critical System graph security Secrets conf 1.00 2 occurrences Possible secret in .github/workflows/deploy.yml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 951, 1041

.github/workflows/deploy.yml:951, 1041 (2 hits)

critical System graph security Secrets conf 1.00 Possible secret in scripts/integration/phase2-smoke.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

scripts/integration/phase2-smoke.ts:92

high System graph security security conf 1.00 Insecure pattern 'eval_used' in apps/cli/src/commands/enterprise/overlay.ts:95

Found a known-risky pattern (eval_used). Review and replace if possible.

apps/cli/src/commands/enterprise/overlay.ts:95 Eval used

high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/agentcore-pi/agent-container/src/runtime/tools/execute-code.ts:27

Found a known-risky pattern (exec_used). Review and replace if possible.

packages/agentcore-pi/agent-container/src/runtime/tools/execute-code.ts:27 Exec used

high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/pi-aws/connectors/agentcore-codeinterpreter.ts:205

Found a known-risky pattern (exec_used). Review and replace if possible.

packages/pi-aws/connectors/agentcore-codeinterpreter.ts:205 Exec used

high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/pi-aws/src/sandbox-types.ts:48

Found a known-risky pattern (exec_used). Review and replace if possible.

packages/pi-aws/src/sandbox-types.ts:48 Exec used

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/web/src/components/ai-elements/code-block.tsx:114

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — packages/computer-stdlib/src/__tests__/contract.test.ts:30

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — packages/ui/src/components/ui/chart.tsx:83

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/cli/src/commands/enterprise/deploy.ts:616

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/cli/src/commands/enterprise/overlay.ts:140

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/cli/src/commands/enterprise/templates/deploy-repo/scripts/apply-release.mjs:526

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/desktop/src/main/protocol.ts:114

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/desktop/test/main/protocol.test.ts:57

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/mobile/app/settings/billing.tsx:68

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/mobile/lib/auth-context.tsx:452

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/mobile/lib/auth.ts:310

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/mobile/lib/hooks/use-connections.ts:135

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/web/src/components/ai-elements/prompt-input.tsx:173

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/web/src/components/workbench/SpacesComposer.tsx:586

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/web/src/components/workbench/TaskThreadView.tsx:4887

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/web/src/iframe-shell/__tests__/iframe-content-scan.test.ts:17

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/web/src/lib/api-fetch.ts:68

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/web/src/lib/auth.ts:290

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/web/src/lib/kb-files-api.ts:62

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/admin-ops/src/client.test.ts:49

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/agentcore-pi/agent-container/src/server.ts:885

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/agent-skills-list.ts:46

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/scripts/pi-runtime-capability-smoke.ts:203

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/graphql/resolvers/core/setKnowledgeGraphDeployment.mutation.ts:135

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/handlers/extension-proxy.ts:117

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/handlers/graphql-http.ts:69

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/handlers/oauth-callback.ts:182

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/handlers/routine-task-weather-email.ts:115

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/handlers/skills.ts:793

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/handlers/slack/oauth-install.ts:188

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/handlers/thread-attachment-download.ts:135

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/handlers/wakeup-processor.ts:253

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/handlers/workspace-fetch-source.test.ts:450

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/handlers/workspace-fetch-source.ts:4

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/lib/evals/dataset-store.ts:223

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/lib/git-ref-fetcher.ts:35

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/lib/mcp-configs.ts:359

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/lib/oauth-token.ts:316

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/lib/routines/n8n/workflow-mapper.ts:546

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/src/lib/slack/file-attachments.ts:278

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/test/integration/context-engine/company-brain-context.e2e.test.ts:48

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/test/integration/sandbox/_harness/fixtures.ts:251

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/api/test/integration/user-memory-mcp/_harness/mcp-json-rpc.ts:61

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pi-extensions/src/fetch-workspace-source.ts:440

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-sdk/src/auth/cognito.ts:133

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/react-native-sdk/src/context-engine.ts:97

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — plugins/company-brain/smoke/cognee-managed-app-smoke.mjs:383

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — plugins/twenty/smoke/twenty-managed-app-smoke.mjs:291

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/cloudflare-sync-mcp.ts:264

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/smoke/knowledge-graph-source-ingest-smoke-lib.mjs:359

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/smoke/knowledge-graph-thread-ingest-smoke.mjs:400

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/smoke/spaces-applet-pipeline-smoke.mjs:213

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/smoke/spaces-appsync-streaming-smoke.mjs:194

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/smoke/spaces-crm-dashboard-prompt-smoke.mjs:276

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/smoke/spaces-runbook-smoke.mjs:411

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/smoke/spaces-surface-smoke.mjs:554

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/smoke/spaces-thread-streaming-smoke.mjs:310

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/verify-thread-traces.ts:160

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: examples/skill-pack/github-issues/SKILL.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

examples/skill-pack/github-issues/SKILL.md VerificationSkill file

medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing

AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.

