https://github.com/prometheus/prometheus ·
lang: go ·
LOC: ·
source: user_submitted
| Rule | Severity | Count |
|---|---|---|
AIC003 Duplicated implementation block across source files |
low | 30 |
MINED126 GHA workflow container/services image unpinned |
high | 10 |
MINED060 Go Context No Cancel |
info | 4 |
MINED016 Go Error Ignored |
high | 4 |
ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. |
medium | 4 |
MINED071 Go Panic Call |
info | 4 |
MINED044 Js Console Log Prod |
info | 4 |
MINED045 Ts Non Null Assertion |
info | 4 |
MINED056 React Key As Index |
info | 4 |
SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from use… |
high | 4 |
MINED013
Password In Url
CWE-200
scripts/sync_repo_files.sh:86
· conf 1.00
[MINED013] Password In Url: https://user:password@host — leaks creds via logs, referrer, error messages.MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:343
· conf 0.90
[MINED116] Workflow uses `secrets.PROMBOT_GITHUB_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.PROMBOT_GITHUB…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:391
· conf 0.90
[MINED116] Workflow uses `secrets.NPM_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.NPM_TOKEN }` lets a PR fr…MINED004
Weak Crypto
CWE-327
notifier/alertmanagerset.go:17
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).MINED004
Weak Crypto
CWE-327
storage/remote/storage.go:18
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).MINED016
Go Error Ignored
CWE-754
cmd/promtool/query.go:82
· conf 1.00
[MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern.MINED016
Go Error Ignored
CWE-754
discovery/ionos/server.go:89
· conf 1.00
[MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern.MINED016
Go Error Ignored
CWE-754
discovery/kubernetes/ingress.go:60
· conf 1.00
[MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern.MINED027
React State Array Mutation
CWE-682
web/ui/mantine-ui/src/state/queryPageSlice.ts:115
· conf 1.00
[MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState — React skips re-render on mutated reference.MINED118
Dockerfile FROM not pinned by sha256 digest
CWE-829
Dockerfile:3
· conf 0.90
[MINED118] Dockerfile FROM `quay.io/prometheus/busybox- (no tag)` not pinned by digest: `FROM quay.io/prometheus/busybox- (no tag)` resolves the tag at build time. The registry CAN re-push a differen…MINED118
Dockerfile FROM not pinned by sha256 digest
CWE-829
Dockerfile.distroless:4
· conf 0.90
[MINED118] Dockerfile FROM `gcr.io/distroless/static-debian13:nonroot-` not pinned by digest: `FROM gcr.io/distroless/static-debian13:nonroot-` resolves the tag at build time. The registry CAN re-pus…MINED126
GHA workflow container/services image unpinned
CWE-829
.github/workflows/ci.yml:19
· conf 0.90
[MINED126] Workflow container/services image `quay.io/prometheus/golang-builder:1.26-base` unpinned: `container/services image: quay.io/prometheus/golang-builder:1.26-base` without `@sha256:...` pull…MINED126
GHA workflow container/services image unpinned
CWE-829
.github/workflows/ci.yml:36
· conf 0.90
[MINED126] Workflow container/services image `quay.io/prometheus/golang-builder:1.26-base` unpinned: `container/services image: quay.io/prometheus/golang-builder:1.26-base` without `@sha256:...` pull…MINED126
GHA workflow container/services image unpinned
CWE-829
.github/workflows/ci.yml:53
· conf 0.90
[MINED126] Workflow container/services image `quay.io/prometheus/golang-builder:1.26-base` unpinned: `container/services image: quay.io/prometheus/golang-builder:1.26-base` without `@sha256:...` pull…MINED126
GHA workflow container/services image unpinned
CWE-829
.github/workflows/ci.yml:68
· conf 0.90
[MINED126] Workflow container/services image `quay.io/prometheus/golang-builder:1.26-base` unpinned: `container/services image: quay.io/prometheus/golang-builder:1.26-base` without `@sha256:...` pull…MINED126
GHA workflow container/services image unpinned
CWE-829
.github/workflows/ci.yml:84
· conf 0.90
[MINED126] Workflow container/services image `quay.io/prometheus/golang-builder:1.25-base` unpinned: `container/services image: quay.io/prometheus/golang-builder:1.25-base` without `@sha256:...` pull…MINED126
GHA workflow container/services image unpinned
CWE-829
.github/workflows/ci.yml:99
· conf 0.90
[MINED126] Workflow container/services image `quay.io/prometheus/golang-builder:1.26-base` unpinned: `container/services image: quay.io/prometheus/golang-builder:1.26-base` without `@sha256:...` pull…MINED126
GHA workflow container/services image unpinned
CWE-829
.github/workflows/ci.yml:137
· conf 0.90
[MINED126] Workflow container/services image `quay.io/prometheus/golang-builder:1.26-base` unpinned: `container/services image: quay.io/prometheus/golang-builder:1.26-base` without `@sha256:...` pull…MINED126
GHA workflow container/services image unpinned
CWE-829
.github/workflows/ci.yml:157
· conf 0.90
[MINED126] Workflow container/services image `quay.io/prometheus/golang-builder:1.26-base` unpinned: `container/services image: quay.io/prometheus/golang-builder:1.26-base` without `@sha256:...` pull…MINED126
GHA workflow container/services image unpinned
CWE-829
.github/workflows/ci.yml:245
· conf 0.90
[MINED126] Workflow container/services image `quay.io/prometheus/golang-builder:1.26-base` unpinned: `container/services image: quay.io/prometheus/golang-builder:1.26-base` without `@sha256:...` pull…MINED126
GHA workflow container/services image unpinned
CWE-829
.github/workflows/repo_sync.yml:15
· conf 0.90
[MINED126] Workflow container/services image `quay.io/prometheus/golang-builder` unpinned: `container/services image: quay.io/prometheus/golang-builder` without `@sha256:...` pulls a mutable tag at w…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
cmd/promtool/debug.go:38
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
discovery/xds/client.go:105
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
documentation/examples/custom-sd/adapter-usage/main.go:165
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC040
innerHTML XSS — template literal with server-supplied data
web/ui/mantine-ui/src/promql/serialize.ts:38
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC040
