critical System graph security Secrets conf 1.00 Possible secret in README.md

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

README.md:339

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — js/dashboard.js:584

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — js/exerciseLibrary.js:143

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — js/rpm/graph-builder.js:253

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — supabase/functions/generate-program/index.ts:38

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — supabase/functions/send-email/index.ts:81

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Tests conf 1.00 CI is configured but no tests are detected

A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal.

CI/CDConfig theaterRepo hardening

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data

A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.

Mock dataCritical flowGenerated repo pattern

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/deploy.yml CI/CD securitySupply chainGithub actions

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in supabase/functions/rpm-ai-suggest/index.ts:34

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

supabase/functions/rpm-ai-suggest/index.ts:34 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in supabase/functions/visitor-survey/index.ts:25

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

supabase/functions/visitor-survey/index.ts:25 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in app.html:2279