Afldocs

[BinilTomJose1278]

No description provided.

[github-actions]

🔒 OWASP Scanner Results

Vulnerabilities were detected:

### File: docs/orion-playertracking&crowdmonitoring/project4docs/_category.json

🔒 OWASP Scanner Results for docs/orion-playertracking&crowdmonitoring/project4docs/_category.json

✅ No vulnerabilities found.

### File: docs/orion-playertracking&crowdmonitoring/project4docs/technicaldocumentation.md

🔒 OWASP Scanner Results for docs/orion-playertracking&crowdmonitoring/project4docs/technicaldocumentation.md

A03: Sensitive Data Exposure (22 findings)

Summary: HIGH: 22

• Line 1217 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: hashed = pwd_context.hash(plain_password) # Variable from user input
• Line 1220 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: is_valid = pwd_context.verify(plain_password, hashed_password) # Variables, not hardcoded
• Line 1262 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: GOOGLE_CLIENT_SECRET=your-client-secret # Replace with actual secret from Google Console
• Line 1285 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: def get_current_user(token: str = Depends(oauth2_scheme)) -> int:
• Line 1287 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM]) # SECRET_KEY from environment
• Line 1561 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -e POSTGRES_PASSWORD=postgres \
• Line 1726 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -e POSTGRES_PASSWORD=postgres \ # ⚠️ CHANGE IN PRODUCTION!
• Line 1765 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: echo JWT_SECRET=your-super-secret-key-change-in-production >> .env # ⚠️ GENERATE SECURE KEY!
• Line 1853 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: DATABASE_URL=postgresql+psycopg2://postgres:STRONG_PASSWORD_HERE@localhost:5432/aflvision
• Line 1856 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET=REPLACE_WITH_CRYPTOGRAPHICALLY_SECURE_RANDOM_STRING_32_BYTES_MINIMUM
• Line 1860 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: GOOGLE_CLIENT_SECRET=your-actual-google-client-secret-from-console
• Line 1909 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -d "username=test@example.com&password=testpass123"
• Line 2133 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: json={"email": "test@example.com", "password": "testpass123"} # Test data
• Line 2142 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: data={"username": "wrong@example.com", "password": "wrongpass"} # Invalid test data
• Line 2402 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: DATABASE_URL=postgresql://user:SECURE_PASSWORD@localhost:5432/db
• Line 2403 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET=CRYPTOGRAPHICALLY_RANDOM_STRING_32_BYTES_MINIMUM
• Line 2415 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: client = boto3.client('secretsmanager', region_name='us-east-1')
• Line 2416 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: response = client.get_secret_value(SecretId=secret_name)
• Line 2420 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: secrets = get_secret('afl-vision/production')
• Line 2421 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET = secrets['JWT_SECRET']
• Line 2430 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: client = SecretClient(vault_url="https://afl-vision.vault.azure.net", credential=credential)
• Line 2431 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET = client.get_secret("JWT-SECRET").value

A09: Security Logging and Monitoring Failures (1 findings)

Summary: MEDIUM: 1

• Line 1873 | Severity MEDIUM | Confidence MEDIUM
  → Possible secret printed to stdout: python -c "import secrets; print(secrets.token_urlsafe(32))"

⛔ Please address these before merging.

[github-actions]

🔒 OWASP Scanner Results

Vulnerabilities were detected:

### File: docs/orion-playertracking&crowdmonitoring/project4docs/_category.json

🔒 OWASP Scanner Results for docs/orion-playertracking&crowdmonitoring/project4docs/_category.json

✅ No vulnerabilities found.

### File: docs/orion-playertracking&crowdmonitoring/project4docs/technicaldocumentation.md

🔒 OWASP Scanner Results for docs/orion-playertracking&crowdmonitoring/project4docs/technicaldocumentation.md

A03: Sensitive Data Exposure (22 findings)

Summary: HIGH: 22

• Line 1217 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: hashed = pwd_context.hash(plain_password) # Variable from user input
• Line 1220 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: is_valid = pwd_context.verify(plain_password, hashed_password) # Variables, not hardcoded
• Line 1262 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: GOOGLE_CLIENT_SECRET=your-client-secret # Replace with actual secret from Google Console
• Line 1285 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: def get_current_user(token: str = Depends(oauth2_scheme)) -> int:
• Line 1287 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM]) # SECRET_KEY from environment
• Line 1561 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -e POSTGRES_PASSWORD=postgres \
• Line 1726 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -e POSTGRES_PASSWORD=postgres \ # ⚠️ CHANGE IN PRODUCTION!
• Line 1765 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: echo JWT_SECRET=your-super-secret-key-change-in-production >> .env # ⚠️ GENERATE SECURE KEY!
• Line 1853 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: DATABASE_URL=postgresql+psycopg2://postgres:STRONG_PASSWORD_HERE@localhost:5432/aflvision
• Line 1856 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET=REPLACE_WITH_CRYPTOGRAPHICALLY_SECURE_RANDOM_STRING_32_BYTES_MINIMUM
• Line 1860 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: GOOGLE_CLIENT_SECRET=your-actual-google-client-secret-from-console
• Line 1909 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: -d "username=test@example.com&password=testpass123"
• Line 2133 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: json={"email": "test@example.com", "password": "testpass123"} # Test data
• Line 2142 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: data={"username": "wrong@example.com", "password": "wrongpass"} # Invalid test data
• Line 2402 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: DATABASE_URL=postgresql://user:SECURE_PASSWORD@localhost:5432/db
• Line 2403 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET=CRYPTOGRAPHICALLY_RANDOM_STRING_32_BYTES_MINIMUM
• Line 2415 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: client = boto3.client('secretsmanager', region_name='us-east-1')
• Line 2416 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: response = client.get_secret_value(SecretId=secret_name)
• Line 2420 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: secrets = get_secret('afl-vision/production')
• Line 2421 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET = secrets['JWT_SECRET']
• Line 2430 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: client = SecretClient(vault_url="https://afl-vision.vault.azure.net", credential=credential)
• Line 2431 | Severity HIGH | Confidence MEDIUM
  → Potential hardcoded sensitive data: JWT_SECRET = client.get_secret("JWT-SECRET").value

A09: Security Logging and Monitoring Failures (1 findings)

Summary: MEDIUM: 1

• Line 1873 | Severity MEDIUM | Confidence MEDIUM
  → Possible secret printed to stdout: python -c "import secrets; print(secrets.token_urlsafe(32))"

⛔ Please address these before merging.