Threat Detector

Detect common security anti-patterns in your codebase before they reach production.

What it detects

• Hardcoded credentials (passwords, API keys, tokens, secrets)
• SQL injection patterns in string concatenation
• Command injection via subprocess/shell usage
• Unsafe eval/exec usage
• Insecure dependency versions (checked against known CVEs)
• Missing CSRF protection
• Weak cryptography (MD5, SHA1, DES, RC4)
• Open redirect vulnerabilities
• Path traversal patterns
• XSS patterns in templates

Usage

# Scan entire project
python scripts/detect.py --path ./src --rules security_rules.yml

# Check dependencies for known CVEs
python scripts/detect.py --check-deps --severity HIGH,CRITICAL

# Generate SARIF report for CI/CD
python scripts/detect.py --path ./src --format sarif --output scan.sarif

Detection Rules

Rules are defined in references/security_rules.yml. Each rule has:

• Pattern (regex or AST pattern)
• Severity (CRITICAL/HIGH/MEDIUM/LOW)
• Category (OWASP Top 10 mapping)
• False positive examples (patterns to exclude)

False Positive Handling

This is a pattern-matching tool, not a SAST. It will generate false positives. Always review findings before blocking CI/CD pipelines.