acme / storefront / AI ReviewDemo data
AI explains each finding and how to fix it, using only PRISM's analysis facts.
PRISM core · claude-sonnet-5-5 (sample)
Fix the SQL injection in users.ts first; it sits on the auth path.
The codebase is in reasonable shape (72/100) and improving, but three critical findings carry most of the risk. Two are security issues on paths that auth and admin depend on; the third is a query pattern that dominates checkout latency.
SQL injection in user lookup
src/api/users.ts:184
PR-184 · Semgrep · taint trace
Why it matters
User input from the lookup endpoint reaches a raw SQL string. Because auth and admin import this module, one injectable query exposes every caller.
Suggested fix
Replace the template string with a parameterized query (db.query(sql, [id])) or your query builder's where() helper. No API change is needed.
Hardcoded payment secret
src/config/payments.ts:12
PR-012 · Secret scan
Why it matters
A live payment secret is committed in source, so anyone with read access to the repository or its build artifacts can use it.
Suggested fix
Rotate the key in your payment dashboard today, move it to an environment variable, and purge it from git history.
N+1 query in OrderService.list()
src/services/orders.ts:77
PR-077 · Query profile
Why it matters
OrderService.list() awaits one query per order, so latency grows with order count and dominates p95.
Suggested fix
Fetch all orders in one query with WHERE id IN (...) or a join, and add an index on orders.user_id.
jsonwebtoken 8.5.1 has a known CVE
package.json
PR-203 · Dependency audit
Why it matters
This jsonwebtoken version has a published advisory. Whether it's exploitable depends on how tokens are verified.
Suggested fix
Upgrade to the latest major version and pin the allowed algorithms in jwt.verify().
The AI thinks this may be a false positive (medium likelihood). Check the code before changing it.
calculateTotals() complexity 38
src/checkout/totals.ts:41
PR-041 · AST · cyclomatic
Why it matters
calculateTotals() has 38 independent paths and changes often, which makes pricing bugs likely.
Suggested fix
Split tax, discount and shipping into separate pure functions with their own tests, then compose them.
Circular dependency: orders ↔ billing
src/services/
PR-118 · Dependency graph
Why it matters
orders and billing import each other, so neither can change or be tested in isolation.
Suggested fix
Move the shared types into a small module both depend on, or have billing emit events that orders subscribes to.
The AI only sees the findings, file locations and metrics above, never your source code. Explanations can be wrong; the linked facts are the source of truth.