FINANCE Code: getsentry/sentry-python/.agents/skills/security-review/references/cryptography.md -> checksum = hashlib.sha256(data).hexdigest() ``` ### Insufficient Key Size ```python # VULNERABLE: Short key key = b'short_key' # 9 bytes # SAFE: Adequate key length key = secrets.token_bytes(32) # 256 bits ``` ### Predictable IV/Nonce ```python # VULNERABLE: Reused or predictable nonce nonce = b'\x0

Instruction: Réponds à la question suivante sur FINANCE. Output: response.

checksum = hashlib.sha256(data).hexdigest() ``` ### Insufficient Key Size ```python # VULNERABLE: Short key key = b'short_key' # 9 bytes # SAFE: Adequate key length key = secrets.token_bytes(32) # 256 bits ``` ### Predictable IV/Nonce ```python # VULNERABLE: Reused or predictable nonce nonce = b'\x00' * 12 # Static nonce # VULNERABLE: Counter-based without persistence nonce = counter.to_bytes(12, 'big') # SAFE: Random nonce nonce = secrets.token_bytes(12) ``` ### ECB Mode Patterns ```python # VULNERABLE: ECB reveals patterns cipher = AES.new(key, AES.MODE_ECB) # SAFE: GCM hides patterns cipher = AES.new(key, AES.MODE_GCM, nonce=nonce) ``` ### Missing Authentication ```python # VULNERABLE: Encryption without authentication cipher = AES.new(key, AES.MODE_CBC, iv=iv) ciphertext = cipher.encrypt(pad(plaintext, 16)) # Vulnerable to bit-flipping, padding oracle # SAFE: Authenticated encryption cipher = AES.new(key, AES.MODE_GCM, nonce=nonce) ciphertext, tag = cipher.encrypt_and_digest(plaintext) ``` --- ## Grep Patterns for Detection ```bash # Weak algorithms grep -rn "MD5\|md5\|SHA1\|sha1\|DES\|des\|RC4\|rc4" --include="*.py" --include="*.js" grep -rn "MODE_ECB\|ecb" --include="*.py" --include="*.js" # Insecure random grep -rn "Math\.random\|random\.random\|random\.randint" --include="*.py" --include="*.js" grep -rn "mt_rand\|rand()" --include="*.php" # Hardcoded keys grep -rn "key\s*=\s*['\"]" --include="*.py" --include="*.js" grep -rn "secret\s*=\s*['\"]" --include="*.py" --include="*.js" grep -rn "AES\.new.*b'" --include="*.py" # Static IVs/nonces grep -rn "iv\s*=\s*b'\|nonce\s*=\s*b'" --include="*.py" grep -rn "\\x00.*\\x00.*\\x00" --include="*.py" # CBC without HMAC grep -rn "MODE_CBC" --include="*.py" | grep -v "hmac\|mac\|tag" ``` --- ## Testing Checklist - [ ] No hardcoded keys/secrets in source code - [ ] Keys not committed to version control - [ ] Using modern algorithms (AES-GCM, RSA-2048+, SHA-256+) - [ ] CSPRNG used for all security-sensitive randomness - [ ] Keys stored securely (HSM, KMS, secrets manager) - [ ] Key rotation mechanism exists - [ ] No ECB mode usage - [ ] Authenticated encryption used (GCM, or encrypt-then-MAC) - [ ] Adequate key lengths (256-bit symmetric, 2048+ RSA) - [ ] IVs/nonces are random and never reused with same key --- ## References - [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) - [OWASP Key Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Key_Management_Cheat_Sheet.html) - [CWE-327: Use of Broken Crypto Algorithm](https://cwe.mitre.org/data/definitions/327.html) - [CWE-330: Insufficient Randomness](https://cwe.mitre.org/data/definitions/330.html) - [CWE-321: Hard-coded Cryptographic Key](https://cwe.mitre.org/data/definitions/321.html)

