AI Verification Engine

1// Example: Pattern engine flags this as "Hardcoded Secret"
2const API_KEY = "sk_test_1234567890";
3
4// AI Engine Analysis:
5// ┌──────────────────────────────────────────────────────────┐
6// │ Finding: Hardcoded API Key                               │
7// │ Engine: Pattern Matching                                 │
8// │ Initial Severity: HIGH                                   │
9// ├──────────────────────────────────────────────────────────┤
10// │ AI Verification:                                         │
11// │                                                          │
12// │ ✓ Key prefix "sk_test_" indicates test/sandbox key       │
13// │ ✓ File location: src/tests/fixtures.ts                   │
14// │ ✓ Git history: Never used in production config           │
15// │ ✓ Pattern matches Stripe test key format                 │
16// │                                                          │
17// │ Verdict: FALSE POSITIVE                                  │
18// │ Reason: Test credential in test fixture file             │
19// │ Action: Suppressed from report                           │
20// └──────────────────────────────────────────────────────────┘
21
22// Another example: This IS flagged as a true positive
23const PROD_API_KEY = "sk_live_abcdef123456";  // 🚨 Real secret!

1// Severity Calibration Example
2
3Finding: SQL Injection in searchProducts()
4Base CVSS: 9.8 (Critical)
5
6AI Calibration Factors:
7┌─────────────────────────────────────────────────────────┐
8│ Factor                          │ Impact    │ Score    │
9├─────────────────────────────────────────────────────────┤
10│ Authentication required?        │ Yes       │ -1.5     │
11│ Rate limiting in place?         │ Yes       │ -0.5     │
12│ WAF/input filtering upstream?   │ Partial   │ -0.3     │
13│ Data sensitivity level?         │ Low (SKU) │ -1.0     │
14│ Network exposure?               │ Internal  │ -1.5     │
15│ Exploit complexity?             │ Medium    │ -0.2     │
16└─────────────────────────────────────────────────────────┘
17
18Calibrated Score: 9.8 - 5.0 = 4.8 (Medium)
19
20Rationale:
21"While technically a SQL injection, this endpoint requires
22authentication, is rate-limited, only exposes non-sensitive
23product data, and is not reachable from the public internet.
24Recommend fixing in next sprint rather than emergency patch."

1// Original vulnerable code
2app.get('/user/:id', (req, res) => {
3  const query = `SELECT * FROM users WHERE id = '${req.params.id}'`;
4  db.query(query, (err, result) => {
5    res.json(result);
6  });
7});
8
9// AI-Generated Fix (tailored to your codebase)
10//
11// Analysis: Your codebase uses mysql2 with promise wrapper
12// and follows repository pattern. Generating compatible fix:
13
14import { userRepository } from '../repositories/user';
15import { validateId } from '../validators/common';
16
17app.get('/user/:id', async (req, res, next) => {
18  try {
19    const id = validateId(req.params.id);  // Added: Input validation
20    const user = await userRepository.findById(id);  // Uses parameterized query
21
22    if (!user) {
23      return res.status(404).json({ error: 'User not found' });
24    }
25
26    res.json(user);
27  } catch (error) {
28    next(error);  // Uses your existing error handler
29  }
30});
31
32// Note: This fix also adds error handling and 404 response
33// which were missing in the original code.