Skip to content
DemoReal data from our own test repository, cernis-intelligence/agentcernis-webhook-test. A PR review that found a SQL injection replays on a loop, sped up. Nothing here is saved.Back to the siteGet started
Agent Cernis

Deep scan

Very small Node.js/Express service. server.js exposes one public GET /health route at server.js:5 that returns a static "ok", listens on port 3000 (server.js:6), and creates an unused pg Pool at server.js:2-4 that reads connection settings from environment variables. No auth, sessions, or data-access code exists, and no dangerous sinks were found. The inventory labels the backend as "rust" and reports 0 dependencies, which conflicts with the JavaScript sources and the express/pg requires, so the manifest and inventory need verification. package.json was not read.

Completed in 49s · $0.03

Took
0:49
Lines read
9
Findings
1
Cost
$0.03
FinishedFull log
  1. Setup (done)
  2. Index (done)
  3. Sweep (done)
  4. Map (done)
  5. Hunt (done)
  6. Verify (done)
  7. Report (done)
00:00Cloning cernis-intelligence/agentcernis-webhook-test @ main
00:02Setup
00:02Index
00:02Repo has 1 source file(s) (≤ 40 threshold); hunting exhaustively across all of them.
00:03Sweep
00:03Building threat model…
00:19Threat model ready in 16s.
00:19Map
00:19Context: 1 source files, 1 mapped routes
00:19Investigating auth model (in the background)…
00:19Hunt
00:19Hunting (streaming gate + skeptic)…
00:47Verify
00:47Validation replay: static_only — static_only (1 finding(s)).
00:49Report

Findings

1 finding, most severe first
  • high
    express@4.19.2 ships a known vulnerability (GHSA-qw6h-vgh9-j6wx)
    package.json:1unconfirmed (none)Dependency, imported
    Details
    Fix prompt
    Fix this high-severity security issue: express@4.19.2 ships a known vulnerability (GHSA-qw6h-vgh9-j6wx).

## What's wrong
express vulnerable to XSS via response.redirect()
Untrusted input enters through dependency express (`package.json:1`) and reaches `package.json:1`.
Who can pull this off: The application pulls this dependency in at runtime.

## Path from input to impact
1. `package.json:1` — Declared dependency express@4.19.2

## Proof it's real
```
Upgrade or patch express past the version affected by GHSA-qw6h-vgh9-j6wx.
```

## How to close it
Bump express to the release that fixes GHSA-qw6h-vgh9-j6wx.

## The fix has to
- GHSA-qw6h-vgh9-j6wx no longer applies to the installed version of express

## Leave alone
- The application still builds and its test suite still passes

## Prove it with this test
```
Re-run the dependency audit and confirm GHSA-qw6h-vgh9-j6wx is cleared for express.
```

Start by getting the regression test to fail against the code as it stands today. Then apply the narrowest change that shuts the attack path, and confirm that same test — plus the rest of the suite — now passes.