Security at input boundaries and in CI gates

The problem

In PgQueuer, seven configurable database object names went into DDL and queries unquoted, so a crafted name could run as SQL.

In Prefect, bundle dependencies went straight into a pip install subprocess, so a flag could slip in. In OWASP cve-lite-cli, a run could exit 1 with a green all-clear and nothing that named the gate.

What I built

PgQueuer in Python and PostgreSQL. Added an identifier validator for the seven settings, accepting dotted schema and table names, with tests.

Prefect in Python. Rejected flag-shaped lines and validated each dependency as PEP 508 before the subprocess, then added the tests the maintainer asked for.

OWASP cve-lite-cli in TypeScript. Printed the reason the gate tripped, made the ratchet gate fail when no baseline exists, and pinned the exit code separately. I mutation-tested my own tests to prove they fail without the guard.

extension.js. Patched two high-severity dependency advisories with the test suite green.

How the work ran

Each pull request went through the maintainers' review rounds until every requested change was done.

Result

3 pull requests merged in OWASP cve-lite-cli.

The OWASP maintainer reran the full suite on my ratchet branch, 168 suites and 2,371 tests, all green.

The Prefect fix merged into a project with 24,061 GitHub stars.

2 high-severity advisories fixed in extension.js.