17 lines
907 B
JSON
17 lines
907 B
JSON
{
|
|
"feature_id": "F-114",
|
|
"agent": "security",
|
|
"stage": "security_gate",
|
|
"verdict": "APPROVED",
|
|
"reviewed_at": "2026-08-21",
|
|
"summary": "No new attack surface. Seed is a one-off CLI with parameterized SQL; helper logic is pure and side-effect-free.",
|
|
"checks": [
|
|
{ "item": "SQL injection: INSERTs use parameterized placeholders; no string concatenation", "ok": true },
|
|
{ "item": "Slug uniqueness: enforced by DB UNIQUE constraint + ON CONFLICT DO NOTHING; helper doesn't trust uniqueness", "ok": true },
|
|
{ "item": "decodeHtmlEntities: does not decode script-like entities or unknown named entities; safe fallback", "ok": true },
|
|
{ "item": "Slugify: strips diacritics and non-alphanumerics; rejects what the gateway regex would reject", "ok": true },
|
|
{ "item": "Seed script: requires DATABASE_URL; dry-run flag prevents accidental writes", "ok": true }
|
|
],
|
|
"issues": []
|
|
}
|