palisade-sec 0.1.0__tar.gz

palisade_sec-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install
+        run: uv sync --dev
+      - name: Lint
+        run: uv run ruff check .
+      - name: Format check
+        run: uv run ruff format --check src tests
+      - name: Tests
+        run: uv run pytest -q
+      - name: Self-check — the example app must fail CI mode
+        run: |
+          if uv run palisade-sec scan examples/vulnerable-app --ci; then
+            echo "expected non-zero exit on the vulnerable example app" && exit 1
+          fi
+      - name: Self-check — palisade's own source must be clean
+        run: uv run palisade-sec scan src --ci

palisade_sec-0.1.0/.gitignore

@@ -0,0 +1,10 @@
+.venv/
+__pycache__/
+*.pyc
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+palisade-report.md
+.palisade/

palisade_sec-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,58 @@
+# Contributing to Palisade
+
+Thanks for helping make LLM-security review as routine as running a linter.
+
+## The fastest way to contribute: rules
+
+Most coverage gaps are rule gaps, not engine gaps. Adding a framework's
+sources/LLM signatures/sinks is a small YAML PR with no engine changes —
+see [`src/palisade_sec/rules/README.md`](src/palisade_sec/rules/README.md)
+for the 5-minute guide. Every rule PR needs two fixtures: one that must be
+flagged, one same-shaped safe variant that must stay silent.
+
+## Ground rules (from the design philosophy)
+
+1. **Precision over recall.** A false positive is worse than a miss. If your
+   change flags something new, it needs a matching must-NOT-flag test.
+2. **Taint, not grep.** Findings require a complete source → LLM → sink path.
+3. **The engine operates only on the IR.** Never leak Python `ast` types into
+   `engine/` or rules; language specifics belong in `frontends/`.
+4. **The tool never runs scanned code.** `ast.parse` only. No network calls
+   in `scan`. Ever.
+5. **Partial defenses (denylists, confirmation gates) downgrade to MED —
+   they never suppress.** Real CVEs shipped with exactly those defenses.
+
+## Dev setup
+
+```bash
+git clone https://github.com/arpankernel/palisade && cd palisade
+uv sync
+uv run pytest          # the example-app FP tests are the ones that gate merges
+uv run ruff check .
+uv run palisade-sec scan examples/vulnerable-app --all
+```
+
+## Project layout
+
+```
+src/palisade_sec/
+├── frontends/   # language -> IR lowering (Python: stdlib ast)
+├── ir/          # normalized taint IR (language-agnostic)
+├── engine/      # taint propagation, sanitizer resolution, confidence
+├── rules/       # YAML rules + pydantic schema (community entry point)
+├── report/      # terminal / json / markdown emitters
+├── baseline.py  # CI baseline (fail only on NEW findings)
+└── cli.py       # Typer CLI
+examples/vulnerable-app/   # the acceptance fixtures — deliberately unsafe
+```
+
+## Adding a language frontend (post-v1)
+
+A frontend lowers source into `ir.Module` — see
+`frontends/ast_python.py` for the reference implementation. If your frontend
+emits correct IR, every existing rule and the whole engine work unchanged.
+Open an issue first so we can coordinate on tree-sitter setup.
+
+## Reporting vulnerabilities in Palisade itself
+
+Email the maintainers privately rather than opening a public issue.

palisade_sec-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Palisade contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

