Sample report. Ledgerline is a fictional, deliberately vulnerable invoicing application written for the Vulkro benchmark; this is unedited Vulkro output for it, with only the folder paths of the machine that ran the scan removed.

馃洶 Vulkro

ledgerline

Codebase intelligence & API security report
Generated 2026-11-02T17:50:45.032104+00:00
0/100
Health score
higher is safer
74
Endpoints
80
Findings
19
Critical
16
High
2420
LOC
0
Contributors
76
Dependencies
0
Suppressed

Findings counted: the same set `vulkro scan` shows; 120 lower-confidence or unreachable-code finding(s) hidden, `--all-confidence` reports them.

Project

FrameworkExpress
LanguageTypeScript
Monorepoyes
Files scanned79
Modules77
Test density0%
Doc coverage1%
Commits 90d0

Findings by severity

Critical
19
High
16
Medium
37
Low
8

Hotspots - recent churn 脳 open findings

ModuleCommits 90dFindingsCrit / High
src/config020 / 1
src/lib/mailer020 / 0
src/lib/pdf010 / 1
src/lib/webhookClient031 / 0
src/middleware/auth010 / 1
src/middleware/errors040 / 1
src/repositories/customersRepository010 / 1
src/repositories/invoiceRepo010 / 1

Findings appendix

SevCategoryFileLineMessage
CRITICALOWASP-API2 路 API2:2023 Broken Authenticationapps/api/src/routes/admin/index.ts15POST /admin/tenants/:tenantId/impersonate has no authentication - endpoint is publicly accessible and accesses object by ID (tenantId)
CRITICALOWASP-API2 路 API2:2023 Broken Authenticationapps/web/app/(dashboard)/invoices/mutations.ts17Next.js server action `exportCustomerLedger` performs `prisma.customer.findUnique` keyed by its own argument `customerId` with no session or authorization check - any visitor can invoke a server action by its action id
CRITICALOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/repositories/customersRepository.ts18tainted request value reaches SQL query without parameter binding. Source: `entry:request` on parameter `term` of `search`.
CRITICALOWASP-API8 路 API8:2023 Security Misconfigurationapps/rpc/src/graphql/customerQueries.ts22tainted request value reaches SQL query without parameter binding. Source: `graphql:args` on parameter `filter` of `search`, reaching the sink through local `where`.
CRITICALOWASP-API8 路 API8:2023 Security Misconfigurationpackages/llm/src/mcp/server.ts20tainted request value reaches child_process / shell. Source: `tool:arguments` on parameter `tenant` of `entry@line19`.
CRITICALOWASP-API8 路 API8:2023 Security Misconfigurationpackages/llm/src/tools.ts55tainted request value reaches child_process / shell. Source: `entry:request` on parameter `tenantId` of `runLedgerReport`.
CRITICALOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/public.ts45tainted request value reaches a filesystem path (path traversal). Source: `entry:request` on parameter `req` of `entry@line43`, reaching the sink through local `name`.
CRITICALOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/attachments.ts33tainted request value reaches a filesystem path (path traversal). Source: `entry:request` on parameter `req` of `entry@line31`, reaching the sink through local `file`.
CRITICALOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/lib/pdf.ts31tainted request value reaches child_process / shell. Source: `entry:request` on parameter `opts` of `renderPdf`, reaching the sink through local `outFile`.
CRITICALOWASP-API7 路 API7:2023 Server Side Request Forgeryapps/api/src/lib/webhookClient.ts26tainted request value reaches an HTTP client URL without host validation (SSRF, CWE-918). Source: `entry:request` on parameter `url` of `sendTest`.
CRITICALOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/repositories/invoiceRepo.ts25tainted request value reaches SQL query without parameter binding. Source: `entry:request` on parameter `name` of `searchByCustomerName`, reaching the sink through local `sql`.
CRITICALOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/audit.ts23tainted request value reaches NoSQL query without sanitisation. Source: `entry:request` on parameter `req` of `entry@line21`, reaching the sink through local `filter`.
