{
  "metadata": {
    "report_type": "QWED_COMPREHENSIVE_AUDIT",
    "generated_at": "2025-12-01T05:13:55.902843",
    "version": "1.0"
  },
  "summary": {
    "timestamp": "2025-12-01T05:13:55.902843",
    "duration_seconds": 2.98094,
    "total_tests": 13,
    "passed": 13,
    "failed": 0,
    "pass_rate": 100.0,
    "by_priority": {
      "critical": {
        "total": 10,
        "passed": 10,
        "pass_rate": 100.0
      },
      "high": {
        "total": 3,
        "passed": 3,
        "pass_rate": 100.0
      },
      "medium": {
        "total": 0,
        "passed": 0,
        "pass_rate": 0
      }
    },
    "by_engine": {
      "code": {
        "total": 13,
        "passed": 13,
        "pass_rate": 100.0
      }
    }
  },
  "results": [
    {
      "test_id": "CODE_AST_001",
      "test_name": "Detect __import__() with user input",
      "engine": "code",
      "priority": "CRITICAL",
      "passed": true,
      "expected_result": "CRITICAL - Dynamic import RCE",
      "actual_result": {
        "is_safe": false,
        "issues": [
          "Dangerous function: __import__"
        ],
        "detailed_issues": [
          {
            "severity": "CRITICAL",
            "message": "Dangerous function: __import__",
            "line": 3,
            "requires_manual_review": false,
            "remediation": "Avoid __import__() - use safer alternatives"
          }
        ],
        "requires_manual_review": false,
        "severity_summary": {
          "critical": 1,
          "warning": 0,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 377.0754337310791,
      "timestamp": "2025-12-01T05:13:53.297984"
    },
    {
      "test_id": "CODE_AST_002",
      "test_name": "Detect getattr() with user input",
      "engine": "code",
      "priority": "CRITICAL",
      "passed": true,
      "expected_result": "CRITICAL - Reflection allows arbitrary method execution",
      "actual_result": {
        "is_safe": false,
        "issues": [
          "Import of restricted module: os - verify usage is necessary",
          "Dangerous function: getattr",
          "Reflection vulnerability: getattr() with user-controlled attribute name allows arbitrary method execution",
          "Use of os.system detected - verify security context"
        ],
        "detailed_issues": [
          {
            "severity": "WARNING",
            "message": "Import of restricted module: os - verify usage is necessary",
            "line": 7,
            "requires_manual_review": true,
            "remediation": "Ensure module usage is validated and necessary for functionality"
          },
          {
            "severity": "CRITICAL",
            "message": "Dangerous function: getattr",
            "line": 12,
            "requires_manual_review": false,
            "remediation": "Avoid getattr() - use safer alternatives"
          },
          {
            "severity": "CRITICAL",
            "message": "Reflection vulnerability: getattr() with user-controlled attribute name allows arbitrary method execution",
            "line": 12,
            "requires_manual_review": false,
            "remediation": "Use explicit attribute access or whitelist allowed attributes"
          },
          {
            "severity": "WARNING",
            "message": "Use of os.system detected - verify security context",
            "line": 8,
            "requires_manual_review": true,
            "remediation": null
          }
        ],
        "requires_manual_review": true,
        "severity_summary": {
          "critical": 2,
          "warning": 2,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 242.23971366882324,
      "timestamp": "2025-12-01T05:13:53.540224"
    },
    {
      "test_id": "CODE_AST_003",
      "test_name": "Detect format string + eval RCE",
      "engine": "code",
      "priority": "CRITICAL",
      "passed": true,
      "expected_result": "CRITICAL - eval with f-string allows code injection",
      "actual_result": {
        "is_safe": false,
        "issues": [
          "Dangerous function: eval"
        ],
        "detailed_issues": [
          {
            "severity": "CRITICAL",
            "message": "Dangerous function: eval",
            "line": 3,
            "requires_manual_review": false,
            "remediation": "Avoid eval() - use safer alternatives"
          }
        ],
        "requires_manual_review": false,
        "severity_summary": {
          "critical": 1,
          "warning": 0,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 193.4363842010498,
      "timestamp": "2025-12-01T05:13:53.736617"
    },
    {
      "test_id": "CODE_AST_004",
      "test_name": "Detect exec() with user input",
      "engine": "code",
      "priority": "CRITICAL",
      "passed": true,
      "expected_result": "CRITICAL - exec() allows arbitrary code execution",
      "actual_result": {
        "is_safe": false,
        "issues": [
          "Dangerous function: exec"
        ],
        "detailed_issues": [
          {
            "severity": "CRITICAL",
            "message": "Dangerous function: exec",
