What green CI does not tell you

Static analysis for hardcoded secrets, SQL injection vectors, authentication bypass patterns, and weak cryptographic primitives in source code.

• — Hardcoded API keys and credentials in source
• — SQL injection via string concatenation
• — Authentication bypass in route handlers
• — Weak or deprecated crypto (MD5, SHA1 for passwords)

Tracks unsanitized user input flowing to SQL execution, shell commands, XSS sinks, or eval — classic injection attack vectors.

• — User input reaching SQL without parameterization
• — Unsanitized data in dangerouslySetInnerHTML
• — User-controlled strings passed to exec/spawn

Audits lockfile integrity, known CVEs in dependencies, and suspicious package names that may be typosquats or supply-chain attacks.

• — Known CVEs in direct dependencies
• — Lockfile tampering or missing integrity hashes
• — Suspicious or typosquatting package names

Runs Semgrep rules tuned for AI-generated code patterns — common mistakes LLMs make when generating production code.

• — AI-specific anti-patterns in generated code
• — Common LLM security mistakes

Ensures Stripe and other webhook route handlers verify signatures (constructEvent, signature header validation) before processing payloads.

• — Stripe webhooks without constructEvent verification
• — Webhook handlers accepting unsigned payloads
• — Missing signature header validation