All findings
500 findings across categories.
Category:
Severity:
Rule:
500 findings
| Category | Rule | Evidence | Actions | ||
|---|---|---|---|---|---|
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:82 | {"role": "user", "content": USER_PROMPT_SUMMARIZE_TEXT.format(text=query)}Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:335 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:84 | ) Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:85 | # ... Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:86 | ``` Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:207 | system_message = """You are a friendly, helpful customer support agent for a SaaS product. Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:88 | ## 2. Common Patterns and Anti-patterns Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:89 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:90 | ### 2.1 Prompt Engineering Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:91 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:92 | Effective prompting is paramount. Follow the "Five-Element Prompt Template" for consistency and optimal results: **Role/Persona, Context, Task, Format, Constraints.** Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:93 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:94 | #### 2.1.1 Model Selection Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:142 | Text: {text}Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:96 | Always target the **latest, most capable model** (e.g., `gpt-4o`). Newer models are generally more intelligent, easier to prompt, and offer better performance. Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:97 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:98 | #### 2.1.2 Clear Instructions and Delimiters Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:99 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:100 | Place instructions at the beginning of the prompt. Use clear delimiters (e.g., `###`, `"""`) to separate instructions from context. Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:101 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:102 | ❌ **BAD**: Ambiguous instruction placement Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:103 | ```python Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:104 | prompt = f"Summarize the text below as a bullet point list of the most important points. {text_input}"Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:105 | ``` Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/openai.mdc:106 | Scope-checking auth functions defined but never consumed by route handlers |
Page 1 of 20