From d455f05023a8b7e19bd2542241f35c2ede0a09db Mon Sep 17 00:00:00 2001 From: vishkulkarni2-tech Date: Fri, 10 Apr 2026 16:49:28 -0400 Subject: [PATCH 1/9] test: verify PR review comments --- server.js | 1 + 1 file changed, 1 insertion(+) diff --git a/server.js b/server.js index bf508d0..c2770a1 100644 --- a/server.js +++ b/server.js @@ -75,3 +75,4 @@ app.get("/account/:userId", (req, res) => { }); app.listen(3000); +// trigger scan - verify PR review comments From 40c40b14be658ff4d7d1543dea9933543b75e1dd Mon Sep 17 00:00:00 2001 From: vishkulkarni2-tech Date: Sun, 12 Apr 2026 19:07:20 -0400 Subject: [PATCH 2/9] trigger scan --- server.js | 1 + 1 file changed, 1 insertion(+) diff --git a/server.js b/server.js index c2770a1..6b7ac83 100644 --- a/server.js +++ b/server.js @@ -76,3 +76,4 @@ app.get("/account/:userId", (req, res) => { app.listen(3000); // trigger scan - verify PR review comments +// trigger From 9b33c97bd8468f4a192ff9f83d466634b026c46a Mon Sep 17 00:00:00 2001 From: Vish Kulkarni Date: Sun, 12 Apr 2026 19:08:56 -0400 Subject: [PATCH 3/9] trigger scan for PR comments test --- server.js | 1 + 1 file changed, 1 insertion(+) diff --git a/server.js b/server.js index 6b7ac83..efe194e 100644 --- a/server.js +++ b/server.js @@ -77,3 +77,4 @@ app.get("/account/:userId", (req, res) => { app.listen(3000); // trigger scan - verify PR review comments // trigger +// trigger 1776035336 From a72b41eaf180c982c68b3ec424b87e853d9f9d6c Mon Sep 17 00:00:00 2001 From: Vish Kulkarni Date: Sun, 12 Apr 2026 23:13:02 -0400 Subject: [PATCH 4/9] verify PR scan after jobId fix --- server.js | 1 + 1 file changed, 1 insertion(+) diff --git a/server.js b/server.js index efe194e..5dba604 100644 --- a/server.js +++ b/server.js @@ -78,3 +78,4 @@ app.listen(3000); // trigger scan - verify PR review comments // trigger // trigger 1776035336 +// verify 1776049982 From c44b066fcea6633feae102577a244b2ffa2c5b95 Mon Sep 17 00:00:00 2001 From: Vish Kulkarni Date: Mon, 13 Apr 2026 17:59:17 -0700 Subject: [PATCH 5/9] add vulnerable file to test PR review comments --- vuln-test.js | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 vuln-test.js diff --git a/vuln-test.js b/vuln-test.js new file mode 100644 index 0000000..f7b42b1 --- /dev/null +++ b/vuln-test.js @@ -0,0 +1,26 @@ +// Deliberately vulnerable file to verify PR review comments +const express = require("express"); +const app = express(); + +// Hardcoded API key - should trigger finding +const STRIPE_KEY = "sk-test-FAKE-verify-pr-comments-1234567890abcdef"; + +// SQL injection via string concat +app.get("/search", (req, res) => { + const query = "SELECT * FROM products WHERE name = '" + req.query.q + "'"; + db.query(query, (err, results) => res.json(results)); +}); + +// Path traversal +app.get("/download", (req, res) => { + const fs = require("fs"); + const content = fs.readFileSync("/files/" + req.params.file, "utf8"); + res.send(content); +}); + +// Open redirect +app.get("/go", (req, res) => { + res.redirect(req.query.url); +}); + +app.listen(4000); From 3f0c2ea7102fd5346f74ed2241bf32524086bc60 Mon Sep 17 00:00:00 2001 From: Vish Kulkarni Date: Mon, 13 Apr 2026 18:39:57 -0700 Subject: [PATCH 6/9] verify PR scan with installationId fallback --- vuln-test.js | 1 + 1 file changed, 1 insertion(+) diff --git a/vuln-test.js b/vuln-test.js index f7b42b1..bd2fe03 100644 --- a/vuln-test.js +++ b/vuln-test.js @@ -24,3 +24,4 @@ app.get("/go", (req, res) => { }); app.listen(4000); +// verify-pr-1776130797 From ea991ade20985b34477fe50cfe75c6b480c04bd2 Mon Sep 17 00:00:00 2001 From: OC Date: Mon, 13 Apr 2026 18:55:45 -0700 Subject: [PATCH 7/9] trigger: re-scan after blob SHA fix --- vuln-test.js | 1 + 1 file changed, 1 insertion(+) diff --git a/vuln-test.js b/vuln-test.js index bd2fe03..81b7f56 100644 --- a/vuln-test.js +++ b/vuln-test.js @@ -25,3 +25,4 @@ app.get("/go", (req, res) => { app.listen(4000); // verify-pr-1776130797 +// trigger scan after blob-sha fix 1776131745 From 9f2f26baa01e0e861e5bed9c4b5133d249ee4d51 Mon Sep 17 00:00:00 2001 From: OC Date: Mon, 13 Apr 2026 18:57:10 -0700 Subject: [PATCH 8/9] trigger: re-scan after deploy confirmed live --- vuln-test.js | 1 + 1 file changed, 1 insertion(+) diff --git a/vuln-test.js b/vuln-test.js index 81b7f56..de3a750 100644 --- a/vuln-test.js +++ b/vuln-test.js @@ -26,3 +26,4 @@ app.get("/go", (req, res) => { app.listen(4000); // verify-pr-1776130797 // trigger scan after blob-sha fix 1776131745 +// re-trigger after deploy confirmed live 1776131829 From 2f567fa2acba44562430642b9f874b75ab1278d1 Mon Sep 17 00:00:00 2001 From: OC Date: Tue, 28 Apr 2026 18:31:33 -0700 Subject: [PATCH 9/9] chore: trigger verify scan post-deploy 2026-04-29 --- verify-deploy.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 verify-deploy.txt diff --git a/verify-deploy.txt b/verify-deploy.txt new file mode 100644 index 0000000..89cf233 --- /dev/null +++ b/verify-deploy.txt @@ -0,0 +1 @@ +Tue Apr 28 18:31:33 PDT 2026