Find security flaws in your code.

BeforeWhat we found

# interpolated straight into SQL
def report(group_by, start, end):
    q = f'SELECT sum(amount) FROM tx ' \
        f'WHERE ts BETWEEN %s AND %s ' \
        f'GROUP BY {group_by}'
    return db.execute(q, [start, end])

# params are bound, the column name is not
# SAST scored this LOW: "parameterised query"

AfterAfter the fix

# column resolved from a fixed allowlist
COLUMNS = {"day", "merchant", "region"}

def report(group_by, start, end):
    if group_by not in COLUMNS:
        raise ValueError("bad grouping")
    ...

# identifier can no longer come from a user