Knowledge Base
Upload docs · BM25 + pgvector hybrid search · Cross-Encoder reranking
📤 Upload Document
Drag & drop file here, or click to upload
Supports coding standards, defect cases, API docs, etc.
.md · .txt · .py · .js · .ts · .java · .go · .pdf
filename.md0%
📚 Uploaded Documents GET /api/v1/knowledge/documents
OWASP Top 10 Secure Coding Standard
Historic Defect Case Collection 2023
Python Secure Dev Guide
TypeScript Best Practices
🔍 Knowledge Search BM25 + pgvector hybrid search
Search Results
BM25 + pgvector + RRF Fusion
97.3
OWASP A03 Injection Defense — Command Injection
Command injection is one of the most severe types. Attackers can execute arbitrary commands via crafted params. Defense: ① always use list args ② never use shell=True ③ whitelist all external inputs...
coding_standard
91.8
Historic Defect #2341 — Payment System Command Injection
Q3 2023: attacker triggered subprocess shell parsing via malicious filenames, gaining server control. Root cause: no input filtering and shell=True...
defect_case
84.2
Python Secure Dev Guide — Safe subprocess Usage
Python's subprocess shell param passes commands to /bin/sh, enabling & | ; $( ) shell metacharacters. Recommended: split command into a list...
coding_standard
76.5
CWE-78 OS Command Injection — Mitigation Checklist
Most effective CWE-78 mitigations: parameterized command calls, input validation (whitelist-first), least privilege, sandboxed execution...
coding_standard
68.1
SQL Injection Defense Patterns (Related Reference)
SQL injection and command injection differ mechanically, but defense principles are similar: parameterize, validate, least privilege...
coding_standard