🛡️ Bright Security Scan

[bararchy]

🛡️ Bright Security Scan

✅ Detecting tech stack and starting the application

• Application running at http://localhost:9000
  ✅ Setting up Bright security scanner and Repeater
• Repeater connected
  ✅ Detecting authentication requirements
• Auth configured (after infra repair)
  ✅ Completing first-time application setup (3 attempts)
• Setup completed: Ran Sentry's upgrade/bootstrap command to ensure migrations were applied, then created/normalized the admin user to bright_test with superuser/staff privileges.
  ✅ Analyzing source code for endpoints and parameters
• 884 endpoints (static analysis)
  ✅ Registering API endpoints for scanning
• 879 live entrypoints after pruning 404s
  ✅ Selecting relevant security tests per endpoint
• Created 10 scan group(s) with per-endpoint test selection
  ✅ Running scans — round 1
• Auth broken after fixes — cannot continue scanning
  ✅ Fixing 9 vulnerabilities — round 1
• Round 1: fixed 9, skipped 0
  🔄 Authentication broke after round 1 fixes and could not be repaired. 9 fixes were applied.

Findings

Severity	Vulnerability	Endpoint	Status
High	[BL] Excessive Data Exposure	GET http://localhost:9000/1001/events/1234567890abcdef1234567890abcdef)?environment=production	🔴 Open
High	[BL] Excessive Data Exposure	GET http://localhost:9000/1/notification-options/42	🔴 Open
High	[BL] Excessive Data Exposure	GET http://localhost:9000/1/insights/crons	🔴 Open
Medium	Secret Tokens Leak	GET http://localhost:9000/acme/api-keys/pk_live_1234567890	🔴 Open
Medium	Insecure HTTP Method OPTIONS	OPTIONS http://localhost:9000/	🔴 Open
Medium	Secret Tokens Leak	GET http://localhost:9000/acme/frontend/keys/pk_live_1234567890abcdef	🔴 Open
Medium	Secret Tokens Leak	GET http://localhost:9000/acme/frontend/keys/pk_live_1234567890abcdef/stats	🔴 Open
Medium	Unvalidated Redirect	GET http://localhost:9000/7f3a2c4d-9f4d-4d2d-8c2f-3b1a9c8e7f10/external-requests?uri=https%3A%2F%2Fexample.com%3Fdummy%3Dhttps%3A%2F%2Fexample.com%2Fcustom-field&projectId=12345&query=search+term&dependentData=%7B%22selected%22%3A%22value%22%7D%7D	🔴 Open
Medium	Unvalidated Redirect	GET http://localhost:9000/auth/google-oauth2?next=https%3A%2F%2Fexample.com%3Fdummy%3D%2Fdashboard&email=user%40example.com%3Fdummy%3D%2Fdashboard	🔴 Open