Security scans · Code review

Every line of your codebase, read and reviewed.

acme/payments-apisrc/api/customers.tsmain

209export async function searchCustomers(req: Request) {

210 const q = req.query.q ?? "";

211 const rows = await db.raw(

212 `SELECT * FROM customers WHERE name LIKE '%${q}%'`

213 );

214 return json(rows);

Scanning 1,284 files…

Search filter interpolates q directly into SQL

criticalCWE-89src/api/customers.ts:212

Unbounded result set — no limit on the returned rows

mediumCWE-770src/api/customers.ts:209

Sign in to Patchlight

Find vulnerabilities and bugs before they ship.

By continuing, you agree to the Terms, Privacy Policy and Refund Policy.