palisade_sec-0.1.0/PKG-INFO

@@ -0,0 +1,177 @@
+Metadata-Version: 2.5
+Name: palisade-sec
+Version: 0.1.0
+Summary: A linter for LLM security: statically detects prompt-injection-to-sink vulnerabilities in Python codebases.
+Project-URL: Homepage, https://github.com/arpankernel/palisade
+Project-URL: Issues, https://github.com/arpankernel/palisade/issues
+Author: Palisade contributors
+License: MIT
+License-File: LICENSE
+Keywords: linter,llm,prompt-injection,security,static-analysis,taint
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Requires-Dist: pydantic>=2.5
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.0
+Requires-Dist: typer>=0.12
+Description-Content-Type: text/markdown
+
+# Palisade
+
+**A linter for LLM security.** Palisade statically detects prompt-injection
+vulnerabilities in Python codebases — untrusted input flowing through an LLM
+into a dangerous sink — in CI, before they ship.
+
+```
+untrusted input  →  LLM  →  exec / shell / raw SQL   (no sanitizer)   ⇒  finding
+```
+
+No API key. No signup. No network calls. Pure static analysis.
+
+```bash
+uvx palisade-sec scan .
+```
+
+```
+HIGH  app.py:31  [PI-EXEC] Prompt injection reaching code execution
+  ↳ source:  question = request.json["question"]        (app.py:31)
+  ↳ llm:     resp = client.chat.completions.create(     (app.py:32)
+  ↳ sink:    exec(code)                                 (app.py:40)
+  No sanitizer on path.  Confidence: HIGH
+  Attack: crafted input makes the model emit Python that executes on your server.
+  Fix:    never exec model output; sandbox + strict allowlist (denylists are bypassable).
+  Refs:   CVE-2024-12366 (PandasAI); CVE-2025-3248 (Langflow, CISA KEV)
+```
+
+## Why
+
+This exact pattern is behind real, exploited CVEs: **Langflow**
+(CVE-2025-3248, on CISA KEV, exploited in the wild), **PandasAI**
+(CVE-2024-12366, CVSS 9.8), **Vanna.ai** (CVE-2024-5565), **LangChain**
+PAL/LLMMath chains (CVE-2023-36258, CVE-2023-29374). Almost nobody defends it
+at the code level: existing tools are runtime proxies (paid, in the traffic
+path) or guardrail libraries you have to know to wire in. Palisade is the
+missing piece — **free, static, LLM-dataflow-aware, and CI-native**, like
+ruff or semgrep but for the OWASP LLM Top-10 #1 risk.
+
+## What it detects (v1)
+
+| Rule | Path | Real-world precedent |
+|------|------|----------------------|
+| `PI-EXEC` | input → LLM → `exec` / `eval` / `compile` / `PythonREPL` | PandasAI, Langflow, LangChain PAL |
+| `PI-SHELL` | input → LLM → `os.system` / `subprocess(shell=True)` | Open Interpreter (by design) |
+| `PI-SQL` | input → LLM → raw non-parameterized SQL | Vanna.ai |
+
+Palisade runs **taint analysis, not grep**: it only reports a *complete*
+`source → LLM → sink` data-flow path with no sanitizer in between.
+
+- Constant developer prompt → LLM → `exec`? **Silent** — no untrusted source.
+- `subprocess.run([...])` with an arg list? **Silent** — safe sink shape.
+- Parameterized `cursor.execute(q, params)`? **Silent.**
+- Allowlist / pydantic validation on the path? **Silent** — sanitized.
+- Denylist or human-confirmation gate? **Flagged MED "risky"** — real CVEs
+  were exploited despite exactly those defenses. That is deliberate.
+
+## Install & run
+
+```bash
+# one-shot, no install
+uvx palisade-sec scan path/to/project
+
+# or
+pipx run palisade-sec scan .
+
+# or as a dev dependency
+uv add --dev palisade-sec
+```
+
+Useful flags:
+
+```bash
+palisade-sec scan . --all          # also show MED/LOW findings
+palisade-sec scan . --json         # stable machine-readable output
+palisade-sec scan . --report       # write palisade-report.md
+palisade-sec scan . --rules ./my-rules   # add your own YAML rules
+```
+
+## CI
+
+Gate pull requests on **new** findings only — adopt Palisade on an imperfect
+codebase without a wall of pre-existing failures:
+
+```bash
+palisade-sec baseline .                 # once; commit .palisade/baseline.json
+palisade-sec scan . --ci --baseline .palisade/baseline.json
+```
+
+`--ci` exits non-zero only if a **new HIGH** finding appears. Fingerprints are
+line-number independent, so refactors don't churn the baseline.
+
+GitHub Actions:
+
+```yaml
+- uses: astral-sh/setup-uv@v5
+- run: uvx palisade-sec scan . --ci --baseline .palisade/baseline.json
+```
+
+## Configuration
+
+`pyproject.toml`:
+
+```toml
+[tool.palisade]
+paths_ignore = ["migrations/*", "sandbox/*"]
+include_tests = false   # tests/** and conftest.py are skipped by default
+max_hops = 3            # inter-procedural depth bound
+```
+
+Or the same keys in `.palisade.toml`.
+
+## Custom rules
+
+Rules are plain YAML validated by a pydantic schema — sources, LLM call
+signatures, sinks, sanitizers, partial defenses. Adding coverage for a new
+framework is a small PR with **no engine changes**. See
+[`src/palisade_sec/rules/README.md`](src/palisade_sec/rules/README.md) for
+the 5-minute guide.
+
+## Architecture
+
+```
+source ──▶ language frontend (Python: stdlib ast) ──▶ normalized taint IR
+                                                        │
+                              language-agnostic engine ─┤ taint propagation,
+                              sanitizer resolution, confidence scoring
+                                                        │
+             YAML rules ──▶ findings ──▶ baseline diff ──▶ terminal / json / md
+```
+
+The frontend/IR split is the scalability story: JS/TS/Go land later as new
+frontends (tree-sitter) with zero engine changes.
+
+## Safety of the tool itself
+
+- Palisade **never executes, imports, or evaluates scanned code** — it only
+  parses source text with `ast.parse`.
+- `scan` makes **no network calls** and needs no API key or account.
+- No telemetry. Nothing leaves your machine.
+
+## An honest note on scope
+
+Palisade is **one layer** of defense against **one class** of vulnerability.
+A clean scan means no *detected* injection-to-sink path — it does not mean
+your application is secure. Keep your runtime guardrails, permissions
+boundaries, and sandboxes; Palisade complements them, before merge.
+
+## License
+
+MIT

