Sample: C# — see SquidGate detect findings

[DotNetRussell]

SquidGate language sample — C#

This PR intentionally introduces insecure patterns so you can see SquidGate work on C#:

• Hardcoded secret / credential
• Injection and/or dangerous API usage

File

examples/csharp/UserService.cs

What to look for

1. Check run named SquidGate
2. Line annotations on the sample file
3. PR comment summarizing findings
4. Check failure when severity ≥ block_on (default high)

Demo only. Do not merge these patterns into production apps.

All language samples · Setup SquidGate on your repo

[github-actions]

🛡️ Security Scan Results

The diff introduces multiple high-severity vulnerabilities including a hardcoded secret, SQL injection via string concatenation, and insecure deserialization-style type instantiation from untrusted input.

⛔ 3 finding(s) block merge.

HIGH — Hardcoded API Key

File: examples/csharp/UserService.cs:6 | Confidence: high

A secret value is hardcoded directly in source code as a constant. This exposes the credential if the source is shared, committed to version control, or decompiled.

CWE: CWE-798 | OWASP: A07:2021

Recommendation: Remove the hardcoded secret. Retrieve it from a secure source such as environment variables or a secrets manager, e.g., Environment.GetEnvironmentVariable("API_KEY").

---

HIGH — SQL Injection

File: examples/csharp/UserService.cs:10 | Confidence: high

Untrusted user input 'id' is concatenated directly into a SQL query string, enabling attackers to inject arbitrary SQL commands.

CWE: CWE-89 | OWASP: A03:2021

Recommendation: Use parameterized queries. Example: var cmd = new SqlCommand("SELECT * FROM Users WHERE Id = @id", conn); cmd.Parameters.AddWithValue("@id", id);

---

HIGH — Insecure Type Instantiation from User Input

File: examples/csharp/UserService.cs:16 | Confidence: high

User-controlled 'payload' is passed to Type.GetType and Activator.CreateInstance, allowing instantiation of arbitrary types which can lead to security issues or code execution via malicious type names or gadget chains.

CWE: CWE-502 | OWASP: A08:2021

Recommendation: Do not use untrusted input to resolve or instantiate types. Implement an allowlist of permitted types or avoid dynamic instantiation entirely.

---