Comments by rohan-cce

All comments ranked by humor rating

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ Bobby Tables called — he'd like a word with you.

conn.execute("DELETE FROM users WHERE id = ?", (user_id,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead. After applying, remove any old

execute(query)
call on the next line.

šŸ”„ Bobby Tables called — he'd like a word with you.

cursor.execute("SELECT * FROM products WHERE name LIKE ?", (search_term,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ Ah yes, concatenated SQL — the hacker's favorite snack. šŸæ

return conn.execute("SELECT * FROM users WHERE name = ?", (username,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ Ah yes, concatenated SQL — the hacker's favorite snack. šŸæ

query = "SELECT * FROM users WHERE name = ?" # Then use: cursor.execute(query, (username,))

šŸ”“ Code Injection (CWE-94) — Severity: CRITICAL

Use of eval()/exec() can execute arbitrary code. Use safe alternatives like ast.literal_eval() or structured parsing.

šŸ”„ eval() on untrusted data? That's not a feature, that's a remote code execution buffet. šŸ½ļø

return ast.literal_eval(data)

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead. After applying, remove any old

execute(query)
call on the next line.

šŸ”„ You basically left the front door open AND put up a 'Free Data' sign.

cursor.execute("SELECT * FROM users WHERE name = ?", (username,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ This query is so injectable, it should come with a syringe emoji. šŸ’‰

cursor.execute("SELECT * FROM products WHERE name LIKE ?", (search_term,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ Ah yes, concatenated SQL — the hacker's favorite snack. šŸæ

cursor.execute("SELECT * FROM products WHERE name LIKE ?", (search_term,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ Ah yes, concatenated SQL — the hacker's favorite snack. šŸæ

return conn.execute("SELECT * FROM users WHERE name = ?", (username,)).fetchall()

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ This query is so injectable, it should come with a syringe emoji. šŸ’‰

return conn.execute("SELECT * FROM users WHERE name = ?", (username,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ This query is so injectable, it should come with a syringe emoji. šŸ’‰

# Use parameterized queries instead of string concatenation

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ Bobby Tables called — he'd like a word with you.

return conn.execute("SELECT * FROM users WHERE name = ?", (username,)).fetchall()

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ This query is so injectable, it should come with a syringe emoji. šŸ’‰

# Use parameterized queries instead of string concatenation

šŸ”“ Hardcoded Credentials (CWE-798) — Severity: CRITICAL

Hardcoded password detected. Credentials should be stored in environment variables or a secret manager.

šŸ”„ Storing secrets in source code? Bold strategy. Let's see if it pays off. (Spoiler: it won't.)

āš ļø Required import — add this at the top of your file:

import os
DB_PASSWORD = os.environ.get("PASSWORD")

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead. After applying, remove any old

execute(query)
call on the next line.

šŸ”„ This query is so injectable, it should come with a syringe emoji. šŸ’‰

cursor.execute("SELECT * FROM users WHERE name = ?", (username,))

šŸ”„ Security Roast Review — Found 19 issue(s): 17 CRITICAL, 2 MEDIUM

Buckle up, this is going to hurt.

Each finding has an inline suggestion that you can apply with one click.

#TypeSeverityFileLine
1šŸ”“ SQL InjectionCRITICAL
vt2 copy 2.py
7
2šŸ”“ SQL InjectionCRITICAL
vt2 copy 2.py
14
3šŸ”“ SQL InjectionCRITICAL
vt2 copy 2.py
20
4šŸ”“ SQL InjectionCRITICAL
vt2 copy.py
7
5šŸ”“ SQL InjectionCRITICAL
vt2 copy.py
14
6šŸ”“ SQL InjectionCRITICAL
vt2 copy.py
20
7šŸ”“ SQL InjectionCRITICAL
vt2.py
7
8šŸ”“ SQL InjectionCRITICAL
vt2.py
14
9šŸ”“ SQL InjectionCRITICAL
vt2.py
20
10šŸ”“ Hardcoded CredentialsCRITICAL
vulnerable_test copy.py
4
11šŸ”“ Hardcoded CredentialsCRITICAL
vulnerable_test copy.py
5
12šŸ”“ SQL InjectionCRITICAL
vulnerable_test copy.py
8
13šŸ”“ Code InjectionCRITICAL
vulnerable_test copy.py
11
14🟔 Weak CryptographyMEDIUM
vulnerable_test copy.py
13
15šŸ”“ Hardcoded CredentialsCRITICAL
vulnerable_test.py
4
16šŸ”“ Hardcoded CredentialsCRITICAL
vulnerable_test.py
5
17šŸ”“ SQL InjectionCRITICAL
vulnerable_test.py
8
18šŸ”“ Code InjectionCRITICAL
vulnerable_test.py
11
19🟔 Weak CryptographyMEDIUM
vulnerable_test.py
13

