Review ID: a844158fa236Generated: 2026-04-11T22:11:53.278Z
CHANGES REQUESTED
549
Total Findings
79
Critical
382
High
37
Medium
49
Low
6 Tools Deployed
DiamondPlatinumGoldSilverBronzeHR RoastyFree Baseline
Free Baseline Scan — Open-source tools + Hyrex
VerifyX-PSUT-main →
AIAI Threat Analysis
# SECURITY REVIEW: VerifyX-PSUT-main
REAL THREATS
CREDENTIAL EXPOSURE - PRODUCTION SECRETS HARDCODED
Findings: 19, 21, 23, 36, 42, 49, 51, 53, 55, 59, 67, 70, 75, 76, 77
This is catastrophic. You have hardcoded database credentials scattered throughout your codebase in actual runtime files, not just test fixtures.
• Finding 36 (platform/chaincode/document-anchor/main.go:40) - Chaincode is the blockchain layer. Hardcoded credentials here compromise your entire immutable ledger.
• Finding 19 (internal/api/issuance_review_folders.go:15) - Production API code with hardcoded DB creds
• Finding 21 (internal/api/verify_document.go:124) - Document verification endpoint compromised
• Finding 67 (platform/signflow/config.js:113) - Digital signature service with hardcoded credentials
Impact: Any attacker who gets read access to your repo (former employee, compromised CI/CD, supply chain attack) has your production database credentials. Game over. They can:
• Forge academic credentials
• Delete verification records
• Exfiltrate all student data
• Backdoor the blockchain anchor service
Scripts with hardcoded creds (49, 51, 53, 55, 59, 70, 75, 76, 77) - These are operational scripts that run in production environments. Anyone running these exposes credentials in process lists, logs, and shell history.
AUTHENTICATION TOKEN LEAKAGE
Findings: 38, 39, 43, 45
• Finding 38/39 (platform/e2e/fixtures/api-mocks.js:17) - Hardcoded JWT token in test fixtures. If this is a valid production token or uses production secrets, you've leaked your signing key.
• Finding 43 (platform/e2e/tests/security.spec.js:24) - JWT token in security tests. Ironic.
• Finding 45 (platform/e2e/tests/security.spec.js:122) - Generic API key detected
Impact: If these are real tokens or the signing secrets match production, attackers can forge authentication, impersonate users, and bypass all authorization checks.
HTTP DOWNGRADE ATTACKS - TLS BYPASS
Critical Production Endpoints: 13, 20, 22, 47, 56, 57, 58, 61, 63, 66, 68, 69
You have insecure HTTP requests in:
• Finding 13 (platform/backend/cmd/api/main.go:23) - Main API server entry point allows HTTP
• Finding 20 (platform/backend/internal/api/server.go:795) - Core API server configuration
• Finding 22 (platform/backend/internal/config/config.go:58) - Configuration allows HTTP URLs
• Finding 47 (platform/keycloak/docker-compose.yml:19) - Keycloak (your identity provider!) over HTTP
• Finding 66 (platform/signflow/config.js:92) - Digital signature service over HTTP
• Finding 68 (platform/signflow/server.js:118) - Signature server runtime
Impact:
• Authentication tokens transmitted in cleartext
• Session cookies stolen via MITM
• Document hashes intercepted and replaced
• Digital signatures compromised before they're even created
This is an academic credential verification system. Students' futures depend on the integrity of these signatures. HTTP = no integrity.
ATTACK CHAINS
Chain 1: Complete System Compromise
1. Extract hardcoded DB credentials (Finding 19, 21, 67, 70, 75)
2. Connect to database over HTTP endpoint (Finding 13, 20)
3. Extract all student records, modify verification status
4. Use leaked JWT token (Finding 38) to authenticate as admin
5. Issue fraudulent credentials that appear legitimate
Chain 2: Blockchain Anchor Manipulation
1. Use hardcoded chaincode credentials (Finding 36)
2. Access blockchain node over HTTP (Finding 13)
3. Anchor fraudulent document hashes to blockchain
4. These fraudulent credentials now have "immutable" blockchain proof
Chain 3: Identity Provider Takeover
1. Keycloak accessible over HTTP (Finding 47)
2. Hardcoded admin credentials in scripts (Finding 49, 51, 53, 55, 59)
3. MITM Keycloak authentication flow
4. Steal all user sessions, create admin accounts
5. Control entire user base
VERDICT
DO NOT DEPLOY THIS TO PRODUCTION. PERIOD.
