Push review · 07e623c
Webhook test delivery endpoint
GitHub check
Passed with warnings
1 lower-severity issue to review, starting with SSRF in app/services/notifications.py:15.
Points
-422ptsTotal1000578
Security700420
Craft300158
What changed: Adds POST /webhooks/test which makes the server POST to any caller-supplied URL (notifications.deliver). Attackers can probe internal services or cloud metadata (169.254.169.254) through the payments API.Scripted demo replay
Security agent
Scripted demo replay
Instead of reading one big prompt, the agent plans, then investigates the code graph one tool call at a time and sees each real result before deciding what to check next.
Plan
- 1Inspect the changed function and where its inputs come from
- 2Trace entry points through the change to dangerous calls
- 3Read the code on the path for validation or auth checks
- 4Report only what the evidence supports
- Step 1Looked up
app.routes.webhooks:send_test_eventStart with the changed symbol.
What it found
{ "id": "app.routes.webhooks:send_test_event", "kind": "function", "file": "app/routes/webhooks.py", "lines": [ 17, 19 ], "params": [ "url", "user" ], "entry_point": true, "route": "POST /test", "depends_on": [ "get_current_user" ], "untrusted_inputs": [ "route_param:url" ], "dangerous_calls": [], "has_docstring": false } callers: (none) callees: app.auth:get_current_user (app/auth.py:9-15) via line 17 app.services.notifications:build_event (app/services/notifications.py:9-11) via line 18 app.services.notifications:deliver (app/services/notifications.py:14-16) [sinks=network@L15(tainted)] via line 18 [tainted args]