šŸ’” Redemption Arc: Apply the suggestions and you'll earn back my respect. Maybe. šŸ”„

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ This query is so injectable, it should come with a syringe emoji. šŸ’‰

conn.execute("DELETE FROM users WHERE id = ?", (user_id,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ Ah yes, concatenated SQL — the hacker's favorite snack. šŸæ

cursor.execute("SELECT * FROM products WHERE name LIKE ?", (search_term,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead. After applying, remove any old

execute(query)
call on the next line.

šŸ”„ Ah yes, concatenated SQL — the hacker's favorite snack. šŸæ

cursor.execute("SELECT * FROM users WHERE name = ?", (username,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead. After applying, remove any old

execute(query)
call on the next line.

šŸ”„ Ah yes, concatenated SQL — the hacker's favorite snack. šŸæ

cursor.execute("SELECT * FROM products WHERE name LIKE ?", (search_term,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ This query is so injectable, it should come with a syringe emoji. šŸ’‰

conn.execute("DELETE FROM users WHERE id = ?", (user_id,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead. After applying, remove any old

execute(query)
call on the next line.

šŸ”„ Bobby Tables called — he'd like a word with you.

conn.execute("DELETE FROM users WHERE id = ?", (user_id,))

🟔 Weak Cryptography (CWE-327) — Severity: MEDIUM

MD5 is cryptographically broken. Use SHA-256, bcrypt, or Argon2 for password hashing.

šŸ”„ MD5 for password hashing? What year is this, 2003? ā°

return hashlib.sha256(pw.encode()).hexdigest()

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ Bobby Tables called — he'd like a word with you.

# Use parameterized queries: cursor.execute("SELECT * FROM table WHERE col = ?", (value,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead. After applying, remove any old

execute(query)
call on the next line.

šŸ”„ This query is so injectable, it should come with a syringe emoji. šŸ’‰

conn.execute("DELETE FROM users WHERE id = ?", (user_id,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ You basically left the front door open AND put up a 'Free Data' sign.

cursor.execute("SELECT * FROM products WHERE name LIKE ?", (search_term,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ You basically left the front door open AND put up a 'Free Data' sign.

return conn.execute("SELECT * FROM users WHERE name = ?", (username,)).fetchall()

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ This query is so injectable, it should come with a syringe emoji. šŸ’‰

return conn.execute("SELECT * FROM users WHERE name = ?", (username,)).fetchall()

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ Ah yes, concatenated SQL — the hacker's favorite snack. šŸæ

conn.execute("DELETE FROM users WHERE id = ?", (user_id,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ This query is so injectable, it should come with a syringe emoji. šŸ’‰

cursor.execute("DELETE FROM users WHERE id =?", (user_id,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead. After applying, remove any old

execute(query)
call on the next line.

šŸ”„ You basically left the front door open AND put up a 'Free Data' sign.

cursor.execute("SELECT * FROM users WHERE name = ?", (username,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ Ah yes, concatenated SQL — the hacker's favorite snack. šŸæ

return conn.execute("SELECT * FROM users WHERE name = ?", (username,)).fetchall()

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead. After applying, remove any old

execute(query)
call on the next line.

šŸ”„ You basically left the front door open AND put up a 'Free Data' sign.

cursor.execute("SELECT * FROM products WHERE name LIKE ?", (search_term,))

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ You basically left the front door open AND put up a 'Free Data' sign.

return conn.execute("SELECT * FROM users WHERE name = ?", (username,))

šŸ”“ Hardcoded Credentials (CWE-798) — Severity: CRITICAL

Hardcoded API key detected. Credentials should be stored in environment variables or a secret manager.

šŸ”„ Congratulations, you just open-sourced your credentials. The whole internet thanks you. šŸ‘

āš ļø Required import — add this at the top of your file:

import os
API_KEY = os.environ.get("API_KEY")

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ This query is so injectable, it should come with a syringe emoji. šŸ’‰

return conn.execute("SELECT * FROM users WHERE name = ?", (username,))

🟔 Weak Cryptography (CWE-327) — Severity: MEDIUM

MD5 is cryptographically broken. Use SHA-256, bcrypt, or Argon2 for password hashing.