This system is currently not safe to issue real academic credentials. The risk isn't theoretical - these are textbook vulnerabilities that get exploited daily in the wild.
FIX IMMEDIATELY (Before ANY production use):
1. ROTATE ALL CREDENTIALS NOW - Assume everything is compromised
- All hardcoded database passwords (19, 21, 23, 36, 42, 49, 51, 53, 55, 59, 67, 70, 75, 76, 77) - JWT signing secrets if Finding 38/39/43 use real keys - All API keys (Finding 45)
2. ENFORCE HTTPS EVERYWHERE - Zero tolerance for HTTP
- Main API (13, 20, 22) - Keycloak (47, 56, 57, 58) - All portals (61, 63, 69) - Signature service (66, 68)
3. IMPLEMENT PROPER SECRET MANAGEMENT
- Use environment variables with proper secrets manager (Vault, AWS Secrets Manager, Azure Key Vault) - Never commit credentials to version control - Rotate regularly
Risk Level:
CRITICAL - Active exploitation would be trivial for any competent attacker
The hardcoded credentials alone are a nuclear-level vulnerability. Combined with HTTP endpoints, you're running an academic credential system with the security posture of a 1990s guestbook.
Students trust you with their academic futures. This codebase, as it stands, cannot honor that trust.
---
549 raw scanner findings — 79 critical · 382 high · 37 medium · 49 low · 2 info
▶ Raw Scanner Output — 549 pre-cleanup findings
⚠ Pre-Cleanup Report
This is the raw, unprocessed output from all scanner agents before AI analysis. Do not use this to fix issues individually. Multiple agents attack from different angles and frequently report the same underlying vulnerability, resulting in significant duplication. Architectural issues also appear as many separate line-level findings when they require a single structural fix.

Use the Copy Fix Workflow button above to get the AI-cleaned workflow — it deduplicates findings, removes false positives, and provides actionable steps. This raw output is provided for transparency and audit purposes only.
HIGHWeak or deprecated cipher
[redacted]/.gitleaks.toml:9
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/.gitleaks.toml at line 9.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/README.md:9
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/README.md at line 9.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/SECURITY.md:5
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/SECURITY.md at line 5.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/STRUCTURE.md:13
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/STRUCTURE.md at line 13.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/nginx-psut-split-hosts-tls.conf:32
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHWeak or deprecated cipher
[redacted]/nginx-psut-split-hosts-tls.conf:112
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/deploy/nginx-psut-split-hosts-tls.conf at line 112.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/nginx-psut-split-hosts.conf:28
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHWeak or deprecated cipher
[redacted]/nginx-verifyx-frontend.conf:4
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/deploy/nginx-verifyx-frontend.conf at line 4.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/nginx-verifyx-frontend.conf:14
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHLocalhost Base Url
[redacted]/BACKEND_CONFIG.md:44
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHWeak or deprecated cipher
[redacted]/BACKUP_DR_PLAN.md:27
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/BACKUP_DR_PLAN.md at line 27.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/BACKUP_RESTORE.md:3
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/BACKUP_RESTORE.md at line 3.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/COMPLIANCE.md:21
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/COMPLIANCE.md at line 21.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHGlobal Access Modifiers
[redacted]/GLOBAL_STANDARDS.md:1
[AGENTS: rules-engine]code_quality
Global classes, methods, and variables should be avoided (especially in managed packages) as they can never be deleted or changed in signature. Always check twice if something needs to be global.
