Skip to content

fix(interceptor): remove trusted-agent verification bypass to prevent false cryptographic endorsement (closes #5)#20

Merged
Rahul Dass (rahuldass19) merged 4 commits into
mainfrom
fix/issue-5-remove-trusted-bypass
May 24, 2026
Merged

fix(interceptor): remove trusted-agent verification bypass to prevent false cryptographic endorsement (closes #5)#20
Rahul Dass (rahuldass19) merged 4 commits into
mainfrom
fix/issue-5-remove-trusted-bypass

fix(deps): add httpx and pytest-cov to dev dependencies

20d18bc
Select commit
Loading
Failed to load commit list.
QWED Security / QWED Security completed May 24, 2026 in 6s

QWED Security — NEUTRAL

QWED Security Verification Report

4 files scanned | 0 blocked | 13 warnings | 0 info | 2 verified

Engines: pattern_scan, python_ast, secret_scan, shell_safety, policy_config

Advisory Warnings

File Line Context Issue
src/qwed_a2a/interceptor.py L275 RUNTIME_CODE compile() can be part of dynamic code generation.
src/qwed_a2a/interceptor.py L276 RUNTIME_CODE compile() can be part of dynamic code generation.
src/qwed_a2a/interceptor.py L277 RUNTIME_CODE compile() can be part of dynamic code generation.
src/qwed_a2a/interceptor.py L281 RUNTIME_CODE compile() can be part of dynamic code generation.
src/qwed_a2a/interceptor.py L282 RUNTIME_CODE compile() can be part of dynamic code generation.
src/qwed_a2a/interceptor.py L283 RUNTIME_CODE compile() can be part of dynamic code generation.
src/qwed_a2a/interceptor.py L284 RUNTIME_CODE compile() can be part of dynamic code generation.
src/qwed_a2a/interceptor.py L285 RUNTIME_CODE compile() can be part of dynamic code generation.
tests/test_endpoints.py L134 TEST_CODE assert should not be the only input-validation boundary.
tests/test_endpoints.py L135 TEST_CODE assert should not be the only input-validation boundary.
tests/test_endpoints.py L136 TEST_CODE assert should not be the only input-validation boundary.
tests/test_endpoints.py L163 TEST_CODE assert should not be the only input-validation boundary.
tests/test_endpoints.py L164 TEST_CODE assert should not be the only input-validation boundary.

Verified Files

  • pyproject.toml
  • tests/test_interceptor.py

Verified by QWED — deterministic security verification. No LLM used.

Details

Scan completed in 6.3s. Engines: pattern_scan, python_ast, secret_scan, shell_safety, policy_config.

Annotations

Check warning on line 275 in src/qwed_a2a/interceptor.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

compile() can be part of dynamic code generation. Context=RUNTIME_CODE. Decision reason: Executable runtime path contains a risky but non-blocking pattern.

Check warning on line 276 in src/qwed_a2a/interceptor.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

compile() can be part of dynamic code generation. Context=RUNTIME_CODE. Decision reason: Executable runtime path contains a risky but non-blocking pattern.

Check warning on line 277 in src/qwed_a2a/interceptor.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

compile() can be part of dynamic code generation. Context=RUNTIME_CODE. Decision reason: Executable runtime path contains a risky but non-blocking pattern.

Check warning on line 281 in src/qwed_a2a/interceptor.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

compile() can be part of dynamic code generation. Context=RUNTIME_CODE. Decision reason: Executable runtime path contains a risky but non-blocking pattern.

Check warning on line 282 in src/qwed_a2a/interceptor.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

compile() can be part of dynamic code generation. Context=RUNTIME_CODE. Decision reason: Executable runtime path contains a risky but non-blocking pattern.

Check warning on line 283 in src/qwed_a2a/interceptor.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

compile() can be part of dynamic code generation. Context=RUNTIME_CODE. Decision reason: Executable runtime path contains a risky but non-blocking pattern.

Check warning on line 284 in src/qwed_a2a/interceptor.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

compile() can be part of dynamic code generation. Context=RUNTIME_CODE. Decision reason: Executable runtime path contains a risky but non-blocking pattern.

Check warning on line 285 in src/qwed_a2a/interceptor.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

compile() can be part of dynamic code generation. Context=RUNTIME_CODE. Decision reason: Executable runtime path contains a risky but non-blocking pattern.

Check warning on line 134 in tests/test_endpoints.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

assert should not be the only input-validation boundary. Context=TEST_CODE. Decision reason: Pattern detected in test code; surfaced as advisory instead of blocking runtime execution.

Check warning on line 135 in tests/test_endpoints.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

assert should not be the only input-validation boundary. Context=TEST_CODE. Decision reason: Pattern detected in test code; surfaced as advisory instead of blocking runtime execution.

Check warning on line 136 in tests/test_endpoints.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

assert should not be the only input-validation boundary. Context=TEST_CODE. Decision reason: Pattern detected in test code; surfaced as advisory instead of blocking runtime execution.

Check warning on line 163 in tests/test_endpoints.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

assert should not be the only input-validation boundary. Context=TEST_CODE. Decision reason: Pattern detected in test code; surfaced as advisory instead of blocking runtime execution.

Check warning on line 164 in tests/test_endpoints.py

See this annotation in the file changed.

@qwed-security qwed-security / QWED Security

QWED: pattern_scan 

assert should not be the only input-validation boundary. Context=TEST_CODE. Decision reason: Pattern detected in test code; surfaced as advisory instead of blocking runtime execution.
View more details on QWED Security