15 critical bugs
PullLight would have caught in your PRs.

// AFTER (fixed)
const validated = validateRSCPayload(req.body.payload);
if (!validated) throw new Error('Untrusted RSC payload');
const component = deserializeRSC(validated);
render(component);

// AFTER (fixed)
// Proxy handler blocks __proto__ assignment at bridge level.
if (key === '__proto__') return false;

// AFTER (fixed)
if (!rcube_utils::is_simple_string($_POST['_from'])) {
  throw new Exception('Invalid _from parameter');
}
$from = $_POST['_from'];

// AFTER (fixed)
const parsed = JSON.parse(req.auth?.meta || '{}');
logger.info('auth', parsed);

// AFTER (fixed)
import { freeze } from '@casl/ability';
ability.update(freeze(attackerConditions));

// AFTER (fixed)
// Disable expandAtFiles() so @ references are literal strings
CmdLineParser parser = new CmdLineParser(cmd);
parser.getProperties().withAtSyntax(false);
parser.parseArgument(args);

// AFTER (fixed)
// Use opaque random temp filename; disallow PUT to .session paths
String tempPath = getTempDir() + UUID.randomUUID();
storeTempFile(tempPath, req.getInputStream());

// AFTER (fixed)
// Use execFile with argument array; validate pkgName
// against a known-good npm package name regex.
execFile('npx", [pkgName, '--help'], ...);

// AFTER (fixed)
// Use mysqli->real_escape_string() — handles ALL special chars
$name = $global['mysqli']->real_escape_string($_POST['name']);
$sql = "SELECT * FROM category WHERE name = '" . $name . "'";

// AFTER (fixed)
const safe = path.basename(userFilename);
const outputPath = path.join(outputDir, safe);
fs.writeFileSync(outputPath, pdfBuffer);

# AFTER (fixed)
with self._lock:
    if self.request_count > 0:
        self.handle_request(request)

// AFTER (fixed)
// Auth check runs for ALL paths; static assets
// bypass the network check via CDN rewrite, not middleware.
return checkAuth(req);

// AFTER (fixed)
parsed, _ := jwt.NewWithClaims(jwt.SigningMethodHS256, &jwt.StandardClaims{
  Audience: urlParseClean(attackerInput), // normalize before parsing
})

// AFTER (fixed)
// Whitelist-validate timeZone against known IANA strings
const ALLOWED = new Set(['UTC', 'America/New_York', ...]);
if (!ALLOWED.has(timeZone)) throw new Error('Invalid timezone');
return `date_trunc('${timeZone}', "createdAt")`;

// AFTER (fixed)
// Validate expr against safe-path allowlist before eval.
if (!isSafeExpression(expr)) throw new Error('Unsafe expression');
const result = vm.runInNewContext(expr, sandbox);

// AFTER (fixed)
// 1. Upgrade axios >= 1.7.4 which properly honors NO_PROXY
// 2. Defense-in-depth: hostname allowlist
const ALLOWED_HOSTS = new Set(['api.example.com', 'status.example.com']);
function isAllowedHost(url) {
  try {
    const { hostname } = new URL(url);
    return ALLOWED_HOSTS.has(hostname);
  } catch { return false; }
}
if (!isAllowedHost(target)) return res.status(403).send('Blocked');
const resp = await axios.get(target);

// AFTER (fixed)
const allowedHosts = new Set(['app.example.com']);
const host = req.headers.host?.split(':')[0];
if (!allowedHosts.has(host)) return socket.destroy();
proxyWs(req, socket, head, { target: host });

# AFTER (fixed)
# Option 1: Don't nest auth-required endpoints under actuator paths
# Option 2: Add explicit Spring Security rules:
# security.filter顺序 = actuator before security
# Option 3: Map health group to isolated path not under actuator base
management.endpoints.web.base-path=/actuator
# Or apply @PreAuthorize("isAuthenticated()") to admin endpoints

// AFTER (fixed)
// Normalize IPv4-mapped IPv6 before the private check.
const normalized = normalizeIp(userSuppliedIp);
if (ip.isPrivate(normalized)) return res.status(403).send('Blocked');
fetch(`http://${normalized}/internal-api`);