juice-shop/juice-shop

Source: GitHub repository · Scanned: 18 Oct 2026, 11:14 UTC · Report ID: 62c5d4e98042

Suggested decision

Don't approve yet

Risk level

High

To fix

9 critical · 30 other

Critical issues must be fixed and the app scanned again before approval.

This is a suggestion based on the checks below. The approval decision belongs to the reviewer.

1 · Rule-based checks (repeatable)

The same code always gives the same result. Rule-based checks covered 1171 files. The AI review read the 25 most security-relevant files of 1171.

Check	Result	Status	Related standard
Exposed secrets API keys, passwords and tokens written into the code	3 critical, 27 warnings across 1171 files	Fail	ASVS 4.0.3 V6.4 Secret Management · CWE-798
Known-vulnerable libraries Packages checked against the OSV.dev vulnerability database	37 vulnerable packages (3 serious) in 167 packages you installed directly	Fail	ASVS 4.0.3 V14.2 Dependency · Top 10 2021 A06
Weak cryptography Outdated hashes, broken cipher modes, hardcoded keys, small RSA keys	0 issues across 1171 files Check required: no weak pattern was confirmed, but one thing needs a person to look: An old hash (MD5 or SHA-1) is used, and this app also handles passwords (lib/insecurity.ts line 41). It may or may not be connected, so check what that hash protects. This check only covers four specific patterns and does not review other cryptography.	Check required	ASVS 4.0.3 V6.2 Algorithms · Top 10 2021 A02
Who can do what Database access rules and login checks on backend functions (Supabase apps)	Not applicable (no Supabase database or function files found), or not run for this report	Not checked	ASVS 4.0.3 V4 Access Control · Top 10 2021 A01

2 · AI review by area (expert opinion)

Written by an AI model reading the code. Treat it as an informed opinion: results can vary slightly between runs, and "no issues found" means none were seen in the files read, not that the area is proven secure.

Area	Findings	Status	Related standard
Auth Login, sessions and who can do what	No issues seen in the 25 files the AI read, out of 1171. That is not proof this area is secure.	Nothing found	ASVS 4.0.3 V2 Authentication, V3 Session Management · Top 10 2021 A07
Database How data is stored and who can read it	No issues seen in the 25 files the AI read, out of 1171. That is not proof this area is secure.	Nothing found	ASVS 4.0.3 V4 Access Control, V5 Validation · Top 10 2021 A01, A03
API The app's server endpoints and what they accept	Authentication Completely Bypassable via JWT Forgery; SQL Injection in Product Search Endpoint; Unrestricted File Upload Allows Remote Code Execution; +1 more	Fail	ASVS 4.0.3 V13 API and Web Service · Top 10 2021 A01
Config Settings, environment variables and deployment setup	No issues seen in the 25 files the AI read, out of 1171. That is not proof this area is secure.	Nothing found	ASVS 4.0.3 V14 Configuration · Top 10 2021 A05
Frontend What runs in the user's browser	DOM-Based XSS via Unescaped User Input; Client-Side Security Controls Can Be Bypassed	Needs fixes	ASVS 4.0.3 V5 Validation, Sanitization and Encoding · Top 10 2021 A03
Libraries Third-party packages the app depends on	Known Vulnerable Dependencies Detected; Intentionally Outdated Vulnerable Packages for Training	Fail	ASVS 4.0.3 V14.2 Dependency · Top 10 2021 A06

3 · Fix before approval

Critical Private Key File infrastructure/terraform/networking.tf:171
Delete the key from the repository, generate a new one, and never store private keys in code.
Critical Private Key File lib/insecurity.ts:21
Delete the key from the repository, generate a new one, and never store private keys in code.
Critical Private Key File terraform/networking.tf:171
Delete the key from the repository, generate a new one, and never store private keys in code.
Critical 37 vulnerable packages in libraries dependency files
Update the affected packages to their fixed versions, then scan again.
Critical API: Authentication Completely Bypassable via JWT Forgery server.ts, routes/verify.ts
Complete authentication bypass means attackers gain full admin access, can modify all data, delete users, change prices, and steal customer information without any credentials.
Critical API: SQL Injection in Product Search Endpoint routes/search.ts
Attackers can extract entire database contents including passwords, credit cards, and personal information, or delete all data with a single malicious search query.
Critical API: Unrestricted File Upload Allows Remote Code Execution server.ts, routes/fileUpload.ts
Attackers can upload malicious executable files or XML bombs that take over the server, install malware, or crash the application.
Critical Libraries: Known Vulnerable Dependencies Detected package.json, frontend/package.json
Vulnerable libraries contain known security flaws that attackers actively exploit. Even one critical vulnerability can provide a path to data theft, server takeover, or denial of service.
Critical Libraries: Intentionally Outdated Vulnerable Packages for Training package.json, routes/verify.ts
While intentional for training, these packages contain severe vulnerabilities (authentication bypass, XSS, prototype pollution) that would be catastrophic in production. Students must understand these are examples of what NEVER to do.
Warning JSON Web Token frontend/src/app/app.guard.spec.ts:46
Remove it. If it belongs to a real account, sign that account out everywhere.
Warning JSON Web Token frontend/src/app/last-login-ip/last-login-ip.component.spec.ts:72
Remove it. If it belongs to a real account, sign that account out everywhere.
Warning JSON Web Token frontend/src/app/last-login-ip/last-login-ip.component.spec.ts:78
Remove it. If it belongs to a real account, sign that account out everywhere.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:42
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:66
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:85
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:104
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:123
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:142
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:182
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:214
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:240
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:257
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:266
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:292
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
Warning Generic Hardcoded Secret test/api/2fa.test.ts:317
If it is a real secret, move it to an environment variable. If it is a placeholder, you can ignore this.
+14 more in the full report

4 · What this review did not check

The running app. This review reads code. It did not test the live site, its hosting or its network setup.
Whether one user can see another user's data in practice. Confirm with a two-account test.
Settings made outside the code, such as database access rules or login options set in a Supabase, Firebase or hosting dashboard.
Where company data goes: which outside services, AI providers and countries receive it.
Sign-in requirements: whether it supports company single sign-on (SSO) or enforces two-factor login.
The packages your packages depend on. The packages these depend on were not checked, because no full package list was found in the files Verilay read.
Cryptography beyond four specific patterns. The weak-cryptography check looks line by line for MD5 or SHA-1 next to a password or token word, AES in ECB mode, hardcoded encryption keys and small RSA keys. It can miss a weak hash used in a different file from the password, and other weak methods.
Software licences of the libraries used.
Business logic: whether the app does the right thing for your processes.
AI-specific risks if the app itself calls an AI model, such as prompt injection.
Files the AI did not read. The rule-based checks cover every file; the AI review covers the most relevant ones only.

5 · Confirm independently

Free, widely used tools your team can run without Verilay:

What	Tool
Known-vulnerable libraries	OSV-Scanner (google/osv-scanner)
Code security bugs	Semgrep community rules
Secrets in code and history	Gitleaks
Live site, passive scan (with the owner's permission)	OWASP ZAP baseline scan

6 · Sign-off

Reviewed by:	Date:
Decision:ApproveApprove with fixesDon't approve
Conditions or notes:

Generated by Verilay (verilay.dev) from report 62c5d4e98042. AI-assisted analysis may contain false positives or miss issues. Not a professional security audit. See verilay.dev/ai-disclaimer.