[Security] HIGH: 34 issue(s) found in forgeflow #20

New issue

Closed

opened 2026-05-14 23:25:29 +00:00 by Mark · 1 comment

Mark commented 2026-05-14 23:25:29 +00:00

Owner

Copy link

Security Scan Results for forgeflow

Severity: HIGH
Findings: 34

1. secret_in_diff

• Details: Potential AWS Secret Key found in commit bca73eff
• Commit: bca73eff
• Pattern: AWS Secret Key

2. secret_in_diff

• Details: Potential AWS Secret Key found in commit 78a4b208
• Commit: 78a4b208
• Pattern: AWS Secret Key

3. secret_in_diff

• Details: Potential AWS Secret Key found in commit 68a33c61
• Commit: 68a33c61
• Pattern: AWS Secret Key

4. secret_in_diff

• Details: Potential AWS Secret Key found in commit 3e4fbb15
• Commit: 3e4fbb15
• Pattern: AWS Secret Key

5. hardcoded_secret

• Details: Potential hardcoded secret in .next/server/app/api/uploadthing/route.js
• File: .next/server/app/api/uploadthing/route.js
• Pattern: password_assignment

6. auth_flaw

• Details: Potential security issue (exec_usage) in .next/server/app/page.js
• File: .next/server/app/page.js
• Pattern: exec_usage

7. auth_flaw

• Details: Potential security issue (exec_usage) in .next/server/app/app/page.js
• File: .next/server/app/app/page.js
• Pattern: exec_usage

8. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/app/app/settings/page.js
• File: .next/server/app/app/settings/page.js
• Pattern: sql_string_concat

9. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/app/app/projects/[projectId]/page.js
• File: .next/server/app/app/projects/[projectId]/page.js
• Pattern: sql_string_concat

10. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/app/app/projects/[projectId]/boms/[bomId]/compare/page.js
• File: .next/server/app/app/projects/[projectId]/boms/[bomId]/compare/page.js
• Pattern: sql_string_concat

11. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/app/app/team/page.js
• File: .next/server/app/app/team/page.js
• Pattern: sql_string_concat

12. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/app/api/changes/[id]/decide/route.js
• File: .next/server/app/api/changes/[id]/decide/route.js
• Pattern: sql_string_concat

13. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/app/api/boms/[bomId]/revisions/route.js
• File: .next/server/app/api/boms/[bomId]/revisions/route.js
• Pattern: sql_string_concat

14. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/app/api/boms/import/route.js
• File: .next/server/app/api/boms/import/route.js
• Pattern: sql_string_concat

15. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/chunks/7802.js
• File: .next/server/chunks/7802.js
• Pattern: sql_string_concat

16. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/chunks/1298.js
• File: .next/server/chunks/1298.js
• Pattern: sql_string_concat

17. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/chunks/5408.js
• File: .next/server/chunks/5408.js
• Pattern: sql_string_concat

18. auth_flaw

• Details: Potential security issue (exec_usage) in .next/server/chunks/2510.js
• File: .next/server/chunks/2510.js
• Pattern: exec_usage

19. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/chunks/5061.js
• File: .next/server/chunks/5061.js
• Pattern: sql_string_concat

20. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/server/chunks/5602.js
• File: .next/server/chunks/5602.js
• Pattern: sql_string_concat

21. auth_flaw

• Details: Potential security issue (exec_usage) in .next/server/chunks/1682.js
• File: .next/server/chunks/1682.js
• Pattern: exec_usage

22. auth_flaw

• Details: Potential security issue (exec_usage) in .next/server/chunks/2202.js
• File: .next/server/chunks/2202.js
• Pattern: exec_usage

23. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/static/chunks/385-cbcb5d8190d647ee.js
• File: .next/static/chunks/385-cbcb5d8190d647ee.js
• Pattern: sql_string_concat

24. auth_flaw

• Details: Potential security issue (exec_usage) in .next/static/chunks/231-e9b2c90fc8da7be4.js
• File: .next/static/chunks/231-e9b2c90fc8da7be4.js
• Pattern: exec_usage

25. auth_flaw

• Details: Potential security issue (exec_usage) in .next/static/chunks/23-5f7d9dfb4baaf614.js
• File: .next/static/chunks/23-5f7d9dfb4baaf614.js
• Pattern: exec_usage

26. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/static/chunks/776-dff4180ccb2166b4.js
• File: .next/static/chunks/776-dff4180ccb2166b4.js
• Pattern: sql_string_concat

27. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/static/chunks/72-516a2687dd4e4cca.js
• File: .next/static/chunks/72-516a2687dd4e4cca.js
• Pattern: sql_string_concat

28. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/static/chunks/webpack-5def70eb935cb1c4.js
• File: .next/static/chunks/webpack-5def70eb935cb1c4.js
• Pattern: sql_string_concat

29. auth_flaw

• Details: Potential security issue (exec_usage) in .next/static/chunks/485-5172b83f9c9f906b.js
• File: .next/static/chunks/485-5172b83f9c9f906b.js
• Pattern: exec_usage

30. auth_flaw

• Details: Potential security issue (exec_usage) in .next/static/chunks/761-4a893e2ffe0dff20.js
• File: .next/static/chunks/761-4a893e2ffe0dff20.js
• Pattern: exec_usage

31. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/static/chunks/app/app/settings/page-f2cb4cff27f22531.js
• File: .next/static/chunks/app/app/settings/page-f2cb4cff27f22531.js
• Pattern: sql_string_concat

32. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/static/chunks/app/app/projects/[projectId]/page-fb1d24f94e8029eb.js
• File: .next/static/chunks/app/app/projects/[projectId]/page-fb1d24f94e8029eb.js
• Pattern: sql_string_concat

33. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/static/chunks/app/app/projects/[projectId]/boms/[bomId]/compare/page-5ab6db763efdeeeb.js
• File: .next/static/chunks/app/app/projects/[projectId]/boms/[bomId]/compare/page-5ab6db763efdeeeb.js
• Pattern: sql_string_concat

34. auth_flaw

• Details: Potential security issue (sql_string_concat) in .next/static/chunks/app/app/team/page-56e94c9ce3220a6a.js
• File: .next/static/chunks/app/app/team/page-56e94c9ce3220a6a.js
• Pattern: sql_string_concat

---

This issue was auto-generated by the security sweep cron job.