šŸ”„ Using MD5 is like locking your front door with scotch tape. šŸ”’

return hashlib.sha256(pw.encode()).hexdigest()

šŸ”“ Hardcoded Credentials (CWE-798) — Severity: CRITICAL

Hardcoded API key detected. Credentials should be stored in environment variables or a secret manager.

šŸ”„ This secret is more exposed than a celebrity's leaked photos. Please use a secret manager.

āš ļø Required import — add this at the top of your file:

import os
API_KEY = os.environ.get("API_KEY")

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ You basically left the front door open AND put up a 'Free Data' sign.

return conn.execute("SELECT * FROM users WHERE name = ?", (username,)).fetchall()

šŸ”“ SQL Injection (CWE-89) — Severity: CRITICAL

SQL query built with string concatenation/formatting. Use parameterized queries instead.

šŸ”„ Bobby Tables called — he'd like a word with you.

conn.execute("DELETE FROM users WHERE id = ?", (user_id,))

🟔 Weak Cryptography (CWE-327) — Severity: MEDIUM

MD5 is cryptographically broken. Use SHA-256, bcrypt, or Argon2 for password hashing.

šŸ”„ Using MD5 is like locking your front door with scotch tape. šŸ”’

return hashlib.sha256(pw.encode()).hexdigest()

šŸ”“ Hardcoded Credentials (CWE-798) — Severity: CRITICAL

Hardcoded API key detected. Credentials should be stored in environment variables or a secret manager.

šŸ”„ This secret is more exposed than a celebrity's leaked photos. Please use a secret manager.

āš ļø Required import — add this at the top of your file:

import os
API_KEY = os.environ.get("API_KEY")

🟔 Weak Cryptography (CWE-327) — Severity: MEDIUM

MD5 is cryptographically broken. Use SHA-256, bcrypt, or Argon2 for password hashing.

šŸ”„ Using MD5 is like locking your front door with scotch tape. šŸ”’

return hashlib.sha256(pw.encode()).hexdigest()

šŸ”“ Hardcoded Credentials (CWE-798) — Severity: CRITICAL

Hardcoded API key detected. Credentials should be stored in environment variables or a secret manager.

šŸ”„ This secret is more exposed than a celebrity's leaked photos. Please use a secret manager.

āš ļø Required import — add this at the top of your file:

import os
API_KEY = os.environ.get("API_KEY")

šŸ”“ Hardcoded Credentials (CWE-798) — Severity: CRITICAL

Hardcoded API key detected. Credentials should be stored in environment variables or a secret manager.

šŸ”„ Congratulations, you just open-sourced your credentials. The whole internet thanks you. šŸ‘

āš ļø Required import — add this at the top of your file:

import os
API_KEY = os.environ.get("API_KEY")

šŸ”“ Hardcoded Credentials (CWE-798) — Severity: CRITICAL

Hardcoded password detected. Credentials should be stored in environment variables or a secret manager.

šŸ”„ Congratulations, you just open-sourced your credentials. The whole internet thanks you. šŸ‘

DB_PASSWORD = os.environ.get("PASSWORD")

šŸ”„ Security Roast Review — Found 5 issue(s): 4 CRITICAL, 1 MEDIUM

Buckle up, this is going to hurt.

Each finding has an inline suggestion that you can apply with one click.

#TypeSeverityFileLine
1šŸ”“ Hardcoded CredentialsCRITICAL
vulnerable_test.py
4
2šŸ”“ Hardcoded CredentialsCRITICAL
vulnerable_test.py
5
3šŸ”“ SQL InjectionCRITICAL
vulnerable_test.py
8
4šŸ”“ Code InjectionCRITICAL
vulnerable_test.py
11
5🟔 Weak CryptographyMEDIUM
vulnerable_test.py
13

šŸ’” Redemption Arc: Apply the suggestions and you'll earn back my respect. Maybe. šŸ”„

šŸ”“ Hardcoded Credentials (CWE-798) — Severity: CRITICAL

Hardcoded API key detected. Credentials should be stored in environment variables or a secret manager.

šŸ”„ Congratulations, you just open-sourced your credentials. The whole internet thanks you. šŸ‘

āš ļø Required import — add this at the top of your file:

import os
API_KEY = os.environ.get("API_KEY")