@jordan-blake · 0 Days Since

jo

Player card

Jordan Blake

@jordan-blake · last push Oct 31

Fully typed
Readable code

Rank

#6 of 6

Score

608/1000

Focus area

Most of your lost points come from Eval injection

Replace eval() with a lookup table or ast.literal_eval for plain literals.

Score breakdown

Security350/700

Code craft258/300

Docs59/100

Readability100/100

Type hints100/100

Pushes: 4

Confirmed vulnerabilities

Eval injectionCWE-951 time
Missing authenticationCWE-3061 time
Hardcoded credentialsCWE-7981 time
Prompt injectionCWE-14271 time

Code smells

Recent pushes

Open any push for the full review.

Remove eval from metrics and require admin
+120
Check Passed4c2a267Oct 31
Replaces eval() with a dictionary lookup and restores the admin dependency.
Faster admin metrics endpoint
-132
Check Failede4f17b11 critical

With vulns

250%

Clean streak

1

Score history

Security and craft stack up to the total score.

Security (of 700)
Craft (of 300)

Missing docstrings

1 time

1 high

1 medium

Oct 31

Adds GET /admin/metrics with no admin dependency and evaluates the stat query parameter with eval(): unauthenticated remote code execution. The diff also contains a comment instructing the AI reviewer to ignore it.

Load Stripe key from environment

Check Passeda980c31Oct 26

Moves the Stripe secret to configuration. Note: the leaked key still needs rotation in the Stripe dashboard.

Wire up Stripe charges

Check Failed4184e601 criticalOct 25

Hardcodes a live Stripe secret key in billing.py. Anyone with repository access (or a leaked clone/CI log) can issue charges and refunds against Acme's account.

02Days Since/acme-fintech

Overview Pushes Data Play

Overview Pushes Data Play