feature/SCC-18

[thavelock]

No description provided.

[snyk-io]

⛔ Snyk checks have failed. 2 issues have been found so far.

Icon	Severity	Issues
	Critical	0
	High	2
	Medium	0
	Low	0

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

⛔ code/snyk check is complete. 2 issues have been found. (View Details)

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

  Hardcoded Secret

Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in here.

Line 75 | CWE-547 | Priority score 828

Data flow: 2 steps

Step 1 - 2

nodejs-goof/app.js

Line 75 in 172f4ff

const SECRET3 = 'password123';

⚡ Fix this issue by replying with the following command: @snyk /fix

[thavelock]

@snyk /fix

[snyk-io]

⚡ Snyk Agent Fix suggestion 1 of 5

The diff replaces the constant SECRET3 with a value from the environment variable SECRET3 set via process.env. This change mitigates the security vulnerability of using hard-coded credentials within the source code, which can expose sensitive information if the codebase is exposed. By sourcing SECRET3 from an environment variable, the credentials can be kept secure and managed separately, reducing the risk of leaking sensitive data. The original vulnerability (489a8cb5-6818-5647-a130-6e3a4545441d) likely involved improper handling of secure data, such as using insecure constant values for authentication purposes. generated by AI

Code changes

--- app.js
+++ app.js
@@ -72,7 +72,7 @@
 
 const SECRET2 = 'password123';
 
-const SECRET3 = 'password123';
+const SECRET3 = process.env.SECRET3;
 
 // Static
 app.use(st({ path: './public', url: '/public' }));

Content generated by AI, expires on 2025-08-12 18:54:06 UTC. Refresh the page after running Snyk commands.

⏩ To see another fix suggestion - reply with @snyk /fix
✅ To apply this fix and create a commit - reply with @snyk /apply 1

[snyk-io]

  NoSQL Injection

Unsanitized input from the HTTP request body flows into find, where it is used in an NoSQL query. This may result in an NoSQL Injection vulnerability.

Line 50 | CWE-943 | Priority score 812 | Learn more about this vulnerability

Data flow: 8 steps

Step 1 - 4

nodejs-goof/routes/index.js

Line 38 in 172f4ff

if (validator.isEmail(req.body.username)) {

Step 5 - 8

nodejs-goof/routes/index.js

Line 50 in 172f4ff

User.find({ username: req.body.username, password: req.body.password }, function (err, users) {