Will It Vibe?Filesystem path built from request input (Python)
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
os.path.join or open() is fed flask request.args/form/values/files, so a traversal payload can escape the intended directory. Validate against a base directory with os.path.realpath.
Why it matters
Feeding flask request.args/form/values/files into os.path.join or open lets a traversal payload escape the intended directory and read arbitrary files. It is a heuristic because the value may be validated elsewhere, but the pattern cannot confirm that.
How to fix it
Confine the path to a base directory: join, then call os.path.realpath and confirm it is still inside the base with os.path.commonpath before opening. Use werkzeug.utils.secure_filename when you expect only a filename. Reject inputs that escape the base.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo