SasanLabs/VulnerableApp · audit

Loading report…

SasanLabs/VulnerableApp · audit — nittim

3 things to fix before you ship3 things to fix before you launch3 things to fix before you ship

A finite, ranked list — highest-severity, lowest-effort blockers first. Clear these and the verdict lifts.A short, ranked list — the most serious, easiest-to-fix problems first. Clear these and the verdict improves.Ranked by severity and effort. Clear these and the verdict lifts.

Personal access token interpolated into git push URL in GitHub Actions workflows

MediumSecurity.github/workflows/stats.ymlSmall (hours)Quick (a few hours)Small (hours)

EvidenceWhat we foundEvidence: .github/workflows/stats.yml(Commit & Push step: git push "https://preetkaran20:${TOKEN}@github.com/SasanLabs/VulnerableApp.git" HEAD:master) and .github/workflows/zap-benchmark.yml (Commit benchmark results step: same pattern with ${TOKEN}=secrets.GH_TRAFFIC_TOKEN).
Business impactWhy it mattersImpact: Tokens embedded in remote URLs can be captured by process listings, shell trace, or verbose git/CI logging, and are more prone to accidental disclosure than credential helpers. A leaked GH_TRAFFIC_TOKEN would grant write access to the repo (and the token is scoped across multiple SasanLabs repos it queries), enabling supply-chain tampering of the published Docker images.
Root causeWhy it happensCause: Credential passed inline in the URL instead of via a git credential helper, extraheader auth, or the checkout action's persisted token.
Recommended fixHow to fix itFix: Authenticate via actions/checkout persisted credentials or git config http.extraheader with a masked secret, avoid interpolating the token into the URL, and prefer a fine-grained token scoped to only the required repos with least privilege.

RemediationHow to fix itRemediationSmall (hours)Quick (a few hours)Small (hours)

Useful?

Production compose publishes a deliberately vulnerable app on 0.0.0.0:80

MediumBusiness & Product Riskdocker-compose.prod.ymlSmall (hours)Quick (a few hours)Small (hours)

EvidenceWhat we foundEvidence: docker-compose.prod.ymlVulnerableApp-facade ports '0.0.0.0:80:80' with SPRING_PROFILES_ACTIVE=public on the base; scripts/productionize/startup_script.sh brings this stack up on a cloud host.
Business impactWhy it mattersImpact: Any publicly reachable deployment of an intentionally vulnerable app is an operational and abuse risk (defacement, use as an attack relay, resource abuse). Mitigated substantially here: the 'internal' network is declared internal:true so the base container has no outbound internet, and the RCE-class modules (CommandInjection, RFI, PathTraversal, UnrestrictedFileUpload) are @Profile("unsafe") and therefore disabled under the 'public' prod profile.

Hardcoded demo keystore password for JWT signing keys

LowSecuritysrc/main/java/org/sasanlabs/service/vulnerability/jwt/keys/JWTAlgorithmKMS.javaTrivial (<1h)Very quick (under an hour)Trivial (<1h)

EvidenceWhat we foundEvidence: src/main/java/org/sasanlabs/service/vulnerability/jwt/keys/JWTAlgorithmKMS.javaKEY_STORE_PASSWORD = "changeIt" used to open sasanlabs.p12 (RSA_KEY_ALIAS = "SasanLabs").
Business impactWhy it mattersImpact: The RSA keypair used by the JWT demo modules is protected by a well-known password; anyone can extract the private key. Because this is a bundled demo keystore for teaching JWT attacks (not a production trust anchor), impact is limited to the intentionally-vulnerable JWT levels.
Root causeWhy it happensCause

Everything else we foundEverything else we noticedEverything else

9 more findings across 8 dimensions — none blocking, all worth a look.9 more problems across 8 categories — none blocking, all worth a look.9 more findings — none blocking.

12Findings in allTotal problems foundAll findings

2Medium

7Low

3Info

Security
Priority: Core

How we scored it

Five component scores roll up into the one number — and the verdict is held to the evidence, not to how the write-up reads.Five scores combine into the one overall number — and the verdict is checked against the actual evidence, not just how the write-up sounds.Five scores roll into one number. The verdict is held to the evidence, not the write-up.

Production ReadinessReady for real usersProduction Readiness71

Security66

Privacy85

What we read — and what we didn’tWhat we checked — and what we didn’tWhat we read — and didn’t

We read the highest-priority 48% of your repository. This verdict covers only that — here is the record of which files, which modules, and what the snapshot was.We checked the highest-priority 48% of your project's code. This verdict covers only that — here is the record of which files, which checks, and what copy of the code was used.Read the highest-priority 48% of your repo. Record of files, modules, and snapshot below.

Audit CoverageHow Much We CheckedCoverage

48%220/458 files audited220/458 files checked220/458 files

220 of 458 files were audited. This audit's size or file-count limit was reached, so some source and configuration files were left unread. The denominator counts every file in the repository — images, generated output, vendored and build directories included.

