Contoso eCommerce API

DotNet

Critical

59

Security Factor Score

Exposed

4

Critical Findings

5

High Findings

17

Total Findings

7-Pillar Breakdown

Code

20% weight

Supply Chain

15% weight

Runtime/API

15% weight

Infra/Config

15% weight

Compliance

15% weight

Proactive

10% weight

Observability

10% weight

Application Details

Name	Contoso eCommerce API
Technology	DotNet
Repository	https://github.com/contoso/ecommerce-api
Source Path	/src/Contoso.Api
Branch	main
Type	Americas
Business Unit	Digital Commerce
Owner	James Chen
Contact	james.chen@contoso.com
Created	Dec 01, 2025
Last Scan	Jun 01, 2026 16:02

Recent Findings

Critical

AWS Access Key exposed in configuration file

Secrets — Hardcoded Secret

Open

Critical

Reflected XSS in error message display

SAST — Cross-Site Scripting

Open

Critical

SQL Injection in user search query

SAST — SQL Injection

Open

Critical

CVE-2024-30105: .NET denial of service in System.Text.Json

SCA — Vulnerable Dependency

Open

High

Stripe API key found in JavaScript bundle

Secrets — Exposed API Key

Open

High

Unsafe JSON deserialization with TypeNameHandling

SAST — Insecure Deserialization

Open

High

Missing authorization check on admin endpoint

SAST — Broken Access Control

Open

High

S3 bucket allows public read access

IaC — Security Misconfiguration

Open

Dependencies (8)

Package	Version	Vulns
BouncyCastle	`1.8.9`	2
Dapper	`2.1.28`
log4net	`2.0.14`
Microsoft.EntityFrameworkCore	`9.0.2`
MudBlazor	`7.6.0`
Newtonsoft.Json	`13.0.1`	1
SharpZipLib	`1.3.3`	1
System.Text.Json	`8.0.0`	1

Secret Exposures (5)

AWS Access Key

src/config/aws-config.json:8 — AKIA3...HN2Q

API Key (Stripe)

src/Services/PaymentService.cs:15 — sk_live_51...gKlP

Private Key

.ssh/id_rsa:1 — -----BEGIN RSA PRI...

Database Password

src/appsettings.Production.json:5 — Password=Pr0d...x!

JWT Secret

src/config/auth.json:3 — super-se...key123

Scan History

Type	Status	Findings	Critical	High	Duration	Date	Initiated By
SAST	Completed	7	2	2	125.0s	Jun 01, 08:02	User
SCA	Completed	0	0	0	101.0s	Jun 01, 07:02	User
IaC	Completed	0	0	0	140.0s	Jun 01, 02:02	User
Config	Completed	0	0	0	98.0s	May 31, 20:02	User
Full Scan	Completed	17	4	5	57.0s	May 31, 06:02	Schedule
Secrets	Completed	0	0	0	134.0s	May 31, 06:02	User