3 ms·
There is also a huge surface area of security problems that can't happen in practice due to how other parts of the code work. A classic example is unsanitized i
by DanielHB 6mo ago
There is also a huge surface area of security problems that can't happen in practice due to how other parts of the code work. A classic example is unsanitized input being used somewhere where untrusted users can't inject any input.
Being flooded with these kind of reports can make the actual real problems harder to see.
- arcfour 6mo agoThey wouldn't be classed as vulnerabilities then, since, you know, there is no vulnerability. Unless you have evidence that most of these issues are unexploitable, but I would be surprised to hear that they were considered vulnerabilities in that case.
- DanielHB 6mo agoI believe the LLM would flag this kind of thing as a potential issue.