follow\" });`,\n    `await fetch(callbackUrl);`,\n    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyU

],       "snippet": "    `await fetch(targetUrl, { redirect: \"follow\" });`,\n    `await fetch(callbackUrl);`,\n    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyUrl);`,", 

"snippet": "    `await fetch(targetUrl, { redirect: \"follow\" });`,\n    `await fetch(callbackUrl);`,\n    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyUrl);`,",

27       ],       "snippet": "  filePatterns: [\"**/*.ts\", \"**/*.tsx\", \"**/*.js\", \"**/*.mjs\"],\n  examples: [\n    `await fetch(targetUrl, { redirect: \"follow\" });`,\n    `await fetch(callbackUrl);`,\n    `const res = await fetch(r

],       "snippet": "  filePatterns: [\"**/*.ts\", \"**/*.tsx\", \"**/*.js\", \"**/*.mjs\"],\n  examples: [\n    `await fetch(targetUrl, { redirect: \"follow\" });`,\n    `await fetch(callbackUrl);`,\n    `const res = await fetch(redirectUr

"snippet": "  filePatterns: [\"**/*.ts\", \"**/*.tsx\", \"**/*.js\", \"**/*.mjs\"],\n  examples: [\n    `await fetch(targetUrl, { redirect: \"follow\" });`,\n    `await fetch(callbackUrl);`,\n    `const res = await fetch(redirectUrl);`,",

28       ],       "snippet": "    `await fetch(targetUrl, { redirect: \"follow\" });`,\n    `await fetch(callbackUrl);`,\n    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,",

],       "snippet": "    `await fetch(targetUrl, { redirect: \"follow\" });`,\n    `await fetch(callbackUrl);`,\n    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,",       "matchedPattern": "fetch(callba

"snippet": "    `await fetch(targetUrl, { redirect: \"follow\" });`,\n    `await fetch(callbackUrl);`,\n    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,",

"matchedPattern": "fetch(callbackUrl) — default redirect: follow + caller-style URL"

29       ],       "snippet": "    `await fetch(callbackUrl);`,\n    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyUrl);`,",

],       "snippet": "    `await fetch(callbackUrl);`,\n    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyUrl);`,",       "matchedPattern": "fetch(redirectUrl) — default redi

"snippet": "    `await fetch(callbackUrl);`,\n    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyUrl);`,",

"matchedPattern": "fetch(redirectUrl) — default redirect: follow + caller-style URL"

30       ],       "snippet": "    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyUrl);`,\n    `await axios.post(websiteUrl, payload);`,",

],       "snippet": "    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyUrl);`,\n    `await axios.post(websiteUrl, payload);`,",       "matchedPattern": "fetch(webhookUrl) — 

"snippet": "    `const res = await fetch(redirectUrl);`,\n    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyUrl);`,\n    `await axios.post(websiteUrl, payload);`,",

"matchedPattern": "fetch(webhookUrl) — default redirect: follow + caller-style URL"

31       ],       "snippet": "    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyUrl);`,\n    `await axios.post(websiteUrl, payload);`,\n    `await got(domainUrl);`,",

],       "snippet": "    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyUrl);`,\n    `await axios.post(websiteUrl, payload);`,\n    `await got(domainUrl);`,",       "matchedPattern": "fetch(companyUrl) — default redirect

"snippet": "    `const r = await fetch(webhookUrl);`,\n    `await axios.get(companyUrl);`,\n    `await axios.post(websiteUrl, payload);`,\n    `await got(domainUrl);`,",

"matchedPattern": "fetch(companyUrl) — default redirect: follow + caller-style URL"

],       "snippet": "    `await axios.get(companyUrl);`,\n    `await axios.post(websiteUrl, payload);`,\n    `await got(domainUrl);`,\n    `await got(imageUrl);",       "matchedPattern": "fetch(websiteUrl) — default redirect: follow + calle

"snippet": "    `await axios.get(companyUrl);`,\n    `await axios.post(websiteUrl, payload);`,\n    `await got(domainUrl);`,\n    `await got(imageUrl);",       "matchedPattern": "fetch(websiteUrl) — default redirect: follow + caller-style U

"matchedPattern": "fetch(websiteUrl) — default redirect: follow + caller-style URL"

