# QWED Comprehensive Test Audit Report

**Generated:** 2025-12-01 05:10:03

**Duration:** 1.7 seconds

---

## Executive Summary

- **Total Tests:** 13
- **Passed:** 9 ✅
- **Failed:** 4 ❌
- **Pass Rate:** 69.2%

**Status:** ⚠️ NEEDS IMPROVEMENT

---

## Results by Priority

| Priority | Total | Passed | Failed | Pass Rate |
|----------|-------|--------|--------|-----------|
| ❌ CRITICAL | 10 | 7 | 3 | 70.0% |
| ❌ HIGH | 3 | 2 | 1 | 66.7% |
| ❌ MEDIUM | 0 | 0 | 0 | 0.0% |


## Results by Engine

| Engine | Total | Passed | Failed | Pass Rate |
|--------|-------|--------|--------|-----------|
| ⚠️ code | 13 | 9 | 4 | 69.2% |


## ❌ Failed Tests (4)

### Detect getattr() with user input
- **Engine:** code
- **Priority:** CRITICAL
- **Test ID:** `CODE_AST_002`
- **Expected:** CRITICAL - Reflection allows arbitrary method execution
- **Timestamp:** 2025-12-01T05:10:01.929475

### Detect MD5 for password hashing
- **Engine:** code
- **Priority:** CRITICAL
- **Test ID:** `CODE_CRYPTO_001`
- **Expected:** CRITICAL - MD5 is cryptographically broken for passwords
- **Timestamp:** 2025-12-01T05:10:03.011766

### Detect hardcoded encryption keys
- **Engine:** code
- **Priority:** CRITICAL
- **Test ID:** `CODE_CRYPTO_002`
- **Expected:** CRITICAL - Hardcoded encryption key
- **Timestamp:** 2025-12-01T05:10:03.194980

### Detect SHA-256 without salt
- **Engine:** code
- **Priority:** HIGH
- **Test ID:** `CODE_CRYPTO_003`
- **Expected:** WARNING - SHA-256 needs salt and key stretching
- **Timestamp:** 2025-12-01T05:10:03.330915

## ✅ Passed Tests (9)


### CODE Engine (9 tests)
- ✅ Detect __import__() with user input (157ms)
- ✅ Detect format string + eval RCE (100ms)
- ✅ Detect exec() with user input (140ms)
- ✅ Detect eval() with user input (104ms)
- ✅ Detect pickle.loads() RCE (100ms)
- ✅ Track user input through function boundaries (98ms)
- ✅ Detect taint through variable aliasing (120ms)
- ✅ Safe open() with hardcoded path (165ms)
- ✅ open() with variable path (145ms)

---

*Generated by QWED Advanced Testing Framework*