## Security Scan Results for `forgeflow` **Severity:** HIGH **Findings:** 34 ### 1. secret_in_diff - **Details:** Potential AWS Secret Key found in commit bca73eff - **Commit:** `bca73eff` - **Pattern:** `AWS Secret Key` ### 2. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 78a4b208 - **Commit:** `78a4b208` - **Pattern:** `AWS Secret Key` ### 3. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 68a33c61 - **Commit:** `68a33c61` - **Pattern:** `AWS Secret Key` ### 4. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 3e4fbb15 - **Commit:** `3e4fbb15` - **Pattern:** `AWS Secret Key` ### 5. hardcoded_secret - **Details:** Potential hardcoded secret in .next/server/app/api/uploadthing/route.js - **File:** `.next/server/app/api/uploadthing/route.js` - **Pattern:** `password_assignment` ### 6. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/server/app/page.js - **File:** `.next/server/app/page.js` - **Pattern:** `exec_usage` ### 7. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/server/app/app/page.js - **File:** `.next/server/app/app/page.js` - **Pattern:** `exec_usage` ### 8. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/app/app/settings/page.js - **File:** `.next/server/app/app/settings/page.js` - **Pattern:** `sql_string_concat` ### 9. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/app/app/projects/[projectId]/page.js - **File:** `.next/server/app/app/projects/[projectId]/page.js` - **Pattern:** `sql_string_concat` ### 10. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/app/app/projects/[projectId]/boms/[bomId]/compare/page.js - **File:** `.next/server/app/app/projects/[projectId]/boms/[bomId]/compare/page.js` - **Pattern:** `sql_string_concat` ### 11. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/app/app/team/page.js - **File:** `.next/server/app/app/team/page.js` - **Pattern:** `sql_string_concat` ### 12. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/app/api/changes/[id]/decide/route.js - **File:** `.next/server/app/api/changes/[id]/decide/route.js` - **Pattern:** `sql_string_concat` ### 13. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/app/api/boms/[bomId]/revisions/route.js - **File:** `.next/server/app/api/boms/[bomId]/revisions/route.js` - **Pattern:** `sql_string_concat` ### 14. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/app/api/boms/import/route.js - **File:** `.next/server/app/api/boms/import/route.js` - **Pattern:** `sql_string_concat` ### 15. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/chunks/7802.js - **File:** `.next/server/chunks/7802.js` - **Pattern:** `sql_string_concat` ### 16. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/chunks/1298.js - **File:** `.next/server/chunks/1298.js` - **Pattern:** `sql_string_concat` ### 17. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/chunks/5408.js - **File:** `.next/server/chunks/5408.js` - **Pattern:** `sql_string_concat` ### 18. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/server/chunks/2510.js - **File:** `.next/server/chunks/2510.js` - **Pattern:** `exec_usage` ### 19. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/chunks/5061.js - **File:** `.next/server/chunks/5061.js` - **Pattern:** `sql_string_concat` ### 20. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/chunks/5602.js - **File:** `.next/server/chunks/5602.js` - **Pattern:** `sql_string_concat` ### 21. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/server/chunks/1682.js - **File:** `.next/server/chunks/1682.js` - **Pattern:** `exec_usage` ### 22. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/server/chunks/2202.js - **File:** `.next/server/chunks/2202.js` - **Pattern:** `exec_usage` ### 23. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/385-cbcb5d8190d647ee.js - **File:** `.next/static/chunks/385-cbcb5d8190d647ee.js` - **Pattern:** `sql_string_concat` ### 24. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/static/chunks/231-e9b2c90fc8da7be4.js - **File:** `.next/static/chunks/231-e9b2c90fc8da7be4.js` - **Pattern:** `exec_usage` ### 25. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/static/chunks/23-5f7d9dfb4baaf614.js - **File:** `.next/static/chunks/23-5f7d9dfb4baaf614.js` - **Pattern:** `exec_usage` ### 26. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/776-dff4180ccb2166b4.js - **File:** `.next/static/chunks/776-dff4180ccb2166b4.js` - **Pattern:** `sql_string_concat` ### 27. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/72-516a2687dd4e4cca.js - **File:** `.next/static/chunks/72-516a2687dd4e4cca.js` - **Pattern:** `sql_string_concat` ### 28. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/webpack-5def70eb935cb1c4.js - **File:** `.next/static/chunks/webpack-5def70eb935cb1c4.js` - **Pattern:** `sql_string_concat` ### 29. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/static/chunks/485-5172b83f9c9f906b.js - **File:** `.next/static/chunks/485-5172b83f9c9f906b.js` - **Pattern:** `exec_usage` ### 30. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/static/chunks/761-4a893e2ffe0dff20.js - **File:** `.next/static/chunks/761-4a893e2ffe0dff20.js` - **Pattern:** `exec_usage` ### 31. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/app/app/settings/page-f2cb4cff27f22531.js - **File:** `.next/static/chunks/app/app/settings/page-f2cb4cff27f22531.js` - **Pattern:** `sql_string_concat` ### 32. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/app/app/projects/[projectId]/page-fb1d24f94e8029eb.js - **File:** `.next/static/chunks/app/app/projects/[projectId]/page-fb1d24f94e8029eb.js` - **Pattern:** `sql_string_concat` ### 33. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/app/app/projects/[projectId]/boms/[bomId]/compare/page-5ab6db763efdeeeb.js - **File:** `.next/static/chunks/app/app/projects/[projectId]/boms/[bomId]/compare/page-5ab6db763efdeeeb.js` - **Pattern:** `sql_string_concat` ### 34. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/app/app/team/page-56e94c9ce3220a6a.js - **File:** `.next/static/chunks/app/app/team/page-56e94c9ce3220a6a.js` - **Pattern:** `sql_string_concat` --- *This issue was auto-generated by the security sweep cron job.*

Mark added the

quickfix

triage-approved

labels 2026-06-20 15:20:40 +00:00

Mark added

in-progress

and removed

quickfix

triage-approved

labels 2026-07-08 04:40:21 +00:00

Mark referenced this issue from a commit 2026-07-08 04:43:37 +00:00

quickfix: Reference issue #20 in Semgrep ignore comments (refs #20)

Mark removed the

in-progress

label 2026-08-12 23:25:47 +00:00

Mark added the

blocked:needs-decision

security/high

labels 2026-09-14 14:04:43 +00:00

Mark commented 2026-09-14 15:45:36 +00:00

Author

Owner

Copy link

Triage: all 34 findings are false positives — closing as not-actionable

Verified against AuWoMe/forgeflow on main (ec297c3) and the full commit history.

Findings 1–4 (secret_in_diff — "AWS Secret Key" in commits)

Pattern-matched on placeholder strings, not real credentials.