palisade_sec-0.1.0/README.md

@@ -0,0 +1,150 @@
+# Palisade
+
+**A linter for LLM security.** Palisade statically detects prompt-injection
+vulnerabilities in Python codebases — untrusted input flowing through an LLM
+into a dangerous sink — in CI, before they ship.
+
+```
+untrusted input  →  LLM  →  exec / shell / raw SQL   (no sanitizer)   ⇒  finding
+```
+
+No API key. No signup. No network calls. Pure static analysis.
+
+```bash
+uvx palisade-sec scan .
+```
+
+```
+HIGH  app.py:31  [PI-EXEC] Prompt injection reaching code execution
+  ↳ source:  question = request.json["question"]        (app.py:31)
+  ↳ llm:     resp = client.chat.completions.create(     (app.py:32)
+  ↳ sink:    exec(code)                                 (app.py:40)
+  No sanitizer on path.  Confidence: HIGH
+  Attack: crafted input makes the model emit Python that executes on your server.
+  Fix:    never exec model output; sandbox + strict allowlist (denylists are bypassable).
+  Refs:   CVE-2024-12366 (PandasAI); CVE-2025-3248 (Langflow, CISA KEV)
+```
+
+## Why
+
+This exact pattern is behind real, exploited CVEs: **Langflow**
+(CVE-2025-3248, on CISA KEV, exploited in the wild), **PandasAI**
+(CVE-2024-12366, CVSS 9.8), **Vanna.ai** (CVE-2024-5565), **LangChain**
+PAL/LLMMath chains (CVE-2023-36258, CVE-2023-29374). Almost nobody defends it
+at the code level: existing tools are runtime proxies (paid, in the traffic
+path) or guardrail libraries you have to know to wire in. Palisade is the
+missing piece — **free, static, LLM-dataflow-aware, and CI-native**, like
+ruff or semgrep but for the OWASP LLM Top-10 #1 risk.
+
+## What it detects (v1)
+
+| Rule | Path | Real-world precedent |
+|------|------|----------------------|
+| `PI-EXEC` | input → LLM → `exec` / `eval` / `compile` / `PythonREPL` | PandasAI, Langflow, LangChain PAL |
+| `PI-SHELL` | input → LLM → `os.system` / `subprocess(shell=True)` | Open Interpreter (by design) |
+| `PI-SQL` | input → LLM → raw non-parameterized SQL | Vanna.ai |
+
+Palisade runs **taint analysis, not grep**: it only reports a *complete*
+`source → LLM → sink` data-flow path with no sanitizer in between.
+
+- Constant developer prompt → LLM → `exec`? **Silent** — no untrusted source.
+- `subprocess.run([...])` with an arg list? **Silent** — safe sink shape.
+- Parameterized `cursor.execute(q, params)`? **Silent.**
+- Allowlist / pydantic validation on the path? **Silent** — sanitized.
+- Denylist or human-confirmation gate? **Flagged MED "risky"** — real CVEs
+  were exploited despite exactly those defenses. That is deliberate.
+
+## Install & run
+
+```bash
+# one-shot, no install
+uvx palisade-sec scan path/to/project
+
+# or
+pipx run palisade-sec scan .
+
+# or as a dev dependency
+uv add --dev palisade-sec
+```
+
+Useful flags:
+
+```bash
+palisade-sec scan . --all          # also show MED/LOW findings
+palisade-sec scan . --json         # stable machine-readable output
+palisade-sec scan . --report       # write palisade-report.md
+palisade-sec scan . --rules ./my-rules   # add your own YAML rules
+```
+
+## CI
+
+Gate pull requests on **new** findings only — adopt Palisade on an imperfect
