docs(security): Semgrep triage inventory (4 findings) - #81
docs(security): Semgrep triage inventory (4 findings)#81marlon-costa-dc wants to merge 2 commits into
Conversation
Inventario dos findings da plataforma Semgrep com regra, arquivo e linha por achado. Totais: high 0, medium 4, low 0 (high confidence: 4) Classes: Insecure Configuration x4 Bead: mro-p57t.13 Nenhuma alteracao de codigo de producao. Findings SAST exigem analise caso a caso do fluxo de dados.
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…e messages Cada achado agora traz: - codigo real numerado extraido da worktree (linha >>> = sink) - mensagem completa da regra (descricao do problema e do fix) - CWE/classe de vulnerabilidade e effort onde disponivel
|
2 participants
Triagem Semgrep — inventário
4 findings — high 0, medium 4, low 0 (high confidence: 4)
Bead:
mro-p57t.13O que este PR contém
Apenas
docs/security/semgrep-triage.md: regra, severidade, confiança, arquivo e linha de cada finding, com coluna de decisão a preencher (corrigir/falso-positivo/risco-aceito).Nenhuma alteração de código.
Classes: Insecure Configuration x4
Findings SAST não têm remediação automática — cada um exige seguir o fluxo de dados até o sink. Priorizar high com confidence=high.
Dados brutos:
~/semgrep-violations/by-repo/flext-sh_flext-ldap.jsonSummary by cubic
Added a Semgrep triage inventory for flext-sh/flext-ldap to centralize security findings and guide triage.
The doc lists 4 medium-severity, high-confidence configuration findings and now includes full rule messages, numbered code snippets (with sink marker), CWE/class, and a decision column; no code changes.
Written for commit fcad98f. Summary will update on new commits.