Push review · 6ac2cb9
Refund eligibility rules
GitHub check
Passed with warnings
Code craft scored 76/300, below the 180 bar. See the Code craft tab for quick wins.
Points
+99ptsTotal578677
Security420560
Craft158117
What changed: Adds refund_ok(), a deeply nested rule ladder with a bare except and a mutable default argument. No vulnerability, but hard to review and test.Scripted demo replay
Security agent
Scripted demo replay
Instead of reading one big prompt, the agent plans, then investigates the code graph one tool call at a time and sees each real result before deciding what to check next.
Plan
- 1Inspect the changed function and where its inputs come from
- 2Trace entry points through the change to dangerous calls
- 3Read the code on the path for validation or auth checks
- 4Report only what the evidence supports
- Step 1Looked up
app.services.billing:auditStart with the changed symbol.
What it found
{ "id": "app.services.billing:audit", "kind": "function", "file": "app/services/billing.py", "lines": [ 42, 43 ], "params": [ "inv", "reason" ], "entry_point": false, "route": null, "depends_on": [], "untrusted_inputs": [], "dangerous_calls": [], "has_docstring": false } callers: app.services.billing:refund_ok (app/services/billing.py:46-64) via line 61 [tainted args] callees: (none)