Intentionally vulnerable code and dependencies, for security-scanner testing only.
This repository exists to exercise an SBOM + code-security pipeline end to end:
- SBOM generation (Syft): real dependency manifests with lockfiles across npm, PyPI, Go, and a container base image, so a generated SBOM contains many components.
- SBOM vulnerability analysis (SCA): dependencies are pinned to known-vulnerable versions, so component→CVE matching produces findings.
- SAST (Semgrep): source files contain deliberate injection / deserialization / weak-crypto / TLS-bypass patterns.
- Secret scanning (Gitleaks): config files contain obvious fake, non-functional credentials.
⚠️ Do not deploy this, expose it to a network, or copy it into production. Every defect here is intentional. All "secrets" are documented example or clearly-fake placeholder values with no access to anything.
| Path | Ecosystem / purpose | Scanners exercised |
|---|---|---|
package.json + package-lock.json |
npm manifest + lockfile | SBOM, SCA |
requirements.txt |
PyPI manifest (pinned) | SBOM, SCA |
go.mod |
Go modules | SBOM, SCA |
Dockerfile |
container base image | SBOM (image), SCA |
src/server.js |
Node/Express | SAST, secrets |
src/auth.py |
Python/Flask | SAST, secrets |
src/handler.go |
Go | SAST |
config/settings.yaml |
config | secrets |
config/.env.example |
config | secrets |
Dependency CVEs (SCA): e.g. lodash 4.17.11 (prototype pollution, CVE-2019-10744),
minimist 1.2.0 (CVE-2020-7598), pyyaml 5.1 (CVE-2020-1747), requests 2.19.1
(CVE-2018-18074), django 2.0.0 (multiple), gin 1.6.0 (CVE-2020-28483),
jwt-go 3.2.0 (CVE-2020-26160).
Code (SAST): command injection, SQL injection, eval, unsafe yaml.load / pickle.loads,
subprocess(..., shell=True), MD5 password hashing, math/rand for tokens, disabled TLS
verification, hardcoded JWT secret.
Secrets (Gitleaks): AWS example access key, fake generic API tokens, a fake DB connection string with an inline password.
GitHub blocks pushes containing strings that match live secret formats. This repo uses obvious fake / documented-example values so it can be hosted publicly while scanners still flag them. If a push is ever blocked, use GitHub's push-protection bypass in the UI (test repo only).
Register this repository (or its clone URL) as a SAST/SBOM source, select branch main, and
scan the full tree. To generate an SBOM locally for comparison:
syft dir:. -o cyclonedx-json > sbom.cdx.json