Sample: C++ — see SquidGate detect findings

[DotNetRussell]

SquidGate language sample — C++

This PR intentionally introduces insecure patterns so you can see SquidGate work on C++:

• Hardcoded secret / credential
• Injection and/or dangerous API usage

File

examples/cpp/demo.cpp

What to look for

1. Check run named SquidGate
2. Line annotations on the sample file
3. PR comment summarizing findings
4. Check failure when severity ≥ block_on (default high)

Demo only. Do not merge these patterns into production apps.

All language samples · Setup SquidGate on your repo

[github-actions]

🛡️ Security Scan Results

New demo file introduces multiple high-severity injection and secret management vulnerabilities through direct use of unsanitized input in SQL and system calls plus a hardcoded credential.

⛔ 3 finding(s) block merge.

HIGH — Hardcoded API Key

File: examples/cpp/demo.cpp:5 | Confidence: high

A secret API key is hardcoded directly in the source code as a const char*.

CWE: CWE-798 | OWASP: A07:2021

Recommendation: Remove the hardcoded key. Retrieve secrets from environment variables or a secure vault at runtime.

---

HIGH — SQL Injection via String Concatenation

File: examples/cpp/demo.cpp:7 | Confidence: high

User-controlled 'id' parameter is directly concatenated into an SQL query string without escaping or parameterization.

CWE: CWE-89 | OWASP: A03:2021

Recommendation: Use parameterized queries or prepared statements from a database library instead of string concatenation.

---

HIGH — OS Command Injection via std::system

File: examples/cpp/demo.cpp:12 | Confidence: high

User-controlled 'name' is concatenated into a shell command and executed with std::system without any sanitization or escaping.

CWE: CWE-78 | OWASP: A03:2021

Recommendation: Avoid std::system entirely with untrusted input. Use exec family functions with argument arrays or a safe API that does not invoke a shell.

---