});
const app = express();
app.use(express.json());
JS 1.0 · Project evidence
JS App (Knex/Postgres 3): Find Vulnerabilities
Express.js app with Knex.js and PostgreSQL. Scaffolded from Cursor's Auto MAX mode.
Project purpose and scale
JS App (Knex/Postgres 3): Find Vulnerabilities
Express.js app with Knex.js and PostgreSQL. Scaffolded from Cursor's Auto MAX mode.
- Source files
- 4
- Reference findings
- 3
- Matched signatures
- 15
- Unmatched signatures
- 11
Reference context
Deterministic reference findings
These findings define the project reference set for JS 1.0. Their presence does not establish exhaustive ground truth.
| Class | Severity | Location | Reference ID |
|---|---|---|---|
| information-exposure | medium | app.js:14 | js-xpowered-by-header-3 |
| hardcoded-credentials | high | app.js:9 | js-hardcoded-creds-3 |
| sql-injection | high | userMode.js:2 | js-sql-injection-3 |
Finding evidence
Reference-matched normalized signatures
Matched means agreement with the Snyk Code reference set, not independent ground-truth adjudication.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Opus 4.6 High | hardcoded-credentials | high | app.js:9 | 5 of 5 | Hardcoded database password in DB config object | 1 |
| Claude Opus 4.6 High | information-exposure | medium | app.js:14 | 5 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Opus 4.6 High | sql-injection | high | userMode.js:2 | 5 of 5 | Unsanitized input from HTTP parameter flows into raw, where it is used in an SQL query. This may result in an SQL Injection vulnerability. | 1 |
| Claude Opus 4.6 Medium | hardcoded-credentials | high | app.js:9 | 5 of 5 | Hardcoded database password in DB config object | 1 |
| Claude Opus 4.6 Medium | information-exposure | medium | app.js:14 | 5 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Opus 4.6 Medium | sql-injection | high | userMode.js:2 | 5 of 5 | Unsanitized input from HTTP parameter flows into raw, where it is used in an SQL query. This may result in an SQL Injection vulnerability. | 1 |
| Claude Opus 4.7 Max | hardcoded-credentials | high | app.js:9 | 5 of 5 | Hardcoded database password in DB config object | 1 |
| Claude Opus 4.7 Max | information-exposure | medium | app.js:14 | 4 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Opus 4.7 Max | sql-injection | high | userMode.js:2 | 5 of 5 | Unsanitized input from HTTP parameter flows into raw, where it is used in an SQL query. This may result in an SQL Injection vulnerability. | 1 |
| Claude Sonnet 4.6 High | hardcoded-credentials | high | app.js:9 | 5 of 5 | Hardcoded database password in DB config object | 1 |
| Claude Sonnet 4.6 High | information-exposure | medium | app.js:14 | 5 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Sonnet 4.6 High | sql-injection | high | userMode.js:2 | 5 of 5 | Unsanitized input from HTTP parameter flows into raw, where it is used in an SQL query. This may result in an SQL Injection vulnerability. | 1 |
| Claude Sonnet 4.6 Medium | hardcoded-credentials | high | app.js:9 | 5 of 5 | Hardcoded database password in DB config object | 1 |
| Claude Sonnet 4.6 Medium | information-exposure | medium | app.js:14 | 5 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Sonnet 4.6 Medium | sql-injection | high | userMode.js:2 | 5 of 5 | Unsanitized input from HTTP parameter flows into raw, where it is used in an SQL query. This may result in an SQL Injection vulnerability. | 1 |
Finding evidence
Unmatched normalized signatures
Unmatched reports may be false-positive-shaped, adjacent, or likely product-gap candidates.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Opus 4.7 Max | allocation-of-resources-without-limits-or-throttling | low | app.js:17 | 1 of 5 | The /users endpoint has no rate limiting, request size limits, or throttling, allowing potential resource-exhaustion abuse. | 1 |
| Claude Opus 4.7 Max | improper-type-validation | medium | app.js:18 | 2 of 5 | req.query.id is passed directly to the SQL layer without any type validation/coercion (e.g., parseInt) or schema validation, contributing to the SQL injection and unexpected behavior on malformed input. | 2 |
