LEAKCADEReport, 2026-10-13
Example report. Our pipeline generated this from OWASP NodeGoat, a public training app that is vulnerable on purpose, without the AI step. Your report uses the same format.
LEAKCADEREPORT 2026-10-13

OWASP/NodeGoat

https://github.com/OWASP/NodeGoat @ c5cb68a
CRITICAL 1HIGH 3MEDIUM 1
NOT READY TO SHIP

Summary

We found 1 critical, 3 high and 1 medium issues. Start with "Private key committed to the repo": it's the most urgent thing to fix. Each finding below lists the exact files and a prompt you can paste into Cursor or Claude Code.

Fix in this order

  1. Private key committed to the repoCRIT
  2. 128 dependencies with known vulnerabilitiesHIGH
  3. User input reaches eval()HIGH
  4. Secret or API key in the code (probable)HIGH

Findings

CRITCritical 1

Private key committed to the repo

artifacts/cert/server.key:1
WHY IT MATTERS

Anyone who can read the repo can impersonate your server or decrypt its traffic.

DO THIS NOW

Rotate (revoke and re-create) these keys in the provider's dashboard now. Deleting them from code is not enough.

FIX PROMPT FOR CURSOR OR CLAUDE CODE
Remove the committed private key files, add them to .gitignore, load keys from env variables or a secret store, and tell me which keys to regenerate. Files: artifacts/cert/server.key.
Source: gitleaks (files + git history)

HIGHHigh 3

128 dependencies with known vulnerabilities

bson@1.0.9 (CVSS 9.8) in package-lock.json, fsevents@1.2.9 (CVSS 9.8) in package-lock.json, getobject@0.1.0 (CVSS 9.8) in package-lock.json, growl@1.9.2 (CVSS 9.8) in package-lock.json and 124 more
WHY IT MATTERS

These package versions have published security advisories. Many are build or dev tools; the ones your app imports directly matter most. Updating is usually quick.

FIX PROMPT FOR CURSOR OR CLAUDE CODE
Run the package manager's audit/update for the flagged lockfiles. Update direct dependencies first to versions that fix the listed advisories, run the tests, and tell me about breaking changes. Packages: bson@1.0.9; fsevents@1.2.9; getobject@0.1.0; growl@1.9.2; handlebars@4.0.5; json-schema@0.2.3; minimist@0.0.10; minimist@0.0.8; minimist@1.2.0; minimist@1.2.5.
Source: OSV-Scanner

User input reaches eval()

app/routes/contributions.js:32, app/routes/contributions.js:33, app/routes/contributions.js:34
WHY IT MATTERS

Code built from what a visitor sends lets an attacker run their own code on your server.

FIX PROMPT FOR CURSOR OR CLAUDE CODE
Remove eval()/new Function() on request data in the flagged files. Parse the input explicitly (parseInt, JSON.parse plus validation). Keep behavior the same for valid input. Files: app/routes/contributions.js.
Source: Semgrep CE + Leakcade rules

Secret or API key in the code (probable)

config/env/test.js:6, config/env/development.js:18
WHY IT MATTERS

Public repos are scanned by bots for keys within minutes. A leaked key can run up your bill or expose your data.

NOTE

Matched a generic key pattern. Check that it's a real key before rotating.

DO THIS NOW

Rotate (revoke and re-create) these keys in the provider's dashboard now. Deleting them from code is not enough.

FIX PROMPT FOR CURSOR OR CLAUDE CODE
Find every hardcoded secret flagged in these files, move each one to an environment variable, add .env to .gitignore, create .env.example with placeholders, and list which keys I must rotate. Files: config/env/development.js, config/env/test.js.
Source: gitleaks (files + git history)

MEDMedium 1

Open redirect

app/routes/index.js:72
WHY IT MATTERS

Attackers can send phishing links that start with your domain and bounce users to a fake site.

FIX PROMPT FOR CURSOR OR CLAUDE CODE
Only allow redirects to relative paths starting with '/' (and not '//'), or to an allow-list of URLs. Fall back to '/' otherwise. Files: app/routes/index.js.
Source: Semgrep CE + Leakcade rules

Next steps

  1. Rotate every leaked key first. Removing it from the code doesn't help once it has been pushed.
  2. Work down the list above. Paste one fix prompt at a time and review each diff before you commit.
  3. Run through your app's main flows after fixing (login, payments, data writes).
  4. If your app handles money or personal data, book a human security review as well.
How the score works: we start at 100 and subtract 25 per critical (max 60), 10 per high (max 30) and 3 per medium (max 15) finding. Any critical finding caps the score at 49. Use it as a guide. It is not a certification. This is an AI-assisted first-pass review. It can miss issues and can be wrong, so every finding names its file for you to check. Your code was never executed, and the clone was deleted after this report.