],       "snippet": "    `await axios.post(websiteUrl, payload);`,\n    `await got(domainUrl);`,\n    `await got(imageUrl);\ngot.get(imageUrl);`,",       "matchedPattern": "fetch(domainUrl) — default redirect: follow + caller-style URL"

"snippet": "    `await axios.post(websiteUrl, payload);`,\n    `await got(domainUrl);`,\n    `await got(imageUrl);\ngot.get(imageUrl);`,",       "matchedPattern": "fetch(domainUrl) — default redirect: follow + caller-style URL"     },

"matchedPattern": "fetch(domainUrl) — default redirect: follow + caller-style URL"

34       ],       "snippet": "    `await got(domainUrl);`,\n    `await got(imageUrl);\ngot.get(imageUrl);`,\n    `await fetch(fetchUrl, { method: \"GET\" });`,",

],       "snippet": "    `await got(domainUrl);`,\n    `await got(imageUrl);\ngot.get(imageUrl);`,\n    `await fetch(fetchUrl, { method: \"GET\" });`,",       "matchedPattern": "fetch(imageUrl) — default redirect: follow + caller-style URL"

"snippet": "    `await got(domainUrl);`,\n    `await got(imageUrl);\ngot.get(imageUrl);`,\n    `await fetch(fetchUrl, { method: \"GET\" });`,",

"matchedPattern": "fetch(imageUrl) — default redirect: follow + caller-style URL"

35       ],       "snippet": "    `await got(imageUrl);\ngot.get(imageUrl);`,\n    `await fetch(fetchUrl, { method: \"GET\" });`,\n    `await fetch(returnTo, { method: \"GET\" });`,",

],       "snippet": "    `await got(imageUrl);\ngot.get(imageUrl);`,\n    `await fetch(fetchUrl, { method: \"GET\" });`,\n    `await fetch(returnTo, { method: \"GET\" });`,",       "matchedPattern": "fetch(imageUrl) — default redirect: foll

"snippet": "    `await got(imageUrl);\ngot.get(imageUrl);`,\n    `await fetch(fetchUrl, { method: \"GET\" });`,\n    `await fetch(returnTo, { method: \"GET\" });`,",

"matchedPattern": "fetch(imageUrl) — default redirect: follow + caller-style URL"

36       ],       "snippet": "got.get(imageUrl);`,\n    `await fetch(fetchUrl, { method: \"GET\" });`,\n    `await fetch(returnTo, { method: \"GET\" });`,\n  ],",

],       "snippet": "got.get(imageUrl);`,\n    `await fetch(fetchUrl, { method: \"GET\" });`,\n    `await fetch(returnTo, { method: \"GET\" });`,\n  ],",       "matchedPattern": "fetch(fetchUrl) — default redirect: follow + caller-style URL

"snippet": "got.get(imageUrl);`,\n    `await fetch(fetchUrl, { method: \"GET\" });`,\n    `await fetch(returnTo, { method: \"GET\" });`,\n  ],",

"matchedPattern": "fetch(fetchUrl) — default redirect: follow + caller-style URL"

37       ],       "snippet": "    `await fetch(fetchUrl, { method: \"GET\" });`,\n    `await fetch(returnTo, { method: \"GET\" });`,\n  ],\n  match(content, filePath) {",

],       "snippet": "    `await fetch(fetchUrl, { method: \"GET\" });`,\n    `await fetch(returnTo, { method: \"GET\" });`,\n  ],\n  match(content, filePath) {",       "matchedPattern": "fetch(returnTo) — default redirect: follow + caller-s

"snippet": "    `await fetch(fetchUrl, { method: \"GET\" });`,\n    `await fetch(returnTo, { method: \"GET\" });`,\n  ],\n  match(content, filePath) {",

"matchedPattern": "fetch(returnTo) — default redirect: follow + caller-style URL"

71       ],       "snippet": "\n      // fetch(url) call where `url` is a caller-style variable\n      const m = line.match(\n        /\\b(?:fetch|axios\\.\\s*(?:get|post|put|delete|head)|got|got\\.\\s*(?:get|post))\\s*\\(\\s*([^,)]+)/,",