Repo hardeningGenerated repo pattern

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data

A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.

Mock dataCritical flowGenerated repo pattern

medium System graph hardware Security conf 1.00 Dockerfile runs as root: packages/agentcore-pi/agent-container/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: packages/cognee/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph cicd CI/CD security conf 1.00 7 occurrences GitHub Action is tag-pinned rather than SHA-pinned

docker/build-push-action@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

3 files, 7 locations

.github/workflows/deploy.yml:236, 253, 548 (3 hits)

.github/workflows/release.yml:104, 122, 140 (3 hits)

apps/cli/src/commands/enterprise/templates/deploy-repo/.github/workflows/deploy.yml:97

CI/CD securitySupply chainGithub actions

medium System graph cicd CI/CD security conf 1.00 5 occurrences GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

5 files, 5 locations

.github/workflows/cla.yml

.github/workflows/publish-sdk.yml

.github/workflows/release-desktop.yml

.github/workflows/release.yml

apps/cli/src/commands/enterprise/templates/deploy-repo/.github/workflows/deploy.yml

CI/CD securitySupply chainGithub actions

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/knowledge-base-files.ts:61

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/knowledge-base-files.ts:61 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/activity.ts:24

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/activity.ts:24 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/agent-actions.ts:49

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/agent-actions.ts:49 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/agents-runtime-config.ts:41

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/agents-runtime-config.ts:41 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/agents.ts:58

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/agents.ts:58 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/budgets.ts:24

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/budgets.ts:24 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/capability-catalog-list.ts:44

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/capability-catalog-list.ts:44 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/connections.ts:60

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/connections.ts:60 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/extension-proxy.ts:222

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/extension-proxy.ts:222 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/github-app.ts:31

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/github-app.ts:31 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/guardrails-handler.ts:60

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/guardrails-handler.ts:60 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/invites.ts:118

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/invites.ts:118 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/manifest-log.ts:51

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/manifest-log.ts:51 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/mcp-admin-keys.ts:72

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/mcp-admin-keys.ts:72 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/mcp-admin-provision.ts:137

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/mcp-admin-provision.ts:137 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/messages.ts:40

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/messages.ts:40 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/recipe-refresh.ts:34

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/recipe-refresh.ts:34 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/routine-asl-validator.ts:656

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/routine-asl-validator.ts:656 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/routine-execution-callback.ts:162

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/routine-execution-callback.ts:162 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/routine-step-callback.ts:103

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/routine-step-callback.ts:103 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/routines.ts:22

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/routines.ts:22 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/sandbox-invocation-log.ts:62

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/sandbox-invocation-log.ts:62 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/sandbox-quota-check.ts:40

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/sandbox-quota-check.ts:40 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/scheduled-jobs.ts:252

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/scheduled-jobs.ts:252 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/skills.ts:81

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/skills.ts:81 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/tenants.ts:48

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/tenants.ts:48 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/users.ts:30

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/users.ts:30 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/handlers/webhooks-admin.ts:68

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/handlers/webhooks-admin.ts:68 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/src/lib/response.ts:7

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/src/lib/response.ts:7 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/api/workspace-files.ts:164

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/api/workspace-files.ts:164 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/lambda/admin-ops-mcp.ts:766

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/lambda/admin-ops-mcp.ts:766 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/lambda/agentcore-admin.ts:45

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

packages/lambda/agentcore-admin.ts:45 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in scripts/dev-stripe-proxy.mjs:123

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

scripts/dev-stripe-proxy.mjs:123 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/ai-elements/code-block.tsx:114

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

apps/web/src/components/ai-elements/code-block.tsx:114 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in packages/ui/src/components/ui/chart.tsx:83

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

packages/ui/src/components/ui/chart.tsx:83 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in apps/web/src/components/workbench/SkillTokenInput.tsx:148

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

apps/web/src/components/workbench/SkillTokenInput.tsx:148 Direct innerhtml assignment

