Snyk Goof
Snyk’s intentionally-vulnerable Node.js demo with documented CVEs.
- Upstream: https://github.com/snyk/goof
- Pinned commit:
add14ba59e98240d9e00a235dd7d42cd61ae9912 - Reference: master HEAD 2026-05-17
- Baseline scan date: 2026-05-17
Vulnerabilities brass detects
These are the specific lines brass catches in this codebase. Re-running brass at the pinned commit reproduces each one. 4 required findings:
| File | Line | Category | Detected by | CWE / Bandit ID |
|---|---|---|---|---|
app.js | 43 | hardcoded_credential | SecretsScanner | Weak express-session secret (CWE-798) |
mongoose-db.js | 52 | hardcoded_credential | SecretsScanner | Hardcoded admin password (CWE-798) |
typeorm-db.js | 12 | hardcoded_credential | SecretsScanner | Hardcoded database password (CWE-798) |
routes/index.js | 328 | hardcoded_credential | SecretsScanner | Hardcoded password in mock user list (CWE-798) |
Documented vulnerabilities brass doesn’t yet catch
Honest list of gaps — vulnerabilities documented upstream but missed by brass’s current scanner set. We publish these so customers see the full picture, not just successes. 3 aspirational entries:
| File | Line | Category | What brass doesn’t catch yet |
|---|---|---|---|
routes/index.js | 174 | command_injection | Command Injection via exec(identify + url) (CWE-78) |
routes/index.js | 52 | nosql_injection | NoSQL Injection via Mongoose find with raw req.body (CWE-943) |
package.json | 1 | vulnerable_dependency | Vulnerable npm dependencies (multiple CVEs incl. lodash CVE-2019-10744) |
Reproduce locally
git clone https://github.com/snyk/goof.git project
cd project && git checkout add14ba59e98240d9e00a235dd7d42cd61ae9912
brasscoders --offline scan .Then check .brass/detailed_analysis.yaml for the listed findings.