],       "snippet": "\n      // fetch(url) call where `url` is a caller-style variable\n      const m = line.match(\n        /\\b(?:fetch|axios\\.\\s*(?:get|post|put|delete|head)|got|got\\.\\s*(?:get|post))\\s*\\(\\s*([^,)]+)/,",       "mat

"snippet": "\n      // fetch(url) call where `url` is a caller-style variable\n      const m = line.match(\n        /\\b(?:fetch|axios\\.\\s*(?:get|post|put|delete|head)|got|got\\.\\s*(?:get|post))\\s*\\(\\s*([^,)]+)/,",

"matchedPattern": "fetch(url) — default redirect: follow + caller-style URL"

Executable file

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

ANTHROPIC_BASE_URL=https://ai-gateway.vercel.sh

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

OPENAI_BASE_URL=https://ai-gateway.vercel.sh/v1

[Credential-related source omitted]

# # One-time setup on npmjs.com: #   1. Visit https://www.npmjs.com/package/deepsec/access (must be a

# One-time setup on npmjs.com: #   1. Visit https://www.npmjs.com/package/deepsec/access (must be a #      maintainer of the package).

#   1. Visit https://www.npmjs.com/package/deepsec/access (must be a

with:           node-version: '24'           registry-url: 'https://registry.npmjs.org'

node-version: '24'           registry-url: 'https://registry.npmjs.org'           cache: pnpm

registry-url: 'https://registry.npmjs.org'

[Credential-related source omitted]

The full text is available at <https://www.contributor-covenant.org/version/2/1/code_of_conduct/>.

[cov]: https://www.contributor-covenant.org/version/2/1/code_of_conduct/

- Match the existing code style. Lint via [Biome](https://biomejs.dev/);

Apache License                            Version 2.0, January 2004                         http://www.apache.org/licenses/

http://www.apache.org/licenses/

http://www.apache.org/licenses/LICENSE-2.0

This product includes software developed at Vercel, Inc. (https://vercel.com/).

(https://vercel.com/).

[`deepsec`](https://deepsec.sh) is an agent-powered vulnerability scanner that you can run in your own infrastructure, optimized to perform on-demand review of all code in existing

`deepsec` is designed to surface hard-to-find issues that have been lurking in applications for a long time. It is configured to use the best models at maximum thinking levels (tunable via `--thinking-level`, see [models](https://github.com

<p>   <a href="https://vercel.com/labs#labs-products"><img alt="Vercel Labs Product" src="https://img.shields.io/badge/LABS-PRODUCT-0a0a0a.svg?style=for-the-badge&amp;logo=Vercel&amp;labelColor=000000" height="28"></a>

<a href="https://vercel.com/labs#labs-products"><img alt="Vercel Labs Product" src="https://img.shields.io/badge/LABS-PRODUCT-0a0a0a.svg?style=for-the-badge&amp;logo=Vercel&amp;labelColor=000000" height="28"></a>

<a href="https://www.npmjs.com/package/deepsec"><img alt="npm version: deepsec" src="https://img.shields.io/npm/v/deepsec.svg?style=for-the-badge&amp;labelColor=000000" height="28"></a>

<a href="https://github.com/vercel-labs/deepsec/blob/main/LICENSE"><img alt="License: Apache-2.0" src="https://img.shields.io/github/license/vercel-labs/deepsec.svg?style=for-the-badge&amp;labelColor=000000" height="28"></a>

<a href="https://www.npmjs.com/package/deepsec"><img alt="npm downloads per month: deepsec" src="https://img.shields.io/npm/dm/deepsec.svg?style=for-the-badge&amp;labelColor=000000&amp;label=npm%20downloads" height="28"></a>

The [getting started guide](https://github.com/vercel-labs/deepsec/blob/main/docs/getting-started.md)

- [Getting started](https://github.com/vercel-labs/deepsec/blob/main/docs/getting-started.md) — set up and run your first scan

- [Reviewing changes](https://github.com/vercel-labs/deepsec/blob/main/docs/reviewing-changes.md) — `process --diff` and CI gating

- [Supported technology](https://github.com/vercel-labs/deepsec/blob/main/docs/supported-tech.md) — built-in coverage

- [Generated and hand-authored matchers](https://github.com/vercel-labs/deepsec/blob/main/docs/writing-matchers.md)

- [Configuration](https://github.com/vercel-labs/deepsec/blob/main/docs/configuration.md)

