Aasim Guard
Home / Sample report

Sample report only — scan your own project to see your real security findings.

fimini-ai / cooking-app
312 files · 18,847 lines scanned
RISK: HIGH
3
Critical
6
High
8
Medium
2
Low
CRITICAL

Hardcoded OpenAI API key in source code

A live OpenAI secret key is hardcoded in src/lib/ai.js line 3. Anyone with repo access can run up your bill or access your AI data. Rotate the key immediately and load it from an environment variable.

CRITICAL

SQL Injection via string concatenation in recipe search

User input is concatenated directly into a SQL query in api/recipes/search.js line 24. An attacker can read, modify, or delete your entire database with a crafted search string.

CRITICAL

Admin dashboard has no authentication check

The route /admin/dashboard in app/admin/page.jsx line 1 renders with no session or token verification. Any unauthenticated user can access all admin functionality.

HIGH

No rate limiting on login endpoint

api/auth/login.js line 3

HIGH

CORS wildcard on all API routes

server.js line 9

HIGH

Passwords hashed with MD5

models/user.js line 34

MEDIUM

Missing Content-Security-Policy headers

server.js — no helmet middleware found

+ 16 more findings hidden. Scan your own project to get real results with exact file locations and fixes.