Start with the reports you already have. Choose where analysis runs. Follow a finding to its source—and a decision to its record.
Explore a real findingOne real contribution to open source. Explore the code, the trust boundary and the fix—each tied to a public record.
The client resolved the requested hostname and checked its IP. It then selected one agent from the original protocol and handed the request to Axios.
The important question is what happens after this adapter handoff.
Axios followed redirects inside the adapter. The advisory identifies a gap between checking the starting URL and checking the destination actually reached.
A protocol change also matters: only the original protocol’s agent had been configured.
The security boundary is the connection—not just the input URL.
The upstream advisory describes a server-side request forgery bypass for an authenticated user who controls an outbound URL. What could be reached depended on the deployment.
Read the upstream advisoryTwenty’s fix installs HTTP and HTTPS agents in safe mode. Each new connection checks the host and attaches validation to DNS resolution.
The lookup handler closes the socket if its resolved address fails the private-IP check.
Inspect the complete fix
httpAgent: createSsrfSafeAgent('http'), httpsAgent: createSsrfSafeAgent('https'), validateHost(options.host ?? undefined); return attachLookupValidation(super.createConnection(options, callback));610c0ebc · included in v1.18.0Public evidence establishes TraceMint’s finder credit. This walkthrough is not a recording of an internal scan; the fix is Twenty’s upstream work.
Read the research noteSelected source excerpts: twentyhq/twenty, GNU AGPL v3. Immutable revisions and original line ranges are linked beside each excerpt.
Start with the question your team needs to answer.
Bring a supported report into a defined project scope. Review the finding against available source context and keep the reasoning with the decision.
The imported report remains the starting evidence.
Decide who operates the application, who serves the model, and where analysis context travels. Each is a separate deployment choice.
| Route | Product location | Model context |
|---|---|---|
| SaaS | TraceMint | Configured hosted endpoint |
| Fully local | Your environment | Local model · stays inside |
| TraceMint LLM | Your environment | Context → TraceMint endpoint |
| BYOK | Your environment | Context → your model provider |
Hosted inference needs no customer GPU. Local inference needs suitable hardware. Review other integrations separately.
Inspect component scopes and source references. Review the evidence behind an inferred relationship as you explore the relevant part of the application.
billing/routes.ts:42Inspect the source behind the relationship. Review the AI interpretation.
Record a rationale and category. Keep the requester and reviewer distinct, set an expiry, and retain the audit trail behind a risk decision.
Restricted endpoint. Mitigation tracked with the application owner.
Accepting risk does not resolve or disprove the finding.
Bring a representative repository or supported SAST export, your model requirements and the decisions your team needs to make. We’ll walk through the relevant workflow and agree what a successful evaluation should demonstrate.