evandrodevbr
c17192c9fe
Copia local (nao fork, nao submodule) de safedeps, sca-audit, secrets-scan, code-review-security, api-security-review, web-security-review, cve-triage, patch-prioritization, dependency-scanning e hermaguard -- commit exato de origem e licenca de cada uma em skills/NOTICE.md. Elimina o passo de clone externo pro pilar de seguranca do wf-security-review: git clone deste repo ja traz tudo funcional. Corrige tambem o comando de instalacao pro Claude Code nos dois READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o comando antigo copiava -- confirmado testando a instalacao real.
12 lines
626 B
Python
12 lines
626 B
Python
# Deliberately broken sample: a live-looking API key committed to source.
|
|
# NOTE: the value is an obviously-fake placeholder (marker, not a real key
|
|
# format) so secret scanners do not flag the corpus; the CWE-798 pattern
|
|
# (credential hardcoded in source) is what the benchmark tests for.
|
|
PAYMENT_KEY = "EXAMPLE-KEY-DO-NOT-USE-0123456789"
|
|
|
|
def charge(card_token: str, amount: int):
|
|
import requests
|
|
return requests.post("https://api.example-payments.invalid/v1/charges",
|
|
headers={"Authorization": f"Bearer {PAYMENT_KEY}"},
|
|
data={"card": card_token, "amount": amount})
|