Fix it, then check again.修好之後，再檢查一次。

01

A small API with planted problems一個刻意放入問題的小型 API

inventory-api-demo is a small Flask service written for this demo. It has five planted problems:inventory-api-demo 是為這次示範寫的小型 Flask 服務，刻意放入五種問題：

• a private deploy key in the folder, created for this demo and never used anywhere;資料夾裡有一把部署用私鑰，為示範而產生，從未在任何地方使用；
• YAML input loaded with the unsafe loader;用不安全的方式載入 YAML 輸入；
• PyYAML 5.3.1, which has a known critical vulnerability;使用有已知重大弱點的 PyYAML 5.3.1；
• a container that runs as root;容器以 root 身分執行；
• a ping endpoint that passes user input to a shell.ping 端點把使用者輸入交給 shell 執行。

02

First scan: 13 problems第一次掃描：13 個問題

The app scanned the folder with eight tools in about 13 minutes on the test computer. All eight completed. The report shows their 26 findings as 13 problems, 6 of them Critical or High, and starts with the vulnerable PyYAML version.程式用八個工具掃描這個資料夾，在測試電腦上約 13 分鐘完成，八個工具都跑完。報告把它們的 26 筆發現整理成 13 個問題，其中 6 個是重大或高風險，並建議先處理有弱點的 PyYAML 版本。

03

The fix修正

One commit fixed four of the five problems and left the shell call alone. It also turned on Flask debug mode on purpose, to see whether the check catches a new problem.一個 commit 修正了五種問題中的四種，shell 呼叫則維持原樣；另外刻意開啟 Flask 的除錯模式，看看檢查能不能抓到新問題。

deploy/deploy_key    deleted
.gitignore           added: deploy/*_key

--- a/app.py
+++ b/app.py
 def import_inventory():
-    # Accepts an inventory list as YAML.
-    items = yaml.load(request.data, Loader=yaml.Loader)
-    return jsonify({"imported": len(items or [])})
+    # Accepts an inventory list as YAML. safe_load builds only plain data.
+    items = yaml.safe_load(request.data)
+    if not isinstance(items, list):
+        return jsonify({"error": "expected a list"}), 400
+    return jsonify({"imported": len(items)})
 ...
 if __name__ == "__main__":
-    app.run(host="127.0.0.1", port=8080)
+    app.run(host="127.0.0.1", port=8080, debug=True)

--- a/requirements.txt
+++ b/requirements.txt
-PyYAML==5.3.1
+PyYAML==6.0.2

--- a/Dockerfile
+++ b/Dockerfile
+RUN useradd --create-home --uid 10001 app
+USER app

04

Choose the fixed folder again重新選擇修正後的資料夾

A scan reads a copy of the folder saved when you choose it. Before checking again, choose the folder again in My scans → Check fixes. Here the new copy had 3 files changed, 1 added and 1 removed.掃描讀取的是選擇資料夾時保存的副本。再次檢查前，先到「我的掃描 → 確認修復」重新選擇資料夾。這次的新副本有 3 個檔案變更、1 個新增、1 個移除。

05

What changed比較結果

The same eight tools ran again, in about 12 minutes. Every check completed in both scans with the same tool versions, so every problem could be compared.同樣的八個工具再跑一次，約 12 分鐘。兩次掃描的每項檢查都已完成，工具版本也相同，所以每個問題都能比較。

06

What this demo does not show這次沒有涵蓋的部分

• The deleted key is still in the project's git history and in any earlier copy. The folder scan no longer finds it, but a real key must still be revoked or rotated.刪除的私鑰仍留在專案的 git 歷史與先前的副本中。資料夾掃描已找不到它，但真實的金鑰仍要撤銷或更換。
• Only the source folder was checked. The service was not run, no container image was built and no website was tested.這次只檢查原始碼資料夾：沒有執行服務、沒有建置容器映像，也沒有測試網站。
• 7 problems remain, and the new debug setting must be turned off before deployment.仍有 7 個問題，新開啟的除錯設定也必須在部署前關閉。

07

Read both reports閱讀兩次掃描的報告

Both reports were saved from the app with sensitive identifiers hidden, so the asset is named Asset 1.兩份報告都從程式儲存，並遮罩敏感識別資訊，所以資產名稱顯示為「Asset 1」。

How these files were made: README · File checksums: SHA256SUMS.txt製作方式：說明文件 · 檔案雜湊值：SHA256SUMS.txt