Findings
Security findings
Every finding identified in breach-guardians-demo, with the remediation and regression test that proves it.
BG-001
SQL Injection
CRITICALbackend/users.py:42
User-controlled request parameter is concatenated directly into a SQL query string.
BG-002
Hardcoded API Secret
CRITICALbackend/config.py:11
A live third-party API secret is committed in source control as a plaintext constant.
BG-003
Broken Authorization
HIGHbackend/auth.py:87
Endpoint verifies authentication but never checks that the caller owns the requested resource.
BG-004
Vulnerable Dependency
HIGHrequirements.txt:7
Pinned dependency version is affected by a published remote code execution advisory.
BG-005
Unsafe Input Handling
MEDIUMbackend/api.py:134
Request body is consumed without schema validation or length limits before processing.