This audit's size limit was reached before it read the whole repository. The verdict and every score on this report were computed from what it did read — read them as evidence about that sample, not a clean bill of health for the rest.

The AI-generated likelihood estimate is based on 48% of repository files (220/458) — read it cautiously. The audited files were selected by priority, but a large portion of the repository was not seen.

In the model’s wordsWhat the AI wrote, in its own wordsThe model's words

The executive summary, as Claude wrote it. Evidence, scores and the verdict are computed by nittim.The summary, as Claude wrote it. The evidence, scores and verdict are computed by nittim, not by Claude.Claude wrote this summary. nittim computes the evidence, scores, and verdict.

executive summary · in the model’s wordssummary · in the AI’s own wordssummary · in the model's words

Claude says

Evidence, scores, and the verdict above are computed by nittim. The written read below — this summary and every finding’s narrative — is Claude’s.The evidence, scores, and the verdict above are computed by nittim. The written explanation below — this summary and every finding’s write-up — is Claude’s, the AI assistant that reviewed your code.nittim computes the evidence, scores, and verdict. Claude writes the summary below.

This repository is OWASP VulnerableApp — a deliberately and intentionally vulnerable Spring Boot (Java 17) application used as a training target and a benchmark harness for DAST/SAST scanners (ZAP integration, benchmark comparison endpoints). The SQL injection, XSS, command injection, path traversal, LDAP injection, JWT flaws, IDOR, weak crypto, session and password-reset weaknesses in the codebase are the PRODUCT, not defects: they are catalogued, level-gated, annotated, and profile-segregated by design. Accordingly they are NOT graded here as production security failures. The engineering AROUND the vulnerabilities is generally mature: an annotation-driven endpoint-discovery framework, Spring profiles ('public' vs 'unsafe') that keep the RCE-class modules (CommandInjection, PathTraversal, RFI, UnrestrictedFileUpload, benchmark writer, email) off in the production compose profile, admin/application datasource privilege separation, an isolated internal Docker network for the base image, randomized credential generation in the startup script, and a working CI/CD + benchmark automation pipeline. Genuine (unintended) concerns are limited and modest: personal-access-tokens embedded directly in git push URLs inside GitHub Actions, a hardcoded demo keystore password, a few placeholder/empty/commented-out classes, a copy-paste no-op constructor bug, and thin runtime observability. Deterministic secret hits are all test data, seed data, or a PEM-delimiter constant — none are live production credentials. There is little defensible proprietary IP and the project is intentionally public and reusable, so IP exposure is a non-issue. Scored as a real deployable service, it is safe to run for its intended purpose provided it stays network-isolated and the CI token handling is tightened.

How the executive score is composedHow the overall score is put togetherHow the exec score is composed

Security66

weightimportanceweight

Privacy85

weightimportanceweight

Production ReadinessReady for real usersProduction Readiness71

weightimportanceweight

ArchitectureHow the code is put togetherArchitecture73

weightimportanceweight

Weighted blend of 4 dimensions → ~73/100. Dimensions are weighted by importance (Security and Privacy weigh heaviest). Published figures are approximate; nittim's exact weighting and precise scoring are proprietary, while the verdict is computed on exact internal values.4 categories combine into ~73/100. Some categories count for more than others (Security and Privacy count the most). The published numbers are approximate; nittim's exact math is kept private, while the verdict itself is worked out from the exact internal numbers.Weighted blend of 4 dimensions → ~73/100 (Security and Privacy weigh heaviest). Published figures are approximate; nittim's exact weighting is proprietary. The verdict runs on exact internal values.
IP Protection is an independent IP-defensibility lens and is excluded from this blend.IP Protection (checking whether your ideas are exposed) is judged separately and isn’t part of this combined number.IP Protection is judged separately, excluded from this blend.
Scores are a judgement, not a measurement: a re-audit of the same commit can land a few points either side of this figure. The evidence underneath it is deterministic — the same commit always yields the same committed-secret and vulnerable-dependency findings.Scores are a judgment call, not an exact measurement: checking the same saved snapshot of your code twice can land a few points either side of this number. The evidence underneath it is not — the same snapshot always turns up the same passwords-in-code and known-security-bug findings.Scores are a judgment, not a measurement — a re-audit can land a few points either side. The evidence underneath is deterministic: the same commit always yields the same secret and vulnerable-dependency findings.
Each score is the model's overall assessment of the dimensions it covers, across everything it reviewed — not a tally of the findings in this report. Findings are the subset worth acting on, so a score can sit above or below what the listed findings alone would suggest.Each score is the AI's overall judgment of everything it reviewed in that category — not a count of the problems listed in this report. The listed problems are the ones worth acting on, so a score can sit above or below what they alone would suggest.Each score is the model's overall assessment across everything it reviewed — not a tally of this report's findings. A score can sit above or below what the findings alone suggest.

