Sample: C — see SquidGate detect findings

[DotNetRussell]

SquidGate language sample — C

This PR intentionally introduces insecure patterns so you can see SquidGate work on C:

• Hardcoded secret / credential
• Injection and/or dangerous API usage

File

examples/c/demo.c

What to look for

1. Check run named SquidGate
2. Line annotations on the sample file
3. PR comment summarizing findings
4. Check failure when severity ≥ block_on (default high)

Demo only. Do not merge these patterns into production apps.

All language samples · Setup SquidGate on your repo

[github-actions]

🛡️ Security Scan Results

The new demo.c file introduces multiple critical and high severity vulnerabilities: hardcoded credentials, SQL injection via direct string formatting, and command injection using system().

⛔ 3 finding(s) block merge.

HIGH — Hardcoded API Key

File: examples/c/demo.c:6 | Confidence: high

A static API key is hardcoded directly in the source code as a global constant. This exposes the credential to anyone with access to the source or compiled binary.

CWE: CWE-798 | OWASP: A07:2021

Recommendation: Remove the hardcoded key. Retrieve secrets from environment variables or a secure vault at runtime, e.g., const char *API_KEY = getenv("API_KEY");

---

CRITICAL — SQL Injection

File: examples/c/demo.c:10 | Confidence: high

User-controlled input 'id' is directly interpolated into an SQL query string via snprintf without sanitization, escaping, or parameterization. This allows arbitrary SQL commands to be injected.

CWE: CWE-89 | OWASP: A03:2021

Recommendation: Use parameterized queries or prepared statements from a database library instead of string formatting for SQL construction.

---

CRITICAL — OS Command Injection

File: examples/c/demo.c:17 | Confidence: high

User input 'name' is concatenated into a shell command string and executed via system(). This enables injection of arbitrary commands if the input contains shell metacharacters.

CWE: CWE-78 | OWASP: A03:2021

Recommendation: Avoid system() with untrusted input. Use execve() or equivalent with separate arguments and strict input validation.

---