AuWoMe/planish
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[Security] HIGH: 34 issue(s) found in planish #9

New issue
Closed
opened 2026-05-14 23:24:40 +00:00 by Mark · 1 comment
Mark commented 2026-05-14 23:24:40 +00:00
Owner
Copy link

Security Scan Results for planish

Severity: HIGH
Findings: 34

1. secret_in_diff

  • Details: Potential AWS Secret Key found in commit 91531dd1
  • Commit: 91531dd1
  • Pattern: AWS Secret Key

2. secret_in_diff

  • Details: Potential Password in URL found in commit 7313ddc4
  • Commit: 7313ddc4
  • Pattern: Password in URL

3. secret_in_diff

  • Details: Potential AWS Secret Key found in commit f560d271
  • Commit: f560d271
  • Pattern: AWS Secret Key

4. secret_in_diff

  • Details: Potential AWS Secret Key found in commit c9e66629
  • Commit: c9e66629
  • Pattern: AWS Secret Key

5. secret_in_diff

  • Details: Potential AWS Secret Key found in commit c69c36a4
  • Commit: c69c36a4
  • Pattern: AWS Secret Key

6. secret_in_diff

  • Details: Potential AWS Secret Key found in commit 7834c636
  • Commit: 7834c636
  • Pattern: AWS Secret Key

7. secret_in_diff

  • Details: Potential AWS Secret Key found in commit 0aaefd03
  • Commit: 0aaefd03
  • Pattern: AWS Secret Key

8. secret_in_diff

  • Details: Potential AWS Secret Key found in commit 398cf3a6
  • Commit: 398cf3a6
  • Pattern: AWS Secret Key

9. secret_in_diff

  • Details: Potential AWS Secret Key found in commit 19749ed8
  • Commit: 19749ed8
  • Pattern: AWS Secret Key

10. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/server/app/page.js
  • File: .next/server/app/page.js
  • Pattern: sql_string_concat

11. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/server/app/trips/page.js
  • File: .next/server/app/trips/page.js
  • Pattern: sql_string_concat

12. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/server/app/trips/[tripId]/page.js
  • File: .next/server/app/trips/[tripId]/page.js
  • Pattern: sql_string_concat

13. auth_flaw

  • Details: Potential security issue (exec_usage) in .next/server/app/favicon.ico/route.js
  • File: .next/server/app/favicon.ico/route.js
  • Pattern: exec_usage

14. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/server/chunks/488.js
  • File: .next/server/chunks/488.js
  • Pattern: sql_string_concat

15. auth_flaw

  • Details: Potential security issue (exec_usage) in .next/server/chunks/404.js
  • File: .next/server/chunks/404.js
  • Pattern: exec_usage

16. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/server/chunks/948.js
  • File: .next/server/chunks/948.js
  • Pattern: sql_string_concat

17. auth_flaw

  • Details: Potential security issue (exec_usage) in .next/server/chunks/682.js
  • File: .next/server/chunks/682.js
  • Pattern: exec_usage

18. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/server/chunks/141.js
  • File: .next/server/chunks/141.js
  • Pattern: sql_string_concat

19. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/server/chunks/195.js
  • File: .next/server/chunks/195.js
  • Pattern: sql_string_concat

20. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/server/chunks/107.js
  • File: .next/server/chunks/107.js
  • Pattern: sql_string_concat

21. auth_flaw

  • Details: Potential security issue (exec_usage) in .next/server/chunks/86.js
  • File: .next/server/chunks/86.js
  • Pattern: exec_usage

22. auth_flaw

  • Details: Potential security issue (exec_usage) in .next/server/chunks/70.js
  • File: .next/server/chunks/70.js
  • Pattern: exec_usage

23. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/server/chunks/245.js
  • File: .next/server/chunks/245.js
  • Pattern: sql_string_concat

24. auth_flaw

  • Details: Potential security issue (exec_usage) in .next/static/chunks/851-8ba13c8574b29682.js
  • File: .next/static/chunks/851-8ba13c8574b29682.js
  • Pattern: exec_usage

25. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/static/chunks/383-990d92e8586399ee.js
  • File: .next/static/chunks/383-990d92e8586399ee.js
  • Pattern: sql_string_concat

26. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/static/chunks/777-8c4dd05d3e255de8.js
  • File: .next/static/chunks/777-8c4dd05d3e255de8.js
  • Pattern: sql_string_concat

27. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/static/chunks/382-73082245b2562993.js
  • File: .next/static/chunks/382-73082245b2562993.js
  • Pattern: sql_string_concat

28. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/static/chunks/993-23fffc8f10a8e2ca.js
  • File: .next/static/chunks/993-23fffc8f10a8e2ca.js
  • Pattern: sql_string_concat

29. auth_flaw

  • Details: Potential security issue (exec_usage) in .next/static/chunks/717-47c2341d683d1b81.js
  • File: .next/static/chunks/717-47c2341d683d1b81.js
  • Pattern: exec_usage

30. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/static/chunks/274-2893f884efb0e7a3.js
  • File: .next/static/chunks/274-2893f884efb0e7a3.js
  • Pattern: sql_string_concat

31. auth_flaw

  • Details: Potential security issue (exec_usage) in .next/static/chunks/117-50e6fc7231178d5f.js
  • File: .next/static/chunks/117-50e6fc7231178d5f.js
  • Pattern: exec_usage

32. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/static/chunks/webpack-4b2008cf03115edd.js
  • File: .next/static/chunks/webpack-4b2008cf03115edd.js
  • Pattern: sql_string_concat

33. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/static/chunks/380-000dff687d679976.js
  • File: .next/static/chunks/380-000dff687d679976.js
  • Pattern: sql_string_concat

34. auth_flaw

  • Details: Potential security issue (sql_string_concat) in .next/static/chunks/app/trips/[tripId]/page-debdb745242d1753.js
  • File: .next/static/chunks/app/trips/[tripId]/page-debdb745242d1753.js
  • Pattern: sql_string_concat

This issue was auto-generated by the security sweep cron job.

## Security Scan Results for `planish` **Severity:** HIGH **Findings:** 34 ### 1. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 91531dd1 - **Commit:** `91531dd1` - **Pattern:** `AWS Secret Key` ### 2. secret_in_diff - **Details:** Potential Password in URL found in commit 7313ddc4 - **Commit:** `7313ddc4` - **Pattern:** `Password in URL` ### 3. secret_in_diff - **Details:** Potential AWS Secret Key found in commit f560d271 - **Commit:** `f560d271` - **Pattern:** `AWS Secret Key` ### 4. secret_in_diff - **Details:** Potential AWS Secret Key found in commit c9e66629 - **Commit:** `c9e66629` - **Pattern:** `AWS Secret Key` ### 5. secret_in_diff - **Details:** Potential AWS Secret Key found in commit c69c36a4 - **Commit:** `c69c36a4` - **Pattern:** `AWS Secret Key` ### 6. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 7834c636 - **Commit:** `7834c636` - **Pattern:** `AWS Secret Key` ### 7. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 0aaefd03 - **Commit:** `0aaefd03` - **Pattern:** `AWS Secret Key` ### 8. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 398cf3a6 - **Commit:** `398cf3a6` - **Pattern:** `AWS Secret Key` ### 9. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 19749ed8 - **Commit:** `19749ed8` - **Pattern:** `AWS Secret Key` ### 10. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/app/page.js - **File:** `.next/server/app/page.js` - **Pattern:** `sql_string_concat` ### 11. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/app/trips/page.js - **File:** `.next/server/app/trips/page.js` - **Pattern:** `sql_string_concat` ### 12. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/app/trips/[tripId]/page.js - **File:** `.next/server/app/trips/[tripId]/page.js` - **Pattern:** `sql_string_concat` ### 13. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/server/app/favicon.ico/route.js - **File:** `.next/server/app/favicon.ico/route.js` - **Pattern:** `exec_usage` ### 14. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/chunks/488.js - **File:** `.next/server/chunks/488.js` - **Pattern:** `sql_string_concat` ### 15. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/server/chunks/404.js - **File:** `.next/server/chunks/404.js` - **Pattern:** `exec_usage` ### 16. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/chunks/948.js - **File:** `.next/server/chunks/948.js` - **Pattern:** `sql_string_concat` ### 17. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/server/chunks/682.js - **File:** `.next/server/chunks/682.js` - **Pattern:** `exec_usage` ### 18. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/chunks/141.js - **File:** `.next/server/chunks/141.js` - **Pattern:** `sql_string_concat` ### 19. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/chunks/195.js - **File:** `.next/server/chunks/195.js` - **Pattern:** `sql_string_concat` ### 20. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/chunks/107.js - **File:** `.next/server/chunks/107.js` - **Pattern:** `sql_string_concat` ### 21. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/server/chunks/86.js - **File:** `.next/server/chunks/86.js` - **Pattern:** `exec_usage` ### 22. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/server/chunks/70.js - **File:** `.next/server/chunks/70.js` - **Pattern:** `exec_usage` ### 23. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/server/chunks/245.js - **File:** `.next/server/chunks/245.js` - **Pattern:** `sql_string_concat` ### 24. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/static/chunks/851-8ba13c8574b29682.js - **File:** `.next/static/chunks/851-8ba13c8574b29682.js` - **Pattern:** `exec_usage` ### 25. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/383-990d92e8586399ee.js - **File:** `.next/static/chunks/383-990d92e8586399ee.js` - **Pattern:** `sql_string_concat` ### 26. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/777-8c4dd05d3e255de8.js - **File:** `.next/static/chunks/777-8c4dd05d3e255de8.js` - **Pattern:** `sql_string_concat` ### 27. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/382-73082245b2562993.js - **File:** `.next/static/chunks/382-73082245b2562993.js` - **Pattern:** `sql_string_concat` ### 28. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/993-23fffc8f10a8e2ca.js - **File:** `.next/static/chunks/993-23fffc8f10a8e2ca.js` - **Pattern:** `sql_string_concat` ### 29. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/static/chunks/717-47c2341d683d1b81.js - **File:** `.next/static/chunks/717-47c2341d683d1b81.js` - **Pattern:** `exec_usage` ### 30. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/274-2893f884efb0e7a3.js - **File:** `.next/static/chunks/274-2893f884efb0e7a3.js` - **Pattern:** `sql_string_concat` ### 31. auth_flaw - **Details:** Potential security issue (exec_usage) in .next/static/chunks/117-50e6fc7231178d5f.js - **File:** `.next/static/chunks/117-50e6fc7231178d5f.js` - **Pattern:** `exec_usage` ### 32. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/webpack-4b2008cf03115edd.js - **File:** `.next/static/chunks/webpack-4b2008cf03115edd.js` - **Pattern:** `sql_string_concat` ### 33. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/380-000dff687d679976.js - **File:** `.next/static/chunks/380-000dff687d679976.js` - **Pattern:** `sql_string_concat` ### 34. auth_flaw - **Details:** Potential security issue (sql_string_concat) in .next/static/chunks/app/trips/[tripId]/page-debdb745242d1753.js - **File:** `.next/static/chunks/app/trips/[tripId]/page-debdb745242d1753.js` - **Pattern:** `sql_string_concat` --- *This issue was auto-generated by the security sweep cron job.*
Mark commented 2026-08-13 06:44:32 +00:00
Author
Owner
Copy link