+codebase without a wall of pre-existing failures:
+
+```bash
+palisade-sec baseline .                 # once; commit .palisade/baseline.json
+palisade-sec scan . --ci --baseline .palisade/baseline.json
+```
+
+`--ci` exits non-zero only if a **new HIGH** finding appears. Fingerprints are
+line-number independent, so refactors don't churn the baseline.
+
+GitHub Actions:
+
+```yaml
+- uses: astral-sh/setup-uv@v5
+- run: uvx palisade-sec scan . --ci --baseline .palisade/baseline.json
+```
+
+## Configuration
+
+`pyproject.toml`:
+
+```toml
+[tool.palisade]
+paths_ignore = ["migrations/*", "sandbox/*"]
+include_tests = false   # tests/** and conftest.py are skipped by default
+max_hops = 3            # inter-procedural depth bound
+```
+
+Or the same keys in `.palisade.toml`.
+
+## Custom rules
+
+Rules are plain YAML validated by a pydantic schema — sources, LLM call
+signatures, sinks, sanitizers, partial defenses. Adding coverage for a new
+framework is a small PR with **no engine changes**. See
+[`src/palisade_sec/rules/README.md`](src/palisade_sec/rules/README.md) for
+the 5-minute guide.
+
+## Architecture
+
+```
+source ──▶ language frontend (Python: stdlib ast) ──▶ normalized taint IR
+                                                        │
+                              language-agnostic engine ─┤ taint propagation,
+                              sanitizer resolution, confidence scoring
+                                                        │
+             YAML rules ──▶ findings ──▶ baseline diff ──▶ terminal / json / md
+```
+
+The frontend/IR split is the scalability story: JS/TS/Go land later as new
+frontends (tree-sitter) with zero engine changes.
+
+## Safety of the tool itself
+
+- Palisade **never executes, imports, or evaluates scanned code** — it only
+  parses source text with `ast.parse`.
+- `scan` makes **no network calls** and needs no API key or account.
+- No telemetry. Nothing leaves your machine.
+
+## An honest note on scope
+
+Palisade is **one layer** of defense against **one class** of vulnerability.
+A clean scan means no *detected* injection-to-sink path — it does not mean
+your application is secure. Keep your runtime guardrails, permissions
+boundaries, and sandboxes; Palisade complements them, before merge.
+
+## License
+
+MIT

palisade_sec-0.1.0/examples/vulnerable-app/README.md

@@ -0,0 +1,15 @@
+# vulnerable-app (fixtures)
+
+A deliberately unsafe Flask app used as Palisade's acceptance fixtures.
+**Do not deploy or copy patterns from this app.**
+
+It contains, on purpose:
+- 4 exploitable source → LLM → sink paths (exec, raw SQL, shell, and a
+  multi-hop exec across three files) that must be flagged **HIGH**;
+- 1 denylist-gated exec that must be flagged **MED "risky"** — partial
+  defenses do not count as safe;
+- 6 safe variants (sanitizer, arg-list subprocess, parameterized SQL,
+  constant prompt, log-only output, enum-constrained output) that must stay
+  **silent** — the false-positive tests are the most important in the repo.
+
+`tests/test_example_app.py` pins every one of these expectations.

