const app = express();
app.use(express.json());
app.get("/users", (req, res) => {JS 1.0 · Project evidence
JS App (Knex/Postgres 2): Find Vulnerabilities
Express.js app with Knex.js and PostgreSQL. Scaffolded from Cursor's Auto MAX mode.
Project purpose and scale
JS App (Knex/Postgres 2): Find Vulnerabilities
Express.js app with Knex.js and PostgreSQL. Scaffolded from Cursor's Auto MAX mode.
- Source files
- 3
- Reference findings
- 3
- Matched signatures
- 15
- Unmatched signatures
- 6
Reference context
Deterministic reference findings
These findings define the project reference set for JS 1.0. Their presence does not establish exhaustive ground truth.
| Class | Severity | Location | Reference ID |
|---|---|---|---|
| information-exposure | medium | app.js:13 | js-xpowered-by-header-2 |
| hardcoded-credentials | high | app.js:8 | js-hardcoded-creds-2 |
| sql-injection | high | app.js:28 | js-sql-injection-2 |
Finding evidence
Reference-matched normalized signatures
Matched means agreement with the Snyk Code reference set, not independent ground-truth adjudication.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Opus 4.6 High | hardcoded-credentials | high | app.js:8 | 5 of 5 | Hardcoded password used in password. | 1 |
| Claude Opus 4.6 High | information-exposure | medium | app.js:13 | 5 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Opus 4.6 High | sql-injection | high | app.js:28 | 5 of 5 | Unsanitized input from an HTTP parameter flows into raw, where it is used in an SQL query. This may result in an SQL Injection vulnerability. | 1 |
| Claude Opus 4.6 Medium | hardcoded-credentials | high | app.js:8 | 5 of 5 | Hardcoded password used in password. | 1 |
| Claude Opus 4.6 Medium | information-exposure | medium | app.js:13 | 5 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Opus 4.6 Medium | sql-injection | high | app.js:28 | 5 of 5 | Unsanitized input from an HTTP parameter flows into raw, where it is used in an SQL query. This may result in an SQL Injection vulnerability. | 1 |
| Claude Opus 4.7 Max | hardcoded-credentials | high | app.js:8 | 5 of 5 | Hardcoded password used in password. | 1 |
| Claude Opus 4.7 Max | information-exposure | medium | app.js:13 | 5 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Opus 4.7 Max | sql-injection | high | app.js:28 | 5 of 5 | Unsanitized input from an HTTP parameter flows into raw, where it is used in an SQL query. This may result in an SQL Injection vulnerability. | 1 |
| Claude Sonnet 4.6 High | hardcoded-credentials | high | app.js:8 | 5 of 5 | Hardcoded password used in password. | 1 |
| Claude Sonnet 4.6 High | information-exposure | medium | app.js:13 | 5 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Sonnet 4.6 High | sql-injection | high | app.js:28 | 5 of 5 | Unsanitized input from an HTTP parameter flows into raw, where it is used in an SQL query. This may result in an SQL Injection vulnerability. | 1 |
| Claude Sonnet 4.6 Medium | hardcoded-credentials | high | app.js:8 | 5 of 5 | Hardcoded password used in password. | 1 |
| Claude Sonnet 4.6 Medium | information-exposure | medium | app.js:13 | 5 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Sonnet 4.6 Medium | sql-injection | high | app.js:28 | 5 of 5 | Unsanitized input from an HTTP parameter flows into raw, where it is used in an SQL query. This may result in an SQL Injection vulnerability. | 1 |
Finding evidence
Unmatched normalized signatures
Unmatched reports may be false-positive-shaped, adjacent, or likely product-gap candidates.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Sonnet 4.6 High | allocation-of-resources-without-limits-or-throttling | medium | app.js:15 | 3 of 5 | The /users endpoint has no rate-limiting or throttling middleware. Combined with the SELECT * query, this allows an unauthenticated attacker to flood the endpoint and exhaust database or server resources. | 3 |
| Claude Sonnet 4.6 High | improper-type-validation | medium | app.js:16 | 1 of 5 | The `id` query parameter is read from req.query and used without any validation: no type check (expected integer), no null/undefined guard, no length or character-set restrictions. A missing or malformed `id` yields malformed SQL such as `WHERE id = undefined`. | 1 |
| Claude Sonnet 4.6 High | other | critical | pnpm-lock.yaml:231 | 3 of 5 | The lockfile resolves `lodash@4.18.1`, a version that has never been published to the official npm registry (the highest legitimate lodash 4.x release is 4.17.21). The listed integrity hash does not correspond to any known lodash release. This strongly indicates a tampered lockfile, a dependency-confusion/supply-chain substitution attack, or a malicious package introduced as a transitive dependency of knex. | 3 |
| Claude Sonnet 4.6 Medium | allocation-of-resources-without-limits-or-throttling | medium | app.js:15 | 2 of 5 | The GET /users endpoint has no rate limiting or request throttling, making it vulnerable to denial-of-service attacks and brute-force enumeration of database records. | 2 |
| Claude Sonnet 4.6 Medium | improper-type-validation | medium | app.js:16 | 1 of 5 | `req.query.id` is used without any type checking or format validation. The value is not verified to be a valid integer (or other expected type) before being passed to the SQL query, making it trivial for attackers to supply arbitrary strings or payloads. | 1 |
| Claude Sonnet 4.6 Medium | other | high | pnpm-lock.yaml:231 | 1 of 5 | The lockfile pins lodash@4.18.1, a version that does not exist in the official npm registry (latest legitimate release is 4.17.21). This strongly indicates a supply-chain/dependency confusion attack or a tampered lockfile containing a malicious package. | 1 |
Model behavior
Recurrence by configuration
Stable recurrence measures repeated behavior, not independent validity.
| Configuration | Matched signatures | Matched all five | Unmatched signatures | Unmatched all five |
|---|---|---|---|---|
| Claude Opus 4.6 High | 3 | 3 | 0 | 0 |
| Claude Opus 4.6 Medium | 3 | 3 | 0 | 0 |
| Claude Opus 4.7 Max | 3 | 3 | 0 | 0 |
| Claude Sonnet 4.6 High | 3 | 3 | 3 | 0 |
| Claude Sonnet 4.6 Medium | 3 | 3 | 3 | 0 |
Inspectable source context
Reference locations
Apache-licensed fixture excerpts are shown around declared reference lines. They are evidence, not runnable examples.
user: "your_database_user",
password: "your_database_password",
database: "myapp_test",
},
});});
const PORT = process.env.PORT || 3000;
app.listen(PORT, () => console.log(`Server running on port ${PORT}`));
Interpretation boundary
Inspect divergence before classifying it
Unmatched reports may be false-positive-shaped, adjacent to the release reference scope, or likely valid product-gap candidates. Missed reference findings may expose representative-versus-systematic coverage behavior.
Return to explorer evidence