I Planted 3 Sneaky Security Flaws in a Web App. Could AI Catch Them?

Description and use

An intern planted three deliberate vulnerabilities in a small Python app and tested whether SecFoo could detect and explain them. All three were found with contextual explanations.

Problem

Determine whether an AI‑powered security reviewer can detect and explain deliberately planted vulnerabilities in a small Python web application.

Outcome

All three intentionally planted vulnerabilities were detected by SecFoo, and the tool provided contextual explanations linking the code patterns to security risks.

Workflow

• 1. Built a small Python web app and intentionally inserted three vulnerabilities: a hardcoded credential, a SQL injection via f‑string, and a command injection via os.system.
• 2. Ran SecFoo’s SAST skill against the project using the command secfoo run --skill sast --agent api --target . --project-name vulnerability-challenge --app-id "".
• 3. Served the SecFoo dashboard with secfoo serve to inspect findings.
• 4. Reviewed the dashboard output to confirm detection of all three vulnerabilities and assess the contextual explanations provided.

Evidence

I built a small Python application and deliberately planted three security vulnerabilities inside it.

Source

After the review completed, I opened the SecFoo dashboard: secfoo serve

Source

Results: Hardcoded credential ✅, SQL injection ✅, Command injection ✅

Source

The useful part was the context around the findings: the review could point toward the risky code and explain the security concern rather than simply saying that a particular function or keyword was "bad."

Source