• bca73eff (CI workflow fix) — matched CLERK_SECRET_KEY: "sk_tes...lder" in a CI env: block. Truncated placeholder, no real value.
• 78a4b208, 68a33c61 — searched full diff for AKIA…, aws_access_key_id, aws_secret_access_key: 0 matches.
• 3e4fbb1 (initial commit) — matched lines in .env.example template: CLERK_SECRET_KEY="***", STRIPE_SECRET_KEY="***" etc. Example placeholders.

Repo-wide grep across git log --all -p for AKIA[A-Z0-9]{16}, aws_access_key_id, aws_secret_access_key → 0 matches.

Findings 5–34 (auth_flaw exec_usage / sql_string_concat)

All 30 are inside .next/ (Next.js build output). Confirmed .next/ is gitignored (.gitignore line 7: .next/), so these paths never existed in source — the scanner is walking the built output bundle.

Source uses Drizzle ORM (drizzle-orm in package.json) — no raw SQL string concatenation. Repo-wide grep for exec(, child_process, template-literal SQL (\SELECT/\INSERT), and password=/secret=/apiKey=assignments insrc/`: 0 matches.

Corresponding source files (e.g. src/app/api/uploadthing/route.ts, src/app/api/changes/[id]/decide/route.ts, src/app/api/boms/[bomId]/revisions/route.ts, src/app/api/boms/import/route.ts) exist and have no flagged patterns.

Verdict

Scanner false-positive batch. No fixit work needed, no kilo-gsd dispatch.

Closing as not-actionable; the blocked:needs-decision label can be removed.

## Triage: all 34 findings are false positives — closing as not-actionable Verified against `AuWoMe/forgeflow` on `main` (`ec297c3`) and the full commit history. ### Findings 1–4 (`secret_in_diff` — "AWS Secret Key" in commits) Pattern-matched on placeholder strings, not real credentials. - `bca73eff` (CI workflow fix) — matched `CLERK_SECRET_KEY: "sk_tes...lder"` in a CI `env:` block. Truncated placeholder, no real value. - `78a4b208`, `68a33c61` — searched full diff for `AKIA…`, `aws_access_key_id`, `aws_secret_access_key`: **0 matches**. - `3e4fbb1` (initial commit) — matched lines in `.env.example` template: `CLERK_SECRET_KEY="***"`, `STRIPE_SECRET_KEY="***"` etc. Example placeholders. Repo-wide grep across `git log --all -p` for `AKIA[A-Z0-9]{16}`, `aws_access_key_id`, `aws_secret_access_key` → **0 matches**. ### Findings 5–34 (`auth_flaw` `exec_usage` / `sql_string_concat`) All 30 are inside `.next/` (Next.js build output). Confirmed `.next/` is gitignored (`.gitignore` line 7: `.next/`), so these paths never existed in source — the scanner is walking the built output bundle. Source uses Drizzle ORM (`drizzle-orm` in `package.json`) — no raw SQL string concatenation. Repo-wide grep for `exec(`, `child_process`, template-literal SQL (`\`SELECT`/\`INSERT`), and `password=`/`secret=`/`apiKey=` assignments in `src/`: **0 matches**. Corresponding source files (e.g. `src/app/api/uploadthing/route.ts`, `src/app/api/changes/[id]/decide/route.ts`, `src/app/api/boms/[bomId]/revisions/route.ts`, `src/app/api/boms/import/route.ts`) exist and have no flagged patterns. ### Verdict Scanner false-positive batch. No fixit work needed, no kilo-gsd dispatch. Closing as not-actionable; the `blocked:needs-decision` label can be removed.

Mark 2026-09-14 15:45:39 +00:00

• closed this issue
• removed the
  blocked:needs-decision
  label

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

No results found.

Labels

Clear labels   

blocked:needs-attention

Manually blocked — needs human attention

  

blocked:needs-decision

  

bug

Functional defect — incorrect behavior, regression, or unmet expectation

  

chore

Config / cleanup / hygiene item, no functional behavior change

  

in-progress

Currently being worked by an agent

  

quickfix

Small, low-risk, spec-aligned — opencode fast-path

  

security/high

High severity security issue

  

triage-approved

Approved by triage — eligible for the issue-fixer pipeline

No labels

blocked:needs-attention

blocked:needs-decision

bug

chore

in-progress

quickfix

security/high

triage-approved

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

AuWoMe/forgeflow#20

No description provided.