Intentional test fixture for Flagrix — contains no functional malicious code.
This repository exists so you can try the Flagrix security scanner and see its medium-risk / "review before cloning" verdict end to end. It reproduces the shape of patterns that warrant a closer look — but nothing here is clearly malicious, and nothing works.
Every value is deliberately non-functional. Nothing in this repository executes, connects to a real server, or performs any harmful action:
- The base64 strings decode to harmless placeholder text — no encoded payload, URL, or command.
- The API key is a random throwaway string, not a real credential.
- The database URL points at
localhostwith fake credentials. - The cookie and clipboard reads return their values to the caller and go nowhere — there is no network destination.
Do not "fix" these patterns — they exist on purpose.
| File | Pattern | Severity |
|---|---|---|
src/encoder.js |
heavy base64 encoding (6+ long strings) | medium |
src/analytics.js |
reads document.cookie |
medium |
src/analytics.js |
reads the clipboard (navigator.clipboard.readText) |
medium |
src/config.js |
hardcoded API key committed to source | high |
src/config.js |
hardcoded database connection string | medium |
Expected verdict: MEDIUM RISK — review before cloning (several medium findings, none critical, so the score lands in the middle band).