14 lines
754 B
JSON
14 lines
754 B
JSON
{
|
|
"feature_id": "F-149",
|
|
"agent": "security",
|
|
"stage": "security_gate",
|
|
"verdict": "APPROVED",
|
|
"summary": "Fully parameterized SQL CTE. All user input (dates, UUIDs, channel) via $1..$8 placeholders. RBAC enforced via requireReportingPermission('REPORTING_PRODUCTS'). No new secrets.",
|
|
"checks": [
|
|
{"item": "SQL injection prevention", "ok": true, "evidence": "All user values: $1..$8 parameterized; sortBy is validated ('units_sold'|'gross_sales_cents'), not interpolated as user string"},
|
|
{"item": "Authentication", "ok": true, "evidence": "requireReportingPermission('REPORTING_PRODUCTS') on GET /reporting/products"},
|
|
{"item": "No new secrets", "ok": true, "evidence": "No env vars or credentials added"}
|
|
],
|
|
"issues": []
|
|
}
|