From b395db73c276f88eb27a8f6a4bbf806aae9f08e6 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 30 Jan 2026 10:01:08 +0000 Subject: [PATCH 1/4] Initial plan From bcfc55e4febbfd3508935df1ed1b8b53ca46e6c8 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 30 Jan 2026 10:02:56 +0000 Subject: [PATCH 2/4] Add automated security scanning with GitHub Actions workflow, update README, and create PR template Co-authored-by: diksha190 <233718673+diksha190@users.noreply.github.com> --- .github/pull_request_template.md | 32 +++++++++++++++ .github/workflows/security-scan.yml | 53 +++++++++++++++++++++++++ README.md | 61 ++++++++++++++++++++++++++++- 3 files changed, 144 insertions(+), 2 deletions(-) create mode 100644 .github/pull_request_template.md create mode 100644 .github/workflows/security-scan.yml diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..432a72c --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,32 @@ +## Description + +Briefly describe what vulnerabilities this code demonstrates. + +## Vulnerability Types + +- [ ] Reentrancy +- [ ] Integer Overflow/Underflow +- [ ] Access Control +- [ ] tx.origin Authorization +- [ ] Unchecked Call Returns +- [ ] SQL Injection +- [ ] XSS +- [ ] Other: _______________ + +## Expected Detections + +List what the security agent SHOULD detect: + +1. [ ] Vulnerability 1 - Severity: CRITICAL +2. [ ] Vulnerability 2 - Severity: HIGH + +## Testing Checklist + +- [ ] Code compiles/runs (even if vulnerable) +- [ ] Comments explain the vulnerability +- [ ] Added to README if new file +- [ ] Tested locally with security agent + +--- + +**Note:** The Security AI Agent will automatically scan this PR and post findings below! 🤖 diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml new file mode 100644 index 0000000..710bb7f --- /dev/null +++ b/.github/workflows/security-scan.yml @@ -0,0 +1,53 @@ +name: Security Scan + +on: + pull_request: + types: [opened, synchronize, reopened] + push: + branches: [main] + +jobs: + security-analysis: + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + issues: write + + steps: + - name: Checkout vulnerable code repository + uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: '3.10' + + - name: Checkout Security Agent + uses: actions/checkout@v4 + with: + repository: security-ai-labs/security-ai-agent + path: security-agent + ref: main + + - name: Install dependencies + run: | + pip install -r security-agent/requirements.txt + + - name: Run Security Analysis + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + REPO_NAME: ${{ github.repository }} + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + cd security-agent + python main.py + working-directory: ${{ github.workspace }} + + - name: Upload Analysis Results + if: always() + uses: actions/upload-artifact@v4 + with: + name: security-analysis-results + path: security-agent/analysis-*.json + retention-days: 30 diff --git a/README.md b/README.md index 3e2d1d1..2a49a50 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,66 @@ -# vulnerable-code-examples # Vulnerable Code Examples 🚨 +[![Security Scan](https://github.com/diksha190/vulnerable-code-examples/actions/workflows/security-scan.yml/badge.svg)](https://github.com/diksha190/vulnerable-code-examples/actions/workflows/security-scan.yml) + This repository contains intentionally vulnerable code samples for testing the **Web3 Security Agent**. **⚠️ WARNING:** These are intentionally vulnerable! Never use this code in production. +## Automated Security Scanning + +Every pull request is automatically scanned by our AI Security Agent: +- ✅ Detects 60+ vulnerability types +- ✅ Covers Ethereum, Solana, Web2, and DeFi +- ✅ Posts detailed findings as PR comments +- ✅ Includes severity levels and remediation advice + +## Testing the Agent + +To test the security agent locally: + +```bash +# Clone this repo +git clone https://github.com/diksha190/vulnerable-code-examples.git +cd vulnerable-code-examples + +# Clone the security agent +git clone https://github.com/security-ai-labs/security-ai-agent.git +cd security-ai-agent + +# Install and run +pip install -r requirements.txt +python main.py +``` + ## Repository Structure -# Test PR + +``` +vulnerable-code-examples/ +├── ethereum/ +│ └── vulnerable_erc20.sol # Intentionally vulnerable ERC20 +├── web2/ +│ └── (coming soon) +├── solana/ +│ └── (coming soon) +└── defi/ + └── (coming soon) +``` + +## Known Vulnerabilities + +### ethereum/vulnerable_erc20.sol +- 🚨 **CRITICAL**: Integer Overflow (Solidity 0.7.0) +- 🚨 **CRITICAL**: Reentrancy Attack +- 🚨 **CRITICAL**: Missing Access Control (mint, burn) +- ⚠️ **HIGH**: Unchecked Call Return +- ⚡ **MEDIUM**: Missing Zero Address Check +- ⚡ **MEDIUM**: Timestamp Dependency + +## Contributing + +Feel free to add more vulnerable examples to test the security agent! + +1. Create a new branch +2. Add vulnerable code in appropriate directory +3. Open a PR +4. Watch the security agent find the vulnerabilities! 🔍 From 3710c92e8cdc56b0bad20b770a1233f0e007260d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 30 Jan 2026 10:05:00 +0000 Subject: [PATCH 3/4] Fix workflow working directory redundancy, use absolute path for artifacts, and improve README instructions Co-authored-by: diksha190 <233718673+diksha190@users.noreply.github.com> --- .github/workflows/security-scan.yml | 7 +++---- README.md | 12 ++++++++---- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 710bb7f..6601fb0 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -38,16 +38,15 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} REPO_NAME: ${{ github.repository }} - PR_NUMBER: ${{ github.event.pull_request.number }} + PR_NUMBER: ${{ github.event.pull_request.number || '' }} run: | - cd security-agent python main.py - working-directory: ${{ github.workspace }} + working-directory: security-agent - name: Upload Analysis Results if: always() uses: actions/upload-artifact@v4 with: name: security-analysis-results - path: security-agent/analysis-*.json + path: ${{ github.workspace }}/security-agent/analysis-*.json retention-days: 30 diff --git a/README.md b/README.md index 2a49a50..ef97f10 100644 --- a/README.md +++ b/README.md @@ -23,12 +23,16 @@ To test the security agent locally: git clone https://github.com/diksha190/vulnerable-code-examples.git cd vulnerable-code-examples -# Clone the security agent +# Clone the security agent into a subdirectory git clone https://github.com/security-ai-labs/security-ai-agent.git -cd security-ai-agent -# Install and run -pip install -r requirements.txt +# Install dependencies +pip install -r security-ai-agent/requirements.txt + +# Set environment variables and run analysis from this directory +export GITHUB_TOKEN=your_token_here +export REPO_NAME=diksha190/vulnerable-code-examples +cd security-ai-agent python main.py ``` From 32d0d78a5a956dcf22ea0eab3a1b0b3d910615c9 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 30 Jan 2026 10:07:02 +0000 Subject: [PATCH 4/4] Fix directory naming consistency and add security warning for tokens Co-authored-by: diksha190 <233718673+diksha190@users.noreply.github.com> --- .github/pull_request_template.md | 2 +- README.md | 10 ++++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 432a72c..d538dd5 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -10,7 +10,7 @@ Briefly describe what vulnerabilities this code demonstrates. - [ ] tx.origin Authorization - [ ] Unchecked Call Returns - [ ] SQL Injection -- [ ] XSS +- [ ] Cross-Site Scripting (XSS) - [ ] Other: _______________ ## Expected Detections diff --git a/README.md b/README.md index ef97f10..c90534e 100644 --- a/README.md +++ b/README.md @@ -24,15 +24,17 @@ git clone https://github.com/diksha190/vulnerable-code-examples.git cd vulnerable-code-examples # Clone the security agent into a subdirectory -git clone https://github.com/security-ai-labs/security-ai-agent.git +git clone https://github.com/security-ai-labs/security-ai-agent.git security-agent # Install dependencies -pip install -r security-ai-agent/requirements.txt +pip install -r security-agent/requirements.txt -# Set environment variables and run analysis from this directory +# Set environment variables and run analysis +# Note: Never commit tokens to your repository! Use secure token management. +# Token needs 'repo' and 'pull_requests: write' permissions export GITHUB_TOKEN=your_token_here export REPO_NAME=diksha190/vulnerable-code-examples -cd security-ai-agent +cd security-agent python main.py ```