https://dashboard.acmecorp.io/admin
May 29, 2026 · 11:22·10 bugs detected
Severity Distribution
Bug breakdown by severity level
Bug Report10 of 10 shown
User-supplied input is rendered directly into the DOM without sanitization. An attacker could inject malicious scripts that run in other users' browsers, stealing session tokens or hijacking accounts.
A raw database query is constructed using string concatenation with unvalidated user input. This allows attackers to manipulate the query and potentially access, modify, or delete all database records.
The function accesses a property on an object that may be null or undefined at runtime. This causes the application to crash when the upstream API returns an empty or error response.
An async function call lacks a try/catch block. If the network request fails or the server returns an error, the rejection is not caught, causing silent failures and leaving the UI in a broken state.
The API endpoint retrieves a document by ID without verifying that the requesting user owns or has permission to access that document. Any authenticated user can access any document by guessing its ID.
The email field in the contact form is not validated on the server side. While client-side validation exists, it can be bypassed, allowing malformed email addresses to be stored in the database.
The code uses `componentWillMount`, a deprecated React lifecycle method that was removed in React 18. This will cause a runtime error when upgrading and may produce unexpected behavior in the current version.
A `setInterval` is started when the component mounts but is never cleared when the component unmounts. This causes the interval to keep running and accumulate in memory every time the component is re-mounted.
Multiple `console.log` statements containing sensitive debug information (user IDs, session tokens) are present in production code. These can expose internal implementation details to anyone with browser DevTools open.
A variable `prevData` is declared and assigned but never used anywhere in the component. While this doesn't cause a runtime error, it increases bundle size slightly and may confuse developers maintaining the code.