Production Ready with Conditions — fix 3 things before you ship.Production Ready with Conditions — fix 3 things before you make it live.Production Ready with Conditions — fix 3 things before you ship.

3 things to fix before you ship3 things to fix before you launch3 things to fix before you ship

Personal access token interpolated into git push URL in GitHub Actions workflows

Production compose publishes a deliberately vulnerable app on 0.0.0.0:80

Hardcoded demo keystore password for JWT signing keys

Everything else we foundEverything else we noticedEverything else

Security
Priority: Core

Security

How we scored it

What we read — and what we didn’tWhat we checked — and what we didn’tWhat we read — and didn’t

Audit CoverageHow Much We CheckedCoverage

In the model’s wordsWhat the AI wrote, in its own wordsThe model's words

executive summary · in the model’s wordssummary · in the AI’s own wordssummary · in the model's words

Deterministic secret-scan hits are test/seed data or a PEM delimiter constant, not live credentials

Privacy & Compliance
Priority: Core1 finding

Privacy & Compliance

Contributor GitHub username forwarded to an external Google Form; no real end-user PII processed

Code Quality & Architecture
Priority: Important2 findings

Code Quality & Architecture

Empty placeholder and fully commented-out vulnerability classes

No-op constructor assignment of uninitialized port field

AI / Vibe Coding Risk
Priority: Important1 finding

AI / Vibe Coding Risk

Benchmark SAST sample contains an intentional fabricated vulnerability entry (test fixture, not a hallucination)

Infrastructure & DevOps
Priority: Important1 finding

Infrastructure & DevOps

Misconfigured inputs in release workflow

Data Layer
Priority: Important1 finding

Data Layer

Schema/data provisioned via raw SQL scripts and JPA auto-DDL with no migration tooling

Observability
Priority: Supporting1 finding

Observability

Runtime observability limited to application logging

IP & Novelty Exposure
Priority: Specialized1 finding

IP & Novelty Exposure

Scanner-benchmark comparison logic is mildly novel but prior-art-heavy and intentionally public

How the executive score is composedHow the overall score is put togetherHow the exec score is composed

Where this score sits on nittim's production-readiness scaleWhere this score falls on nittim's “is it ready to ship” scaleThis score's spot on nittim's scale.

Modules run (17)

Production Ready with Conditions — fix 3 things before you ship.Production Ready with Conditions — fix 3 things before you make it live.Production Ready with Conditions — fix 3 things before you ship.

3 things to fix before you ship3 things to fix before you launch3 things to fix before you ship

Personal access token interpolated into git push URL in GitHub Actions workflows

Production compose publishes a deliberately vulnerable app on 0.0.0.0:80

Hardcoded demo keystore password for JWT signing keys

Everything else we foundEverything else we noticedEverything else

SecurityPriority: Core

Security

How we scored it

What we read — and what we didn’tWhat we checked — and what we didn’tWhat we read — and didn’t

Audit CoverageHow Much We CheckedCoverage

In the model’s wordsWhat the AI wrote, in its own wordsThe model's words

executive summary · in the model’s wordssummary · in the AI’s own wordssummary · in the model's words

Deterministic secret-scan hits are test/seed data or a PEM delimiter constant, not live credentials

Privacy & CompliancePriority: Core1 finding

Privacy & Compliance

Contributor GitHub username forwarded to an external Google Form; no real end-user PII processed

Code Quality & ArchitecturePriority: Important2 findings

Code Quality & Architecture

Empty placeholder and fully commented-out vulnerability classes

No-op constructor assignment of uninitialized port field

AI / Vibe Coding RiskPriority: Important1 finding

AI / Vibe Coding Risk

Benchmark SAST sample contains an intentional fabricated vulnerability entry (test fixture, not a hallucination)

Infrastructure & DevOpsPriority: Important1 finding

Infrastructure & DevOps

Misconfigured inputs in release workflow

Data LayerPriority: Important1 finding

Data Layer

Schema/data provisioned via raw SQL scripts and JPA auto-DDL with no migration tooling

ObservabilityPriority: Supporting1 finding

Observability

Runtime observability limited to application logging

IP & Novelty ExposurePriority: Specialized1 finding

IP & Novelty Exposure

Scanner-benchmark comparison logic is mildly novel but prior-art-heavy and intentionally public

How the executive score is composedHow the overall score is put togetherHow the exec score is composed

Where this score sits on nittim's production-readiness scaleWhere this score falls on nittim's “is it ready to ship” scaleThis score's spot on nittim's scale.

Modules run (17)

Security
Priority: Core

Privacy & Compliance
Priority: Core1 finding

Code Quality & Architecture
Priority: Important2 findings

AI / Vibe Coding Risk
Priority: Important1 finding

Infrastructure & DevOps
Priority: Important1 finding

Data Layer
Priority: Important1 finding

Observability
Priority: Supporting1 finding

IP & Novelty Exposure
Priority: Specialized1 finding