Claude and Fixinator - a great team

Claude and Fixinator - a great team

February 17, 2026 Security 192 views 0 comments

This blog was built using Claude prompts. After it was finished, the ColdFusion security checker Fixinator was run against the 27 files in the project. The command in Fixinator was fixinator engines=adobe resultFormat=pdf,json resultFile=fixinatorReport.pdf, fixinatorReport.json ignoreExtensions=xls,xlsx,pdf,msg,mdb confidence=low Then Claude prompt "read fixinatorreport.json" was executed using the CLI in Powershell

Fixinator Security Remediation Report

S&R Tech Group Blog — ColdFusion Application

Scan Date: February 18, 2026 Remediated: February 18, 2026 Scanner: Fixinator v6.1.1 Engine: Adobe ColdFusion
1
High Severity
4
Medium Severity
32
Low Severity
37 / 37
Findings Fixed

Files Modified

File Findings Fixed Categories
post.cfm 1 SQL Injection
includes/header.cfm 7 XSS Unscoped Variable SRI Crossorigin
includes/footer.cfm 5 XSS Unscoped Variable SRI Crossorigin
admin/post-list.cfm 7 Reverse Tabnabbing SRI Crossorigin
admin/comments.cfm 6 SRI Crossorigin
admin/post-editor.cfm 2 SRI Crossorigin
post-editor.cfm 2 SRI Crossorigin
Application.cfc 2 SRI Crossorigin
admin/Application.cfc 2 SRI Crossorigin
mnt/user-data/outputs/blog/admin/Application.cfc 2 SRI Crossorigin

High SQL Injection

SQL Injection in Query of Queries Fixed

File: post.cfm : line 177

Issue: A variable (#parentID#) was interpolated directly into a SQL statement without parameterization. Even though this is a Query-of-Queries (QoQ) operating on an in-memory recordset, unparameterized variables in SQL are flagged as injection risks and should always use .

Fix: Wrapped the variable with using cfsqltype="cf_sql_integer".

Before
SELECT * FROM qComments WHERE parent_id = #parentID#
After
SELECT * FROM qComments WHERE parent_id =

Medium Cross-Site Scripting (XSS)

Unencoded Page Title in
Attachments (2)