Authorization-first, deterministic BOLA/IDOR validation for HTTP APIs
Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution in LeonardSEO/OpenBOLA
- HIGH code analysis flagged dynamic code execution in LeonardSEO/OpenBOLA
- HIGH code analysis flagged dynamic code execution in LeonardSEO/OpenBOLA
transport stdio counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit fde23cf · analyzer v33 · 1w ago
skills & prompt files 1
- agent-rules LeonardSEO-OpenBOLA-fde23cf/AGENTS.md
danger signals2
- dynamic code execution unsafe yaml.load() LeonardSEO-OpenBOLA-fde23cf/src/openbola/scope.py :328
raw_document = yaml.load( - committed secret Stripe live key LeonardSEO-OpenBOLA-fde23cf/tests/test_state.py :586
sk_liv…(28 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 79
filesystem 47
- fs LeonardSEO-OpenBOLA-fde23cf/packaging/build_artifacts.py :20
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/scripts/check_demo_transcript.py :11
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/scripts/check_launch_assets.py :14
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/scripts/render_launch_assets.py :13
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/capture.py :20
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/cli.py :7
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/doctor.py :21
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/mcp_server.py :27
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/paths.py :7
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/pipeline.py :20
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/recovery.py :27
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/reporting.py :28
from pathlib import Path
show 28 more
- fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/reports.py :24
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/scope.py :18
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/session.py :21
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/setup.py :28
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/state.py :30
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/tui.py :14
from pathlib import Path - fs LeonardSEO-OpenBOLA-fde23cf/src/openbola/updates.py :17
import shutil - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/conftest.py :4
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_ai_boundary.py :6
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_ai_clients.py :5
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_capture.py :5
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_cli.py :6
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_demo_transcript.py :5
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_doctor.py :6
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_e2e.py :6
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_endpoints.py :3
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_executor.py :8
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_installers.py :1
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_launch_assets.py :5
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_mcp_server.py :5
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_mutation_boundary.py :3
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_mutations.py :5
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_packaging.py :7
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_paths.py :19
from pathlib import PureWindowsPath - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_recovery.py :6
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_release_workflow.py :1
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_report_boundary.py :6
from pathlib import Path - fs (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_report_command.py :4
from pathlib import Path
7 more not shown — this panel samples each group; the count above is the real total.
network 26
- net (weak) LeonardSEO-OpenBOLA-fde23cf/scripts/check_demo_transcript.py :12
from urllib.parse import urlsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/ai.py :15
from urllib.parse import urlsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/ai_clients.py :15
from urllib.parse import quote, urljoin, urlsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/capture.py :23
from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/discovery.py :24
from urllib.parse import urlsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/endpoints.py :19
from urllib.parse import parse_qsl, unquote, urlsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/executor.py :29
from urllib.parse import urljoin, urlsplit, urlunsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/extract.py :17
from urllib.parse import parse_qsl, unquote_plus, urlencode, urlsplit, urlunsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/mcp_server.py :29
from urllib.parse import urlsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/mutations.py :21
from urllib.parse import quote, urlsplit, urlunsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/pipeline.py :22
from urllib.parse import urlsplit, urlunsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/providers/firebase.py :36
from urllib.parse import urlsplit
show 14 more
- net LeonardSEO-OpenBOLA-fde23cf/src/openbola/providers/hasura.py :16
from urllib.parse import urlsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/providers/supabase.py :25
from urllib.parse import parse_qsl, urlsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/recovery.py :180
from urllib.parse import urlsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/reporting.py :30
from urllib.parse import quote - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/reports.py :26
from urllib.parse import quote - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/scope.py :20
from urllib.parse import unquote, urlsplit, urlunsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/session.py :25
from urllib.parse import urlsplit - net LeonardSEO-OpenBOLA-fde23cf/src/openbola/updates.py :28
from urllib.parse import SplitResult, urlsplit - net (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_ai_boundary.py :9
import httpx - net (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_ai_clients.py :8
import httpx - net (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_executor.py :11
import httpx - net (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_mcp_server.py :9
import httpx - net (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_mutations.py :8
import httpx - net (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_updates.py :11
import httpx
secrets 1
- secrets LeonardSEO-OpenBOLA-fde23cf/src/openbola/recovery.py :82
import keyring
database 8
- db LeonardSEO-OpenBOLA-fde23cf/src/openbola/doctor.py :16
import sqlite3 - db LeonardSEO-OpenBOLA-fde23cf/src/openbola/mcp_server.py :23
import sqlite3 - db LeonardSEO-OpenBOLA-fde23cf/src/openbola/pipeline.py :16
import sqlite3 - db LeonardSEO-OpenBOLA-fde23cf/src/openbola/reports.py :18
import sqlite3 - db LeonardSEO-OpenBOLA-fde23cf/src/openbola/state.py :23
import sqlite3 - db (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_doctor.py :5
import sqlite3 - db (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_mcp_server.py :4
import sqlite3 - db (weak) LeonardSEO-OpenBOLA-fde23cf/tests/test_state.py :5
import sqlite3
declared dependencies 16
- fastmcp@>=2,<4
- cryptography@>=50,<51
- httpx@>=0.27,<1
- keyring@>=25.7,<26
- pydantic@>=2.8,<3
- pyyaml@>=6,<7
- rich@>=13,<16
- textual@>=0.70,<1
- typer@>=0.12,<1
- playwright@>=1.48,<2
- mypy@>=1.13,<3
- pytest@>=8,<10
show 4 more
- pytest-cov@>=5,<8
- respx@>=0.22,<1
- ruff@>=0.8,<1
- types-pyyaml@>=6,<7