            "line": 3,
            "requires_manual_review": false,
            "remediation": "Avoid exec() - use safer alternatives"
          }
        ],
        "requires_manual_review": false,
        "severity_summary": {
          "critical": 1,
          "warning": 0,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 230.03602027893066,
      "timestamp": "2025-12-01T05:13:53.966653"
    },
    {
      "test_id": "CODE_001",
      "test_name": "Detect eval() with user input",
      "engine": "code",
      "priority": "CRITICAL",
      "passed": true,
      "expected_result": "CRITICAL - eval() with user input",
      "actual_result": {
        "is_safe": false,
        "issues": [
          "Dangerous function: eval"
        ],
        "detailed_issues": [
          {
            "severity": "CRITICAL",
            "message": "Dangerous function: eval",
            "line": 3,
            "requires_manual_review": false,
            "remediation": "Avoid eval() - use safer alternatives"
          }
        ],
        "requires_manual_review": false,
        "severity_summary": {
          "critical": 1,
          "warning": 0,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 219.2978858947754,
      "timestamp": "2025-12-01T05:13:54.187157"
    },
    {
      "test_id": "CODE_002",
      "test_name": "Detect pickle.loads() RCE",
      "engine": "code",
      "priority": "CRITICAL",
      "passed": true,
      "expected_result": "CRITICAL - pickle.loads()",
      "actual_result": {
        "is_safe": false,
        "issues": [
          "Import of dangerous module: pickle",
          "Dangerous function: pickle.loads"
        ],
        "detailed_issues": [
          {
            "severity": "CRITICAL",
            "message": "Import of dangerous module: pickle",
            "line": 2,
            "requires_manual_review": false,
            "remediation": "Use json or safer serialization instead"
          },
          {
            "severity": "CRITICAL",
            "message": "Dangerous function: pickle.loads",
            "line": 4,
            "requires_manual_review": false,
            "remediation": "Avoid pickle.loads() - use safer alternatives"
          }
        ],
        "requires_manual_review": false,
        "severity_summary": {
          "critical": 2,
          "warning": 0,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 258.04972648620605,
      "timestamp": "2025-12-01T05:13:54.445206"
    },
    {
      "test_id": "CODE_CTX_001",
      "test_name": "Track user input through function boundaries",
      "engine": "code",
      "priority": "CRITICAL",
      "passed": true,
      "expected_result": "CRITICAL - Command injection via tainted input",
      "actual_result": {
        "is_safe": false,
        "issues": [
          "Import of restricted module: subprocess - verify usage is necessary",
          "Command injection risk: subprocess with user-controlled arguments"
        ],
        "detailed_issues": [
          {
            "severity": "WARNING",
            "message": "Import of restricted module: subprocess - verify usage is necessary",
            "line": 10,
            "requires_manual_review": true,
            "remediation": "Ensure module usage is validated and necessary for functionality"
          },
          {
            "severity": "CRITICAL",
            "message": "Command injection risk: subprocess with user-controlled arguments",
            "line": 11,
            "requires_manual_review": false,
            "remediation": "Validate and sanitize all subprocess arguments, use absolute paths, avoid user input"
          }
        ],
        "requires_manual_review": true,
        "severity_summary": {
          "critical": 1,
          "warning": 1,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 213.92202377319336,
      "timestamp": "2025-12-01T05:13:54.660641"
    },
    {
      "test_id": "CODE_CTX_002",
      "test_name": "Detect taint through variable aliasing",
      "engine": "code",
      "priority": "CRITICAL",
      "passed": true,
      "expected_result": "CRITICAL - shell=True with tainted input",
      "actual_result": {
        "is_safe": false,
        "issues": [
          "Import of restricted module: subprocess - verify usage is necessary",
          "Command injection risk: subprocess with user-controlled arguments"
        ],
        "detailed_issues": [
          {
            "severity": "WARNING",
            "message": "Import of restricted module: subprocess - verify usage is necessary",
            "line": 6,
            "requires_manual_review": true,
            "remediation": "Ensure module usage is validated and necessary for functionality"
          },
          {
            "severity": "CRITICAL",
            "message": "Command injection risk: subprocess with user-controlled arguments",
            "line": 7,
            "requires_manual_review": false,
            "remediation": "Validate and sanitize all subprocess arguments, use absolute paths, avoid user input"
          }
        ],