- [Plugins](https://github.com/vercel-labs/deepsec/blob/main/docs/plugins.md)

- [Models](https://github.com/vercel-labs/deepsec/blob/main/docs/models.md)

- [Project link and credentials](https://github.com/vercel-labs/deepsec/blob/main/docs/vercel-setup.md)

- [Architecture](https://github.com/vercel-labs/deepsec/blob/main/docs/architecture.md)

- [Data layout](https://github.com/vercel-labs/deepsec/blob/main/docs/data-layout.md)

- [FAQ](https://github.com/vercel-labs/deepsec/blob/main/docs/faq.md)

- [Samples](https://github.com/vercel-labs/deepsec/tree/main/samples)

- [Contributing](https://github.com/vercel-labs/deepsec/blob/main/CONTRIBUTING.md)

Deepsec only ever stores the *name* of the environment variable holding your key, never the key itself. See [project link and credentials](https://github.com/vercel-labs/deepsec/blob/main/docs/vercel-setup.md)

your key, never the key itself. See [project link and credentials](https://github.com/vercel-labs/deepsec/blob/main/docs/vercel-setup.md) for the full reference.

[project link and credentials](https://github.com/vercel-labs/deepsec/blob/main/docs/vercel-setup.md)

Large monorepos can fan work across [Vercel Sandbox](https://vercel.com/docs/vercel-sandbox) microVMs:

{   "$schema": "https://biomejs.dev/schemas/2.4.13/schema.json",

"$schema": "https://biomejs.dev/schemas/2.4.13/schema.json",

Five extension points, all defined in [`packages/core/src/plugin.ts`](https://github.com/vercel-labs/deepsec/blob/main/packages/core/src/plugin.ts):

[`packages/core/src/plugin.ts`](https://github.com/vercel-labs/deepsec/blob/main/packages/core/src/plugin.ts):

projects: [     { id: "my-app", root: "../my-app" },     { id: "service", root: "../service", githubUrl: "https://github.com/me/service/blob/main" },

{ id: "my-app", root: "../my-app" },     { id: "service", root: "../service", githubUrl: "https://github.com/me/service/blob/main" },   ],

{ id: "service", root: "../service", githubUrl: "https://github.com/me/service/blob/main" },

For a fully-worked example exercising every common field (`infoMarkdown`, `promptAppend`, `priorityPaths`, an inline plugin), see [`samples/webapp/deepsec.config.ts`](https://github.com/vercel-labs/deepsec/blob/main/samples/webapp/deepsec.c

see [`samples/webapp/deepsec.config.ts`](https://github.com/vercel-labs/deepsec/blob/main/samples/webapp/deepsec.config.ts).

[Credential-related source omitted]

provider: "openai",   apiKeyEnv: "MY_OPENAI_KEY",   baseUrl: "https://api.openai.com/v1",

apiKeyEnv: "MY_OPENAI_KEY",   baseUrl: "https://api.openai.com/v1", }

baseUrl: "https://api.openai.com/v1",

provider: "martian",   apiKeyEnv: "MARTIAN_KEY",   baseUrl: "https://api.martian.example/v1",

apiKeyEnv: "MARTIAN_KEY",   baseUrl: "https://api.martian.example/v1",   credentialHeader: { name: "x-api-key", scheme: "raw" },

baseUrl: "https://api.martian.example/v1",

| `id` | `string` | yes | Used as `--project-id` and the data directory name (`data/<id>/`). | | `root` | `string` | yes | Absolute or relative path to the codebase. | | `githubUrl` | `string` | no | `https://github.com/owner/repo/blob/bran

| `root` | `string` | yes | Absolute or relative path to the codebase. | | `githubUrl` | `string` | no | `https://github.com/owner/repo/blob/branch` — used in exports for clickable links. Auto-detected from `git remote` when omitted. | | `i

| `githubUrl` | `string` | no | `https://github.com/owner/repo/blob/branch` — used in exports for clickable links. Auto-detected from `git remote` when omitted. |

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

|---|---|---| | `OPENAI_API_KEY` | `--agent codex`, `--agent pi --model openai/...` | Codex SDK token or Pi OpenAI-provider token. Unset is fine if `AI_GATEWAY_API_KEY` is set. | | `OPENAI_BASE_URL` | `--agent codex` | Default (when `AI_GAT

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

The schemas below are the source of truth for any tool that reads `data/` directly. They live in [`packages/core/src/types.ts`](https://github.com/vercel-labs/deepsec/blob/main/packages/core/src/types.ts).

