marcos
9378fe0427
A deliberately small Python service — auth helpers, a sqlite-backed store, and two request handlers — plus a .pr-review.json that steers the reviewer toward this repo's house rules. Pull requests against it carry planted defects so the reviewer has something real to find.
7 lines
566 B
JSON
7 lines
566 B
JSON
{
|
|
"focus": ["security", "sql-injection", "auth", "path-traversal"],
|
|
"exclude_paths": ["tests/fixtures/**"],
|
|
"languages": ["python"],
|
|
"instructions": "House rules: all SQL must be parameterised — flag any query built by string concatenation or f-string as critical. Secrets and tokens must be compared with hmac.compare_digest, never ==. Any filesystem path derived from user input must be resolved and checked to stay inside its intended root. Public handlers in app/api.py must have an explicit authorisation check, not merely an authentication check."
|
|
}
|