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/api-client.ts:11

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/api-client.ts:11 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/aws-discovery.ts:10

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/aws-discovery.ts:10 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/aws.ts:7

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/aws.ts:7 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/cognito-discovery.ts:19

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/cognito-discovery.ts:19 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/cognito-oauth.ts:29

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/cognito-oauth.ts:29 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/bootstrap.ts:2

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/bootstrap.ts:2 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/cleanup-space-hindsight-banks.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/cleanup-space-hindsight-banks.ts:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/deploy.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/deploy.ts:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/doctor.ts:3

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/doctor.ts:3 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/enterprise/aws-bootstrap.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/enterprise/aws-bootstrap.ts:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/enterprise/aws-deployments.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/enterprise/aws-deployments.ts:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/enterprise/deploy.ts:2

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/enterprise/deploy.ts:2 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/enterprise/github.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/enterprise/github.ts:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/enterprise/preflight.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/enterprise/preflight.ts:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/enterprise/repository.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/enterprise/repository.ts:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/enterprise/secrets.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/enterprise/secrets.ts:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/enterprise/workflow.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/enterprise/workflow.ts:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/init.ts:4

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/init.ts:4 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/login.ts:25

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/login.ts:25 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/migrate-folder-canon.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/migrate-folder-canon.ts:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/release.ts:16

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/release.ts:16 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/status.ts:2

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/status.ts:2 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/update.ts:2

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/update.ts:2 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/commands/user.ts:13

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/commands/user.ts:13 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/prerequisites.ts:6

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/prerequisites.ts:6 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/cli/src/terraform.ts:9

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/cli/src/terraform.ts:9 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in apps/desktop/src/main/code-signature.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

apps/desktop/src/main/code-signature.ts:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/namespace-registry/src/db.ts:17

Found a known-risky pattern (node_child_process). Review and replace if possible.

packages/namespace-registry/src/db.ts:17 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in plugins/company-brain/smoke/cognee-managed-app-smoke.mjs:19

Found a known-risky pattern (node_child_process). Review and replace if possible.

plugins/company-brain/smoke/cognee-managed-app-smoke.mjs:19 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in plugins/plane/smoke/plane-managed-app-smoke.mjs:18

Found a known-risky pattern (node_child_process). Review and replace if possible.

plugins/plane/smoke/plane-managed-app-smoke.mjs:18 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in plugins/twenty/smoke/twenty-managed-app-smoke.mjs:17

Found a known-risky pattern (node_child_process). Review and replace if possible.

plugins/twenty/smoke/twenty-managed-app-smoke.mjs:17 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/cloudflare-sync-mcp.ts:26

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/cloudflare-sync-mcp.ts:26 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/integration/phase2-smoke.ts:19

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/integration/phase2-smoke.ts:19 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/deployment-evidence.mjs:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/deployment-evidence.mjs:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/deployment-teardown-readiness-smoke.mjs:23

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/deployment-teardown-readiness-smoke.mjs:23 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/foundation-bootstrap-smoke.mjs:20

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/foundation-bootstrap-smoke.mjs:20 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/hindsight-consolidation-backfill.mjs:32

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/hindsight-consolidation-backfill.mjs:32 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/knowledge-graph-source-ingest-smoke-lib.mjs:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/knowledge-graph-source-ingest-smoke-lib.mjs:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/knowledge-graph-thread-ingest-smoke.mjs:22

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/knowledge-graph-thread-ingest-smoke.mjs:22 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/managed-app-controller-readiness-smoke.mjs:23

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/managed-app-controller-readiness-smoke.mjs:23 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/spaces-applet-pipeline-smoke.mjs:22

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/spaces-applet-pipeline-smoke.mjs:22 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/spaces-crm-dashboard-prompt-smoke.mjs:17

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/spaces-crm-dashboard-prompt-smoke.mjs:17 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/spaces-runbook-smoke.mjs:20

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/spaces-runbook-smoke.mjs:20 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/spaces-shared-multi-user-smoke.mjs:18

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/spaces-shared-multi-user-smoke.mjs:18 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/spaces-surface-smoke.mjs:25

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/spaces-surface-smoke.mjs:25 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/smoke/spaces-thread-streaming-smoke.mjs:29

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/smoke/spaces-thread-streaming-smoke.mjs:29 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/verify-thread-traces.ts:62

Found a known-risky pattern (node_child_process). Review and replace if possible.

scripts/verify-thread-traces.ts:62 Node child process

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — terraform/modules/app/deployment-control-plane/runner.py:55

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected

Found 414 placeholder/mock markers across 175 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.

