Sample: Python — see SquidGate detect findings

[DotNetRussell]

SquidGate language sample — Python

This PR intentionally introduces insecure patterns so you can see SquidGate work on Python:

• Hardcoded secret / credential
• Injection and/or dangerous API usage

File

examples/python/app.py

What to look for

1. Check run named SquidGate
2. Line annotations on the sample file
3. PR comment summarizing findings
4. Check failure when severity ≥ block_on (default high)

Demo only. Do not merge these patterns into production apps.

All language samples · Setup SquidGate on your repo

[github-actions]

🛡️ Security Scan Results

New example file introduces multiple high-severity vulnerabilities: hardcoded credentials, SQL injection, insecure deserialization, and OS command injection.

⛔ 4 finding(s) block merge.

HIGH — Hardcoded AWS Secret Access Key

File: examples/python/app.py:5 | Confidence: high

A hardcoded AWS access key is embedded directly in the source code. This exposes credentials if the repository is public, shared, or logged.

CWE: CWE-798 | OWASP: A07:2021

Recommendation: Remove the hardcoded secret. Use environment variables (e.g., os.environ['AWS_SECRET_ACCESS_KEY']) or a secrets manager.

---

HIGH — SQL Injection via String Concatenation

File: examples/python/app.py:9 | Confidence: high

User-controlled input (user_id) is directly interpolated into an SQL query string using an f-string, enabling SQL injection attacks.

CWE: CWE-89 | OWASP: A03:2021

Recommendation: Use parameterized queries: query = 'SELECT * FROM users WHERE id = %s'; cursor.execute(query, (user_id,))

---

HIGH — Insecure Deserialization with pickle.loads

File: examples/python/app.py:14 | Confidence: high

Untrusted data is deserialized using pickle.loads without any validation, which can lead to arbitrary code execution.

CWE: CWE-502 | OWASP: A08:2021

Recommendation: Do not use pickle on untrusted input. Use safe serialization formats like JSON with strict schema validation.

---

HIGH — Command Injection via os.system

File: examples/python/app.py:18 | Confidence: high

User input is concatenated directly into an os.system() call, allowing arbitrary command execution.

CWE: CWE-78 | OWASP: A03:2021

Recommendation: Use subprocess.run with a list of arguments and shell=False. Validate/sanitize input if necessary.

---