[
 {
  "id": "C01",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:48:36+00:00",
  "ms": 107,
  "reply": {
   "slug": "taloscrypt-audit",
   "title": "Find weak cryptography in source code",
   "status": "ok",
   "input": "import bcrypt, hashlib, secrets, requests\nh = bcrypt.hashpw(pw, bcrypt.gensalt())\nd = hashlib.sha256(data).hexdigest()\nt = secrets.token_urlsafe(32)\nr = requests.get(url, timeout=10)\n",
   "total_ms": 39,
   "steps": [
    {
     "call": "POST /scan-source",
     "request": {
      "source_code": "import bcrypt, hashlib, secrets, requests\nh = bcrypt.hashpw(pw, bcrypt.gensalt())\nd = hashlib.sha256(data).hexdigest()\nt = secrets.token_urlsafe(32)\nr = requests.get(url, timeout=10)\n",
      "filename": "auth.py"
     },
     "status": 200,
     "ms": 19,
     "reply": {
      "filename": "auth.py",
      "findings": [],
      "total": 0,
      "by_severity": {
       "CRITICAL": 0,
       "HIGH": 0,
       "MEDIUM": 0
      },
      "score": 100
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C02",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:48:36+00:00",
  "ms": 79,
  "reply": {
   "slug": "taloscrypt-audit",
   "title": "Find weak cryptography in source code",
   "status": "ok",
   "input": "import jwt, requests\nfrom cryptography.fernet import Fernet\nclaims = jwt.decode(tok, options={'verify_signature': False})\nr = requests.get(url, verify=False)\nf = Fernet(b'ZmFrZWtleWZha2VrZXlmYWtla2V5ZmFrZWtleWZha2U=')\n",
   "total_ms": 26,
   "steps": [
    {
     "call": "POST /scan-source",
     "request": {
      "source_code": "import jwt, requests\nfrom cryptography.fernet import Fernet\nclaims = jwt.decode(tok, options={'verify_signature': False})\nr = requests.get(url, verify=False)\nf = Fernet(b'ZmFrZWtleWZha2VrZXlmYWtla2V5ZmFrZWtleWZha2U=')\n",
      "filename": "auth.py"
     },
     "status": 200,
     "ms": 9,
     "reply": {
      "filename": "auth.py",
      "findings": [
       {
        "cwe_id": "CWE-347",
        "rule_name": "JWT_SignatureNotVerified",
        "severity": "CRITICAL",
        "line": 3,
        "snippet": "claims = jwt.decode(tok, options={'verify_signature': False})",
        "recommendation": "The token's signature is not checked, so anyone can forge it. Call jwt.decode(token, key, algorithms=['RS256' or 'EdDSA']) and never accept 'none'."
       },
       {
        "cwe_id": "CWE-295",
        "rule_name": "TLS_VerificationDisabled",
        "severity": "CRITICAL",
        "line": 4,
        "snippet": "r = requests.get(url, verify=False)",
        "recommendation": "TLS certificate checking is off, so a network attacker can read and change the traffic. Remove it and trust a CA bundle (or pin the server key) instead."
       },
       {
        "cwe_id": "CWE-321",
        "rule_name": "HardcodedKey",
        "severity": "CRITICAL",
        "line": 5,
        "snippet": "f = Fernet(b'ZmFrZWtleWZha2VrZXlmYWtla2V5ZmFrZWtleWZha2U=')",
        "recommendation": "Hardcoded cryptographic material detected. Load keys from environment variables, a secrets manager (e.g., HashiCorp Vault), or an HSM. Never commit key material to source control."
       }
      ],
      "total": 3,
      "by_severity": {
       "CRITICAL": 3,
       "HIGH": 0,
       "MEDIUM": 0
      },
      "score": 25
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C03",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:48:37+00:00",
  "ms": 145,
  "reply": {
   "slug": "taloscrypt-audit",
   "title": "Find weak cryptography in source code",
   "status": "ok",
   "input": "import hashlib\npw = hashlib.md5(password.encode()).hexdigest()\n",
   "total_ms": 43,
   "steps": [
    {
     "call": "POST /scan-source",
     "request": {
      "source_code": "import hashlib\npw = hashlib.md5(password.encode()).hexdigest()\n",
      "filename": "auth.py"
     },
     "status": 200,
     "ms": 22,
     "reply": {
      "filename": "auth.py",
      "findings": [
       {
        "cwe_id": "CWE-327",
        "rule_name": "WeakHash_MD5",
        "severity": "CRITICAL",
        "line": 2,
        "snippet": "pw = hashlib.md5(password.encode()).hexdigest()",
        "recommendation": "MD5 is cryptographically broken (collision attacks). Replace with SHA-256 (hashlib.sha256) or SHA-3."