Prompt: checksum = hashlib.sha256(data).hexdigest() ``` ### Insufficient Key Size ```python # VULNERABLE: Short key key = b'short_key' # 9 bytes # SAFE: Adequate key length key = secrets.token_bytes(32) # 256 bits ``` ### Predictable IV/Nonce ```python # VULNERABLE: Reused or predictable nonce nonce = b'\x00' * 12 # Static nonce # VULNERABLE: Counter-based without persistence nonce = counter.to_bytes(12, 'big') # SAFE: Random nonce nonce = secrets.token_bytes(12) ``` ### ECB Mode Patterns ```python # VULNERABLE: ECB reveals patterns cipher = AES.new(key, AES.MODE_ECB) # SAFE: GCM hides patterns cipher = AES.new(key, AES.MODE_GCM, nonce=nonce) ``` ### Missing Authentication ```python # VULNERABLE: Encryption without authentication cipher = AES.new(key, AES.MODE_CBC, iv=iv) ciphertext = cipher.encrypt(pad(plaintext, 16)) # Vulnerable to bit-flipping, padding oracle # SAFE: Authenticated encryption cipher = AES.new(key, AES.MODE_GCM, nonce=nonce) ciphertext, tag = cipher.encrypt_and_digest(plaintext) ``` --- ## Grep Patterns for Detection ```bash # Weak algorithms grep -rn "MD5\|md5\|SHA1\|sha1\|DES\|des\|RC4\|rc4" --include="*.py" --include="*.js" grep -rn "MODE_ECB\|ecb" --include="*.py" --include="*.js" # Insecure random grep -rn "Math\.random\|random\.random\|random\.randint" --include="*.py" --include="*.js" grep -rn "mt_rand\|rand()" --include="*.php" # Hardcoded keys grep -rn "key\s*=\s*['\"]" --include="*.py" --include="*.js" grep -rn "secret\s*=\s*['\"]" --include="*.py" --include="*.js" grep -rn "AES\.new.*b'" --include="*.py" # Static IVs/nonces grep -rn "iv\s*=\s*b'\|nonce\s*=\s*b'" --include="*.py" grep -rn "\\x00.*\\x00.*\\x00" --include="*.py" # CBC without HMAC grep -rn "MODE_CBC" --include="*.py" | grep -v "hmac\|mac\|tag" ``` --- ## Testing Checklist - [ ] No hardcoded keys/secrets in source code - [ ] Keys not committed to version control - [ ] Using modern algorithms (AES-GCM, RSA-2048+, SHA-256+) - [ ] CSPRNG used for all security-sensitive randomness - [


FINANCE Code: vercel/next.js/.agents/skills/flags/SKILL.md -> Feature Flags Use this skill when adding or changing framework feature flags in Next.js internals. ## Required Wiring All flags need: `config-shared.ts` (type) → `config-schema.ts` (zod). If the flag is consumed in user-bundled code (client components, edge routes, `app-page.ts` template), also add

Instruction: Réponds à la question suivante sur FINANCE. Output: response.

