A real Sentrint report, redacted

D 29/100

Copy prompt

Copied!

Get badge

Export · Founder

Scan your repo free

Security verdict · High Risk

29/100

*****/*****

Real gaps here. Fix these before you ship.

Code D<br>Dependencies B

Redacted

12 findings

How this is scored

Every finding carries a weight by severity. They add up, and the total goes through one fixed formula.

SeverityEachCodeDepsFindings on the left of each arrow, the weight they carry on the right.

Code is your own files. You fix it by editing, and it stays fixed.

Deps is packages you installed. You fix it by upgrading, and it returns as new advisories land.

Critical<br>&times;10<br>8&rarr;80

High<br>&times;5<br>1&rarr;5<br>2&rarr;10

Medium<br>&times;2<br>1&rarr;2

Total weight<br>85<br>12

score = 100 &times; 40 &divide; (40 + W)<br>&rarr; code 32 (D)<br>· deps 77 (B)

40 is a fixed constant, identical for every scan. Grades: A is 90+, B 70+, C 50+, D 25+. Together they weigh 97, which is the 29 at the top.

An A takes the 11 heaviest gone.One Critical outranks ten Lows.

A real scan of a real public repo, shown exactly as you would get it. The repo name, the paths and every key are starred out. Publishing a stranger's live credentials is not ours to do. Your own report names every file and every line.

Critical

High

Medium

Low

Fix prompt

Copy & paste into your AI coding tool

Any AI tool

Claude Code

Cursor

Lovable

ChatGPT

Gemini

More tools…

Base44

Bolt

Claude (chat)

Codex CLI

GitHub Copilot

Gemini CLI

Replit

v0

Windsurf

On this sample the panel shows the plain-text prompt. Your own report rewrites it for whichever tool you pick above.

universal_prompt.md

Copy prompt

Copied!

# Fix 10 security vulnerabilities

**7 CRITICAL** — exploitable now, fix these first · **3 HIGH** — fix before your next deploy

> 🔑 4 of these are **leaked credentials**. Those need manual steps from you (marked below) — an AI tool cannot rotate keys for you.

## 🔑 Rotate these leaked credentials first — steps only YOU can do

Every finding marked 🔑 below is a leaked credential. Changing the code is NOT enough: the value is already in your git history, so treat it as stolen. An AI tool cannot rotate credentials for you — do the steps for each type, then apply the code changes below.

**Third-party API keys** (`*****/*****.py`, `*****.py`):<br>1. Log in to the service that issued it (Stripe, AWS, OpenAI, …) and **revoke the key**.<br>2. Generate a new one and store it in an environment variable (for example a `.env` file listed in `.gitignore`). Never paste it into source code.

**Application secret keys** (`*****/*****.py`):<br>There is no provider dashboard for this — you create the value yourself.<br>1. Generate a new random value. For Django: `python -c "from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())"`.<br>2. Store it in an environment variable (`.env` in `.gitignore`), never in code.<br>3. Expect every logged-in user to be signed out when you deploy — that is normal and means the rotation worked.

**Hardcoded passwords** (`*****/*****.py`):<br>No provider is involved — you choose the replacement yourself.<br>1. Pick a new strong password (a password manager can generate one).<br>2. Treat the old one as already stolen: if it was reused anywhere else, change it there too.<br>3. **Where the new password lives is decided by each fix below, not here.** Most fixes replace the hardcoded check with your framework's own login (for example Django's `authenticate()`), which reads the user table — so the new password belongs in a real user account (`User.objects.create_user(...)` hashes it for you), NOT in an environment variable. Only put a hash in an env var if the fix for that specific finding says to. Doing both is what breaks login.

Apply each fix below to the referenced file and line. The corrected code is included inline, so this works in any AI IDE or chat assistant without further context. The dependency upgrades at the end are shell commands, not code edits.

## 1. [CRITICAL] weak-password-hash-python<br>- **File:** `*****/*****.py` (line 59)<br>- **Problem:** An attacker who steals your database can brute-force fast hashes on a GPU in hours.<br>- **Fix:**

Use a slow password hasher. In Django, store with make_password() and verify with check_password(); or use bcrypt directly.

## 2. [CRITICAL] command-injection-python<br>- **File:** `*****/*****.py` (line 460)<br>- **Problem:** An attacker can type Python code into the form and eval() runs it on your server.<br>- **Fix:**

Remove eval(). For arithmetic, use a restricted AST evaluator or the numexpr library; ast.literal_eval only parses literals and will raise on any real expression.

## 3. [CRITICAL] path-traversal-user-path-python<br>- **File:** `*****/*****.py` (line 926)<br>- **Problem:** An attacker can pass ../../.env to read files anywhere on the server.<br>- **Fix:**

Strip directory components with os.path.basename(file) before joining, or use Django's safe_join() to confine access to one directory.

## 4....