Real Vulnerabilities We Found

def get_user_by_email(email):
    query = f"SELECT * FROM users WHERE email = '{email}'"
    cursor.execute(query)
    return cursor.fetchone()

# Attacker input: ' OR '1'='1
# Resulting query: SELECT * FROM users WHERE email = '' OR '1'='1'
# Result: Returns ALL users in database

def get_user_by_email(email):
    query = "SELECT * FROM users WHERE email = %s"
    cursor.execute(query, (email,))  # Use parameterized queries
    return cursor.fetchone()

import requests

API_KEY = "sk_live_51HbkY2GH3w8e9mK4N5pQ6rS7tU8vW9xY0z"
OPENAI_KEY = "sk-proj-AbCdEfGhIjKlMnOpQrStUvWxYz"

def call_external_api(endpoint):
    headers = {"Authorization": f"Bearer {API_KEY}"}
    response = requests.get(endpoint, headers=headers)
    return response.json()

import requests
import os
from dotenv import load_dotenv

load_dotenv()
API_KEY = os.getenv("API_KEY")

def call_external_api(endpoint):
    headers = {"Authorization": f"Bearer {API_KEY}"}
    response = requests.get(endpoint, headers=headers)
    return response.json()

<div class="user-bio">
  {{ user.bio }}  <!-- Raw HTML rendered -->
</div>



<div class="user-bio">
  {{ user.bio | escape }}  <!-- Auto-escaped -->
</div>


from django.utils.html import escape
safe_bio = escape(user.bio)

def process_payment(user_id, amount):
    user = User.query.get(user_id)

    # Two separate operations - RACE CONDITION WINDOW
    if user.balance >= amount:  # Check
        user.balance -= amount   # Act (but another request may have run the check!)
        db.session.commit()

# Two concurrent requests can both pass the check
# User charged twice despite insufficient balance

from sqlalchemy import and_, select

def process_payment(user_id, amount):
    # Atomic update: check and act in single query
    result = db.session.execute(
        update(User)
        .where(and_(User.id == user_id, User.balance >= amount))
        .values(balance=User.balance - amount)
    )

    if result.rowcount == 0:
        raise InsufficientBalanceError()
    db.session.commit()

import pickle

# User uploads a file
user_data = request.files['data'].read()

# This deserializes and EXECUTES arbitrary Python code
restored_object = pickle.loads(user_data)

# Attacker can create pickled payload that:
# - Deletes all files
# - Exfiltrates database
# - Installs backdoor

import json

# Use JSON for user data, not pickle
user_data_json = request.files['data'].read()
restored_object = json.loads(user_data_json)

# Or use restricted unpickler:
import pickle
from typing import Any
class RestrictedUnpickler(pickle.Unpickler):
    def find_class(self, module, name):
        if module in ["os", "sys", "subprocess"]:
            raise ValueError("Module not allowed")
        return super().find_class(module, name)

from argon2 import PasswordHasher
from passlib.context import CryptContext

# Best: Argon2
pwd_context = CryptContext(schemes=["argon2"], deprecated="auto")
hashed = pwd_context.hash(password)

# Or: bcrypt (slower, resistant to brute force)
from bcrypt import hashpw, gensalt
hashed = hashpw(password.encode(), gensalt(rounds=12))