`endpoint_risk`

Endpoint Risk — a PullGuard finding type. Findings of this type appear in the PR comment, Step Summary, SARIF (GitHub Security tab / IDE viewers), and the HTML report, each with severity, location, and the remediation guidance below.

How to fix

Fix compounding factors together — individual fixes leave gaps medium effort

// Example: /api/admin/export has missing_auth + sql_injection +
// high reachability. Fix order matters:
//   1. Add auth guard first (blocks anonymous exploit window)
//   2. Sanitize tainted input (defense in depth even behind auth)
//   3. Add integration test covering "authenticated user can NOT
//      SQL-inject" — proves both fixes held together

Review reachability — high-fan-in files deserve stricter review low effort

// A bug in src/utils/db.ts (fan-in 87) affects all 87 callers.
// Apply defense-in-depth: parameterized queries + input validation
// at the caller AND the helper, not just one layer.

Triage

Suppress a confirmed non-issue with a committed .pullguardignore entry (pullguard ignore locally, or comment /pullguard ignore <fingerprint> <reason> on the PR — the fingerprint is printed in the PR comment’s Triage section). Entries support expiresAt for time-boxed snoozes.

Security findings at major or critical severity — and any critical finding — always surface: .pullguardignore cannot hide them. The reviewed paths that keep them visible are acknowledged (reviewed, stays in reports) and, for a confirmed false positive, a reasoned false_positive entry — visible and audited, excluded only from the merge block.