Feature Flags Use this skill when adding or changing framework feature flags in Next.js internals. ## Required Wiring All flags need: `config-shared.ts` (type) → `config-schema.ts` (zod). If the flag is consumed in user-bundled code (client components, edge routes, `app-page.ts` template), also add it to `define-env.ts` for build-time injection. Runtime-only flags consumed exclusively in pre-compiled bundles can skip `define-env.ts`. ## Where the Flag Is Consumed **Client/bundled code only** (e.g. `__NEXT_PPR` in client components): `define-env.ts` is sufficient. Webpack/Turbopack replaces `process.env.X` at the user's build time. **Pre-compiled runtime bundles** (e.g. code in `app-render.tsx`): The flag must also be set as a real `process.env` var at runtime, because `app-render.tsx` runs from pre-compiled bundles where `define-env.ts` doesn't reach. Two approaches: - **Runtime env var**: Set in `next-server.ts` + `export/worker.ts`. Both code paths stay in one bundle. Simple but increases bundle size. - **Separate bundle variant**: Add DefinePlugin entry in `next-runtime.webpack-config.js` (scoped to `bundleType === 'app'`), new taskfile tasks, update `module.compiled.js` selector, and still set env var in `next-server.ts` + `export/worker.ts` for bundle selection. Eliminates dead code but adds build complexity. For runtime flags, also add the field to the `NextConfigRuntime` Pick type in `config-shared.ts`. ## Runtime-Bundle Model - Runtime bundles are built by `next-runtime.webpack-config.js` (rspack) via `taskfile.js` bundle tasks. - Bundle selection occurs at runtime in `src/server/route-modules/app-page/module.compiled.js` based on `process.env` vars. - Variants: `{turbo/webpack} × {experimental/stable/nodestreams/experimental-nodestreams} × {dev/prod}` = up to 16 bundles per route type. - `define-env.ts` affects user bundling, not pre-compiled runtime internals. - `process.env.X` checks in `app-render.tsx` are either replaced by DefinePlugin at runtime-bundle-build time, or read as actual env vars at server startup. They are NOT affected by the user's defines from `define-env.ts`. - **Gotcha**: DefinePlugin entries in `next-runtime.webpack-config.js` must be scoped to the correct `bundleType` (e.g. `app` only, not `server`) to avoid replacing assignment targets in `next-server.ts`. ## Related Skills - `$dce-edge` - DCE-safe require patterns and edge constraints - `$react-vendoring` - entry-base boundaries and vendored React - `$runtime-debug` - reproduction and verification workflow

Prompt: Feature Flags Use this skill when adding or changing framework feature flags in Next.js internals. ## Required Wiring All flags need: `config-shared.ts` (type) → `config-schema.ts` (zod). If the flag is consumed in user-bundled code (client components, edge routes, `app-page.ts` template), also add it to `define-env.ts` for build-time injection. Runtime-only flags consumed exclusively in pre-compiled bundles can skip `define-env.ts`. ## Where the Flag Is Consumed **Client/bundled code only** (e.g. `__NEXT_PPR` in client components): `define-env.ts` is sufficient. Webpack/Turbopack replaces `process.env.X` at the user's build time. **Pre-compiled runtime bundles** (e.g. code in `app-render.tsx`): The flag must also be set as a real `process.env` var at runtime, because `app-render.tsx` runs from pre-compiled bundles where `define-env.ts` doesn't reach. Two approaches: - **Runtime env var**: Set in `next-server.ts` + `export/worker.ts`. Both code paths stay in one bundle. Simple but increases bundle size. - **Separate bundle variant**: Add DefinePlugin entry in `next-runtime.webpack-config.js` (scoped to `bundleType === 'app'`), new taskfile tasks, update `module.compiled.js` selector, and still set env var in `next-server.ts` + `export/worker.ts` for bundle selection. Eliminates dead code but adds build complexity. For runtime flags, also add the field to the `NextConfigRuntime` Pick type in `config-shared.ts`. ## Runtime-Bundle Model - Runtime bundles are built by `next-runtime.webpack-config.js` (rspack) via `taskfile.js` bundle tasks. - Bundle selection occurs at runtime in `src/server/route-modules/app-page/module.compiled.js` based on `process.env` vars. - Variants: `{turbo/webpack} × {experimental/stable/nodestreams/experimental-nodestreams} × {dev/prod}` = up to 16 bundles per route type. - `define-env.ts` affects user bundling, not pre-compiled runtime internals. - `process.env.X` checks in `app-render.tsx` are either replaced by DefinePlugin at runtime-bundl


Samuel Dinsmoor (disambiguation)

Samuel Dinsmore may refer to: Samuel Dinsmoor (1766–1835), American politician, U.S. Congressman and Governor of New Hampshire Samuel Dinsmoor Jr. (1799–1869), American banker, Governor of New Hampshire Samuel P. Dinsmoor (1843–1932), eccentric American sculptor and landscape designer