Sample: Swift — see SquidGate detect findings

[DotNetRussell]

SquidGate language sample — Swift

This PR intentionally introduces insecure patterns so you can see SquidGate work on Swift:

• Hardcoded secret / credential
• Injection and/or dangerous API usage

File

examples/swift/Demo.swift

What to look for

1. Check run named SquidGate
2. Line annotations on the sample file
3. PR comment summarizing findings
4. Check failure when severity ≥ block_on (default high)

Demo only. Do not merge these patterns into production apps.

All language samples · Setup SquidGate on your repo

[github-actions]

🛡️ Security Scan Results

New demo file introduces high-severity issues: hardcoded secret (CWE-798) and two injection vulnerabilities (SQLi CWE-89, command injection CWE-78).

⛔ 3 finding(s) block merge.

HIGH — Hardcoded API Key / Secret

File: examples/swift/Demo.swift:2 | Confidence: high

An API key is hardcoded directly in source code as a string literal. This exposes credentials in version control and can lead to secret leakage even if labeled as demo/not-real.

CWE: CWE-798 | OWASP: A07:2021

Recommendation: Remove hardcoded secrets. Load from environment variables or a secure vault, e.g. let apiKey = ProcessInfo.processInfo.environment["API_KEY"] ?? ""

---

HIGH — SQL Injection

File: examples/swift/Demo.swift:4 | Confidence: high

User-controlled 'id' parameter is directly interpolated into a SQL query string using string interpolation without escaping or parameterization.

CWE: CWE-89 | OWASP: A03:2021

Recommendation: Use parameterized queries or a safe ORM. Example: Use SQLite.swift or similar with prepared statements instead of string concatenation.

---

HIGH — OS Command Injection

File: examples/swift/Demo.swift:9 | Confidence: high

Untrusted 'input' is passed unsanitized into a shell command via Process.launchPath with /bin/sh -c and string interpolation in arguments, allowing arbitrary command execution.

CWE: CWE-78 | OWASP: A03:2021

Recommendation: Avoid shell invocation with user input. Use Process with separate arguments array without shell, or validate/sanitize input strictly. Example: task.arguments = ["-c", "echo", input] but better to avoid shell entirely.

---