F

HikmShield Security Report

Security Grade: F  ·  Score: 10/100

Project: /tmp/demo-saas-app

Scanned: August 19, 2026 at 12:22 AM EDT · 19 files in 24ms · v0.6.1

Executive Summary

F
Security Grade
34
Critical Issues
25
High Issues
12
Medium Issues
19
Files Scanned
3
Auto-Fixable

OWASP Top 10 (2021) Coverage

A01:2021A02:2021A03:2021A04:2021A05:2021A06:2021A07:2021A08:2021A09:2021A10:2021

Remediation Roadmap

Immediate — fix before next deploy (34 findings)
CRITICAL
Hardcoded Anthropic API key in source
.env.example:9
+33more in the full report
Short-term — fix within this sprint (25 findings)
HIGH
dangerouslySetInnerHTML without visible sanitization
app/ai-summary/page.tsx:5
+24more in the full report
Planned — address in upcoming work (12 findings)
MEDIUM
LLM API call without max_tokens
app/api/llm/agent/route.ts:8
+11more in the full report

Score Breakdown

Critical categories (Auth, Secrets, Injection, RLS, Access control, Validation, Path traversal)
0/100
High categories (XSS, CSRF, Dependencies, Rate limiting, Webhooks, Crypto, JWT, LLM injection, Cookies, AI security)
0/100
Medium categories (CORS, File upload, Exposure, Silent failures, Headers)
30/100

Severity Distribution

Critical: 34High: 25Medium: 12

Findings

One example per severity is shown below. The full report itemises every finding with evidence, location and a fix.

CRITICAL (34)

CRITICALHardcoded Anthropic API key in source
Secrets.env.example:9
A02:2021CWE-798

Anthropic API key appears literally in a source file. Move to environment variable and add the file to .gitignore. Rotate the key — assume it is leaked.

Evidence:
sk-ant…ghij
Fix: Move the Anthropic API key to process.env and ensure the env file is gitignored. Rotate the secret.
Before:
sk-ant-…ghij
After:
process.env.ANTHROPIC_API_KEY
+33more critical findings — itemised in the full report

HIGH (25)

HIGHdangerouslySetInnerHTML without visible sanitization
XSSapp/ai-summary/page.tsx:5
A03:2021CWE-79

Rendering raw HTML with dangerouslySetInnerHTML is the most common XSS vector. Sanitize with DOMPurify or sanitize-html before rendering. If the content is markdown, use a renderer that escapes HTML by default.

Evidence:
dangerouslySetInnerHTML={{ __html: aiResponse }}
Fix: Wrap the html string with DOMPurify.sanitize(html) before passing it to dangerouslySetInnerHTML, or render via a markdown library that escapes by default.
Before:
dangerouslySetInnerHTML={{ __html: userHtml }}
After:
dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userHtml) }}
+24more high findings — itemised in the full report

MEDIUM (12)

MEDIUMLLM API call without max_tokens
AI securityapp/api/llm/agent/route.ts:8
A04:2021CWE-770

Calling the Anthropic or OpenAI API without max_tokens means a single request can consume the model's full context window (up to 200k tokens for Claude). This enables denial-of-wallet attacks and unbounded latency spikes. Set an explicit max_tokens appropriate to your use case.

Evidence:
messages.create({
Fix: Add max_tokens: <N> to the API call. For most responses 512–4096 is appropriate; reserve higher limits for deliberate long-form generation.
Before:
anthropic.messages.create({ model: 'claude-...', messages: [...] })
After:
anthropic.messages.create({ model: 'claude-...', max_tokens: 1024, messages: [...] })
+11more medium findings — itemised in the full report

Scan Metadata

Scanned at August 19, 2026 at 12:22 AM EDT
Duration 24ms
Files scanned 19
Scanner version v0.6.1
Stack detected
Next.jsSupabaseStripeTypeScript
Total findings 71

HikmShield performs static analysis across 22 security categories. Static analysis has inherent limits — complement this report with dynamic testing, penetration testing, and dependency auditing (npm audit).