CRITICALOWASP-API8 路 API8:2023 Security Misconfigurationapps/web/lib/search.ts19tainted request value reaches SQL query without parameter binding. Source: `next:server-action` on parameter `term` of `searchInvoices`, reaching the sink through local `sql`.
CRITICALOWASP-API10 路 API10:2023 Unsafe Consumption of APIsapps/api/package.json25mongoose 8.4.1 has 4 known vulnerabilities (CVE-2026-73562 (GHSA-664h-wqgq-64gw)) [reachability unknown]
CRITICALOWASP-API10 路 API10:2023 Unsafe Consumption of APIsapps/web/package.json16next 14.2.10 has 33 known vulnerabilities (GHSA-2xp9-vwfh-vxw4) [EPSS 99%] [reachability unknown]
CRITICALOWASP-API3 路 API3:2023 Broken Object Property Level Authorizationapps/api/src/routes/v1/users.ts17Mass assignment: PATCH /api/v1/users/me hands the whole request body to a write call (`const user = await usersService.updateProfile(req.user!.id, { ...req.body });`) - any column the caller names, including role or tenant fields, is written
CRITICALOWASP-API2 路 API2:2023 Broken Authenticationapps/web/app/api/exports/[tenant]/ledger/route.ts6GET /api/exports/{tenant}/ledger is outside the middleware matcher (the project authenticates through middleware.ts matcher '/invoices/:path*' (not a guard: next 14.2.10 is affected by CVE-2025-29927, middleware can be skipped)) and performs no session check of its own - line 7 passes `period` to a data helper
CRITICALOWASP-API2 路 API2:2023 Broken Authenticationapps/web/app/api/invoices/[id]/route.ts7GET /api/invoices/{id} is authenticated only by the Next.js middleware (middleware.ts matcher '/api/invoices/:path*' (not a guard: next 14.2.10 is affected by CVE-2025-29927, middleware can be skipped)) and performs no check of its own; the installed `next` is affected by CVE-2025-29927, where an `x-middleware-subrequest` header skips middleware entirely (line 8 trusts an identity header only the middleware sets)
CRITICALOWASP-API5 路 API5:2023 Broken Function Level Authorizationapps/rpc/src/trpc/routers/user.ts11Privilege escalation: POST /trpc/user.setRole writes a role / privilege field from caller input (line 12) and requires no role - any signed-in user can grant any account, including their own, an admin role
HIGHOWASP-API2 路 API2:2023 Broken Authenticationapps/rpc/src/trpc/routers/invoice.ts6GET /trpc/invoice.byNumber has no authentication - endpoint is publicly accessible
HIGHOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/public.ts28tainted request value reaches an HTML response sink without escaping (reflected XSS). Source: `entry:request` on parameter `req` of `entry@line26`, reaching the sink through local `email`.
HIGHOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/customers.ts38tainted request value reaches a deep merge / path set / computed-key write that can write through `__proto__` and mutate Object.prototype (prototype pollution). Source: `entry:request` on parameter `req` of `entry@line37`.
HIGHOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/invoices.ts50tainted request value reaches a deep merge / path set / computed-key write that can write through `__proto__` and mutate Object.prototype (prototype pollution). Source: `entry:request` on parameter `req` of `entry@line46`, reaching the sink through local `fieldPath`.
HIGHOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/invoices.ts70tainted request value reaches a filesystem path (path traversal). Source: `entry:request` on parameter `req` of `entry@line67`, reaching the sink through local `file`.
HIGHOWASP-API4 路 API4:2023 Unrestricted Resource Consumptionapps/api/src/routes/v1/reports.ts15tainted request value is compiled as a regular expression PATTERN (regex injection / ReDoS): a catastrophically backtracking pattern stalls the event loop. Source: `entry:request` on parameter `req` of `entry@line13`, reaching the sink through local `pattern`.
HIGHOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/settings.ts17tainted request value reaches a deep merge / path set / computed-key write that can write through `__proto__` and mutate Object.prototype (prototype pollution). Source: `entry:request` on parameter `req` of `entry@line12`, reaching the sink through local `section`.
HIGHOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/services/tenantExporter.ts8tainted request value reaches child_process / shell. Source: `entry:request` on parameter `tenantId` of `dumpTenant`, reaching the sink through local `outFile`.
HIGHOWASP-API10 路 API10:2023 Unsafe Consumption of APIsapps/api/package.json24lodash 4.17.10 has 9 known vulnerabilities (CVE-2020-28500 (GHSA-29mw-wpgm-hmr9)) [unreachable]
HIGHOWASP-API10 路 API10:2023 Unsafe Consumption of APIsapps/api/package.json26multer 1.4.5-lts.1 has 11 known vulnerabilities (CVE-2025-47935 (GHSA-44fp-w29j-9vj5)) [reachability unknown]
HIGHOWASP-API10 路 API10:2023 Unsafe Consumption of APIsapps/api/package.json27nodemailer 6.9.13 has 14 known vulnerabilities (CVE-2026-82661 (GHSA-268h-hp4c-crq3)) [reachability unknown]
HIGHOWASP-API10 路 API10:2023 Unsafe Consumption of APIsapps/rpc/package.json12@apollo/server 4.10.4 has 2 known vulnerabilities (GHSA-9q82-xgwf-vj6h) [reachability unknown]
HIGHOWASP-API10 路 API10:2023 Unsafe Consumption of APIsapps/rpc/package.json14@trpc/server 10.45.2 has 1 known vulnerability (CVE-2025-68130 (GHSA-43p4-m455-4f4j)) [reachability unknown]
HIGHOWASP-API10 路 API10:2023 Unsafe Consumption of APIspackages/llm/package.json12@modelcontextprotocol/sdk 1.12.1 has 7 known vulnerabilities (CVE-2026-25536 (GHSA-345p-7cg4-v4c7)) [reachability unknown]
HIGHOWASP-API1 路 API1:2023 Broken Object Level Authorizationapps/api/src/routes/v1/invoices.ts21IDOR: GET /api/v1/invoices/:id authenticates the caller but `invoiceService.getById` (line 22) is keyed by the caller-supplied `id` with no ownership or tenant check - any signed-in user can reach another user's record
HIGHOWASP-API1 路 API1:2023 Broken Object Level Authorizationapps/web/app/(dashboard)/settings/page.tsx9IDOR: POST /settings authenticates the caller but `prisma.tenantSettings.upsert` (line 13) is keyed by the caller-supplied `tenantId` with no ownership or tenant check - any signed-in user can reach another user's record
MEDIUMOWASP-API2 路 API2:2023 Broken Authenticationapps/api/src/middleware/auth.ts16JWT read with jwt.decode(), which does not verify the signature - a forged or tampered token is accepted as genuine
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/web/app/(dashboard)/invoices/[id]/page.tsx34React `dangerouslySetInnerHTML` is wired to a dynamic expression - potential XSS sink
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/attachments.ts40Path traversal: filesystem entry-point receives a request-controlled path - attacker may read or write outside the intended directory
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/public.ts14tainted request value reaches a redirect (Location header) without allowlisting (open redirect). Source: `entry:request` on parameter `req` of `entry@line12`, reaching the sink through local `to`.
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/public.ts63CRLF-002: user-controlled value flows into HTTP header / cookie / redirect without CRLF validation. A `\r\n` payload in the value splits the response and lets the attacker forge a second header or response.
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/auth.ts33CRLF-002: user-controlled value flows into HTTP header / cookie / redirect without CRLF validation. A `\r\n` payload in the value splits the response and lets the attacker forge a second header or response.
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/auth.ts21PII in logs - `logger.info` call carries `req.body`; sensitive data will be persisted by the log shipper
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/server.ts27CORS-REFLECT-002: a `cors(...)` config reflects every request origin (`origin: true`, or a callback that always calls `cb(null, true)`) while `credentials: true` is set. The middleware echoes back the caller's own origin as allowed, so any site can issue credentialed cross-origin requests and read the authenticated responses (CWE-942).
MEDIUMOWASP-API2 路 API2:2023 Broken Authenticationapps/api/src/config.ts17Hardcoded JWT secret - the token signing key is a string literal in configuration; anyone with the source or the build can forge tokens