innerHTML XSS — template literal with server-supplied data
web/ui/react-app/src/pages/flags/Flags.tsx:60
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC040
innerHTML XSS — template literal with server-supplied data
web/ui/react-app/src/pages/graph/GraphHelpers.ts:124
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC100
CORS permissive Access-Control-Allow-Origin: *
util/httputil/cors.go:41
· conf 1.00
[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `A…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
cmd/promtool/analyze.go:109
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
web/ui/mantine-ui/src/pages/query/ExpressionInput.tsx:320
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
web/ui/react-app/src/pages/graph/ExpressionInput.tsx:220
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…AGT012
Agent control bridge may listen on a network interface without visible auth
discovery/moby/testdata/swarmprom/tasks.json:128
· conf 0.72
Agent control bridge may listen on a network interface without visible authAGT012
Agent control bridge may listen on a network interface without visible auth
web/api/v1/testdata/openapi_3.1_golden.yaml:573
· conf 0.72
Agent control bridge may listen on a network interface without visible authAGT012
Agent control bridge may listen on a network interface without visible auth
web/api/v1/testdata/openapi_3.2_golden.yaml:573
· conf 0.72
Agent control bridge may listen on a network interface without visible authSEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
web/ui/mantine-ui/src/components/RuleDefinition.tsx:60
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC045
eval()/exec() on stored or user-supplied data
rules/recording.go:85
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC045
eval()/exec() on stored or user-supplied data
rules/rule.go:43
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC089
Go: bind to all interfaces (0.0.0.0)
documentation/examples/remote_storage/example_write_adapter/server.go:73
· conf 1.00
[SEC089] Go: bind to all interfaces (0.0.0.0): Server binds to all network interfaces — exposes service beyond intended scope. Ported from gosec G102 (Apache-2.0).SEC089
Go: bind to all interfaces (0.0.0.0)
util/testutil/port.go:56
· conf 1.00
[SEC089] Go: bind to all interfaces (0.0.0.0): Server binds to all network interfaces — exposes service beyond intended scope. Ported from gosec G102 (Apache-2.0).SEC091
Go: net/http server without timeouts
documentation/examples/remote_storage/example_write_adapter/server.go:73
· conf 1.00
[SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0).SEC091
Go: net/http server without timeouts
documentation/examples/remote_storage/remote_storage_adapter/main.go:280
· conf 1.00
[SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0).AIC003
Duplicated implementation block across source files
discovery/aws/elasticache.go:19
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/aws/lightsail.go:15
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/aws/msk.go:71
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/eureka/eureka.go:58
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/http/http.go:43
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/kubernetes/endpointslice.go:22
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/kubernetes/pod.go:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/kubernetes/service.go:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/kubernetes/service.go:58
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/linode/linode.go:69
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/moby/dockerswarm.go:89
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/nomad/nomad.go:55
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/ovhcloud/vps.go:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/puppetdb/puppetdb.go:13
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/puppetdb/puppetdb.go:66
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/scaleway/instance.go:59
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/scaleway/scaleway.go:174
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/uyuni/uyuni.go:90
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/uyuni/uyuni.go:91
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
discovery/vultr/vultr.go:40
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
model/labels/labels_stringlabels.go:33
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
model/labels/labels_stringlabels.go:342
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
model/labels/sharding_dedupelabels.go:6
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
model/labels/sharding.go:6
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
model/textparse/promlex.l.go:19
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
model/textparse/promparse.go:169
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
prompb/io/prometheus/write/v2/codec.go:62
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
rules/manager.go:35
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
tsdb/fileutil/flock_solaris.go:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
tsdb/fileutil/flock_unix.go:1
· conf 0.86
Duplicated implementation block across source filesDKR008
.dockerignore misses sensitive defaults
.dockerignore
· conf 0.72
.dockerignore misses sensitive defaultsERR003
[ERR003] Ignored Error (Go): Ignoring error return values.
model/labels/sharding_dedupelabels.go:33
· conf 1.00
[ERR003] Ignored Error (Go): Ignoring error return values.ERR003
[ERR003] Ignored Error (Go): Ignoring error return values.
model/labels/sharding.go:31
· conf 1.00
[ERR003] Ignored Error (Go): Ignoring error return values.ERR003
[ERR003] Ignored Error (Go): Ignoring error return values.
model/labels/sharding_stringlabels.go:35
· conf 1.00
[ERR003] Ignored Error (Go): Ignoring error return values.DKR002
Dockerfile base image has no explicit tag
Dockerfile:3
· conf 0.48
Dockerfile base image is selected through a build variableDKR002
Dockerfile base image has no explicit tag
Dockerfile.distroless:4
· conf 0.48
Dockerfile base image is selected through a build variableERR003
[ERR003] Ignored Error (Go): Ignoring error return values.
