I submitted a side-project extension for review and an AI bot found 4 real security bugs in it

Описание и применение

При проверке расширения Raycast автоматический ревьюер обнаружил четыре уязвимости: неэкранированный HTML, инъекция Markdown, сбой из-за null‑элементов и скрытое перезаписывание файлов. Были добавлены проверки и экранирование, что устранило проблемы.

Задача

A Raycast extension that renders invoice JSON into HTML/Markdown preview contained four security bugs discovered by an automated reviewer.

Результат

Four security vulnerabilities were identified and fixed: unescaped HTML, Markdown injection, null item crash, and silent file overwrite.

Рабочий процесс

• 1. Paste invoice JSON into extension
• 2. Render HTML/Markdown preview
• 3. Save preview to file

Доказательства

Within a few minutes, an automated reviewer (Greptile, which Raycast runs on every incoming PR) left 9 comments. Four were tagged P1/security.

Источник

Paste "tax_rate": "0"><script>alert(1)</script>" and it reaches the HTML template unescaped

Источник

A notes value like  turns into an image markdown tag that fires a real HTTP request

Источник

Two invoices with numbers like INV/001 and INV:001 both sanitize to the same filename. Saving the second one silently overwrote the first

Источник