feat: add production infrastructure #114

hacktron-app-stg · 2026-07-23T09:19:52Z

Publicly Readable S3 Bucket with Public Access Block Disabled

The aws_s3_bucket named backups is configured with acl = "public-read", and the associated aws_s3_bucket_public_access_block explicitly disables all public access block protections. This exposes any objects stored in the bucket (such as production backups) to the public internet, allowing unauthenticated users to download sensitive backup files.

Steps to Reproduce

Deploy the Terraform configuration in testerror/infra.tf using terraform apply.

Upload a file to the created S3 bucket corp-prod-backups.

Access the uploaded file via its public URL (e.g., https://corp-prod-backups.s3.amazonaws.com/<filename>) from an unauthenticated browser session.

Observe that the file is successfully downloaded without any authentication.

Fix with AI

A security vulnerability was found by Hacktron. File: infra.tf Lines: 4-15 Severity: high Vulnerability: Publicly Readable S3 Bucket with Public Access Block Disabled Description: The `aws_s3_bucket` named `backups` is configured with `acl = "public-read"`, and the associated `aws_s3_bucket_public_access_block` explicitly disables all public access block protections. This exposes any objects stored in the bucket (such as production backups) to the public internet, allowing unauthenticated users to download sensitive backup files. Proof of Concept: **Steps to Reproduce** 1. Deploy the Terraform configuration in `testerror/infra.tf` using `terraform apply`. 2. Upload a file to the created S3 bucket `corp-prod-backups`. 3. Access the uploaded file via its public URL (e.g., `https://corp-prod-backups.s3.amazonaws.com/<filename>`) from an unauthenticated browser session. 4. Observe that the file is successfully downloaded without any authentication. Affected Code: resource "aws_s3_bucket" "backups" { bucket = "corp-prod-backups" acl = "public-read" } resource "aws_s3_bucket_public_access_block" "backups" { bucket = aws_s3_bucket.backups.id block_public_acls = false block_public_policy = false ignore_public_acls = false restrict_public_buckets = false } Acceptance criteria: - Acceptance is defined by the **actual reported behavior**, not by tests passing. - Reproduce the issue, or narrow the exact code path that produces it, *before* changing code. State what you confirmed. - Fix the underlying cause. Mitigations that paper over the reported behavior do not count as a fix. - Add a regression test that fails on the unpatched code and passes on the fix. If a regression test is genuinely impractical (e.g. race condition, infra-level issue), say so and explain why. - Existing tests passing is **not** the bar. Do not declare done on tests-pass theatre. Only change what is necessary to fix this vulnerability. Do not refactor adjacent code or modify unrelated files.

_{Triage: Reply !fp <reason> (false positive), !valid (confirmed), !accepted_risk <reason>, or !fixed (resolved). Any other reply is saved as a triage note.}
_{Reason is optional but improves future scans — e.g. !fp internal endpoint, not user-facing.}

_{View finding in Hacktron}

A fix for this finding has been opened: #121

hacktron-app-stg · 2026-07-23T09:19:52Z

Overly Permissive Security Group Allowing Unrestricted Ingress

The security group open is configured to allow inbound traffic on all ports (0-65535) from any IP address (0.0.0.0/0). This completely disables network-level ingress filtering, exposing any associated resources to attacks from the entire internet.

Steps to Reproduce

Open ./testerror/infra.tf and locate the aws_security_group resource named open (lines 18-27).

Note the ingress block configuration:

from_port = 0

to_port = 65535

protocol = "-1"

cidr_blocks = ["0.0.0.0/0"]

Running terraform apply with this configuration will provision a security group in AWS that allows unrestricted inbound traffic from any source IP on all ports, exposing any attached resources to the public internet.