       }
      ],
      "total": 1,
      "by_severity": {
       "CRITICAL": 1,
       "HIGH": 0,
       "MEDIUM": 0
      },
      "score": 75
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C04",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:48:38+00:00",
  "ms": 73,
  "reply": {
   "slug": "taloscrypt-audit",
   "title": "Find weak cryptography in source code",
   "status": "ok",
   "input": "from Crypto.Cipher import AES\nc = AES.new(key, AES.MODE_ECB)\n",
   "total_ms": 26,
   "steps": [
    {
     "call": "POST /scan-source",
     "request": {
      "source_code": "from Crypto.Cipher import AES\nc = AES.new(key, AES.MODE_ECB)\n",
      "filename": "auth.py"
     },
     "status": 200,
     "ms": 10,
     "reply": {
      "filename": "auth.py",
      "findings": [
       {
        "cwe_id": "CWE-327",
        "rule_name": "InsecureMode_ECB",
        "severity": "CRITICAL",
        "line": 2,
        "snippet": "c = AES.new(key, AES.MODE_ECB)",
        "recommendation": "ECB mode is deterministic and leaks block patterns. Use AES-GCM (provides confidentiality + integrity) or AES-CBC with HMAC."
       }
      ],
      "total": 1,
      "by_severity": {
       "CRITICAL": 1,
       "HIGH": 0,
       "MEDIUM": 0
      },
      "score": 75
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C05",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:48:38+00:00",
  "ms": 71,
  "reply": {
   "slug": "taloscrypt-audit",
   "title": "Find weak cryptography in source code",
   "status": "ok",
   "input": "import random\ntoken = random.random()\n",
   "total_ms": 22,
   "steps": [
    {
     "call": "POST /scan-source",
     "request": {
      "source_code": "import random\ntoken = random.random()\n",
      "filename": "auth.py"
     },
     "status": 200,
     "ms": 9,
     "reply": {
      "filename": "auth.py",
      "findings": [
       {
        "cwe_id": "CWE-338",
        "rule_name": "InsecureRandom_Crypto",
        "severity": "HIGH",
        "line": 2,
        "snippet": "token = random.random()",
        "recommendation": "Python's random module uses a PRNG (Mersenne Twister) unsuitable for cryptographic use. Replace with os.urandom() or secrets.token_bytes() for all key/nonce/salt generation."
       }
      ],
      "total": 1,
      "by_severity": {
       "CRITICAL": 0,
       "HIGH": 1,
       "MEDIUM": 0
      },
      "score": 90
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C06",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:48:39+00:00",
  "ms": 72,
  "reply": {
   "slug": "taloscrypt-audit",
   "title": "Find weak cryptography in source code",
   "status": "ok",
   "input": "from cryptography.hazmat.primitives.asymmetric import rsa\nk = rsa.generate_private_key(public_exponent=65537, key_size=1024)\n",
   "total_ms": 23,
   "steps": [
    {
     "call": "POST /scan-source",
     "request": {
      "source_code": "from cryptography.hazmat.primitives.asymmetric import rsa\nk = rsa.generate_private_key(public_exponent=65537, key_size=1024)\n",
      "filename": "auth.py"
     },
     "status": 200,
     "ms": 9,
     "reply": {
      "filename": "auth.py",
      "findings": [
       {
        "cwe_id": "CWE-326",
        "rule_name": "ShortRSAKey",
        "severity": "HIGH",
        "line": 2,
        "snippet": "k = rsa.generate_private_key(public_exponent=65537, key_size=1024)",
        "recommendation": "RSA key size < 2048 bits is insecure (NIST SP 800-57). Use RSA-3072 or RSA-4096 for new keys."
       }
      ],
      "total": 1,
      "by_severity": {
       "CRITICAL": 0,
       "HIGH": 1,
       "MEDIUM": 0
      },
      "score": 90
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 }
]