Suggested Fix
See CWE-284: Improper Access Control
HIGHNo Scriptlets
[redacted]/GLOBAL_STANDARDS.md:22
[AGENTS: rules-engine]security
JSP scriptlet detected. Scriptlets are difficult to use securely and are considered bad practice. See https://stackoverflow.com/a/3180202. Instead, consider migrating to JSF or using the Expression Language '$[value]' with the escapeXml function in your JSP files.
Suggested Fix
See CWE-116: Improper Encoding or Escaping of Output
HIGHWeak or deprecated cipher
[redacted]/GLOBAL_STANDARDS.md:49
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/GLOBAL_STANDARDS.md at line 49.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHUse Escapexml
[redacted]/MANUAL_BACKUP_CHECKLIST.md:15
[AGENTS: rules-engine]security
Detected an Expression Language segment that does not escape output. This is dangerous because if any data in this expression can be controlled externally, it is a cross-site scripting vulnerability. Instead, use the 'escapeXml' function from the JSTL taglib. See https://www.tutorialspoint.com/jsp/jstl_function_escapexml.htm for more information.
Suggested Fix
See CWE-116: Improper Encoding or Escaping of Output
HIGHLocalhost Base Url
[redacted]/MANUAL_BACKUP_CHECKLIST.md:26
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHGlobal Access Modifiers
[redacted]/MULTI_CLIENT_READINESS.md:61
[AGENTS: rules-engine]code_quality
Global classes, methods, and variables should be avoided (especially in managed packages) as they can never be deleted or changed in signature. Always check twice if something needs to be global.
Suggested Fix
See CWE-284: Improper Access Control
HIGHWeak or deprecated cipher
[redacted]/MULTI_CLIENT_READINESS.md:74
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/MULTI_CLIENT_READINESS.md at line 74.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/PEER_SIGNING_SETUP.md:7
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/PEER_SIGNING_SETUP.md at line 7.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/PER_DEPLOYMENT_GUIDE.md:62
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/PER_DEPLOYMENT_GUIDE.md at line 62.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/PRODUCTION_CHECKLIST.md:8
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/PRODUCTION_CHECKLIST.md at line 8.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/README.md:3
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/README.md at line 3.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/ROLLBACK.md:36
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHLocalhost Base Url
[redacted]/RUNBOOK.md:10
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHWeak or deprecated cipher
[redacted]/SECURITY_COMPLIANCE.md:21
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/SECURITY_COMPLIANCE.md at line 21.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHNo Scriptlets
[redacted]/SECURITY_COMPLIANCE.md:88
[AGENTS: rules-engine]security
JSP scriptlet detected. Scriptlets are difficult to use securely and are considered bad practice. See https://stackoverflow.com/a/3180202. Instead, consider migrating to JSF or using the Expression Language '$[value]' with the escapeXml function in your JSP files.
Suggested Fix
See CWE-116: Improper Encoding or Escaping of Output
HIGHLocalhost Base Url
[redacted]/SECURITY_COMPLIANCE.md:89
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHGlobal Access Modifiers
[redacted]/SECURITY_ENGINEERING.md:76
[AGENTS: rules-engine]code_quality
Global classes, methods, and variables should be avoided (especially in managed packages) as they can never be deleted or changed in signature. Always check twice if something needs to be global.
Suggested Fix
See CWE-284: Improper Access Control
HIGHWeak or deprecated cipher
[redacted]/SECURITY_ENGINEERING.md:103
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/SECURITY_ENGINEERING.md at line 103.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/SECURITY_ENGINEERING.md:185
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHWeak or deprecated cipher
[redacted]/SERVICES_AND_WHITELABEL_BASELINE.md:3
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/SERVICES_AND_WHITELABEL_BASELINE.md at line 3.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/api-reference.md:3
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/docs/api-reference.md at line 3.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/api-reference.md:11
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHMessage Whitespace Check
[redacted]/mkdocs.yml:1
[AGENTS: rules-engine]code_quality
It looks like you have an additional space in your rule message, this can look awkward in the finding output, please remove the additional whitespace!
