One sample, scanned, fixed and scanned again

A MAGDOX demonstration on a small Flask service we wrote ourselves, deliberately unsafe in four places. It shows what one run of the rules engine found, how the fix was checked and what the scan cannot tell you. It is not a benchmark.

Date
10 October 2026
Engine
MAGDOX rules engine 1.3.2, the engine hosted scans used that day
Rules
935 rules from the synced signed bundle
Vulnerability database
Built 9 October 2026, 288,353 advisories, digest sha256:e9866473...0f50
Sample
sample-order-lookup, revisions flawed (e9d9a87) and fixed (79858b5)

1. The flaw is real

The sample's own test asks for a crafted customer name. On the flawed revision it fails: the name returns every customer's orders.

GET /orders?customer=x' OR '1'='1
FAILED test_a_crafted_name_reads_no_other_orders

2. Scan the flawed revision

18 findings in about 5 seconds by the report's own start and finish times. Every pass that ran completed; the AI inventory and malicious package checks were not part of this run. The critical one carries its flow: untrusted input at line 18 reaches the SQL call at line 19 (CWE-89). The committed sample key appears masked, never in full, in every report.

3. Fix and test

Bind the customer as a SQL parameter, use SHA-256, read the key from the environment and move to current Flask and Werkzeug, locked with hashes. All three tests pass. The test, not the vanished alert, shows the fix works.

4. Scan the fixed revision

2 findings remain, explained below.

Findings before and after the fix
SurfaceFlawed revisionFixed revision
Code5 (1 critical, 2 high, 2 medium)2 high
Dependencies12 published advisories0
Secrets1 (the sample key)0
Total182

What remains, as it is

  • A review item: the demo endpoint has no authentication requirement. It is public on purpose; REVIEW findings ask a person to confirm the real access rule.
  • A false positive: a FastAPI rule matched the @app.get decorator this Flask app shares with FastAPI. We have recorded it for a rule fix.

What this does not show

  • One small sample in one language: no measure of detection or false-positive rates elsewhere.
  • Static analysis is not proof of exploitability, and REVIEW findings need a person.
  • The scan checks the files as they are; the sample key is still in the first commit's history. For a real key: rotate it first, then rewrite history.
  • The report records the vulnerability database's build and digest but not the rules bundle version.
  • Timings are from one machine and this sample.

Download the evidence

Reproduce it
curl -O https://magdox.io/evidence/code-security/sample-order-lookup.bundle
git clone sample-order-lookup.bundle sample-order-lookup && cd sample-order-lookup
git archive --format=tar.gz -o ../flawed.tar.gz flawed
git archive --format=tar.gz -o ../fixed.tar.gz fixed

Upload each archive in the console or send it to the scan API. Rules and advisory data change, so a new scan can differ from this run.