palisade_sec-0.1.0/examples/vulnerable-app/agent_pipeline.py

@@ -0,0 +1,10 @@
+"""Multi-hop fixture: source in app.py, LLM in llm_utils.py, sink in
+executor.py — this module is the middle hop."""
+
+from executor import execute_plan
+from llm_utils import ask_llm
+
+
+def run_agent(goal: str) -> str:
+    plan = ask_llm(f"Write Python code to accomplish: {goal}")
+    return execute_plan(plan)

palisade_sec-0.1.0/examples/vulnerable-app/app.py

@@ -0,0 +1,187 @@
+"""Deliberately vulnerable Flask app — Palisade's acceptance fixtures.
+
+DO NOT DEPLOY. Every route here is either a real LLM prompt-injection
+vulnerability (must be flagged), a safe variant (must stay silent), or a
+partially-defended variant (must be flagged MED "risky").
+"""
+
+import subprocess
+
+from flask import Flask, jsonify, request
+from openai import OpenAI
+
+from db import get_db
+from agent_pipeline import run_agent
+from guards import is_blocked_code, validate_code
+
+app = Flask(__name__)
+client = OpenAI()
+
+MODEL = "gpt-4o-mini"
+
+
+# ---------------------------------------------------------------------------
+# VULNERABLE — must be flagged HIGH
+# ---------------------------------------------------------------------------
+
+
+@app.route("/calc", methods=["POST"])
+def calc():
+    """VULN 1 (PI-EXEC, PandasAI-style): NL question -> LLM Python -> exec."""
+    question = request.json["question"]
+    resp = client.chat.completions.create(
+        model=MODEL,
+        messages=[
+            {"role": "system", "content": "Reply with Python code only."},
+            {"role": "user", "content": f"Write Python that answers: {question}"},
+        ],
+    )
+    code = resp.choices[0].message.content
+    exec(code)  # noqa: S102 — the vulnerability under test
+    return jsonify(status="done")
+
+
+@app.route("/ask-db")
+def ask_db():
+    """VULN 2 (PI-SQL, Vanna-style): text-to-SQL -> raw execute."""
+    question = request.args.get("q", "")
+    resp = client.chat.completions.create(
+        model=MODEL,
+        messages=[{"role": "user", "content": f"Write a SQL query for: {question}"}],
+    )
+    sql = resp.choices[0].message.content
+    cur = get_db().cursor()
+    cur.execute(sql)
+    return jsonify(rows=cur.fetchall())
+
+
+@app.route("/ops", methods=["POST"])
+def ops():
+    """VULN 3 (PI-SHELL): task description -> LLM shell command -> shell."""
+    task = request.form["task"]
+    resp = client.chat.completions.create(
+        model=MODEL,
+        messages=[{"role": "user", "content": f"Give me one shell command to: {task}"}],
+    )
+    command = resp.choices[0].message.content
+    subprocess.run(command, shell=True)
+    return jsonify(status="ran")
+
+
+@app.route("/agent", methods=["POST"])
+def agent():
+    """VULN 4 (PI-EXEC, multi-hop): source here, LLM in llm_utils.py,
+    sink in executor.py — three functions across three files."""
+    goal = request.json["goal"]
+    result = run_agent(goal)
+    return jsonify(result=result)
+
+
+# ---------------------------------------------------------------------------
+# PARTIAL DEFENSE — must be flagged MED "risky" (not HIGH, not silent)
+# ---------------------------------------------------------------------------
+
+
+@app.route("/calc-guarded", methods=["POST"])
+def calc_guarded():
+    """A denylist gate before exec, LangChain-PAL-style. Real CVEs were
+    exploited despite exactly this defense."""
+    question = request.json["question"]
+    resp = client.chat.completions.create(
+        model=MODEL,
+        messages=[{"role": "user", "content": f"Write Python that answers: {question}"}],
+    )
+    code = resp.choices[0].message.content
+    if is_blocked_code(code):
