test: cluster e2e (eval RCE + secret leak) #5

[CRITICAL] eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process.

Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new Error(`invalid amount: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process. Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new Error(`invalid amount: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

[CRITICAL] A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer.

Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead.

const API_KEY = process.env.API_KEY ?? "";
export function getToken(): string { return API_KEY; }

📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

**[CRITICAL]** A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer. Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead. ```suggestion const API_KEY = process.env.API_KEY ?? ""; export function getToken(): string { return API_KEY; } ``` 📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

[CRITICAL] eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process.

Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new Error(`invalid amount: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process. Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new Error(`invalid amount: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

[CRITICAL] A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer.

Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead.

const API_KEY = process.env.API_KEY ?? "";
export function getToken(): string { return API_KEY; }

📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

**[CRITICAL]** A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer. Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead. ```suggestion const API_KEY = process.env.API_KEY ?? ""; export function getToken(): string { return API_KEY; } ``` 📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

[CRITICAL] eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process.

Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new Error(`invalid amount: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process. Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new Error(`invalid amount: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

[CRITICAL] A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer.

Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead.

const API_KEY = process.env.API_KEY ?? "";
export function getToken(): string { return API_KEY; }

📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

**[CRITICAL]** A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer. Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead. ```suggestion const API_KEY = process.env.API_KEY ?? ""; export function getToken(): string { return API_KEY; } ``` 📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

[CRITICAL] eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process.

Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new Error(`invalid amount: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process. Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new Error(`invalid amount: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

[CRITICAL] A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer.

Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead.

const API_KEY = process.env.API_KEY ?? "";
export function getToken(): string { return API_KEY; }

📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

**[CRITICAL]** A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer. Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead. ```suggestion const API_KEY = process.env.API_KEY ?? ""; export function getToken(): string { return API_KEY; } ``` 📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

[CRITICAL] eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process.

Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new Error(`invalid amount: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process. Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new Error(`invalid amount: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

[CRITICAL] A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer.

Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead.

const API_KEY = process.env.API_KEY ?? "";
export function getToken(): string { return API_KEY; }

📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

**[CRITICAL]** A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer. Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead. ```suggestion const API_KEY = process.env.API_KEY ?? ""; export function getToken(): string { return API_KEY; } ``` 📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

[CRITICAL] eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process.

Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new Error(`invalid amount: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process. Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new Error(`invalid amount: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

[CRITICAL] A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer.

Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead.

const API_KEY = process.env.API_KEY ?? "";
export function getToken(): string { return API_KEY; }

📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

**[CRITICAL]** A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer. Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead. ```suggestion const API_KEY = process.env.API_KEY ?? ""; export function getToken(): string { return API_KEY; } ``` 📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

[CRITICAL] eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process.

Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new Error(`invalid amount: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process. Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new Error(`invalid amount: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

[CRITICAL] A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer.

Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead.

const API_KEY = process.env.API_KEY ?? "";
export function getToken(): string { return API_KEY; }

📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

**[CRITICAL]** A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer. Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead. ```suggestion const API_KEY = process.env.API_KEY ?? ""; export function getToken(): string { return API_KEY; } ``` 📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

[CRITICAL] eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process.

Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new Error(`invalid amount: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process. Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new Error(`invalid amount: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

[CRITICAL] A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer.

Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead.

const API_KEY = process.env.API_KEY ?? "";
export function getToken(): string { return API_KEY; }

📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

**[CRITICAL]** A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer. Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead. ```suggestion const API_KEY = process.env.API_KEY ?? ""; export function getToken(): string { return API_KEY; } ``` 📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

[CRITICAL] eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process.

Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new Error(`invalid amount: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code (RCE); any caller-controlled string runs as code in this process. Fix: Parse the input explicitly instead of evaluating it, e.g. Number(input) or a structured parser, and validate the result. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new Error(`invalid amount: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

[CRITICAL] A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer.

Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead.

const API_KEY = process.env.API_KEY ?? "";
export function getToken(): string { return API_KEY; }

📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

**[CRITICAL]** A live API key (sk-live-...) is hardcoded in source and will be leaked via git history; getToken() exposes it to any importer. Fix: Remove the key, rotate it immediately, and read secrets from environment variables or a secrets manager instead. ```suggestion const API_KEY = process.env.API_KEY ?? ""; export function getToken(): string { return API_KEY; } ``` 📎 ref: https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password

+export function parseAmount(input: string): number {
+  // trust user input directly -> eval
+  return eval(input);
+}
+const API_KEY = "sk-live-1234567890abcdef";
+export function getToken(): string { return API_KEY; }