Executive Summary

Quality Gate: FAILED

• Found 45 critical/high findings (max allowed: 0)
• Found 3 secrets (max allowed: 0)
• Found 3 deprecated crypto algorithms (max allowed: 0)

45 critical/high severity findings across all scanners.

66 total findings identified. 3 low-confidence findings collapsed below.

This codebase has 11.8 security findings per KLOC. Industry average for javascript applications is 3.8 per KLOC.

OWASP Top 10: 1/10 categories passing, 9 with findings.

Finding Summary

Total findings: 66

Findings by Scanner

Top Critical Findings

Top Priority Fixes

Security Findings (SAST)

```
	$username = $_GET['username'];
	echo '<div class="header"> Welcome, ' . $username . '</div>';
```

```
	try {
		File file = new File("object.obj");
		ObjectInputStream in = new ObjectInputStream(new FileInputStream(file));
		javax.swing.JButton button = (javax.swing.JButton) in.readObject();
		in.close();
	}
```

```java
// Option 1: Use JSON instead of Java serialization
ObjectMapper mapper = new ObjectMapper();
mapper.activateDefaultTyping(
    mapper.getPolymorphicTypeValidator(),
    ObjectMapper.DefaultTyping.NON_FINAL
);
MyObject obj = mapper.readValue(input, MyObject.class);

// Option 2: Use ObjectInputFilter (Java 9+)
ObjectInputStream ois = new ObjectInputStream(inputStream);
ois.setObjectInputFilter(ObjectInputFilter.Config.createFilter(
    "com.myapp.model.*;!*"
));
```

```
	XPath xpath = XPathFactory.newInstance().newXPath();
	XPathExpression xlogin = xpath.compile("//users/user[login/text()='" + login.getUserName() + "' and password/text() = '" + login.getPassword() + "']/home_dir/text()");
	Document d = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new File("db.xml"));
	String homedir = xlogin.evaluate(d);
```

```
	$url = $_GET['url'];
```
# User-controlled input* 
	
	
	 *# Fetch the content of the provided URL* 
	$response = file_get_contents($url);
	
	echo $response;

```
```
// Define the target location where the picture being* 
	
	
	 *// uploaded is going to be saved.* 
	$target = "pictures/" . basename($_FILES['uploadedfile']['name']);
	
	
	 *// Move the uploaded file to the new location.* 
	if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target))
	{
	```
		echo "The picture has been successfully uploaded.";
	}
	else
	{
		echo "There was an error uploading the picture, please try again.";
	}
```

```
	<form action="/url/profile.php" method="post">
	<input type="text" name="firstname"/>
	<input type="text" name="lastname"/>
	<br/>
	<input type="text" name="email"/>
	<input type="submit" name="submit" value="Update"/>
	</form>
```

```java
// Spring Security enables CSRF by default — do not disable it
@Configuration
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf(csrf -> csrf
            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
        );
        return http.build();
    }
}

// In Thymeleaf forms, the token is included automatically:
// <form th:action="@{/transfer}" method="post">...</form>
```

```
	EVP_des_ecb();
```

```java
// Use AES-256-GCM instead of DES/3DES/RC4
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
GCMParameterSpec gcmSpec = new GCMParameterSpec(128, iv);
cipher.init(Cipher.ENCRYPT_MODE, keySpec, gcmSpec);

// Use SHA-256 or SHA-3 instead of MD5/SHA-1
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] hash = md.digest(data);
```

```
	$redirect_url = $_GET['url'];
	header("Location: " . $redirect_url);
```

```
	function generateSessionID($userID){
		srand($userID);
		return rand();
	}
```

```
	$MessageFile = "messages.out";
	if ($_GET["action"] == "NewMessage") {
		$name = $_GET["name"];
		$message = $_GET["message"];
		$handle = fopen($MessageFile, "a+");
		fwrite($handle, "<b>$name</b> says '$message'<hr>\n");
		fclose($handle);
		echo "Message Saved!<p>\n";
	}
	else if ($_GET["action"] == "ViewMessages") {
		include($MessageFile);
	}
```

```java
// Instead of ScriptEngine.eval(userInput), use a safe templating engine
// with auto-escaping and no code execution:
Configuration cfg = new Configuration(Configuration.VERSION_2_3_31);
Template template = cfg.getTemplate("safe-template.ftl");
Map<String, Object> model = Map.of("name", userInput);
template.process(model, writer);
```

```
	try {
		/.../
	}
	catch (Exception e) {
		System.out.println(e);
	}
```

Secrets Detection

Compliance Mapping

OWASP Top 10 (2025)

OWASP Top 10 (2021)

CWE Top 25 (2023)

Total findings mapped to compliance frameworks: 64

Remediation Priorities

Findings sorted by severity for remediation prioritisation.

Security (SAST) Remediation

Secrets Remediation

Scan Metadata

Appendix

Full Finding Inventory

Glossary

SAST

Static Application Security Testing — analyzes source code for security vulnerabilities without executing the program.

SCA

Software Composition Analysis — identifies known vulnerabilities in third-party dependencies.

SBOM

Software Bill of Materials — an inventory of all software components and dependencies.

IaC

Infrastructure as Code — configuration files (Terraform, CloudFormation, etc.) that define infrastructure.

CWE

Common Weakness Enumeration — a standardized list of software and hardware weakness types.

OWASP

Open Worldwide Application Security Project — a nonprofit foundation focused on improving software security.

CVSS

Common Vulnerability Scoring System — a framework for rating the severity of security vulnerabilities.

Code Health Rating

A severity-based A–E rating derived from the worst security finding severity.

CycloneDX

A lightweight SBOM standard designed for use in application security contexts.