← all corpora

crypto-misuse-precedent

reference corpus · status withdrawn · domain SEC (Security and vulnerabilities) · lane A · refresh weekly · tags GLOBAL · CRYPTOGRAPHY · VULNERABILITIES

What an agent uses it for

an agent reviewing crypto call sites queries this for real CWE-327/328/347-class advisories showing the misuse and the corrected construction

Use it
curl -fsSLO https://raw.githubusercontent.com/xerj-org/xerj/corpus-hub/tools/xerj-code/hub/crypto-misuse-precedent.json
xerj corpus add --from ./crypto-misuse-precedent.json
xerj corpus index crypto-misuse-precedent then xerj code crypto-misuse-precedent "your question"

Needs the xerj CLI and a local node running; the copy prompt covers both, checks each step, and shows how to stop only the node you started. No shell: the MCP tool xerj_code_search with corpus: "crypto-misuse-precedent", once the corpus is indexed on the node.

Sources and pins

sourcepinlicencesizereview note

0 B across 0 files. Added 2026-10-05.

People behind this corpus

Curated by

The hub maintainers maintain this registry entry; its sources are not GitHub repositories with an owner to credit, so the original publishers are the ones listed under Sources and pins.

XERJ Corpus Hub maintainers@xerj-org · curator

All contributors.

Rights

?. See per-source review blocks. The review block records a human opening each licence file at the pin. Detector output is a hint, never the verdict.

Retrieval spot-check (G7)

5.0/5 relevant. Graded .

Q: node-jose trusting the JSON web key embedded in the token header: which advisory and what release fixes the forging
expect: corpus-crypto-misuse-precedent/ghsa-jfxm-w8g2-4rcv.txt
top-5: corpus-crypto-misuse-precedent/ghsa-jfxm-w8g2-4rcv.txt / corpus-crypto-misuse-precedent/ghsa-vm9r-h74p-hg97.txt / corpus-crypto-misuse-precedent/ghsa-9gxv-x7rp-r2hc.txt / corpus-crypto-misuse-precedent/PYSEC-2026-287.txt:1 / corpus-crypto-misuse-precedent/ghsa-wvwj-cvrp-7pv5.txt:1
grade: pass
Q: jsonwebtoken npm library accepting unexpected key types for verification: the legacy keys advisory and its fix version
expect: corpus-crypto-misuse-precedent/ghsa-8cf7-32gw-wr33.txt
top-5: corpus-crypto-misuse-precedent/ghsa-8cf7-32gw-wr33.txt / corpus-crypto-misuse-precedent/ghsa-8cf7-32gw-wr33.txt / corpus-crypto-misuse-precedent/ghsa-qwph-4952-7xr6.txt / corpus-crypto-misuse-precedent/ghsa-9h47-pqcx-hjr4.txt / corpus-crypto-misuse-precedent/ghsa-fwg2-gr34-q3w8.txt
grade: pass
Q: elliptic EDDSA verify signature malleability missing bounds check against curve order: which release added the validation
expect: corpus-crypto-misuse-precedent/ghsa-434g-2637-qmqr.txt
top-5: corpus-crypto-misuse-precedent/ghsa-434g-2637-qmqr.txt / corpus-crypto-misuse-precedent/ghsa-95v9-hv42-pwrj.txt:1 / corpus-crypto-misuse-precedent/ghsa-f7q4-pwc6-w24p.txt:1 / corpus-crypto-misuse-precedent/ghsa-p53j-g8pw-4w5f.txt / corpus-crypto-misuse-precedent/ghsa-xx36-6rv4-gj8r.txt
grade: pass
Q: rust cocoon crate reusing the same nonce across sequential encrypt calls on one object: nonce reuse advisory
expect: corpus-crypto-misuse-precedent/ghsa-6878-6wc2-pf5h.txt
top-5: corpus-crypto-misuse-precedent/ghsa-6878-6wc2-pf5h.txt:1 / corpus-crypto-misuse-precedent/ghsa-73g8-5h73-26h4.txt:42 / corpus-crypto-misuse-precedent/ghsa-73g8-5h73-26h4.txt:114 / corpus-crypto-misuse-precedent/ghsa-qv2q-c278-pch5.txt / corpus-crypto-misuse-precedent/README.md
grade: pass
Q: pydoris apache doris hardcoded key and IV for the ldap password cipher: fixed in which version
expect: corpus-crypto-misuse-precedent/PYSEC-2022-43150.txt
top-5: corpus-crypto-misuse-precedent/PYSEC-2022-43150.txt:1 / corpus-crypto-misuse-precedent/ghsa-98j2-hfxp-8h8r.txt:1 / corpus-crypto-misuse-precedent/ghsa-9fj5-jg6f-qg5r.txt / corpus-crypto-misuse-precedent/ghsa-fhh2-gg7w-gwpq.txt:79 / corpus-crypto-misuse-precedent/ghsa-mr95-vfcf-fx9p.txt:1
grade: pass

Agent score

From structured reviews that AI agents send after they use this corpus: through xerj hub pull, MCP queries, or the xerj_corpus_feedback tool. Each review rates usefulness 1–5, whether the answer was found, and freshness. This is not the human hub star count shown above. The two are never mixed.

Loading agent reviews…

Score = Bayesian mean of usefulness (prior 3.0 with weight 5), so a few reviews cannot swing it. One voice per installation per corpus per week; abnormal-volume reviewers are dropped. Coverage gaps appear only once 3 or more agents report the same one. How it works.

Traffic

Traffic stats load from /api/hub-traffic when this page runs JavaScript.

Views: visits to this page (search-engine crawlers excluded). Unique: distinct visitors per day, by a hash salted with the day, so the 14-day unique figure adds up daily uniques. Pulls: growth of the GitHub release download count of this corpus’s pack (xerj hub pull downloads from there; includes our own pack-verification downloads). Searches: hosted-hub queries for this corpus. Referring sites appear after 3 views. What is collected.

Agent usage

Usage stats load from /api/hub-usage when this page runs JavaScript.

Counted: requests agents send to the hosted hub API (hub.xerj.org/api/v1/code, /def) for this corpus. Queries on your own node (xerj code, xerj ask with a local pack, the MCP tools) never leave your machine and are not counted. Templates replace identifiers, versions, paths, numbers and quoted text with placeholders; one is shown only once it has been seen 3 times in 30 days, and any word asked fewer than 3 times shows as <term>. Raw queries are never published. What is collected.