[ERR003] Ignored Error (Go) (and 8 more): Same pattern found in 8 additional files. Review if needed.MINED016
Go Error Ignored
CWE-754
[MINED016] Go Error Ignored (and 11 more): Same pattern found in 11 additional files. Review if needed.MINED043
Http Not Https
CWE-319
documentation/examples/custom-sd/adapter-usage/main.go:165
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED043
Http Not Https
CWE-319
web/ui/react-app/src/pages/targets/__testdata__/testdata.ts:9
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED044
Js Console Log Prod
CWE-532
[MINED044] Js Console Log Prod (and 2 more): Same pattern found in 2 additional files. Review if needed.MINED044
Js Console Log Prod
CWE-532
web/ui/mantine-ui/src/components/ErrorBoundary.tsx:26
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
web/ui/mantine-ui/src/pages/query/HistogramHelpers.ts:72
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
web/ui/mantine-ui/src/pages/query/urlStateEncoding.ts:56
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED045
Ts Non Null Assertion
CWE-476
[MINED045] Ts Non Null Assertion (and 1 more): Same pattern found in 1 additional files. Review if needed.MINED045
Ts Non Null Assertion
CWE-476
web/ui/mantine-ui/src/api/api.ts:76
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
web/ui/mantine-ui/src/pages/query/ExplainViews/Selector.tsx:33
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
web/ui/mantine-ui/src/promql/format.tsx:100
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED052
Ts Any Typed
CWE-704
[MINED052] Ts Any Typed (and 2 more): Same pattern found in 2 additional files. Review if needed.MINED052
Ts Any Typed
CWE-704
web/ui/react-app/src/pages/graph/GraphTabContent.tsx:10
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED052
Ts Any Typed
CWE-704
web/ui/react-app/src/pages/graph/Graph.tsx:49
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED052
Ts Any Typed
CWE-704
web/ui/react-app/src/pages/graph/TimeInput.tsx:37
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED054
Ts As Any
CWE-704
web/ui/react-app/src/hooks/useFetch.ts:22
· conf 1.00
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.MINED055
Npm Install No Lockfile
CWE-1357
scripts/npm-deps.sh:22
· conf 1.00
[MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versions on every build) instead of npm ci.MINED056
React Key As Index
CWE-682
[MINED056] React Key As Index (and 18 more): Same pattern found in 18 additional files. Review if needed.MINED056
React Key As Index
CWE-682
web/ui/mantine-ui/src/components/NotificationsIcon.tsx:73
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
web/ui/mantine-ui/src/pages/query/DataTable.tsx:90
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
web/ui/mantine-ui/src/pages/query/ExplainViews/BinaryExpr/VectorScalar.tsx:81
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED058
React Dangerously Set Html
CWE-79
web/ui/mantine-ui/src/pages/query/MetricsExplorer/MetricsExplorer.tsx:126
· conf 1.00
[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data.MINED058
React Dangerously Set Html
CWE-79
web/ui/react-app/src/pages/flags/Flags.tsx:108
· conf 1.00
[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data.MINED058
React Dangerously Set Html
CWE-79
web/ui/react-app/src/pages/graph/MetricsExplorer.tsx:49
· conf 1.00
[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data.MINED060
Go Context No Cancel
CWE-401
[MINED060] Go Context No Cancel (and 14 more): Same pattern found in 14 additional files. Review if needed.MINED060
Go Context No Cancel
CWE-401
cmd/promtool/analyze.go:64
· conf 1.00
[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines.MINED060
Go Context No Cancel
CWE-401
cmd/promtool/backfill.go:130
· conf 1.00
[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines.MINED060
Go Context No Cancel
CWE-401
cmd/promtool/metrics.go:115
· conf 1.00
[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines.MINED071
Go Panic Call
CWE-755
[MINED071] Go Panic Call (and 23 more): Same pattern found in 23 additional files. Review if needed.MINED071
Go Panic Call
CWE-755
discovery/file/file.go:224
· conf 1.00
[MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases.MINED071
Go Panic Call
CWE-755
discovery/moby/dockerswarm.go:199
· conf 1.00
[MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases.MINED071
Go Panic Call
CWE-755
discovery/registry.go:64
· conf 1.00
[MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases.SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input (and 5 more): Same pattern found in 5 additional files. Review if needed.Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/f49f0d4c-44f5-476f-ae97-1d983f63dbf9/.