HIGHWeak or deprecated cipher
[redacted]/mkdocs.yml:7
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/mkdocs.yml at line 7.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHGlobal Access Modifiers
[redacted]/mkdocs.yml:47
[AGENTS: rules-engine]code_quality
Global classes, methods, and variables should be avoided (especially in managed packages) as they can never be deleted or changed in signature. Always check twice if something needs to be global.
Suggested Fix
See CWE-284: Improper Access Control
HIGHMessage Whitespace Check
[redacted]/.golangci.yml:1
[AGENTS: rules-engine]code_quality
It looks like you have an additional space in your rule message, this can look awkward in the finding output, please remove the additional whitespace!
HIGHLocalhost Base Url
[redacted]/API_SPEC.md:7
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHWeak or deprecated cipher
[redacted]/API_SPEC.md:19
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/API_SPEC.md at line 19.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/README.md:13
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHUse Escapexml
[redacted]/ensure-keycloak-env.sh:7
[AGENTS: rules-engine]security
Detected an Expression Language segment that does not escape output. This is dangerous because if any data in this expression can be controlled externally, it is a cross-site scripting vulnerability. Instead, use the 'escapeXml' function from the JSTL taglib. See https://www.tutorialspoint.com/jsp/jstl_function_escapexml.htm for more information.
Suggested Fix
See CWE-116: Improper Encoding or Escaping of Output
HIGHWeak or deprecated cipher
[redacted]/CUSTOM_LOGIN.md:80
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/docs/CUSTOM_LOGIN.md at line 80.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHSSRF — user-controlled URL in HTTP request
[redacted]/CUSTOM_LOGIN.md:113
[AGENTS: rules-engine]security
HTTP request with user-controlled URL in VerifyX-PSUT-main/platform/backend/docs/CUSTOM_LOGIN.md at line 113 enables SSRF attacks.
Suggested Fix
Validate URLs against an allowlist. Block private/internal IP ranges.
HIGHUse Escapexml
[redacted]/CUSTOM_LOGIN.md:114
[AGENTS: rules-engine]security
Detected an Expression Language segment that does not escape output. This is dangerous because if any data in this expression can be controlled externally, it is a cross-site scripting vulnerability. Instead, use the 'escapeXml' function from the JSTL taglib. See https://www.tutorialspoint.com/jsp/jstl_function_escapexml.htm for more information.
Suggested Fix
See CWE-116: Improper Encoding or Escaping of Output
HIGHWeak or deprecated cipher
[redacted]/DEPLOY_DOCANCHOR.md:3
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/docs/DEPLOY_DOCANCHOR.md at line 3.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/DEPLOY_DOCANCHOR.md:9
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHLocalhost Base Url
[redacted]/DEPLOY_SIGNING_ON_PEER_NODE.md:76
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHWeak or deprecated cipher
[redacted]/DEPLOY_SIGNING_ON_PEER_NODE.md:372
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/docs/DEPLOY_SIGNING_ON_PEER_NODE.md at line 372.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/INTEGRATION_API.md:4
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/docs/INTEGRATION_API.md at line 4.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/INTEGRATION_API.md:34
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHMessage Whitespace Check
[redacted]/openapi.yaml:1
[AGENTS: rules-engine]code_quality
It looks like you have an additional space in your rule message, this can look awkward in the finding output, please remove the additional whitespace!
HIGHWeak or deprecated cipher
[redacted]/openapi.yaml:4
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/docs/openapi.yaml at line 4.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/VerifyX-Integration.postman_collection.json:5
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/docs/postman/VerifyX-Integration.postman_collection.json at line 5.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/README.md:3
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/addons-optional/sanad/README.md at line 3.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/addon.go:3
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/addons-optional/workflow/addon.go at line 3.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/registry.go:1
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/addons/registry.go at line 1.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/addon_deps.go:1
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/addon_deps.go at line 1.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/admin_handlers.go:34
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/admin_handlers.go at line 34.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/auth_handlers.go:39
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/auth_handlers.go at line 39.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/chaincode_handlers.go:488
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/chaincode_handlers.go at line 488.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/chaincode_helper.go:94
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGH[semgrep] go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
[redacted]/chaincode_runner.go:81
[AGENTS: baseline:semgrep]security
Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
HIGHWeak or deprecated cipher
[redacted]/doc.go:2
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/doc.go at line 2.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGH[semgrep] go.lang.security.filepath-clean-misuse.filepath-clean-misuse
[redacted]/document_download.go:37
[AGENTS: baseline:semgrep]security
`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path, "/")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.