Fix with AI

A security vulnerability was found by Hacktron. File: infra.tf Lines: 18-27 Severity: high Vulnerability: Overly Permissive Security Group Allowing Unrestricted Ingress Description: The security group `open` is configured to allow inbound traffic on all ports (`0-65535`) from any IP address (`0.0.0.0/0`). This completely disables network-level ingress filtering, exposing any associated resources to attacks from the entire internet. Proof of Concept: **Steps to Reproduce** 1. Open `./testerror/infra.tf` and locate the `aws_security_group` resource named `open` (lines 18-27). 2. Note the `ingress` block configuration: - `from_port = 0` - `to_port = 65535` - `protocol = "-1"` - `cidr_blocks = ["0.0.0.0/0"]` 3. Running `terraform apply` with this configuration will provision a security group in AWS that allows unrestricted inbound traffic from any source IP on all ports, exposing any attached resources to the public internet. Affected Code: resource "aws_security_group" "open" { name = "allow-all" ingress { from_port = 0 to_port = 65535 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } } Acceptance criteria: - Acceptance is defined by the **actual reported behavior**, not by tests passing. - Reproduce the issue, or narrow the exact code path that produces it, *before* changing code. State what you confirmed. - Fix the underlying cause. Mitigations that paper over the reported behavior do not count as a fix. - Add a regression test that fails on the unpatched code and passes on the fix. If a regression test is genuinely impractical (e.g. race condition, infra-level issue), say so and explain why. - Existing tests passing is **not** the bar. Do not declare done on tests-pass theatre. Only change what is necessary to fix this vulnerability. Do not refactor adjacent code or modify unrelated files.

_{Triage: Reply !fp <reason> (false positive), !valid (confirmed), !accepted_risk <reason>, or !fixed (resolved). Any other reply is saved as a triage note.}
_{Reason is optional but improves future scans — e.g. !fp internal endpoint, not user-facing.}

_{View finding in Hacktron}

A fix for this finding has been opened: #122

hacktron-app-stg · 2026-07-23T09:19:52Z

Publicly Accessible and Unencrypted RDS Instance

The aws_db_instance resource named prod is configured with publicly_accessible = true and storage_encrypted = false. This exposes the database directly to the public internet and fails to encrypt the data at rest. Combined with the hardcoded credentials, this allows any internet-facing attacker to connect to and compromise the database.

Steps to Reproduce

Inspect the ./testerror/infra.tf file.

Observe the aws_db_instance resource named prod defined with publicly_accessible = true, storage_encrypted = false, and a hardcoded password SuperSecret123!.

If this Terraform configuration is applied, the resulting database will be exposed to the internet and accessible via the hardcoded credentials.

Fix with AI

A security vulnerability was found by Hacktron. File: infra.tf Lines: 30-37 Severity: high Vulnerability: Publicly Accessible and Unencrypted RDS Instance Description: The `aws_db_instance` resource named `prod` is configured with `publicly_accessible = true` and `storage_encrypted = false`. This exposes the database directly to the public internet and fails to encrypt the data at rest. Combined with the hardcoded credentials, this allows any internet-facing attacker to connect to and compromise the database. Proof of Concept: **Steps to Reproduce** 1. Inspect the `./testerror/infra.tf` file. 2. Observe the `aws_db_instance` resource named `prod` defined with `publicly_accessible = true`, `storage_encrypted = false`, and a hardcoded password `SuperSecret123!`. 3. If this Terraform configuration is applied, the resulting database will be exposed to the internet and accessible via the hardcoded credentials. Affected Code: resource "aws_db_instance" "prod" { engine = "postgres" instance_class = "db.t3.large" username = "admin" password = "SuperSecret123!" # hardcoded secret committed to source storage_encrypted = false # no encryption at rest publicly_accessible = true # reachable from the internet } Acceptance criteria: - Acceptance is defined by the **actual reported behavior**, not by tests passing. - Reproduce the issue, or narrow the exact code path that produces it, *before* changing code. State what you confirmed. - Fix the underlying cause. Mitigations that paper over the reported behavior do not count as a fix. - Add a regression test that fails on the unpatched code and passes on the fix. If a regression test is genuinely impractical (e.g. race condition, infra-level issue), say so and explain why. - Existing tests passing is **not** the bar. Do not declare done on tests-pass theatre. Only change what is necessary to fix this vulnerability. Do not refactor adjacent code or modify unrelated files.

