thank you!

Does disabling the dependency_paths feature flag affect the ability to detect transitive dependencies? With that flag disabled with the customer still be able to detect vulnerabilites that are 2 or 3 layers deep? It's a little unclear to them whether changing the dependency_paths feature flag will decrease the effectiveness of the security scanning (which would then introduce a risk that needs to be approved by their management).

Erin Rasmussen (ea8da3e4) at 17 Mar 02:25

unmarked it as draft

Closes #223

Closes #223

Erin Rasmussen (16dba8bf) at 16 Mar 22:03

File: cli.py — show_logs() function Category: Sensitive Data Exposure

Description

The logs command writes database credentials, API keys, and full user records (including passwords and credit cards) to /tmp/flask_app_debug.log with permissions 0o666 (world-readable and world-writable). Any user on the system can read these secrets.

Remediation Hint

• Never write credentials to log files
• If logging is necessary, use restrictive permissions (e.g., 0o600)
• Redact sensitive fields before logging
• Use a proper logging framework with secret filtering

Erin Rasmussen (1cae0e76) at 16 Mar 22:03

... and 1 more commit

Updated the permissions on the file and also commented the writes of sensitive information to the log file

closes #227

Updated the permissions on the file and also commented the writes of sensitive information to the log file

closes #227

Updated the permissions on the file and also commented the writes of sensitive information to the log file

closes #227

Erin Rasmussen (16dba8bf) at 16 Mar 22:00

Erin Rasmussen (cbfb3182) at 16 Mar 21:51