b3e8a9a058
Major additions: - Community Next.js app (port 18187) for browsing claims with API docs - stemedb-chaos crate: Fault injection, chaos testing, CRDT properties - Latent ingestion system: Reddit/FDA ingesters with ADK-Go agents - Disputed claims handling: Manual review workflows and validation - Aphoria security scanner: New extractors (SQL injection, command injection, weak crypto, TLS version), policy-based ignores, UAT reports - Docker infrastructure: Dockerfile, docker-compose.yml for full stack - VulnBank demo: Intentionally vulnerable multi-language test corpus SDK & API enhancements: - Source registry handlers for tracking data provenance - Metrics endpoint - Skeptic filtering improvements Code quality: - Split 14 large files (>500 lines) into focused modules - All files now under 500-line limit per project guidelines Documentation: - Chaos testing guide, circuit breakers, observability docs - Phase 7 UAT documentation updates - Martin Kleppmann technical writer agent Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
38 lines
1.1 KiB
Rust
38 lines
1.1 KiB
Rust
//! Configuration - Contains intentional vulnerabilities
|
|
//!
|
|
//! Vulnerabilities:
|
|
//! - Hardcoded API keys and secrets
|
|
//! - No rate limiting configured
|
|
|
|
/// VULNERABILITY: Hardcoded API key
|
|
/// Secrets in source code are exposed in version control
|
|
pub const API_KEY: &str = "sk-live-1234567890abcdef";
|
|
|
|
/// VULNERABILITY: Hardcoded database password
|
|
/// Anyone with repo access can access the database
|
|
pub const DB_PASSWORD: &str = "super_secret_password_123!";
|
|
|
|
/// API configuration with security issues
|
|
pub struct ApiConfig {
|
|
pub api_key: String,
|
|
pub rate_limit_enabled: bool,
|
|
pub max_requests_per_minute: u32,
|
|
}
|
|
|
|
impl Default for ApiConfig {
|
|
fn default() -> Self {
|
|
Self {
|
|
// BLOCK: Hardcoded secret in source code
|
|
api_key: "sk-prod-abcdef123456".to_string(),
|
|
// BLOCK: Rate limiting disabled - vulnerable to abuse
|
|
rate_limit_enabled: false,
|
|
max_requests_per_minute: 0, // No limit
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Initialize the vulnerable configuration
|
|
pub fn init_config() -> ApiConfig {
|
|
ApiConfig::default()
|
|
}
|