HIGHWeak or deprecated cipher
[redacted]/document_type_handlers.go:22
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/document_type_handlers.go at line 22.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/employee_handlers.go:109
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/employee_handlers.go at line 109.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/integration_handlers.go:69
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/integration_handlers.go at line 69.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/issuance_queues_metadata.go:21
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/issuance_queues_metadata.go at line 21.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHHardcoded database credentials
[redacted]/issuance_review_folders.go:15
[AGENTS: rules-engine]attack_chains
**Perspective 1:** Database credentials (_APP_DB_USER, _APP_DB_PASS, _APP_DB_ROOT_PASS) are set to default values ('user', 'password', 'rootsecretpassword'). These are weak credentials that could be easily guessed in a production environment. **Perspective 2:** Default database credentials '_APP_DB_USER=user' and '_APP_DB_PASS=password' with root access '_APP_DB_ROOT_PASS=rootsecretpassword' create a critical attack chain: 1) Attacker scans for default Appwrite deployments, 2) Uses default cred
Suggested Fix
Require unique database credentials during installation. Generate strong random passwords and avoid default values. Implement database network isolation to prevent external access.
HIGHHardcoded secrets in production code
[redacted]/issuance_review_folders.go:15
[AGENTS: rules-engine]api_surface
**Perspective 1:** The configuration requires hardcoded paths for SSL certificates and keys, which can expose sensitive information if not properly secured. **Perspective 2:** SSL certificate and key files must have restrictive permissions to prevent unauthorized access. **Perspective 3:** The configuration requires a hardcoded token for metrics access, which poses a security risk if the configuration file is exposed. **Perspective 4:** The Nginx configuration references SSL certificate paths
Suggested Fix
Ensure that the SSL certificate paths are set via environment variables and that the files have restrictive permissions.
HIGHWeak or deprecated cipher
[redacted]/issuance_review_folders.go:96
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/issuance_review_folders.go at line 96.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/issuance_review_handlers.go:30
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/issuance_review_handlers.go at line 30.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGH[semgrep] go.lang.security.injection.tainted-sql-string.tainted-sql-string
[redacted]/issuance_review_handlers.go:418
[AGENTS: baseline:semgrep]security
User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library.
HIGH[semgrep] go.lang.security.injection.tainted-sql-string.tainted-sql-string
[redacted]/issuance_review_handlers.go:423
[AGENTS: baseline:semgrep]security
User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library.
HIGH[semgrep] go.lang.security.injection.tainted-sql-string.tainted-sql-string
[redacted]/issuance_review_handlers.go:428
[AGENTS: baseline:semgrep]security
User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library.
HIGH[semgrep] go.lang.security.injection.tainted-sql-string.tainted-sql-string
[redacted]/issuance_review_handlers.go:432
[AGENTS: baseline:semgrep]security
User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library.
HIGH[semgrep] go.lang.security.injection.tainted-sql-string.tainted-sql-string
[redacted]/issuance_review_handlers.go:436
[AGENTS: baseline:semgrep]security
User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library.
HIGH[semgrep] go.lang.security.injection.tainted-sql-string.tainted-sql-string
[redacted]/issuance_review_handlers.go:439
[AGENTS: baseline:semgrep]security
User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library.
HIGHWeak or deprecated cipher
[redacted]/keycloak_admin_client.go:282
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/keycloak_admin_client.go at line 282.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/keycloak_middleware.go:66
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/keycloak_middleware.go at line 66.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHPath traversal — user input in file operation
[redacted]/pdf_handlers.go:535
[AGENTS: rules-engine]security
File operation with user-controlled path in VerifyX-PSUT-main/platform/backend/internal/api/pdf_handlers.go at line 535. Attacker can read arbitrary files via ../ sequences.
