vibeeval/vibecosystem/fp-check

FINDING: SQL injection in /api/users
CLAIM: User input reaches database query unsanitized
 
VERIFICATION:
1. Read the actual code at the reported location
2. Trace the data flow from input to sink
3. Check for sanitization/validation between input and sink
4. Check for framework-level protections (ORM, parameterized queries)
5. Attempt to construct an exploit payload

FINDING: [scanner/auditor finding description]
SOURCE: [which tool/person reported it]
LOCATION: file.ts:42
 
VERDICT: [TRUE POSITIVE | FALSE POSITIVE | NEEDS INVESTIGATION]
 
EVIDENCE:
  - [What you checked]
  - [What you found]
  - [Why you reached this conclusion]
 
REASONING:
  [Detailed explanation of why this is/isn't a real finding]
 
CONFIDENCE: [HIGH | MEDIUM | LOW]
  [If LOW, explain what would increase confidence]

Scanner says: "Hardcoded password detected"
Actual code: const DEFAULT_LABEL = "password"
Verdict: FALSE POSITIVE -- it's a UI label, not a credential
Evidence: Variable is used only in form field label rendering

Scanner says: "SQL injection in query"
Actual code: db.query("SELECT * FROM users WHERE id = $1", [userId])
Verdict: FALSE POSITIVE -- parameterized query prevents injection
Evidence: $1 is a parameter placeholder, userId is bound safely

Scanner says: "XSS in renderUserInput()"
Actual code: renderUserInput() exists but is never called
Verdict: FALSE POSITIVE -- function is dead code
Evidence: grep shows no callers; function should be removed anyway
WARNING: Verify it's truly unreachable, not just unused currently

Scanner says: "Hardcoded API key"
Actual code: const TEST_KEY = "test-key-123" in test/fixtures.ts
Verdict: FALSE POSITIVE -- test fixture, not production code
Evidence: File is in test directory, key is clearly a test value
WARNING: Verify the key isn't a real key used in test environment

Scanner says: "Insecure random number generation"
Actual code: Math.random() used for UI animation timing
Verdict: FALSE POSITIVE -- not used for security purposes
Evidence: Used only for visual jitter in animation, no security impact

Source (user input) -> [validation?] -> [transformation?] -> [sanitization?] -> Sink (dangerous operation)
 
If ANY step is missing or bypassable, it's a TRUE POSITIVE.

Can the code be reached without authentication?
Can the code be reached with different parameters?
Can the code be reached through an alternative route?

Input: [specific malicious input]
Expected: [what should happen if vulnerable]
Actual: [what actually happens]
Blocked by: [what prevents exploitation, if anything]

# Has this code had real vulnerabilities before?
git log --grep="fix\|vuln\|security\|CVE" -- <file>
 
# Has the scanner been wrong about this pattern before?
# Check past triage decisions for this rule

# Security Scan Triage - [Date]
 
Scanner: [tool name and version]
Scan target: [repo/branch/commit]
Total findings: [N]
 
## Summary
| Verdict | Count |
|---------|-------|
| True Positive | X |
| True Positive (mitigated) | X |
| False Positive | X |
| Needs Investigation | X |
 
## True Positives (Action Required)
1.[SEVERITY] file.ts:42 -- [description] -- [recommended fix]
 
## False Positives (Documented)
1.file.ts:88 -- [reason it's false positive]
 
## Needs Investigation
1.file.ts:120 -- [what additional info is needed]