Afldocs

[BinilTomJose1278]

No description provided.

[github-actions]

🔒 OWASP Scanner Results

Vulnerabilities were detected:

### File: docs/orion-playertracking&crowdmonitoring/project4docs/_category.json

🔒 OWASP Scanner Results for docs/orion-playertracking&crowdmonitoring/project4docs/_category.json

✅ No vulnerabilities found.

### File: docs/orion-playertracking&crowdmonitoring/project4docs/technicaldocumentation.md

🔒 OWASP Scanner Results for docs/orion-playertracking&crowdmonitoring/project4docs/technicaldocumentation.md

A03: Sensitive Data Exposure (13 findings)

Summary: HIGH: 13

• Line 1278 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: hashed = pwd_context.hash(plain_password)
• Line 1281 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: is_valid = pwd_context.verify(plain_password, hashed_password)
• Line 1314 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: GOOGLE_CLIENT_SECRET=your-client-secret
• Line 1330 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: def get_current_user(token: str = Depends(oauth2_scheme)) -> int:
• Line 1331 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
• Line 1598 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -e POSTGRES_PASSWORD=postgres \
• Line 1751 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -e POSTGRES_PASSWORD=postgres \
• Line 1782 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: echo JWT_SECRET=your-super-secret-key-change-in-production >> .env
• Line 1858 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET=change-this-to-a-secure-random-string
• Line 1862 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: GOOGLE_CLIENT_SECRET=your-google-client-secret
• Line 1896 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -d "username=test@example.com&password=testpass123"
• Line 2112 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: json={"email": "test@example.com", "password": "testpass123"}
• Line 2120 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: data={"username": "wrong@example.com", "password": "wrongpass"}

⛔ Please address these before merging.

[github-actions]

🔒 OWASP Scanner Results

Vulnerabilities were detected:

### File: docs/orion-playertracking&crowdmonitoring/project4docs/_category.json

🔒 OWASP Scanner Results for docs/orion-playertracking&crowdmonitoring/project4docs/_category.json

✅ No vulnerabilities found.

### File: docs/orion-playertracking&crowdmonitoring/project4docs/technicaldocumentation.md

🔒 OWASP Scanner Results for docs/orion-playertracking&crowdmonitoring/project4docs/technicaldocumentation.md

A03: Sensitive Data Exposure (22 findings)

Summary: HIGH: 22

• Line 1212 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: hashed = pwd_context.hash(plain_password) # Variable from user input
• Line 1215 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: is_valid = pwd_context.verify(plain_password, hashed_password) # Variables, not hardcoded
• Line 1257 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: GOOGLE_CLIENT_SECRET=your-client-secret # Replace with actual secret from Google Console
• Line 1280 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: def get_current_user(token: str = Depends(oauth2_scheme)) -> int:
• Line 1282 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM]) # SECRET_KEY from environment
• Line 1556 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -e POSTGRES_PASSWORD=postgres \
• Line 1721 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -e POSTGRES_PASSWORD=postgres \ # ⚠️ CHANGE IN PRODUCTION!
• Line 1760 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: echo JWT_SECRET=your-super-secret-key-change-in-production >> .env # ⚠️ GENERATE SECURE KEY!
• Line 1848 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: DATABASE_URL=postgresql+psycopg2://postgres:STRONG_PASSWORD_HERE@localhost:5432/aflvision
• Line 1851 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET=REPLACE_WITH_CRYPTOGRAPHICALLY_SECURE_RANDOM_STRING_32_BYTES_MINIMUM
• Line 1855 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: GOOGLE_CLIENT_SECRET=your-actual-google-client-secret-from-console
• Line 1904 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -d "username=test@example.com&password=testpass123"
• Line 2128 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: json={"email": "test@example.com", "password": "testpass123"} # Test data
• Line 2137 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: data={"username": "wrong@example.com", "password": "wrongpass"} # Invalid test data
• Line 2397 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: DATABASE_URL=postgresql://user:SECURE_PASSWORD@localhost:5432/db
• Line 2398 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET=CRYPTOGRAPHICALLY_RANDOM_STRING_32_BYTES_MINIMUM
• Line 2410 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: client = boto3.client('secretsmanager', region_name='us-east-1')
• Line 2411 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: response = client.get_secret_value(SecretId=secret_name)
• Line 2415 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: secrets = get_secret('afl-vision/production')
• Line 2416 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET = secrets['JWT_SECRET']
• Line 2425 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: client = SecretClient(vault_url="https://afl-vision.vault.azure.net", credential=credential)
• Line 2426 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET = client.get_secret("JWT-SECRET").value

A09: Security Logging and Monitoring Failures (1 findings)

Summary: MEDIUM: 1

• Line 1868 | Severity MEDIUM | Confidence MEDIUM
  → Possible secret printed to stdout: python -c "import secrets; print(secrets.token_urlsafe(32))"

⛔ Please address these before merging.