| Claude Opus 4.7 Max | sql-injection | critical | app.js:20 | 1 of 5 | Untrusted req.query.id is forwarded unsanitized to fetchUserById, which constructs a raw SQL query — propagates the SQL injection vulnerability. | 1 |
| Claude Sonnet 4.6 High | allocation-of-resources-without-limits-or-throttling | medium | app.js:17 | 4 of 5 | No rate limiting or request throttling is applied to any endpoint. This allows unlimited automated requests, enabling brute-force enumeration of user records and amplifying the impact of other vulnerabilities such as SQL injection. | 4 |
| Claude Sonnet 4.6 High | code-injection | medium | app.js:2 | 1 of 5 | The Node.js `vm` module is imported but never used. This module enables execution of arbitrary JavaScript code in a V8 context. Its presence alongside unvalidated user input (req.query.id) raises concern that future code paths may pass user-supplied data to vm.runInContext() or similar, enabling code injection. The unused import should be removed and any future use of `vm` with user input must be strictly sandboxed. | 1 |
| Claude Sonnet 4.6 High | idor | high | app.js:17 | 2 of 5 | The /users endpoint accepts a caller-supplied id parameter and returns user records with no authentication or authorization checks. Any unauthenticated client can retrieve arbitrary user records by enumerating id values. | 2 |
| Claude Sonnet 4.6 High | other | low | app.js:2 | 1 of 5 | The node:vm module (which enables arbitrary code execution) is imported but never used. Its unexplained presence may indicate dead code from a prior unsafe code-execution feature, or intent to execute user-controlled code in future changes. | 1 |
| Claude Sonnet 4.6 Medium | allocation-of-resources-without-limits-or-throttling | medium | app.js:17 | 1 of 5 | The /users endpoint has no rate limiting, request throttling, or pagination. Any unauthenticated caller can issue unlimited requests, enabling enumeration attacks, brute-force, and potential denial-of-service via resource exhaustion. | 1 |
| Claude Sonnet 4.6 Medium | code-injection | medium | app.js:2 | 1 of 5 | The Node.js `vm` module is imported but never used. Its presence is suspicious; if user-controlled data is ever passed to vm.runInNewContext(), vm.runInThisContext(), or similar APIs, it would result in arbitrary code execution. The vm module does not provide a true security sandbox. | 1 |
| Claude Sonnet 4.6 Medium | improper-type-validation | medium | app.js:18 | 1 of 5 | The query parameter `req.query.id` is used directly without any type, format, length, or presence validation. Query string values are always strings (or arrays if repeated), and no check is performed before passing the value to the database layer, enabling malformed or missing input to cause unexpected behavior. | 1 |
| Claude Sonnet 4.6 Medium | other | low | app.js:2 | 1 of 5 | The Node.js 'vm' module is imported but never used. This module enables execution of arbitrary JavaScript code in a sandbox context and its unexplained presence is a code hygiene concern. If it is ever wired to user input it would constitute a critical code-injection vulnerability. The unused import should be removed. | 1 |
Model behavior
Recurrence by configuration
Stable recurrence measures repeated behavior, not independent validity.
| Configuration | Matched signatures | Matched all five | Unmatched signatures | Unmatched all five |
|---|---|---|---|---|
| Claude Opus 4.6 High | 3 | 3 | 0 | 0 |
| Claude Opus 4.6 Medium | 3 | 3 | 0 | 0 |
| Claude Opus 4.7 Max | 3 | 2 | 3 | 0 |
| Claude Sonnet 4.6 High | 3 | 3 | 4 | 0 |
| Claude Sonnet 4.6 Medium | 3 | 3 | 4 | 0 |
Inspectable source context
Reference locations
Apache-licensed fixture excerpts are shown around declared reference lines. They are evidence, not runnable examples.
host: "127.0.0.1",
user: "your_database_user",
password: "your_database_password",
database: "myapp_test",
},function fetchUserById(knex, userProvidedValue) {
return knex.raw(`SELECT * FROM users WHERE id = ${userProvidedValue}`);
}
Interpretation boundary
Inspect divergence before classifying it
Unmatched reports may be false-positive-shaped, adjacent to the release reference scope, or likely valid product-gap candidates. Missed reference findings may expose representative-versus-systematic coverage behavior.
Return to explorer evidence