+        return jsonify(error="blocked"), 400
+    exec(code)  # noqa: S102 — still exploitable: denylists are bypassable
+    return jsonify(status="done")
+
+
+# ---------------------------------------------------------------------------
+# SAFE — must NOT be flagged
+# ---------------------------------------------------------------------------
+
+
+@app.route("/calc-safe", methods=["POST"])
+def calc_safe():
+    """SAFE (a): same shape as /calc, but the code is validated against a
+    strict AST allowlist before running."""
+    question = request.json["question"]
+    resp = client.chat.completions.create(
+        model=MODEL,
+        messages=[{"role": "user", "content": f"Write Python that answers: {question}"}],
+    )
+    code = validate_code(resp.choices[0].message.content)
+    exec(code)  # noqa: S102 — sanitized above
+    return jsonify(status="done")
+
+
+@app.route("/ping", methods=["POST"])
+def ping():
+    """SAFE (b): LLM output used as ONE ARGUMENT in an arg-list subprocess
+    call — no shell, no injection into a command line."""
+    where = request.json["where"]
+    resp = client.chat.completions.create(
+        model=MODEL,
+        messages=[{"role": "user", "content": f"Hostname most relevant to: {where}"}],
+    )
+    host = resp.choices[0].message.content.strip()
+    subprocess.run(["ping", "-c", "1", host], check=False)
+    return jsonify(status="ok")
+
+
+@app.route("/lookup", methods=["POST"])
+def lookup():
+    """SAFE (c): LLM output bound via a PARAMETERIZED query."""
+    description = request.json["description"]
+    resp = client.chat.completions.create(
+        model=MODEL,
+        messages=[{"role": "user", "content": f"Product name for: {description}"}],
+    )
+    product = resp.choices[0].message.content
+    cur = get_db().cursor()
+    cur.execute("SELECT * FROM products WHERE name = ?", (product,))
+    return jsonify(rows=cur.fetchall())
+
+
+def nightly_report():
+    """SAFE (d): constant developer prompt — no untrusted source at all."""
+    resp = client.chat.completions.create(
+        model=MODEL,
+        messages=[{"role": "user", "content": "Write Python that prints yesterday's date."}],
+    )
+    code = resp.choices[0].message.content
+    exec(code)  # noqa: S102 — developer-controlled prompt, not user input
+
+
+@app.route("/chat", methods=["POST"])
+def chat():
+    """SAFE (e): LLM output is only logged and returned — never executed."""
+    message = request.json["message"]
+    resp = client.chat.completions.create(
+        model=MODEL,
+        messages=[{"role": "user", "content": message}],
+    )
+    answer = resp.choices[0].message.content
+    app.logger.info("chat answer: %s", answer)
+    print(answer)
+    return jsonify(answer=answer)
+
+
+@app.route("/action", methods=["POST"])
+def action():
+    """SAFE (f): LLM output constrained to a literal enum before the sink."""
+    wish = request.json["wish"]
+    resp = client.chat.completions.create(
+        model=MODEL,
+        messages=[{"role": "user", "content": f"One of list|status|uptime for: {wish}"}],
+    )
+    verb = resp.choices[0].message.content.strip()
+    if verb in ("list", "status", "uptime"):
+        subprocess.run(verb, shell=True)
+    return jsonify(status="ok")
+
+
+if __name__ == "__main__":
+    app.run(debug=True)

palisade_sec-0.1.0/examples/vulnerable-app/db.py

@@ -0,0 +1,5 @@
+import sqlite3
+
+
+def get_db():
+    return sqlite3.connect("app.db")

palisade_sec-0.1.0/examples/vulnerable-app/executor.py

@@ -0,0 +1,6 @@
+"""Multi-hop fixture: the dangerous sink lives here."""
+
+
+def execute_plan(code: str) -> str:
+    exec(code)  # noqa: S102 — the vulnerability under test (multi-hop)
+    return "ok"