        "requires_manual_review": true,
        "severity_summary": {
          "critical": 1,
          "warning": 1,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 209.46478843688965,
      "timestamp": "2025-12-01T05:13:54.872015"
    },
    {
      "test_id": "CODE_CTX_003",
      "test_name": "Safe open() with hardcoded path",
      "engine": "code",
      "priority": "HIGH",
      "passed": true,
      "expected_result": "SAFE - Hardcoded path is safe",
      "actual_result": {
        "is_safe": true,
        "issues": [],
        "detailed_issues": [],
        "requires_manual_review": false,
        "severity_summary": {
          "critical": 0,
          "warning": 0,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 119.16923522949219,
      "timestamp": "2025-12-01T05:13:55.057228"
    },
    {
      "test_id": "CODE_CTX_004",
      "test_name": "open() with variable path",
      "engine": "code",
      "priority": "HIGH",
      "passed": true,
      "expected_result": "WARNING - Variable path needs review",
      "actual_result": {
        "is_safe": true,
        "issues": [
          "File I/O with variable path - verify input validation"
        ],
        "detailed_issues": [
          {
            "severity": "WARNING",
            "message": "File I/O with variable path - verify input validation",
            "line": 3,
            "requires_manual_review": true,
            "remediation": "Ensure file path is validated and within allowed directory"
          }
        ],
        "requires_manual_review": true,
        "severity_summary": {
          "critical": 0,
          "warning": 1,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 208.5103988647461,
      "timestamp": "2025-12-01T05:13:55.266769"
    },
    {
      "test_id": "CODE_CRYPTO_001",
      "test_name": "Detect MD5 for password hashing",
      "engine": "code",
      "priority": "CRITICAL",
      "passed": true,
      "expected_result": "CRITICAL - MD5 is cryptographically broken for passwords",
      "actual_result": {
        "is_safe": false,
        "issues": [
          "hashlib.md5 is cryptographically broken - MUST NOT be used for password hashing"
        ],
        "detailed_issues": [
          {
            "severity": "CRITICAL",
            "message": "hashlib.md5 is cryptographically broken - MUST NOT be used for password hashing",
            "line": 5,
            "requires_manual_review": false,
            "remediation": "Use bcrypt, scrypt, or argon2 for password hashing"
          }
        ],
        "requires_manual_review": false,
        "severity_summary": {
          "critical": 1,
          "warning": 0,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 225.4934310913086,
      "timestamp": "2025-12-01T05:13:55.492263"
    },
    {
      "test_id": "CODE_CRYPTO_002",
      "test_name": "Detect hardcoded encryption keys",
      "engine": "code",
      "priority": "CRITICAL",
      "passed": true,
      "expected_result": "CRITICAL - Hardcoded encryption key",
      "actual_result": {
        "is_safe": false,
        "issues": [
          "Hardcoded encryption key detected: key"
        ],
        "detailed_issues": [
          {
            "severity": "CRITICAL",
            "message": "Hardcoded encryption key detected: key",
            "line": 5,
            "requires_manual_review": false,
            "remediation": "Use environment variables or Key Management Service"
          }
        ],
        "requires_manual_review": false,
        "severity_summary": {
          "critical": 1,
          "warning": 0,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 196.31624221801758,
      "timestamp": "2025-12-01T05:13:55.689580"
    },
    {
      "test_id": "CODE_CRYPTO_003",
      "test_name": "Detect SHA-256 without salt",
      "engine": "code",
      "priority": "HIGH",
      "passed": true,
      "expected_result": "WARNING - SHA-256 needs salt and key stretching",
      "actual_result": {
        "is_safe": false,
        "issues": [
          "hashlib.sha256 without salt/key stretching is insufficient for passwords"
        ],
        "detailed_issues": [
          {
            "severity": "CRITICAL",
            "message": "hashlib.sha256 without salt/key stretching is insufficient for passwords",
            "line": 5,
            "requires_manual_review": false,
            "remediation": "Use bcrypt, scrypt, or argon2 with proper salt and iterations"
          }
        ],
        "requires_manual_review": false,
        "severity_summary": {
          "critical": 1,
          "warning": 0,
          "info": 0
        }
      },
      "error": null,
      "latency_ms": 204.6363353729248,
      "timestamp": "2025-12-01T05:13:55.900849"
    }
  ],
  "failures": [],
  "statistics": {
    "total_tests": 13,
    "passed_count": 13,
    "failed_count": 0,
    "latency": {
      "min_ms": 119.16923522949219,
      "max_ms": 377.0754337310791,
      "avg_ms": 222.89597071134128
    },
    "engines_tested": [
      "code"
    ],
    "priorities_tested": [
      "CRITICAL",
      "HIGH"
    ]
  }
}