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/server.ts26CORS misconfiguration: wildcard `Access-Control-Allow-Origin: *` paired with `Access-Control-Allow-Credentials: true` (cors() middleware)
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/middleware/errors.ts18User-controlled value passed to logger without newline sanitisation - log-injection / log-forging risk
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/services/billingService.ts7Hardcoded production-internal service URL in source - environment-specific config leaks into the codebase; dev / stage / prod cutovers require a code change
MEDIUMOWASP-API4 路 API4:2023 Unrestricted Resource Consumptionapps/api/src/lib/mailer.ts1Email send appears in an HTTP handler with no queue / background-job library imported anywhere in the project. Synchronous SMTP / SES / SendGrid calls block the request thread, leak latency to the user, and lose all messages on provider outage.
MEDIUMOWASP-API1 路 API1:2023 Broken Object Level Authorizationapps/api/src/routes/v1/attachments.ts17Insecure direct file access - request-derived path flows into a file-serve sink without an authorisation / path-validation guard
MEDIUMOWASP-API1 路 API1:2023 Broken Object Level Authorizationapps/api/src/routes/v1/attachments.ts33Insecure direct file access - request-derived path flows into a file-serve sink without an authorisation / path-validation guard
MEDIUMOWASP-API1 路 API1:2023 Broken Object Level Authorizationapps/api/src/routes/v1/customers.ts53GET /api/v1/customers/:id fetches an object by `id` from the path with no visible ownership / tenant filter - anyone authenticated can read another user's record
MEDIUMOWASP-API10 路 API10:2023 Unsafe Consumption of APIsapps/api/package.json16axios 1.7.2 has 34 known vulnerabilities (CVE-2026-44494 (GHSA-35jp-ww65-95wh)) [unreachable]
MEDIUMOWASP-API10 路 API10:2023 Unsafe Consumption of APIsapps/api/package.json20express 4.19.2 has 1 known vulnerability (CVE-2024-43796 (GHSA-qw6h-vgh9-j6wx)) [reachability unknown]
MEDIUMOWASP-API10 路 API10:2023 Unsafe Consumption of APIsapps/rpc/package.json17express 4.19.2 has 1 known vulnerability (CVE-2024-43796 (GHSA-qw6h-vgh9-j6wx)) [reachability unknown]
MEDIUMOWASP-API10 路 API10:2023 Unsafe Consumption of APIspackages/llm/package.json13express 4.19.2 has 1 known vulnerability (CVE-2024-43796 (GHSA-qw6h-vgh9-j6wx)) [reachability unknown]
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/repositories/usersRepository.ts50Secret column `users.resetToken` (declared at packages/db/prisma/schema.prisma:44) is stored in plain text: 1 write site (first at apps/api/src/repositories/usersRepository.ts:50) stores the raw value with no hash or encryption
MEDIUMOWASP-API5 路 API5:2023 Broken Function Level Authorizationapps/api/src/routes/admin/index.ts15Likely-forgotten authorization: `POST /admin/tenants/:tenantId/impersonate` has no auth guard, but 2 of 3 routes on the same controller / router do - this odd-one-out is probably a missing function-level authz check (OWASP API5 / BFLA)
MEDIUMOWASP-LLM01 路 LLM01:2025 Prompt Injectionpackages/llm/src/tools.ts71LLM tool `email_summary` calls `sendDocument` with a destination the model chooses (`args.to`) and no allowlist or user confirmation - content the agent reads can steer it into sending the user's data to any address
MEDIUMOWASP-API2 路 API2:2023 Broken Authenticationapps/api/src/services/passwordResetService.ts10Insecure RNG used to mint a token, secret, or session identifier - its output is predictable and not cryptographically random
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/services/billingService.ts17PII in logs - `logger.info` call carries `customer`; sensitive data will be persisted by the log shipper
MEDIUMOWASP-API3 路 API3:2023 Broken Object Property Level Authorizationapps/api/src/routes/v1/customers.ts25GET /api/v1/customers/lookup returns `customer` without a visible field allowlist - every column on the record (including ssn / password_hash / internal_notes) goes over the wire
