Questions
Status
Invoice download endpoints for the billing pageEasyCode reviewStripe styleCode reviewStripe styleEasy10 minProfile update route for account settingsEasyCode reviewSalesforce styleCode reviewSalesforce styleEasy10 minCoupon lookup builds SQL from the typed codeEasyCode reviewCode reviewEasy10 minLive SMS token committed in a helper moduleEasyCode reviewCode reviewEasy10 minExpense approval skips the approver checkEasyCode reviewCode reviewEasy12 minGift card codes come from the random moduleEasyCode reviewCode reviewEasy10 minAttachment delete joins a user filename onto the upload pathEasyCode reviewCode reviewEasy12 minString concatenation in SQLMediumCode reviewCode reviewMedium25 mininnerHTML with user inputMediumCode reviewCode reviewMedium20 minShell injection via filenameMediumCode reviewCode reviewMedium20 minPing endpoint command injectionMediumCode reviewCisco styleCode reviewCisco styleMedium20 minPassword hash reuses global saltMediumCode reviewCoinbase styleCode reviewCoinbase styleMedium20 minHardcoded API keys in sourceMediumCode reviewStripe styleCode reviewStripe styleMedium20 minToken check middleware for the API gatewayMediumCode reviewStripe styleCode reviewStripe styleMedium20 minAPI key comparison timing-sensitiveMediumCode reviewStripe styleCode reviewStripe styleMedium25 minUnescaped HTML injectionMediumCode reviewMeta styleCode reviewMeta styleMedium20 minSQL injection in sort columnMediumCode reviewCode reviewMedium20 minSQL injection in ORDER BYMediumCode reviewCode reviewMedium22 minSHA256 replaces password hashingMediumCode reviewCoinbase styleCode reviewCoinbase styleMedium25 minXSS in search results rendererMediumCode reviewGoogle styleCode reviewGoogle styleMedium20 minSignature check on the payment webhookMediumCode reviewStripe styleCode reviewStripe styleMedium15 minProduction password hardcoded in sourceMediumCode reviewCode reviewMedium20 minSort column injectionMediumCode reviewCode reviewMedium25 minSession role client-writableMediumCode reviewCode reviewMedium25 minQuery string unescapedMediumCode reviewCode reviewMedium16 minComment HTML injectionMediumCode reviewGoogle styleCode reviewGoogle styleMedium18 minJWT secret hardcoded in fallbackMediumCode reviewCode reviewMedium18 minSQL injection in queryMediumCode reviewCode reviewMedium14 minLogin SQL injectionMediumCode reviewCode reviewMedium20 minUser reads another user's invoiceMediumCode reviewStripe styleCode reviewStripe styleMedium18 minJWT secret hardcodedMediumCode reviewCode reviewMedium15 minTransfer CSRF unprotectedMediumCode reviewCoinbase styleCode reviewCoinbase styleMedium18 minLogin redirect open redirectMediumCode reviewCode reviewMedium15 minCharge logs card dataMediumCode reviewStripe styleCode reviewStripe styleMedium15 minMongoDB query accepts plaintext passwordMediumCode reviewCode reviewMedium18 minOverly permissive CORS with credentialsMediumCode reviewStripe styleCode reviewStripe styleMedium18 minAES encryption uses ECB modeMediumCode reviewCoinbase styleCode reviewCoinbase styleMedium25 minMD5 with global saltMediumCode reviewCoinbase styleCode reviewCoinbase styleMedium20 minWeak random token generationMediumCode reviewStripe styleCode reviewStripe styleMedium20 minTLS verification disabledMediumCode reviewStripe styleCode reviewStripe styleMedium22 minJWT parsed without signature verificationMediumCode reviewCode reviewMedium22 minDownload handler for user data exportsMediumCode reviewCode reviewMedium20 minReDoS vulnerability in email regexMediumCode reviewCode reviewMedium25 minTable name not parameterizedHardCode reviewCode reviewHard30 minMarkup wraps untrusted HTMLHardCode reviewCode reviewHard25 minEncryption produces different outputHardCode reviewCoinbase styleCode reviewCoinbase styleHard30 minMass assignment vulnerability in FastAPIHardCode reviewSalesforce styleCode reviewSalesforce styleHard30 minXML parser vulnerable to XXEHardCode reviewCode reviewHard30 minCSV export unescaped delimitersHardCode reviewCode reviewHard30 minUnvalidated URL hrefHardCode reviewMeta styleCode reviewMeta styleHard22 min