{
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "magdox",
          "version": "1.3.2",
          "informationUri": "https://magdox.io/",
          "rules": [
            {
              "id": "CWE-306",
              "name": "CWE-306",
              "shortDescription": {
                "text": "CWE-306 security finding"
              },
              "fullDescription": {
                "text": "Public security classification; each result carries its own evidence and actionable guidance."
              },
              "help": {
                "text": "Review each result's message and properties for its remediation and analysis limitations."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "properties": {
                "tags": [
                  "security",
                  "external/cwe/cwe-306"
                ]
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "CWE-306",
          "ruleIndex": 0,
          "level": "error",
          "message": {
            "text": "REVIEW: View lacks an authentication requirement\n\nREVIEW: This view has no authentication applied at the view. Global middleware, URL wrappers or handler helpers may still protect it. Confirm the actual route and object or function permissions before confirming anonymous access.\n\nHow to fix: Protect the view with an authentication decorator such as flask_login's @login_required (or Django's login_required), then check that the signed-in user may access the specific record.\n\nWhat this rule cannot determine: Static analysis is not proof of exploitability. Validate the affected control and runtime behavior."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "app.py"
                },
                "region": {
                  "startLine": 16,
                  "endLine": 20,
                  "startColumn": 1
                }
              }
            }
          ],
          "partialFingerprints": {
            "magdoxFingerprint/v1": "sha256:cd51ffe0aec634000e0a3d684946c521327861fa337317d9aadc4635408f49ec"
          },
          "properties": {
            "magdox:confidence": "low",
            "magdox:limits": "Static analysis is not proof of exploitability. Validate the affected control and runtime behavior.",
            "magdox:remediation": "Protect the view with an authentication decorator such as flask_login's @login_required (or Django's login_required), then check that the signed-in user may access the specific record.",
            "magdox:severity": "high",
            "magdox:title": "REVIEW: View lacks an authentication requirement",
            "tags": [
              "security",
              "external/cwe/cwe-306",
              "external/cwe/cwe-862",
              "external/owasp/A01:2021"
            ]
          }
        },
        {
          "ruleId": "CWE-306",
          "ruleIndex": 0,
          "level": "error",
          "message": {
            "text": "REVIEW: FastAPI route lacks an authentication dependency\n\nREVIEW: This route declares no authentication dependency. Application or router dependencies, middleware and checks in the handler may still enforce access. Verify effective registration and permissions before confirming forced browsing or authorisation bypass.\n\nHow to fix: Declare an authentication dependency on the route (viewer = Depends(current_user)) or on the APIRouter, and use the authenticated identity to scope the data returned.\n\nWhat this rule cannot determine: Static analysis is not proof of exploitability. Validate the affected control and runtime behavior."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "app.py"
                },
                "region": {
                  "startLine": 16,
                  "endLine": 20,
                  "startColumn": 1
                }
              }
            }
          ],
          "partialFingerprints": {
            "magdoxFingerprint/v1": "sha256:cb6bd390c3b5c495b9d8bf82bbb2ec25bbbaa52a57a58f4ef7c74b813f94e0d4"
          },
          "properties": {
            "magdox:confidence": "low",
            "magdox:limits": "Static analysis is not proof of exploitability. Validate the affected control and runtime behavior.",
            "magdox:remediation": "Declare an authentication dependency on the route (viewer = Depends(current_user)) or on the APIRouter, and use the authenticated identity to scope the data returned.",
            "magdox:severity": "high",
            "magdox:title": "REVIEW: FastAPI route lacks an authentication dependency",
            "tags": [
              "security",
              "external/cwe/cwe-306",
              "external/owasp/A01:2021"
            ]
          }
        }
      ],
      "invocations": [
        {
          "executionSuccessful": true,
          "properties": {
            "magdox:failures": null,
            "magdox:filesFailed": 0,
            "magdox:filesScanned": 4,
            "magdox:filesSkipped": 0,
            "magdox:rulesRun": 935,
            "magdox:rulesUnsupportedCount": 0
          }
        }
      ],
      "properties": {
        "magdox:snippetsIncluded": false
      }
    }
  ]
}