Push review · f06ef04
Validate invoice status filter
GitHub check
All clear
No verified vulnerabilities and code craft 271/300.
Points
+94ptsTotal690784
Security455537
Craft235247
What changed: Adds an allow-list for the status filter.Scripted demo replay
Security agent
Scripted demo replay
Instead of reading one big prompt, the agent plans, then investigates the code graph one tool call at a time and sees each real result before deciding what to check next.
Plan
- 1Inspect the changed function and where its inputs come from
- 2Trace entry points through the change to dangerous calls
- 3Read the code on the path for validation or auth checks
- 4Report only what the evidence supports
- Step 1Looked up
app.services.billing:BillingService.search_invoicesStart with the changed symbol.
What it found
{ "id": "app.services.billing:BillingService.search_invoices", "kind": "method", "file": "app/services/billing.py", "lines": [ 26, 34 ], "params": [ "self", "customer", "status" ], "entry_point": false, "route": null, "depends_on": [], "untrusted_inputs": [], "dangerous_calls": [], "has_docstring": true } callers: app.routes.invoices:search (app/routes/invoices.py:20-23) [ENTRY fastapi GET /search] via line 23 [tainted args] callees: app.db:Database.fetch_all (app/db.py:20-24) [sinks=sql@L23(tainted)] via line 30 [tainted args]