📦
Audit History
python-web-app-security-audit - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Aug 10, 2026, 11:14 AM
All 136 static findings are false positives caused by defensive test payloads, explicit local configuration, safe copy operations, or Markdown formatting. Requests use in-process ASGITransport, active probes require owner opt-in, and no credential exfiltration, prompt injection, or malicious intent was found.
26
Files scanned
2,063
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
🌐 Network access (16)
references/assertion-catalog.md:7 security/.env.test.template:33 security/.env.test.template:41 security/.env.test.template:42 security/conftest.py:63 security/conftest.py:80 security/conftest.py:110 security/test_config.py:149 security/test_config.py:161 security/test_cookies.py:94 security/test_cors.py:42 security/test_cors.py:56 security/test_cors.py:16 security/test_cors.py:17 security/test_headers.py:93 security/test_rate_limit.py:117
🔑 Env variables (50)
references/setup-and-boundaries.md:19 requirements.txt:4 security/conftest.py:18 security/conftest.py:44 security/conftest.py:76 security/conftest.py:84 security/conftest.py:85 security/conftest.py:106 security/conftest.py:113 security/conftest.py:114 security/conftest.py:131 security/conftest.py:18 security/conftest.py:44 security/conftest.py:76 security/conftest.py:84 security/conftest.py:85 security/conftest.py:106 security/conftest.py:113 security/conftest.py:114 security/conftest.py:131 security/conftest.py:10 security/conftest.py:13 security/conftest.py:10 security/conftest.py:13 security/test_auth.py:114 security/test_auth.py:149 security/test_auth.py:168 security/test_auth.py:114 security/test_auth.py:149 security/test_auth.py:168 security/test_authorization.py:15 security/test_authorization.py:24 security/test_authorization.py:64 security/test_authorization.py:15 security/test_authorization.py:24 security/test_authorization.py:64 security/test_config.py:89 security/test_config.py:90 security/test_config.py:128 security/test_config.py:88 security/test_config.py:91 security/test_config.py:97 security/test_cookies.py:37 security/test_cookies.py:38 security/test_cookies.py:60 security/test_cookies.py:61 security/test_cookies.py:81 security/test_cookies.py:82 security/test_cookies.py:106 security/test_cookies.py:107
📁 Filesystem access (3)
Audited by: codex
Aug 7, 2026, 01:59 PM
All 123 static findings are false positives in context. They describe documented test configuration, bounded file copying, in-process HTTP checks, defensive payloads, or Markdown code examples; no evidence of data exfiltration, malicious commands, or prompt injection was found.
17
Files scanned
1,831
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
🔑 Env variables (50)
references/setup-and-boundaries.md:17 security/conftest.py:22 security/conftest.py:54 security/conftest.py:62 security/conftest.py:63 security/conftest.py:84 security/conftest.py:91 security/conftest.py:92 security/conftest.py:109 security/conftest.py:22 security/conftest.py:54 security/conftest.py:62 security/conftest.py:63 security/conftest.py:84 security/conftest.py:91 security/conftest.py:92 security/conftest.py:109 security/conftest.py:10 security/conftest.py:13 security/conftest.py:10 security/conftest.py:13 security/test_auth.py:112 security/test_auth.py:147 security/test_auth.py:166 security/test_auth.py:112 security/test_auth.py:147 security/test_auth.py:166 security/test_authorization.py:15 security/test_authorization.py:15 security/test_config.py:89 security/test_config.py:90 security/test_config.py:128 security/test_config.py:88 security/test_config.py:91 security/test_config.py:97 security/test_cookies.py:37 security/test_cookies.py:38 security/test_cookies.py:60 security/test_cookies.py:61 security/test_cookies.py:81 security/test_cookies.py:82 security/test_cookies.py:106 security/test_cookies.py:107 security/test_cookies.py:37 security/test_cookies.py:38 security/test_cookies.py:60 security/test_cookies.py:61 security/test_cookies.py:81 security/test_cookies.py:82 security/test_cookies.py:106
📁 Filesystem access (3)
🌐 Network access (14)
security/.env.test.template:34 security/.env.test.template:35 security/conftest.py:41 security/conftest.py:58 security/conftest.py:88 security/test_config.py:149 security/test_config.py:161 security/test_cookies.py:94 security/test_cors.py:42 security/test_cors.py:56 security/test_cors.py:16 security/test_cors.py:17 security/test_headers.py:93 security/test_rate_limit.py:100
Audited by: codex