From 4dcda61ec920357cd6f91c58cfb3138d9409b7ef Mon Sep 17 00:00:00 2001
From: embeddevio <embeddev.iot@gmail.com>
Date: Wed, 28 Oct 2026 22:39:20 +0300
Subject: [PATCH] =?UTF-8?q?test(ci):=20=D0=BF=D1=80=D0=BE=D0=B1=D0=BD?=
 =?UTF-8?q?=D0=B8=D0=BA=20HIGH-=D0=BD=D0=B0=D1=85=D0=BE=D0=B4=D0=BA=D0=B8?=
 =?UTF-8?q?=20=D0=B4=D0=BB=D1=8F=20bandit=20(B602)=20=E2=80=94=20Refs=20#1?=
 =?UTF-8?q?7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/awg_api/_gate_probe.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 backend/awg_api/_gate_probe.py

diff --git a/backend/awg_api/_gate_probe.py b/backend/awg_api/_gate_probe.py
new file mode 100644
index 0000000..07bb2a8
--- /dev/null
+++ b/backend/awg_api/_gate_probe.py
@@ -0,0 +1,15 @@
+"""CI-пробник для негативного прогона гейта security (bandit).
+
+Содержит намеренно небезопасный вызов `subprocess.call(..., shell=True)` —
+bandit B602, severity HIGH. Файл живёт только в ветке `ci/17-gate-negative`
+и удаляется вместе с ней; в `main`/`feat/*` его нет.
+"""
+
+from __future__ import annotations
+
+import subprocess
+
+
+def run_probe(cmd: str) -> int:
+    """Намеренно небезопасно: shell=True (bandit B602 -> HIGH)."""
+    return subprocess.call(cmd, shell=True)  # noqa: S602