OWASP PyGoat
Django app demonstrating OWASP Top 10 vulnerabilities in Python.
- Upstream: https://github.com/adeyosemanputra/pygoat
- Pinned commit:
c11e8429349cc05ff38564d3bf7ef09fb2411874 - Reference: v2.0.1 release tag
- Baseline scan date: 2026-05-17
Vulnerabilities brass detects
These are the specific lines brass catches in this codebase. Re-running brass at the pinned commit reproduces each one. 7 required findings:
| File | Line | Category | Detected by | CWE / Bandit ID |
|---|---|---|---|---|
introduction/views.py | 857 | hardcoded_credential | auth_pattern_analyzer | Hardcoded Credentials (CWE-798) |
introduction/views.py | 859 | hardcoded_credential | auth_pattern_analyzer | Hardcoded Credentials (CWE-798) |
introduction/views.py | 861 | hardcoded_credential | auth_pattern_analyzer | Hardcoded Credentials (CWE-798) |
introduction/views.py | 863 | hardcoded_credential | auth_pattern_analyzer | Hardcoded Credentials (CWE-798) |
introduction/views.py | 529 | hardcoded_credential | SecretsScanner | Hardcoded secret keyword in source (CWE-798) |
introduction/views.py | 423 | command_injection | bandit | OS Command Injection via subprocess shell=True (CWE-78, Bandit B602) |
introduction/views.py | 1017 | weak_crypto | bandit | Weak Hash: MD5 (CWE-327, Bandit B324) |
Documented vulnerabilities brass doesn’t yet catch
Honest list of gaps — vulnerabilities documented upstream but missed by brass’s current scanner set. We publish these so customers see the full picture, not just successes. 4 aspirational entries:
| File | Line | Category | What brass doesn’t catch yet |
|---|---|---|---|
introduction/views.py | 421 | command_injection | OS Command Injection via subprocess shell taint |
introduction/views.py | 155 | sql_injection | A01: SQL Injection via string concatenation |
introduction/views.py | 211 | deserialization | A08: Insecure Deserialization via pickle.loads |
introduction/views.py | 451 | code_injection | A03: Insecure Design via eval() |
Reproduce locally
git clone https://github.com/adeyosemanputra/pygoat.git project
cd project && git checkout c11e8429349cc05ff38564d3bf7ef09fb2411874
brasscoders --offline scan .Then check .brass/detailed_analysis.yaml for the listed findings.