{
  "schema_version": "codestax-public-evidence/v1",
  "kind": "recorded_scan_extract",
  "recorded_at": "2026-10-23T17:43:22.762018Z",
  "repository": "juice-shop/juice-shop",
  "repository_revision": "717f5efa886b0417eeecb52378b03cf10567b7e2",
  "product_revision": "0ef00eba5e5c1ee897f1b00e761b360fa13c0bf1",
  "harness_version": "1.0.0",
  "sources": [
    {
      "artifact": "evaluation/results/2026-10-23/juice_shop.findings.json",
      "sha256": "5b4d403d4b9f9e57f2fab3fd3603712b1c313ca8662750b2fbb4f01e999f5a39"
    },
    {
      "artifact": "evaluation/results/2026-10-23/juice_shop.results.json",
      "sha256": "7cec9d94dd4f6c3cf16a9cbb949ff5171f54046cba65084e5433ec9e096c9163"
    }
  ],
  "scope": "Historical CodeStax evaluation of a deliberately vulnerable public training repository. Not a customer scan, current accuracy guarantee, live GitHub integration test or independent certification.",
  "analyzer": "SAST Analyzer",
  "analyzer_version": "1.168.0",
  "finding": {
    "rule_id": "javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection",
    "file": "routes/login.ts",
    "line": 34,
    "severity": "critical",
    "cwes": [
      89
    ],
    "message": "Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.",
    "analysis_method": "pattern"
  },
  "source_path": "routes/login.ts",
  "source_url": "https://github.com/juice-shop/juice-shop/blob/717f5efa886b0417eeecb52378b03cf10567b7e2/routes/login.ts#L32-L35",
  "coverage_status": "degraded",
  "coverage_warning": "Partial SAST coverage; 23 files could not be fully parsed: corpora/juice_shop/.github/workflows/ci.yml, corpora/juice_shop/.github/workflows/frontend-bundle-analysis.yml and 21 more; 1 rule timeout on: corpora/juice_shop/frontend/src/assets/private/three.js",
  "limits": "A pattern finding in intentionally vulnerable TypeScript training code. No exploit execution or scan of the editorial remediation is included."
}