mihirsuchak11/teracode-testbed
#4 by mihirsuchak11+20−0across 1 filesopenView on GitHub
1
Runs
8
Findings
0
Resolved
0
Deleted
Latest review
Security and Senior Engineer reviewed this change.
Hardcoded secrets ran.
8 findings are still open.
8b82c1eopenedAug 14, 2026, 1:31 PM · 760 B diff
Hardcoded API key/secret literal committed to source. Even as a placeholder, this establishes a bad pattern; secrets should be loaded from environment variables or a secret manager.
src/auth.js:4openview
SQL injection: email is concatenated directly into the query string. Use parameterized queries/prepared statements instead.
src/auth.js:8openhas fixview
Assignment instead of comparison: `token = API_KEY` overwrites token with API_KEY and is always truthy, making checkToken always return true regardless of the input token — a critical authentication bypass.
src/auth.js:13openhas fixview
Logging the plaintext password on failed login writes sensitive credentials to logs. Remove the password from the log message (log only the email/timestamp/reason).
src/auth.js:19openhas fixview
API_KEY is hardcoded as a string literal in source. Even though the comment claims it's a fake placeholder, this pattern should not be committed—secrets/tokens should be loaded from environment variables or a secret manager.
src/auth.js:4openhas fixview
findUser builds a SQL query via string concatenation of the email parameter, making it vulnerable to SQL injection. Use parameterized queries instead.
src/auth.js:8openhas fixview
checkToken uses assignment (=) instead of comparison (=== or ==), so it always sets token to API_KEY and returns true regardless of the input token, effectively bypassing authentication.
src/auth.js:13openhas fixview
auditFailure logs the plaintext password on failed login attempts, which is a serious security/privacy issue (sensitive data exposure in logs).
src/auth.js:19openhas fixview