Mock dataIncompleteGenerated repo pattern

low System graph quality Maintenance conf 1.00 119 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

low System graph quality Integrity conf 1.00 355 env vars used in code but missing from .env.example

Drift between code and config docs. The first few: `ADMIN_OPS_MCP_FUNCTION_NAME`, `ADMIN_URL`, `AGENTCORE_ADMIN_LAMBDA_ARN`, `AGENTCORE_ADMIN_TOKEN`, `AGENTCORE_BROWSER_IDENTIFIER`, `AGENTCORE_FILES_BUCKET`, `AGENTCORE_FUNCTION_NAME`, `AGENTCORE_GATEWAY_URL` + 347 more. Add them (with a placeholder…

config drift

low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

Deployment

low System graph quality Debug conf 1.00 Debug logging residue appears in source files

Found 1012 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.

CleanupRepo hardeningGenerated repo pattern

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: public.ecr.aws/docker/library/node:22-bookworm-slim

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

packages/agentcore-pi/agent-container/Dockerfile:9 containersPinned dependencies

low System graph cicd CI/CD security conf 1.00 3 occurrences GitHub Action is tag-pinned rather than SHA-pinned

actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

2 files, 3 locations

.github/workflows/release.yml:196, 374 (2 hits)

.github/workflows/release-desktop.yml:392

CI/CD securitySupply chainGithub actions

low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence

The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.

Governance

low System graph quality Integrity conf 1.00 2 occurrences Near-duplicate function bodies in 2 places

Functions with the same first-5-line body hash: terraform/modules/app/deployment-control-plane/runner.py:psql_env, terraform/modules/app/deployment-control-plane/runner.py:psql This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consol…

2 occurrences

repo-level (2 hits)

duplicatesduplication

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: apps/cli/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

apps/cli/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: apps/desktop/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

apps/desktop/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: apps/mobile/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

apps/mobile/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: apps/web/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

apps/web/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: docs/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

docs/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/admin-ops/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/admin-ops/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/agentcore-pi/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/agentcore-pi/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/api/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/api/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/audit-verifier/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/audit-verifier/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/computer-stdlib/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/computer-stdlib/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/database-pg/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/database-pg/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/deployment-profile/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/deployment-profile/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/deployment-runner/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/deployment-runner/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/desktop-ipc/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/desktop-ipc/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/evals-core/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/evals-core/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/graph/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/graph/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/lambda/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/lambda/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/namespace-registry/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/namespace-registry/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/pi-aws/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/pi-aws/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/pi-extensions/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/pi-extensions/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/pi-runtime-core/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/pi-runtime-core/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/plugin-catalog/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/plugin-catalog/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/pricing-config/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/pricing-config/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/react-native-sdk/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/react-native-sdk/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/release-manifest/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/release-manifest/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/runtime-config/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/runtime-config/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/ui/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/ui/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/workspace-defaults/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/workspace-defaults/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/workspace-editor/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

packages/workspace-editor/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: plugins/company-brain/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

plugins/company-brain/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: plugins/lastmile/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

plugins/lastmile/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: plugins/plane/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

plugins/plane/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality dependencies conf 1.00 Node manifest has dependencies but no lockfile: plugins/twenty/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

plugins/twenty/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `daysOld` in packages/api/scripts/wipe-external-memory-stores.ts:159

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `list_objects_v2` in packages/agentcore/agent-container/install_skills.py:127

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `nLegacy` in packages/api/src/lib/__tests__/workspace-map-generator.test.ts:882

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `nOld` in packages/api/src/__tests__/wiki-draft-compile.test.ts:375

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `rOld` in packages/api/src/lib/brain/enrichment-apply-draft.test.ts:249

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `totalLegacy` in packages/api/scripts/wipe-external-memory-stores.test.ts:142

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `tp_legacy` in packages/api/src/graphql/resolvers/threads/unreadThreadCount.query.test.ts:19

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `tp_legacy` in packages/api/src/graphql/resolvers/threads/unreadThreadCount.query.ts:49

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `withLegacy` in packages/api/src/lib/workspace-renderer/agents-md-composer.test.ts:54

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph software Dead code conf 1.00 Possibly dead Python function: build_conversation_string