Closed by fixup lane (t_745ad387) — all 34 findings verified false positives

What the scanner actually flagged:

  • Findings 1,3-9 ("AWS Secret Key"): sha512 subresource-integrity digests in package-lock.json / bun.lock (e.g. sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==) — base64 lockfile hashes, not credentials.
  • Finding 2 ("Password in URL"): README placeholder DATABASE_URL=postgresql://user:***@localhost:5432/planish — already redacted (***), localhost only.
  • Findings 10-34 (sql_string_concat/exec_usage): .next/ build output — generated, gitignored.

Fix landed: commits e9088bd1, 52e46c5, 40f8632, 6b67d59, a0bc5eb, 77a7c1b, 7530b93, daffae6 on origin/main (9 commits reference #9). Suppression files: .bearerignore, .gitattributes, .semgrepignore, .gitleaks.toml (allowlist: "Verified false positives for AuWoMe/planish#9").

Verification: npm run security:scan → 0 HIGH findings across 96 unsuppressed tracked files, exit 0. eslint + tsc pass. The kilo-gsd runner could not close this itself: its Commit gate structurally cannot pass (nothing left to push — fix already on origin), so it looped Implement→Lint→Verify→Review→Commit and exited non-zero. Manual close per documented recovery for gate-structurally-unable-to-pass. Sibling #10 closed the same way.

## Closed by fixup lane (t_745ad387) — all 34 findings verified false positives **What the scanner actually flagged:** - Findings 1,3-9 ("AWS Secret Key"): sha512 subresource-integrity digests in package-lock.json / bun.lock (e.g. `sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==`) — base64 lockfile hashes, not credentials. - Finding 2 ("Password in URL"): README placeholder `DATABASE_URL=postgresql://user:***@localhost:5432/planish` — already redacted (`***`), localhost only. - Findings 10-34 (sql_string_concat/exec_usage): .next/ build output — generated, gitignored. **Fix landed:** commits `e9088bd1`, `52e46c5`, `40f8632`, `6b67d59`, `a0bc5eb`, `77a7c1b`, `7530b93`, `daffae6` on origin/main (9 commits reference #9). Suppression files: .bearerignore, .gitattributes, .semgrepignore, .gitleaks.toml (allowlist: "Verified false positives for AuWoMe/planish#9"). **Verification:** `npm run security:scan` → 0 HIGH findings across 96 unsuppressed tracked files, exit 0. eslint + tsc pass. The kilo-gsd runner could not close this itself: its Commit gate structurally cannot pass (nothing left to push — fix already on origin), so it looped Implement→Lint→Verify→Review→Commit and exited non-zero. Manual close per documented recovery for gate-structurally-unable-to-pass. Sibling #10 closed the same way.
Mark 2026-08-13 06:44:32 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
blocked:needs-decision

   
bug

   
chore

   
in-progress

Locked by an active fixit pipeline run

  
security/high

High severity security issue

  
security/medium

Medium severity security issue

  
triage-approved
No labels
blocked:needs-decision
bug
chore
in-progress
security/high
security/medium
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
AuWoMe/planish#9
No description provided.