[`packages/core/src/types.ts`](https://github.com/vercel-labs/deepsec/blob/main/packages/core/src/types.ts).

| `rootPath` | `string` | Absolute path to the codebase. Updated each scan with the most recent `--root`. | | `createdAt` | `string` (ISO) | Project init time. | | `githubUrl` | `string?` | `https://github.com/owner/repo/blob/branch` — used

| `githubUrl` | `string?` | `https://github.com/owner/repo/blob/branch` — used for clickable links in exports. Auto-detected from `git remote` if not set. |

[Credential-related source omitted]

[Credential-related source omitted]

[sb]: https://vercel.com/docs/sandbox

See [SECURITY.md](https://github.com/vercel-labs/deepsec/blob/main/SECURITY.md). Don't open a public issue — use

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

GPT-5.6 Sol, Claude Opus 5, Kimi K3, Grok 4.5, and the current DeepSeek entry. Deepsec fetches the latest score, reasoning level, harness, and total run cost from [DeepSecBench](https://vercel.com/ai-gateway/leaderboards/deepsecbench/result

Deepsec fetches the latest score, reasoning level, harness, and total run cost from [DeepSecBench](https://vercel.com/ai-gateway/leaderboards/deepsecbench/results.json), then displays cost relative to the cheapest recommendation. A bundled 

from [DeepSecBench](https://vercel.com/ai-gateway/leaderboards/deepsecbench/results.json),

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

--model-auth custom \   --ai-provider martian \   --ai-base-url https://api.withmartian.com/v1 \

--ai-provider martian \   --ai-base-url https://api.withmartian.com/v1 \   --ai-api-key-env MARTIAN_API_KEY \

--ai-base-url https://api.withmartian.com/v1 \

[Credential-related source omitted]

The plugin contract lives in [`packages/core/src/plugin.ts`](https://github.com/vercel-labs/deepsec/blob/main/packages/core/src/plugin.ts):

[`packages/core/src/plugin.ts`](https://github.com/vercel-labs/deepsec/blob/main/packages/core/src/plugin.ts):

A complete inline-plugin example with two real matchers lives at [`samples/webapp/deepsec.config.ts`](https://github.com/vercel-labs/deepsec/blob/main/samples/webapp/deepsec.config.ts) and

[`samples/webapp/deepsec.config.ts`](https://github.com/vercel-labs/deepsec/blob/main/samples/webapp/deepsec.config.ts) and

[`samples/webapp/matchers/`](https://github.com/vercel-labs/deepsec/tree/main/samples/webapp/matchers/) — the same

The Vercel-Sandbox path lives in [`packages/deepsec/src/sandbox/`](https://github.com/vercel-labs/deepsec/tree/main/packages/deepsec/src/sandbox); it's

[`packages/deepsec/src/sandbox/`](https://github.com/vercel-labs/deepsec/tree/main/packages/deepsec/src/sandbox); it's

[Credential-related source omitted]

deployment, swap each tag for the action's full commit SHA so a   compromised tag can't pivot into your secret-bearing job. See   [GitHub's hardening guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-ac

compromised tag can't pivot into your secret-bearing job. See   [GitHub's hardening guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions). - **The AI gateway secret still flows through PR code.** E

[GitHub's hardening guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions).

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

--ai-provider martian \   --ai-api-key-env MARTIAN_KEY \   --ai-base-url https://api.martian.example/v1 \

[Credential-related source omitted]

[Credential-related source omitted]

--ai-base-url https://api.martian.example/v1 \

[Credential-related source omitted]

[Credential-related source omitted]

References: [AI Gateway authentication](https://vercel.com/docs/ai-gateway/authentication-and-byok#quick-start), [Sandbox authentication](https://vercel.com/docs/vercel-sandbox/concepts/authentication).

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

const response = await fetch(`${target}/api/data`);

const data = await req.json();   return fetch(req.body.endpoint);

return fetch(req.body.endpoint);

Executable file

exec(`ls -la ${userInput}`, (err, stdout) => {