Push review · 4184e60
Wire up Stripe charges
GitHub check
Merge blocked
Hardcoded credentials in app/services/billing.py:6. Fix it and push again to pass the check.
Points
-730ptsTotal1000270
Security7000
Craft300270
What changed: Hardcodes a live Stripe secret key in billing.py. Anyone with repository access (or a leaked clone/CI log) can issue charges and refunds against Acme's account.Scripted demo replay
Security agent
Scripted demo replay
Instead of reading one big prompt, the agent plans, then investigates the code graph one tool call at a time and sees each real result before deciding what to check next.
Plan
- 1Inspect the changed function and where its inputs come from
- 2Trace entry points through the change to dangerous calls
- 3Read the code on the path for validation or auth checks
- 4Report only what the evidence supports
- Step 1Looked up
app.services.billing:BillingService.chargeStart with the changed symbol.
What it found
{ "id": "app.services.billing:BillingService.charge", "kind": "method", "file": "app/services/billing.py", "lines": [ 33, 40 ], "params": [ "self", "customer_id", "amount_cents" ], "entry_point": false, "route": null, "depends_on": [], "untrusted_inputs": [], "dangerous_calls": [ { "kind": "network", "call": "httpx.post", "line": 35, "reached_by_untrusted_data": true } ], "has_docstring": true } callers: (none) callees: (none)