Sec-Context

// PSEUDOCODE

// BAD: Hardcoded API keys
CONSTANT API_KEY = "sk-abcd1234efgh5678"
CONSTANT DB_PASSWORD = "super_secret_password"

FUNCTION call_api(endpoint):
    headers = {"Authorization": "Bearer " + API_KEY}
    RETURN http.get(endpoint, headers)

// GOOD: Environment variables
FUNCTION call_api(endpoint):
    api_key = environment.get("API_KEY")
    IF api_key IS NULL:
        THROW Error("API_KEY required")
    headers = {"Authorization": "Bearer " + api_key}
    RETURN http.get(endpoint, headers)

// PSEUDOCODE

// BAD: String concatenation
FUNCTION get_user(user_id):
    query = "SELECT * FROM users WHERE id = " + user_id
    RETURN database.execute(query)

// Attacker input: "1 OR 1=1 --"
// Result: Returns ALL users!

// GOOD: Parameterized queries
FUNCTION get_user(user_id):
    query = "SELECT * FROM users WHERE id = ?"
    RETURN database.execute(query, [user_id])

// PSEUDOCODE

// BAD: Direct HTML injection (86% AI failure rate!)
FUNCTION display_comment(comment):
    element.innerHTML = comment

// Attacker input: "<script>steal(cookies)</script>"

// GOOD: Encode output for context
FUNCTION display_comment(comment):
    element.textContent = comment
    // Or use HTML encoding function
    element.innerHTML = html_encode(comment)

// PSEUDOCODE

// BAD: Shell command with user input
FUNCTION ping_host(hostname):
    command = "ping -c 4 " + hostname
    RETURN shell.execute(command)

// Attacker input: "google.com; rm -rf /"

// GOOD: Use argument arrays, avoid shell
FUNCTION ping_host(hostname):
    IF NOT is_valid_hostname(hostname):
        THROW Error("Invalid hostname")
    RETURN process.spawn("ping", ["-c", "4", hostname])

// PSEUDOCODE

// BAD: Plaintext or weak hashing
FUNCTION save_password(password):
    database.insert({password: password})  // Plaintext!
    database.insert({password: md5(password)})  // Weak!
    database.insert({password: sha256(password)})  // No salt!

// GOOD: bcrypt/argon2 with proper cost
FUNCTION save_password(password):
    hashed = bcrypt.hash(password, cost=12)
    database.insert({password_hash: hashed})