An open security research lab

Open security research and the tools we build

Read our research See how Andesyte applies it

Check for any issues before I merge this PR

server: "andesyte"

tool: "andesyte_review"

arguments: { pr: "current", scope: "deps" }

~/repo/acme · package.json · 214 dependencies

Resolved lockfile to exact versions 0.4s

Checked 214 packages against the CVE database 1.2s

Traced cross-spawn to src/jobs/run-task.ts:42 0.6s

Job payload flows into cross-spawn unsanitised reachable

cross-spawn@7.0.3 via CVE-2024-21538 (ReDoS, high) flagged

CWE-1333 · Inefficient Regular Expression Complexity cvss 7.7

No other unsanitised call paths found 0.3s

Bumped cross-spawn to 7.0.5 and relocked 0.8s

Ran install + test suite against the patch 3.1s

Opened PR #482, no known CVEs remain patched

Follow-up

Open

fix: bump cross-spawn to patch CVE-2024-21538 #482

andesyte-code-security wants to merge 2 commits into main

andesyte-code-security [bot]reviewed 2m ago

package.json

11 "dependencies": {

12 "commander": "^11.1.0",

13 "cross-spawn": "7.0.3",

13 "cross-spawn": "7.0.5",

14 "execa": "^8.0.1",

src/jobs/run-task.ts +2 -1

andesyte-code-security [bot]high

CVE-2024-21538 affects cross-spawn <7.0.5, which is vulnerable to ReDoS via crafted arguments. Traced the call path to src/jobs/run-task.ts:42, where job payloads reach it unsanitised, confirming this is exploitable, not just present in the lockfile. Bumped to 7.0.5, the patched release.

This branch has not been deployed

No deployments

All checks have passed

1 successful check

No conflicts with base branch

Merging can be performed automatically.

Squash and mergeor merge from the command line

Open-source projects we've helped secure

In your terminal, and in your agent

The same checks that review your pull requests run locally. Your source code stays on your machine. Dependency scanning sends package names and versions to OSV, and nothing else.

npm install -g @andesyte-oss/cli

andesyte check code --changed

~/repo/acme · 2 files changed · not yet committed

Loaded local rules, no registry call 0.2s

Query built by concatenation at src/db/users.ts:42 0.4s

req.query.email reaches the query unsanitised reachable

SQL injection · CWE-89 flagged

Severity: critical 1 finding

Fix: use a parameterised query exit 1

Follow-up

Open

feat: add user search endpoint #291

lewiswigmore wants to merge 1 commit into main from lewiswigmore/user-search

andesyte-code-security [bot]reviewed 1m ago

src/db/users.ts

40export async function findByEmail(email: string) {

41 const sql =

42 "SELECT * FROM users WHERE email = '" + email + "'";

43 return db.query(sql);

41 const sql = "SELECT * FROM users WHERE email = $1";

42 return db.query(sql, [email]);

44}

src/routes/search.ts +1 -1

andesyte-code-security [bot]critical

SQL injection. The email value arrives from the request query string and is concatenated into the statement, so a crafted value can end the string literal and append its own SQL. Bind it as a parameter instead. The driver then sends the value separately from the statement, and the database never parses it as code.

This branch has not been deployed

No deployments

All checks have passed

1 successful check

No conflicts with base branch

Merging can be performed automatically.

Squash and mergeor merge from the command line

Published findings

All research →

Each of these was reported to the maintainer, fixed upstream, and then written up in full. The write-ups include the exploit path, because a finding you cannot reproduce is difficult to learn from.

A pull request is the entry point

Install the GitHub App once. Every pull request then triggers the same review, inline findings, and safe autofix workflow.

Review this PR before I merge it

server: "andesyte"

tool: "andesyte_review"

arguments: { pr: 53417, scope: "authz" }

Diffed PR #53417 against main

Traced request handling in app/api/chat/route.ts:27

userId is read from the request body, not the authenticated session

Flagged missing authorization check · CWE-862

Severity: critical · user impersonation possible

Both handlers already validate the session correctly

Suggested guard: reject when userId !== session user

Ran the auth test suite against the suggested fix

Posted the fix as a review comment on PR #53417

Done. Impersonation path closed, existing behaviour unchanged for authorised users.

∞

Open

feat: Adding chat generation #53417

lewiswigmore wants to merge 2 commits into main from lewiswigmore/feature

andesyte-code-security [bot]reviewed 2m ago

app/api/chat/route.ts

25export async function POST(req: NextRequest) {

26 const { userId, messages } = await req.json();

27 if (userId !== req.user.id) {

28 return NextResponse.json(

29 { error: "Unauthorized" },

30 { status: 401 },

31 );

32 }

33 const stream = await generateChat(messages);

lib/session.ts +3 -0

andesyte-code-security [bot]critical

Missing authorization check allows user impersonation. userId is taken from the request body instead of the authenticated session, so any signed-in user can act as another by changing the value they send. Add a check that the requested user matches the session before processing.

This branch has not been deployed

No deployments

All checks have passed

1 successful check

No conflicts with base branch

Merging can be performed automatically.

Squash and mergeor merge from the command line

Integrations

Reviews where your code already lives

Install Andesyte Code Security on GitHub, or connect a GitLab project from the dashboard, to review changes where your team already works.

Add to GitHub

Agents

ClaudeCodexCursorGitHub CopilotWindsurf

Available now

GitHub AppGitLab Connect

Working with us

Research services

Focused reviews for high-risk software

Our researchers examine applications, cloud infrastructure, source control and release pipelines, then work with engineering teams through remediation.

Work with our researchers

Andesyte Code Security

Our research, built into your development cycle

Andesyte brings the lab's methods into everyday code review, tracing exploitable issues and putting the evidence in front of engineers as code changes.

Explore Andesyte

Read the work before you decide

Everything we have published is open, including the parts where the answer was that nothing was wrong.

Browse the research Work with our researchers

Careers

We're a small team. No open roles. Drop us a line anyway.

If you ship security tools people rely on, we want to know you.

Introduce yourself