AUTH/SESSION PRE-SCAN REPORT
============================
files scanned : 3
findings      : 15

[HIGH  ] AUTH-PW-WEAKHASH       app.py:8
         md5/sha1 applied to a password/credential — trivially brute-forced; use a salted KDF
[HIGH  ] AUTH-JWT-NOVERIFY      app.py:14
         JWT signature verification explicitly disabled — any forged token is accepted
[HIGH  ] AUTH-JWT-NONE-ALG      app.py:18
         JWT 'none' algorithm accepted/selected — unsigned tokens would be treated as valid
[HIGH  ] AUTH-PW-WEAKHASH       site.php:2
         md5/sha1 applied to a password/credential — trivially brute-forced; use a salted KDF
[MEDIUM] AUTH-JWT-SECRET-LIT    api.ts:4
         jwt sign/verify with an inline literal secret — hardcoded signing keys leak with the repo
[MEDIUM] AUTH-PREDICTABLE-TOKEN api.ts:12
         non-CSPRNG used to mint a token/session/reset/nonce value — predictable by an attacker
[MEDIUM] AUTH-SESSION-FIXATION  api.ts:21
         session id taken from request input — attacker can fix the victim's session id
[MEDIUM] AUTH-PW-HARDCODED      app.py:22
         credential compared to a hardcoded literal — password/secret in source
[MEDIUM] AUTH-SESSION-FIXATION  site.php:4
         session id taken from request input — attacker can fix the victim's session id
[MEDIUM] AUTH-COOKIE-FLAGS      site.php:5
         session/auth cookie set without HttpOnly — readable by injected script
[LOW   ] AUTH-JWT-NO-EXP        api.ts:4
         jwt.sign without an expiry — token never expires
[LOW   ] AUTH-JWT-NOVERIFY      api.ts:8
         jwt.decode() reads claims without verifying the signature — ensure a verify() precedes any authz decision
[LOW   ] AUTH-LOCALSTORAGE-TOKEN api.ts:17
         token/session written to web storage — readable by any injected script (XSS)
[LOW   ] AUTH-TIMING-COMPARE    app.py:31
         credential material compared with ==/!= — non-constant-time compare leaks bytes; use a timing-safe compare
[LOW   ] AUTH-DISABLED          app.py:39
         auth decorator/middleware appears commented out — confirm the route is still protected

Scope: deterministic pre-scan only — not an audit.