# QWED Comprehensive Test Audit Report

**Generated:** 2025-12-01 05:03:53

**Duration:** 1.6 seconds

---

## Executive Summary

- **Total Tests:** 13
- **Passed:** 9 ✅
- **Failed:** 4 ❌
- **Pass Rate:** 69.2%

**Status:** ⚠️ NEEDS IMPROVEMENT

---

## Results by Priority

| Priority | Total | Passed | Failed | Pass Rate |
|----------|-------|--------|--------|-----------|
| ❌ CRITICAL | 10 | 7 | 3 | 70.0% |
| ❌ HIGH | 3 | 2 | 1 | 66.7% |
| ❌ MEDIUM | 0 | 0 | 0 | 0.0% |


## Results by Engine

| Engine | Total | Passed | Failed | Pass Rate |
|--------|-------|--------|--------|-----------|
| ⚠️ code | 13 | 9 | 4 | 69.2% |


## ❌ Failed Tests (4)

### Detect getattr() with user input
- **Engine:** code
- **Priority:** CRITICAL
- **Test ID:** `CODE_AST_002`
- **Expected:** CRITICAL - Reflection allows arbitrary method execution
- **Timestamp:** 2025-12-01T05:03:52.449757

### Detect MD5 for password hashing
- **Engine:** code
- **Priority:** CRITICAL
- **Test ID:** `CODE_CRYPTO_001`
- **Expected:** CRITICAL - MD5 is cryptographically broken for passwords
- **Timestamp:** 2025-12-01T05:03:53.536999

### Detect hardcoded encryption keys
- **Engine:** code
- **Priority:** CRITICAL
- **Test ID:** `CODE_CRYPTO_002`
- **Expected:** CRITICAL - Hardcoded encryption key
- **Timestamp:** 2025-12-01T05:03:53.649776

### Detect SHA-256 without salt
- **Engine:** code
- **Priority:** HIGH
- **Test ID:** `CODE_CRYPTO_003`
- **Expected:** WARNING - SHA-256 needs salt and key stretching
- **Timestamp:** 2025-12-01T05:03:53.766420

## ✅ Passed Tests (9)


### CODE Engine (9 tests)
- ✅ Detect __import__() with user input (143ms)
- ✅ Detect format string + eval RCE (148ms)
- ✅ Detect exec() with user input (117ms)
- ✅ Detect eval() with user input (159ms)
- ✅ Detect pickle.loads() RCE (118ms)
- ✅ Track user input through function boundaries (108ms)
- ✅ Detect taint through variable aliasing (103ms)
- ✅ Safe open() with hardcoded path (101ms)
- ✅ open() with variable path (103ms)

---

*Generated by QWED Advanced Testing Framework*
