SafeRook
Start free

Security for teams that ship fast.
SafeRook finds it. You approve the fix.

Rook watches your code, cloud and dependencies around the clock, explains every finding in plain language and opens a tested fix for review. Nothing merges without you.

Start freeBook a demo
SafeRook
SQL injection in /api/orders
checkout-api · src/routes/orders.ts:42 · critical
DismissApprove fix
Rookdetected on push9:41 AM
The status query parameter is concatenated straight into SQL. Anyone could read every customer's orders.
− db.query(`SELECT * FROM orders WHERE status = '${status}'`)
+ db.query('SELECT * FROM orders WHERE status = $1', [status])
Rookfix ready9:43 AM
Switched to a parameterised query and added a regression test. All 214 tests pass.
Tests passingPR #482 · fix/orders-sqli
MC
Maya Chensecurity lead9:52 AM
Looks good. Approving after the release freeze lifts at 2 PM.
Reply, or ask Rook about this finding
Visible to your teamSend