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/memory.py:544

low System graph software Dead code conf 1.00 Possibly dead Python function: build_converse_messages

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/memory.py:514

low System graph software Dead code conf 1.00 Possibly dead Python function: clear_all_tokens

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/identity.py:121

low System graph software Dead code conf 1.00 Possibly dead Python function: clear_thread_memory

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/memory.py:569

low System graph software Dead code conf 1.00 Possibly dead Python function: configure_bank

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/hindsight_client.py:92

low System graph software Dead code conf 1.00 Possibly dead Python function: do_GET

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/kb_search_server.py:189

low System graph software Dead code conf 1.00 Possibly dead Python function: do_POST

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/kb_search_server.py:142

low System graph software Dead code conf 1.00 Possibly dead Python function: install_on_session

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/bedrock_request_tracker.py:53

low System graph software Dead code conf 1.00 Possibly dead Python function: install_skills

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/install_skills.py:17

low System graph software Dead code conf 1.00 Possibly dead Python function: install_system_workspace

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/install_skills.py:160

low System graph software Dead code conf 1.00 Possibly dead Python function: install_workspace

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/install_skills.py:79

low System graph software Dead code conf 1.00 Possibly dead Python function: list_entities

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/hindsight_client.py:97

low System graph software Dead code conf 1.00 Possibly dead Python function: log_agent_invocation

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/observability.py:32

low System graph software Dead code conf 1.00 Possibly dead Python function: log_approval_decision

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/observability.py:104

low System graph software Dead code conf 1.00 Possibly dead Python function: log_message

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/kb_search_server.py:139

low System graph software Dead code conf 1.00 Possibly dead Python function: log_permission_denied

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/observability.py:69

low System graph software Dead code conf 1.00 Possibly dead Python function: reflect

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/hindsight_client.py:82

low System graph software Dead code conf 1.00 Possibly dead Python function: reset_captured_request_ids

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/bedrock_request_tracker.py:38

low System graph software Dead code conf 1.00 Possibly dead Python function: retain

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/hindsight_client.py:65

low System graph software Dead code conf 1.00 Possibly dead Python function: retrieve_assistant_memory

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/memory.py:259

low System graph software Dead code conf 1.00 Possibly dead Python function: retrieve_memory_events

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/memory.py:427

low System graph software Dead code conf 1.00 Possibly dead Python function: retrieve_session_memory

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/memory.py:233

low System graph software Dead code conf 1.00 Possibly dead Python function: revoke_token

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/identity.py:115

low System graph software Dead code conf 1.00 Possibly dead Python function: store_turn

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/memory.py:79

low System graph software Dead code conf 1.00 Possibly dead Python function: store_turn_pair

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/memory.py:128

low System graph software Dead code conf 1.00 Possibly dead Python function: validate_token

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

packages/agentcore/agent-container/identity.py:76

low System graph frontend Frontend quality conf 1.00 React Flow <Controls> without dark theming — apps/web/src/components/routines/RoutineFlowCanvas.tsx:136

`<Controls>` ships with white buttons. Override `.react-flow__controls` and `.react-flow__controls-button` in your stylesheet or pass a styled wrapper. Why: P1 in CHECKLIST.md — vendor defaults bleed light through. Rule id: fq.controls.no-bg

Fq controls no bg

low System graph frontend Frontend quality conf 1.00 React Flow edge with `label=` but no project-wide edge-label CSS override — packages/graph/src/MemoryGraph.tsx:304

React Flow edge labels render with a white rectangle behind the text by default, which scatters bright boxes across a dark canvas. Either drop the label, or override `.react-flow__edge-textbg` and `.react-flow__edge-text` in your stylesheet. Why: P-H in CHECKLIST.md — vendor edge labels bleed whit…

Fq edge label no bg

low System graph frontend Frontend quality conf 1.00 React Flow edge with `label=` but no project-wide edge-label CSS override — packages/graph/src/WikiGraph.tsx:145

React Flow edge labels render with a white rectangle behind the text by default, which scatters bright boxes across a dark canvas. Either drop the label, or override `.react-flow__edge-textbg` and `.react-flow__edge-text` in your stylesheet. Why: P-H in CHECKLIST.md — vendor edge labels bleed whit…

Fq edge label no bg

low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence

The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.

Git historyGenerated repo pattern

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — apps/cli/scripts/bundle-terraform.js:50