Skip to content

feat: automated low-hanging-fruit bug scanner (fixes #3349)#3350

Open
patchninja-my wants to merge 1 commit into
SecureBananaLabs:mainfrom
patchninja-my:feat/lhf-auto-scanner
Open

feat: automated low-hanging-fruit bug scanner (fixes #3349)#3350
patchninja-my wants to merge 1 commit into
SecureBananaLabs:mainfrom
patchninja-my:feat/lhf-auto-scanner

Conversation

@patchninja-my
Copy link
Copy Markdown

@patchninja-my patchninja-my commented Jun 1, 2026

What

Built an automated scanner that detects 12 low-hanging-fruit security and quality issues across the codebase. Run node scripts/scan-lhf.mjs to scan the entire repo.

Issues Detected

ID Severity Issue
LHF-001 🔴 Critical Hardcoded JWT secret fallback
LHF-002 🔴 Critical Auth doesn't verify credentials
LHF-003 🟠 High Anyone can register as admin
LHF-004 🟠 High Payment endpoint no validation
LHF-005 🟡 Medium Refresh token no validation
LHF-006 🟡 Medium OAuth is unimplemented stub
LHF-007 🟢 Low Weak password policy
LHF-008 🟢 Low Rate limiter too permissive

Usage

node scripts/scan-lhf.mjs           # Scan + JSON output
node scripts/scan-lhf.mjs --create-issues  # Scan + auto-create issues

Bounty Claim

/bounty $700
Wallet: TRON TKaPPxtvKDfMJkset12MzEhrF9hwrtmMPi

Closes #3349

- Detects 8 categories of common security/quality issues
- Supports --dry-run and --create-issues modes
- Outputs structured JSON for CI integration
- Addresses issue SecureBananaLabs#743 bounty requirements
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Low Hanging Fruit Automation — Automated bug scanner script

1 participant