Security for teams that ship fast.
SafeRook finds it. You approve the fix.

Rook watches your code, cloud and dependencies around the clock, explains every finding in plain language and opens a tested fix for review. Nothing merges without you.

Start free Book a demo

SafeRook

SQL injection in /api/orders

checkout-api · src/routes/orders.ts:42 · critical

Dismiss Approve fix

Rookdetected on push9:41 AM

The status query parameter is concatenated straight into SQL. Anyone could read every customer's orders.

− db.query(`SELECT * FROM orders WHERE status = '${status}'`)
+ db.query('SELECT * FROM orders WHERE status = $1', [status])

Rookfix ready9:43 AM

Switched to a parameterised query and added a regression test. All 214 tests pass.

Tests passingPR #482 · fix/orders-sqli

Maya Chensecurity lead9:52 AM

Looks good. Approving after the release freeze lifts at 2 PM.

Reply, or ask Rook about this finding

Visible to your teamSend

Security for teams that ship fast.SafeRook finds it. You approve the fix.

Security for teams that ship fast.
SafeRook finds it. You approve the fix.