ShipSafe Release Report

Findings — 11 total

ID	Severity	Agent	Finding	Location	Status
SEC-001	CRITICAL	🔒 Security	SQL Injection — login endpoint A03:2021 Injection · username/password concatenated into SQL	users.js:15	Auto-Fixed
SEC-002	CRITICAL	🔒 Security	Hardcoded JWT_SECRET in source code A02:2021 Cryptographic Failure · string literal secret, not env var	users.js:7	Auto-Fixed
SEC-003	CRITICAL	🔒 Security	Hardcoded DB_PASSWORD logged to console A09:2021 Logging Failure · production secret in console.log	index.js:37	Auto-Fixed
SEC-004	HIGH	🔒 Security	Path Traversal — user-controlled file path A01:2021 Broken Access · req.query.file passed to sendFile()	products.js:9	Manual
SEC-005	HIGH	🔒 Security	IDOR — no ownership check on orders A01:2021 Broken Access · any user can read any order ID	orders.js:7	Manual
SEC-006	HIGH	🔒 Security	JWT token issued with no expiry A07:2021 Auth Failure · jwt.sign() missing expiresIn	users.js:27	Auto-Fixed
QUA-001	HIGH	🔍 Quality	Cyclomatic complexity 14 in GET /products Threshold: 10 · Extract filter builders into helper functions	products.js:17	Manual
QUA-002	MEDIUM	🔍 Quality	Dead code — calculateDiscount() never called Orders.js function defined but 0 references	orders.js:38	Auto-Fixed
QUA-003	MEDIUM	🔍 Quality	Error responses expose database error details 3 routes send err.message to client	users.js, products.js, orders.js	Auto-Fixed
TST-001	CRITICAL	🧪 Tests	No SQL injection rejection test Critical: login route exploitable, zero security test coverage	tests/ (missing)	Auto-Generated
TST-002	CRITICAL	🧪 Tests	Overall test coverage: 12% 4 of 5 source files have 0% coverage · products.js, orders.js untested	src/ (all routes)	Manual

Auto-Fixes Applied — 6 issues resolved

✅

FIX-002 · Hardcoded JWT_SECRET → process.env.JWT_SECRET

Replaced string literal secret with environment variable reference

src/routes/users.js:7 + src/index.js:13

✅

FIX-004 · Removed secret from console.log

console.log(`DB Password: ${DB_PASSWORD}`) removed from startup

src/index.js:37

✅

FIX-001 · JWT expiresIn added

jwt.sign() now includes expiresIn: '1h', algorithm: 'HS256'

src/routes/users.js:27

✅

FIX-005 · Error detail leakage patched (3 locations)

err.message replaced with 'Internal server error' in all 500 responses

users.js:22, products.js:61, orders.js:11

✅

FIX-009 · .env added to .gitignore

.env and *.env patterns added to prevent future secret commits

.gitignore (created/updated)

✅

TST-AUTO · 15 critical test cases generated

SQL injection, path traversal, auth bypass, negative amounts, validation tests added

tests/shipsafe-generated.test.js

Manual Action Required — 4 items · Est. 3–4 hours

1 · CRITICAL

Fix SQL Injection in products.js and orders.js

Convert all remaining string-concatenated SQL queries to parameterized queries using ? placeholders

Est. 45 min · Bob can guide: "Fix SQL injection in products.js"

2 · HIGH

Fix Path Traversal in GET /products/image

Validate file parameter against an allowlist and use path.basename() + boundary check

Est. 30 min · Bob can guide: "Fix path traversal in products.js"

3 · HIGH

Add ownership validation on GET /orders/:id

Verify req.user.id matches order.user_id before returning order data

Est. 30 min · Bob can guide: "Fix IDOR in orders.js"

4 · HIGH

Refactor GET /products for complexity (14 → under 10)

Extract buildFilters(), buildSort() helper functions to reduce cyclomatic complexity

Est. 60 min · Bob can guide: "Refactor product filter logic"