_{Triage: Reply !fp <reason> (false positive), !valid (confirmed), !accepted_risk <reason>, or !fixed (resolved). Any other reply is saved as a triage note.}
_{Reason is optional but improves future scans — e.g. !fp internal endpoint, not user-facing.}

_{View finding in Hacktron}

A fix for this finding has been opened: #123

hacktron-app-stg · 2026-07-23T09:19:52Z

Unencrypted EBS Volume

The EBS volume is configured with storage encryption disabled, leaving the data at risk in the event of unauthorized access to physical storage or snapshots.

Steps to Reproduce

Inspect the Terraform configuration file ./testerror/infra.tf.

Locate the aws_ebs_volume resource named data (lines 40-44).

Observe that the encrypted attribute is explicitly set to false.

Running terraform apply with this configuration will provision an unencrypted EBS volume in AWS.

Fix with AI

A security vulnerability was found by Hacktron. File: infra.tf Lines: 40-44 Severity: medium Vulnerability: Unencrypted EBS Volume Description: The EBS volume is configured with storage encryption disabled, leaving the data at risk in the event of unauthorized access to physical storage or snapshots. Proof of Concept: **Steps to Reproduce** 1. Inspect the Terraform configuration file `./testerror/infra.tf`. 2. Locate the `aws_ebs_volume` resource named `data` (lines 40-44). 3. Observe that the `encrypted` attribute is explicitly set to `false`. 4. Running `terraform apply` with this configuration will provision an unencrypted EBS volume in AWS. Acceptance criteria: - Acceptance is defined by the **actual reported behavior**, not by tests passing. - Reproduce the issue, or narrow the exact code path that produces it, *before* changing code. State what you confirmed. - Fix the underlying cause. Mitigations that paper over the reported behavior do not count as a fix. - Add a regression test that fails on the unpatched code and passes on the fix. If a regression test is genuinely impractical (e.g. race condition, infra-level issue), say so and explain why. - Existing tests passing is **not** the bar. Do not declare done on tests-pass theatre. Only change what is necessary to fix this vulnerability. Do not refactor adjacent code or modify unrelated files.

_{Triage: Reply !fp <reason> (false positive), !valid (confirmed), !accepted_risk <reason>, or !fixed (resolved). Any other reply is saved as a triage note.}
_{Reason is optional but improves future scans — e.g. !fp internal endpoint, not user-facing.}

_{View finding in Hacktron}

Navigation Menu

feat: add production infrastructure #114

Uh oh!

Diff view

Diff view

There are no files selected for viewing

hacktron-app-stg Bot Jul 23, 2026

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Uh oh!

-Original file line number
+Diff line change
@@ -0,0 +1,44 @@
+    # Production infrastructure (AWS)
+    # VULN 1: Publicly readable S3 bucket — backup objects exposed to the internet.
+    resource "aws_s3_bucket" "backups" {
+      bucket = "corp-prod-backups"
+      acl    = "public-read"
+    }
+    resource "aws_s3_bucket_public_access_block" "backups" {
+      bucket                  = aws_s3_bucket.backups.id
+      block_public_acls       = false
+      block_public_policy     = false
+      ignore_public_acls      = false
+      restrict_public_buckets = false
+    }
+    # VULN 2: Security group open to the entire internet on every port (incl. SSH).
+    resource "aws_security_group" "open" {
+      name = "allow-all"
+      ingress {
+        from_port   = 0
+        to_port     = 65535
+        protocol    = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+      }
+    }
+    # VULN 3: Unencrypted, publicly accessible RDS with a hardcoded master password.
+    resource "aws_db_instance" "prod" {
+      engine              = "postgres"
+      instance_class      = "db.t3.large"
+      username            = "admin"
+      password            = "SuperSecret123!" # hardcoded secret committed to source
+      storage_encrypted   = false             # no encryption at rest
+      publicly_accessible = true              # reachable from the internet
+    }
+    # VULN 4: Unencrypted EBS volume.
+    resource "aws_ebs_volume" "data" {
+      availability_zone = "us-east-1a"
+      size              = 100
+      encrypted         = false
+    }

feat: add production infrastructure #114

Are you sure you want to change the base?

Uh oh!

feat: add production infrastructure #114

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

hacktron-app-stg Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

hacktron-app-stg Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!