Fastapi Repo Security Preflight

The problem

Manual security audits for FastAPI applications are slow and error-prone. Developers frequently ship code with hardcoded secrets, insecure CORS headers, or unverified webhooks that lead to production vulnerabilities.

What it does

• Scans code for hardcoded API keys, tokens, and database credentials using AST analysis.
• Detects insecure FastAPI configurations including debug mode, permissive CORS, and broad network binds.
• Identifies SQL injection risks in f-strings and unparameterized execute calls.
• Validates webhook implementations for missing HMAC or signature verification.
• Audits route handlers to ensure Pydantic models are used instead of raw JSON requests.

Frameworks & tools

FastAPI, Python 3.11+, Pydantic, Uvicorn, and SQL databases using SQLAlchemy or raw SQL drivers.

Why this beats prompting it yourself

General LLM prompts often miss subtle context-specific vulnerabilities or produce hallucinations. This skill uses deterministic AST scanning to ensure 100% coverage of your codebase without the token costs or privacy risks of sending your entire repo to an external API.

Use cases

• Running pre-deployment checks to block insecure code from hitting production.
• Auditing legacy FastAPI repositories for hidden secrets or raw SQL injections.
• Integrating into CI/CD pipelines to enforce security standards automatically.
• Ensuring webhook endpoints are properly protected by signature verification.

Known limitations

Requires Python 3.11 or higher. Scans are limited to static analysis and may not catch vulnerabilities hidden in dynamic string evaluations.