rules-scala

Hardcoded credentials in Scala source are compiled into the JAR. Use sys.env('SECRET_KEY') or a configuration library (PureConfig, Typesafe Config) reading from environment variables.

Java ObjectInputStream deserialization is a well-known RCE vector. Use circe, play-json, upickle, or protobuf for safe serialization instead.

Runtime.exec() or scala.sys.process.Process with shell and interpolated strings enables command injection. Use the Seq form: Process(Seq('cmd', arg1, userArg)) — no shell involved.

scala.xml.XML.load/loadString may process external entities (XXE). Create a custom SAXParser with DOCTYPE processing disabled: SAXParserFactory with setFeature(DISALLOW_DOCTYPE_DECL).

String interpolation in SQL queries enables SQL injection. Use Slick's sql/sqlu interpolators with explicit parameters, or Doobie's fr interpolator which handles parameterization safely.

asInstanceOf[] throws ClassCastException if the runtime type doesn't match. Use pattern matching instead: value match { case x: TargetType => ... case _ => ... }