[Security Triage] Triage Report — 2026-03-25

[devin-ai-integration]

Security Triage Report — 2026-03-25

Summary

Metric	Count
Total alerts reviewed	50
demo-only	48
tutorial-code	2
fix	0
false-positive	0

Classification Breakdown

tutorial-code (2 alerts)

These alerts are in server/routes.py, which contains intentional SQL injection vulnerabilities for the CodeQL tutorial. No fixes applied per playbook rules.

Alert	Description	Severity	File	Line	Tracking Issue
#1	SQL query built from user-controlled sources	HIGH	server/routes.py	16	#3
#2	SQL query built from user-controlled sources	HIGH	server/routes.py	22	#4

demo-only (48 alerts)

These alerts are in files prefixed with vulnerable_*, which are intentionally insecure demo files for CodeQL demonstration purposes. No fixes applied per playbook rules.

Alert Range	Description	File(s)
#3, #4, #5	Uncontrolled command line	vulnerable_command_injection.py
#6-#13	Flask app is run in debug mode	vulnerable_command_injection.py, vulnerable_deserialization.py, vulnerable_path_traversal.py, vulnerable_sql_injection.py, vulnerable_missing_auth.py, vulnerable_ssrf.py, vulnerable_xss.py, vulnerable_xxe.py
#14, #15	SQL query built from user-controlled sources	vulnerable_sql_injection.py
#16, #17, #18	Use of a broken or weak cryptographic hashing algorithm on sensitive data	vulnerable_weak_crypto.py
#19, #20, #21	Use of a broken or weak cryptographic algorithm	vulnerable_weak_crypto.py
#22-#26	Full server-side request forgery	vulnerable_ssrf.py
#27	XML external entity expansion	vulnerable_xxe.py
#28-#31	Uncontrolled data used in path expression	vulnerable_path_traversal.py
#32, #33	XML internal entity expansion	vulnerable_xxe.py
#34, #35, #36	Deserialization of user-controlled data	vulnerable_deserialization.py
#37	Server Side Template Injection	vulnerable_xss.py
#38-#50	Reflected server-side cross-site scripting	vulnerable_deserialization.py, vulnerable_ssrf.py, vulnerable_xss.py, vulnerable_xxe.py

PRs Created

None — this was a DRY-RUN (classify-and-track-only). No fix branches or PRs were created.

GitHub Projects Board

All 50 tracking issues + the summary issue have been added to the Security Issue Tracker board.

Alerts Requiring Human Judgment

None. All alerts were clearly classifiable as demo-only (files prefixed with vulnerable_*) or tutorial-code (server/routes.py). No real unintentional vulnerabilities were found in the non-demo codebase.

References

• Summary issue: [Security Triage] CodeQL Alert Summary — 2026-03-25 #2
• Tracking issues: [CodeQL #1] SQL query built from user-controlled sources #3 through [CodeQL #50] Reflected server-side cross-site scripting #52
• GitHub Projects board

---

Generated by automated security triage on 2026-03-25.