Original Summary

https://github.com/h0p3sf4ll/threatlint A security reviewer that sits next to you, not at the end of the release. The core idea, in one line: Threatlint finds the security bug while the code is still in your editor, and hands you the fix and the test. The problem you already know It's Thursday, 4:40 pm. Your pull request has two approvals. Then the security scan comes back: 312 findings. Most are noise, a few are real, and none of them say which. Do you merge, or do you lose your Friday? Here's what usually happens: the real one gets merged with the noise. In the code below, an AI assistant wrote a "quick" customer lookup in under a second: customer_id = request.args["id"] query = f"SELECT FROM customers WHERE id = '{customer_id}'" # api/customers.py:42 Any visitor who types ' OR '1'='1 into that id gets every customer record. The scanner flagged it as finding #187 of 312. Nobody reached #187. What Threatlint does instead Threatlint is the colleague who reads your diff before anyone else does, and tells you one thing : CR-001 · HIGH · api/customers.py:42 — SQL built from request input. Fix: cursor.execute("SELECT FROM customers WHERE id = %s", (customer_id,)) Test: test_lookup_rejects_injection — passes ' OR '1'='1 , expects zero rows. A file, a line, a fix, and a test. Then you can ask why: "Is this reachable without login?" , "Where else do we do this?" , and it answers from your actual code. Why that's different The surprise is what Threatlint doesn't do. It doesn't give you a longer list. It gives you a shorter, verified one, and it never touches your code. Every agent is read-only, every finding must point to a real path:line , and anything it couldn't verify is labeled as an assumption instead of being dressed up as fact. Don't take our word for it. Run it on a deliberately broken app. npm --prefix web ci && npm --prefix web run demo-app # a weak app on 127.0.0.1:4010 npm --prefix web start # open http://127.0.0.1:3000 → Scan running app In about a minute you'll watch it sign in as an admin (OAuth), a developer, and an anonymous visitor, and catch the anonymous order leak, the reflected CORS origin, the session cookie without HttpOnly , and the stack trace on /debug , each drawn as an attack chain from who you are to what an attacker gets .   submitted by   /u/m0rt4ls3c [link]   [comments]

  • 情报分类：技术学习与提效
  • 分类依据：内容涉及技术、AI、软件工具或工程实践
  • 信息来源：Reddit · SideProject
  • 发布时间：2026/10/19 03:04:52