Tool: Bandit B108

Severity: Warning ×4
  Issue: "Probable insecure usage of temp file/directory" — /tmp/<filename> literals used as synthetic DB field values in two integration tests
  Status: Fixed
  ────────────────────────────────────────
  Tool: CodeQL Python / JS
  Severity: Pending
  Issue: Still running on the head SHA
  Status: —
  ────────────────────────────────────────
  Tool: Trivy container scan
  Severity: Pending
  Issue: Still running
  Status: —
  ────────────────────────────────────────
  Tool: Bandit (Python Security Analysis)
  Severity: Pass
  Issue: The separate Bandit run on the changes already passes
  Status: ✓

backend/tests/integration/test_library_trash_api.py

@@ -18,7 +18,7 @@ async def file_factory(db_session):
         counter = _counter[0]
         defaults = {
             "filename": f"trash_test_{counter}.3mf",
-            "file_path": f"/tmp/trash_test_{counter}.3mf",
+            "file_path": f"/test/library/trash_test_{counter}.3mf",
             "file_size": 1024 * counter,
             "file_type": "3mf",
         }
@@ -286,14 +286,14 @@ async def test_sweeper_hard_deletes_past_retention(db_session):
 
     fresh = LibraryFile(
         filename="fresh.3mf",
-        file_path="/tmp/fresh.3mf",
+        file_path="/test/library/fresh.3mf",
         file_size=1024,
         file_type="3mf",
         deleted_at=datetime.now(timezone.utc) - timedelta(days=5),
     )
     stale = LibraryFile(
         filename="stale.3mf",
-        file_path="/tmp/stale.3mf",
+        file_path="/test/library/stale.3mf",
         file_size=2048,
         file_type="3mf",
         deleted_at=datetime.now(timezone.utc) - timedelta(days=40),

backend/tests/integration/test_pending_upload_display_name.py

@@ -38,7 +38,7 @@ async def _seed_pending(
 ) -> int:
     pending = PendingUpload(
         filename=filename,
-        file_path=f"/tmp/{filename}",
+        file_path=f"/test/pending/{filename}",
         file_size=42,
         source_ip="192.168.1.50",
         status="pending",