Globomantics Code Review Assistant

A deliberately vulnerable Node.js/Express application used to demonstrate GitHub Advanced Security (GHAS) features: CodeQL code scanning, secret scanning, and Dependabot.

Course Overview

This repository is for the Globomantics Code Review Assistant demo:

• CodeQL and custom query packs for JavaScript
• Security vulnerabilities intentionally introduced for training
• GitHub Advanced Security workflow configuration
• Common web app vulnerability classes (SQLi, XSS, hardcoded secrets)

See docs/vulnerabilities.md for the full vulnerability catalog.

Getting Started

Prerequisites

• Node.js (v18 or later)
• npm

Installation

npm install

Run the app

npm run dev

The app starts on http://localhost:3000.

Admin login (intentionally insecure demo)

POST /admin/login
{ "username": "admin", "password": "admin123" }

Structure

.devcontainer/     dev container config
.github/workflows  CodeQL Actions workflow
docs/              vulnerability documentation
ql/                custom CodeQL queries and suite
src/               Express app source + EJS views
public/            static assets
data.db            SQLite database (created at runtime)

License

MIT

This repository is for educational/demo purposes only. No sensitive data should be committed.