schemathesis-fuzzing
Audited by Socket on Nov 1, 2026
2 alerts found:
SecurityAnomalyDo not merge the production-targeting and reduced-coverage changes. The reported run was not read-only: it created six production records. Keep the useful manual trigger, JUnit artifact, and reporter change, but run generated cases against the branch preview using that preview's served OpenAPI document and a preview-scoped credential. Configure PREVIEW_TOKEN for the preview environment before relying on the job.
The branch is green by weakening enforcement, not by fixing the API: it removes module response validation and drastically reduces CLI sampling. Reject it as proposed. The 38 monetary-schema failures reflect a stale generated OpenAPI document after the intentional 9.2.0 serialization change; update it through its generator/source workflow. The remaining 3 failures are distinct server errors with the reproducers and impacts described above and should remain gating or be explicitly tracked with an approved temporary policy. No malicious behavior is evident in the supplied code.