demo/clawguard-showcase

PR #1[Demo] Checkout, webhooks, exports — full ClawGuard showcase

Audited

just now

3/28/2026, 10:18:00 AM

Review verdict: Request changes

CRITICAL findings (SQL injection, committed API key) block approval. Address HIGH items (XSS surface, login rate limit) before merge; follow with MEDIUM CSRF, SSRF, and path traversal fixes. Re-run the audit after rotation and remediation.

Executive summary

This showcase PR adds checkout, webhooks, exports, and auth touchpoints. The scan surfaced a CRITICAL injection issue, a HIGH-severity credential-in-source finding, additional HIGH/MEDIUM items (XSS surface, brute-force risk, CSRF, path traversal, SSRF), plus quality, architecture, testing, and documentation gaps on the payment path.

/ 100GradeD

Critical: 1High: 4Medium: 6Low: 4Info: 1

16 findings across 3 pipeline stage(s)

OWASP Top 10 Distribution

CRITICALHIGHMEDIUMLOWINFO

What this team keeps doing

String-built SQL in data layer
Third hit this quarter in `lib/db/*` — add a lint or enforced query helper.
Elevated
Secrets in `lib/env` fallbacks
Matches prior incident in PR #88 — forbid non-empty defaults for credential envs.
Elevated
API routes without CSRF on mutating POST
Same gap as `app/api/cart/route.ts` (#412); standardize middleware.

demo/clawguard-showcase

OWASP Top 10 Distribution

CRITICALSQL built from string concatenationlib/db/orders.ts:12CWE-89A03:2021 — InjectionsecurityEffort: small

HIGHBusiness rules embedded in the route handlerapp/api/checkout/route.ts:22architectureEffort: medium

HIGHProduction API key committed in env helperlib/env.ts:14CWE-798A02:2021 — Cryptographic FailuressecurityEffort: small

HIGHHTML email template renders unsanitized user fieldslib/email/receipt.tsx:36CWE-79A03:2021 — InjectionsecurityEffort: small

HIGHLogin route has no rate limitingapp/api/auth/login/route.ts:9CWE-307A07:2021 — Identification and Authentication FailuressecurityEffort: medium

MEDIUMDuplicate input validationapp/api/checkout/route.ts:18qualityEffort: small

MEDIUMState-changing POST without CSRF protectionapp/api/checkout/route.ts:31CWE-352A01:2021 — Broken Access ControlsecurityEffort: medium

MEDIUMExport path joins user input without normalizationapp/api/exports/[id]/route.ts:22CWE-22A01:2021 — Broken Access ControlsecurityEffort: small

MEDIUMWebhook dispatcher fetches user-supplied URLapp/api/webhooks/dispatch/route.ts:41CWE-918A10:2021 — Server-Side Request ForgerysecurityEffort: medium

MEDIUMNo automated test for payment failure rollbackapp/api/checkout/route.ts:1testingEffort: medium

MEDIUMAdmin export list omits org scoping checkapp/api/admin/exports/route.ts:17CWE-639A01:2021 — Broken Access ControlsecurityEffort: small

LOWNested conditionals in checkout handlerapp/api/checkout/route.ts:44qualityEffort: trivial

LOWPublic POST handler lacks request/response documentationapp/api/checkout/route.ts:1documentationEffort: small

LOWSequential awaits in order summarylib/db/orders.ts:28performanceEffort: small

LOWAPI responses omit key security headersmiddleware.ts:12CWE-693A05:2021 — Security MisconfigurationsecurityEffort: trivial

INFOPII written to stdout in production pathlib/auth/session.ts:55CWE-532A09:2021 — Security Logging and Monitoring FailuressecurityEffort: trivial