MEDIUMOWASP-API3 路 API3:2023 Broken Object Property Level Authorizationapps/api/src/routes/v1/settings.ts10PATCH /api/v1/settings/preferences returns `prefs` without a visible field allowlist - every column on the record (including ssn / password_hash / internal_notes) goes over the wire
MEDIUMOWASP-API3 路 API3:2023 Broken Object Property Level Authorizationapps/api/src/routes/v1/settings.ts27PUT /api/v1/settings/branding returns `branding` without a visible field allowlist - every column on the record (including ssn / password_hash / internal_notes) goes over the wire
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/public.ts27Query-string parameter `email` carries PII - URL captured by every proxy / CDN / APM trace in the request chain
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/customers.ts28Query-string parameter `email` carries PII - URL captured by every proxy / CDN / APM trace in the request chain
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/customers.ts16GET /api/v1/customers returns PII-shaped data with no `Cache-Control: no-store` - responses may be cached by CDNs / browsers / proxies
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/customers.ts25GET /api/v1/customers/lookup returns PII-shaped data with no `Cache-Control: no-store` - responses may be cached by CDNs / browsers / proxies
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/customers.ts53GET /api/v1/customers/:id returns PII-shaped data with no `Cache-Control: no-store` - responses may be cached by CDNs / browsers / proxies
MEDIUMOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/v1/users.ts7GET /api/v1/users/me returns PII-shaped data with no `Cache-Control: no-store` - responses may be cached by CDNs / browsers / proxies
MEDIUMOWASP-API5 路 API5:2023 Broken Function Level Authorizationapps/api/src/routes/v1/audit.ts7Admin-shaped route GET /api/v1/audit lives outside an /admin or /internal namespace - operations boundaries (IP allow-list, WAF rules, SSO scope) likely won't apply here
MEDIUMOWASP-API5 路 API5:2023 Broken Function Level Authorizationapps/api/src/routes/v1/audit.ts19Admin-shaped route POST /api/v1/audit/query lives outside an /admin or /internal namespace - operations boundaries (IP allow-list, WAF rules, SSO scope) likely won't apply here
MEDIUMOWASP-API7 路 API7:2023 Server Side Request Forgeryapps/web/middleware.ts10Taint-confirmed open redirect: data from req.nextUrl (line 7) reaches `NextResponse.redirect` without sanitization. Crafted input from a request can drive the sink.
LOWOWASP-API5 路 API5:2023 Broken Function Level Authorizationapps/api/src/routes/admin/index.ts30Administrative endpoint GET /admin/tenants is authenticated but no role/admin check is visible in the handler (any logged-in user can call it)
LOWOWASP-API5 路 API5:2023 Broken Function Level Authorizationapps/api/src/routes/admin/index.ts42Administrative endpoint POST /admin/tenants/:tenantId/export is authenticated but no role/admin check is visible in the handler (any logged-in user can call it)
LOWOWASP-API4 路 API4:2023 Unrestricted Resource Consumptionapps/api/src/routes/public.ts31POST /public/invoices/:shareToken/comments has no rate limiting - vulnerable to brute-force or DoS
LOWOWASP-API4 路 API4:2023 Unrestricted Resource Consumptionapps/api/src/routes/v1/auth.ts28POST /api/v1/auth/login has no rate limiting - vulnerable to brute-force or DoS
LOWOWASP-API4 路 API4:2023 Unrestricted Resource Consumptionapps/api/src/routes/v1/auth.ts38POST /api/v1/auth/password-reset has no rate limiting - vulnerable to brute-force or DoS
LOWOWASP-API4 路 API4:2023 Unrestricted Resource Consumptionapps/api/src/routes/v1/auth.ts47POST /api/v1/auth/password-reset/confirm has no rate limiting - vulnerable to brute-force or DoS
LOWOWASP-API8 路 API8:2023 Security Misconfigurationapps/api/src/routes/admin/index.ts15No CSRF-protection library detected - browser-origin state-changing requests may be forgeable (first state-changing route: POST /admin/tenants/:tenantId/impersonate)
LOWOWASP-API4 路 API4:2023 Unrestricted Resource Consumptionapps/api/src/routes/admin/index.ts30Admin listing /admin/tenants may return unbounded data - large customer accounts can cause query timeouts and admin-panel hangs