@sam-okafor · 0 Days Since

sa

Player card

Sam Okafor

@sam-okafor · last push Nov 7

Rank

#3 of 6

Score

829/1000

Focus area

Most of your lost points come from SSRF

Allow-list outbound hosts and block private and metadata IP ranges.

Score breakdown

Security630/700

Code craft199/300

Docs40/100

Readability92/100

Type hints67/100

Pushes: 4

Confirmed vulnerabilities

SSRFCWE-9181 time

Code smells

Missing docstrings4 times
Bare except1 time
Deep nesting1 time
High complexity1 time

Recent pushes

Open any push for the full review.

Retry transient webhook failures
+47
Check Passed57fcb33Nov 7
Adds bounded retries for 5xx webhook responses; still enforces the allow-list via deliver().
Restrict webhook test deliveries to https public hosts
+105
Check Passed2dbb29dNov 2
Adds an https + public-address allow-list before outbound webhook delivery and disables redirects, closing the SSRF from day 5.

With vulns

125%

Clean streak

2

Score history

Security and craft stack up to the total score.

Security (of 700)
Craft (of 300)

Mutable defaults1 time

Swallowed exceptions1 time

Refund eligibility rules

▲+99

Check Warned6ac2cb9Oct 26

Adds refund_ok(), a deeply nested rule ladder with a bare except and a mutable default argument. No vulnerability, but hard to review and test.

Webhook test delivery endpoint

Check Warned07e623c1 mediumOct 23

Adds POST /webhooks/test which makes the server POST to any caller-supplied URL (notifications.deliver). Attackers can probe internal services or cloud metadata (169.254.169.254) through the payments API.

02Days Since/acme-fintech

Overview Pushes Data Play

Overview Pushes Data Play