Security & code observations
Static observations, ordered by severity then confidence. Each one states how it could be wrong. Nothing here has been executed, proven, or verified against a running system.
These are review leads, not vulnerabilities. This engine has no type checker, no data-flow analysis and no runtime knowledge. It can see that a route mutates and contains no auth call; it cannot see a middleware matcher, a platform rule, or an ownership predicate inside a query. Read the caveat on every row before acting on it.
SQL update built by string interpolation
(f"UPDATE accounts SET credits = credits - {amount} WHERE id = '{user_id}'")
fixture-api-py/app/main.py:23(f"UPDATE accounts SET credits = credits - {amount} WHERE id = '{user_id}'") Why this may be wrong: Interpolating a literal or an already-validated constant is safe. Confirm the interpolated expression is not user-controlled before treating this as injectable.
POST /api/public-note mutates without an auth call in its file
Writes to orders.
fixture-shop/src/app/api/public-note/route.ts:5
Why this may be wrong: Auth may be applied by a wrapper, a framework config, or a platform-level rule that static analysis cannot see.
SQL select built by string interpolation
"SELECT * FROM users WHERE email = '" + email + "'"
fixture-shop/src/lib/db.ts:11"SELECT * FROM users WHERE email = '" + email + "'"
Why this may be wrong: Interpolating a literal or an already-validated constant is safe. Confirm the interpolated expression is not user-controlled before treating this as injectable.
POST (app) app.post mutates without an auth call in its file
No database write observed; classified as a mutation by HTTP method.
fixture-api-py/app/main.py:20
Why this may be wrong: Auth may be applied by a wrapper, a framework config, or a platform-level rule that static analysis cannot see.
mediumlowauthenticated-but-unauthorized-resource
fixture-shopGET /api/orders/[id] authenticates but shows no ownership check on [id]
The route establishes WHO the caller is, but no call matching an authorization pattern was found — the classic IDOR shape.
fixture-shop/src/app/api/orders/[id]/route.ts:7
Why this may be wrong: Ownership is very often enforced inside the query itself (e.g. `where(eq(t.userId, userId))`), which this rule does not inspect. Expect a high false-positive rate; treat as a review list, not a defect list.