Suggested Fix
Validate and sanitize file paths. Use path.resolve() and verify the result is within the expected directory.
HIGHWeak or deprecated cipher
[redacted]/pdf_handlers.go:752
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/pdf_handlers.go at line 752.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/review_handlers.go:124
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/review_handlers.go at line 124.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/sanad_handlers.go:534
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/sanad_handlers.go at line 534.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHPath traversal — user input in file operation
[redacted]/sanad_handlers.go:833
[AGENTS: rules-engine]security
File operation with user-controlled path in VerifyX-PSUT-main/platform/backend/internal/api/sanad_handlers.go at line 833. Attacker can read arbitrary files via ../ sequences.
Suggested Fix
Validate and sanitize file paths. Use path.resolve() and verify the result is within the expected directory.
HIGHWeak or deprecated cipher
[redacted]/server.go:158
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/server.go at line 158.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/server.go:795
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHGlobal Access Modifiers
[redacted]/server.go:1021
[AGENTS: rules-engine]code_quality
Global classes, methods, and variables should be avoided (especially in managed packages) as they can never be deleted or changed in signature. Always check twice if something needs to be global.
Suggested Fix
See CWE-284: Improper Access Control
HIGHWeak or deprecated cipher
[redacted]/server_workflow_addon.go:9
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/server_workflow_addon.go at line 9.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/signature_settings.go:60
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/signature_settings.go at line 60.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/student_handlers.go:153
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/student_handlers.go at line 153.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHHardcoded database credentials
[redacted]/verify_document.go:124
[AGENTS: rules-engine]attack_chains
**Perspective 1:** Database credentials (_APP_DB_USER, _APP_DB_PASS, _APP_DB_ROOT_PASS) are set to default values ('user', 'password', 'rootsecretpassword'). These are weak credentials that could be easily guessed in a production environment. **Perspective 2:** Default database credentials '_APP_DB_USER=user' and '_APP_DB_PASS=password' with root access '_APP_DB_ROOT_PASS=rootsecretpassword' create a critical attack chain: 1) Attacker scans for default Appwrite deployments, 2) Uses default cred
Suggested Fix
Require unique database credentials during installation. Generate strong random passwords and avoid default values. Implement database network isolation to prevent external access.
HIGHHardcoded secrets in production code
[redacted]/verify_document.go:124
[AGENTS: rules-engine]api_surface
**Perspective 1:** The configuration requires hardcoded paths for SSL certificates and keys, which can expose sensitive information if not properly secured. **Perspective 2:** SSL certificate and key files must have restrictive permissions to prevent unauthorized access. **Perspective 3:** The configuration requires a hardcoded token for metrics access, which poses a security risk if the configuration file is exposed. **Perspective 4:** The Nginx configuration references SSL certificate paths
Suggested Fix
Ensure that the SSL certificate paths are set via environment variables and that the files have restrictive permissions.
HIGHWeak or deprecated cipher
[redacted]/verify_document.go:225
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/verify_document.go at line 225.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/workflow_handlers.go:358
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/api/workflow_handlers.go at line 358.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHLocalhost Base Url
[redacted]/config.go:58
[AGENTS: rules-engine]code_quality
The 'baseURL' is set to localhost. This may cause links to not work if deployed.
HIGHWeak or deprecated cipher
[redacted]/config.go:83
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/config/config.go at line 83.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
HIGHWeak or deprecated cipher
[redacted]/config_test.go:34
[AGENTS: rules-engine]security
Weak cipher mode/algorithm in VerifyX-PSUT-main/platform/backend/internal/config/config_test.go at line 34.
Suggested Fix
Use AES-GCM or ChaCha20-Poly1305 instead.
Note: Fixing issues can create a domino effect — resolving one finding often surfaces new ones that were previously hidden. Multiple scan-and-fix cycles may be needed until you’re satisfied no further issues remain. How deep you go is your call.

Generated by ShipItClean.com — Autonomous Adversarial Code Validation