ruvnet/ruflo

Component	Sub-score	Weight	Contribution
`structure_score`	60.0	0.15	9.00
`security_score`	100.0	0.25	25.00
`testing_score`	98.0	0.20	19.60
`documentation_score`	77.0	0.15	11.55
`practices_score`	86.0	0.15	12.90
`code_quality`	70.0	0.10	7.00
Overall		1.00	85.0

critical Security checks quality Quality conf 1.00 ✓ Repobility [MINED035] Js New Function: new Function(...) compiles strings to functions.

Review and fix per the pattern semantics. See CWE-95 / for context.

v3/@claude-flow/plugin-agent-federation/src/transport/midstream-aware-loader.ts:125

critical Security checks software dependencies conf 0.90 ✓ Repobility [MINED120] package.json `scripts.postinstall` runs network/exec on install: `scripts.postinstall: node -e "const{execSync}=require('child_process');try{execSync('agent-browser --version',{stdio:'ignore'});}catch{consol` runs during `npm install` on every developer's machine and in every CI build. Common crypto-miner / data-exfiltration vector. Even when intentional, the hook should be reviewed and pinned.

Move the logic to an explicit build step (npm run build), or remove the hook. Run with `--ignore-scripts` in CI to audit what depends on these hooks.

v3/@claude-flow/browser/package.json:1

critical Security checks software dependencies conf 0.90 ✓ Repobility [MINED123] Trojan Source bidi character (LRE) in source: Line 183 contains a Unicode bidirectional override character (U+202A LRE). This is the 'Trojan Source' attack (CVE-2021-42574): the character makes the compiler / interpreter see different code than the human reviewer.

Audit the line manually. If the character is not intentional (it almost never is in code), remove it. Configure your editor / pre-commit hook to reject bidi controls in source.

v3/@claude-flow/security/src/tool-output-guardrail.ts:183

low Security checks cicd CI/CD security conf 0.35 ✓ Repobility 3 occurrences Workflow references repository secrets in a pull_request workflow

Fork pull_request runs do not receive normal repository secrets on GitHub Actions. Review this as a reliability/intent signal, not as direct fork-secret exfiltration. Raise severity only for pull_request_target or another trusted-context path that runs untrusted PR code with secrets.

2 files, 3 locations

ruflo/src/ruvocal/.github/workflows/deploy-dev.yml:26, 27 (2 hits)

.github/workflows/v3-ci.yml:2114

CI/CD securityworkflow secretsGitHub Actions

critical System graph security security conf 1.00 Insecure pattern 'private_key_in_repo' in v3/plugins/agentic-qe/src/tools/security-compliance/detect-secrets.ts:327

Found a known-risky pattern (private_key_in_repo). Review and replace if possible.

v3/plugins/agentic-qe/src/tools/security-compliance/detect-secrets.ts:327 Private key in repo

critical System graph security Secrets conf 1.00 2 occurrences Possible secret in v3/@claude-flow/guidance/src/analyzer.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 1725, 2732

v3/@claude-flow/guidance/src/analyzer.ts:1725, 2732 (2 hits)

critical System graph security Secrets conf 1.00 Possible secret in v3/@claude-flow/guidance/src/headless.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

v3/@claude-flow/guidance/src/headless.ts:470

critical System graph security Secrets conf 1.00 2 occurrences Possible secret in v3/@claude-flow/guidance/src/manifest-validator.ts

Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager.

lines 984

v3/@claude-flow/guidance/src/manifest-validator.ts:984 (2 hits)

critical System graph security Secrets conf 1.00 2 occurrences Possible secret in v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 1075, 1988

v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:1075, 1988 (2 hits)

critical System graph security Secrets conf 1.00 3 occurrences Possible secret in v3/plugins/agentic-qe/src/tools/security-compliance/detect-secrets.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 328, 342, 365

v3/plugins/agentic-qe/src/tools/security-compliance/detect-secrets.ts:328, 342, 365 (3 hits)

low Security checks quality Quality conf 1.00 ✓ Repobility [MINED012] Curl Pipe Bash: curl ... | sh / bash — runs unverified network code.

Review and fix per the pattern semantics. See CWE-494 / A08:2021 for context.

scripts/install.sh:85

high Security checks quality Quality conf 1.00 ✓ Repobility 3 occurrences [MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState — React skips re-render on mutated reference.

Review and fix per the pattern semantics. See CWE-682 / for context.

3 files, 3 locations

v3/@claude-flow/browser/src/application/cookie-vault-service.ts:116

v3/@claude-flow/browser/src/infrastructure/causal-recovery-store.ts:62

v3/@claude-flow/cli/src/benchmarks/gaia-convergence.ts:326

high Security checks quality Quality conf 1.00 ✓ Repobility [MINED031] React Direct State Mutation: this.state.X = Y mutates without setState. React wont re-render.

Review and fix per the pattern semantics. See CWE-682 / for context.

v3/plugins/teammate-plugin/src/utils/circuit-breaker.ts:67

high Security checks quality Quality conf 1.00 ✓ Repobility [MINED031] React Direct State Mutation: this.state.X = Y mutates without setState. React wont re-render.

Review and fix per the pattern semantics. See CWE-682 / for context.

v3/@claude-flow/shared/src/events/state-reconstructor.ts:206

high Security checks quality Quality conf 1.00 ✓ Repobility 3 occurrences [MINED104] Chmod 777: chmod 777 makes a file or directory world-readable, world-writable, AND world-executable. Local privilege escalation surface; audit-failing for most compliance frameworks.

Use the least-privilege mode the file actually needs (e.g. 640 for configs, 750 for executables). For directories that genuinely need shared write access, use a group with chmod g+w and chown the right group.

3 files, 3 locations

.claude/helpers/guidance-hooks.sh:46

v3/@claude-flow/cli/.claude/helpers/guidance-hooks.sh:46

v3/@claude-flow/mcp/.claude/helpers/guidance-hooks.sh:46

high Security checks quality Quality conf 0.80 ✓ Repobility [MINED113] Express POST /chat/completions has no auth: Express route POST /chat/completions declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

Add an auth middleware: app.post('/chat/completions', requireAuth, handler) — or mount the router under app.use('/api', authMiddleware) and ensure the path is covered. If truly public, mark with a comment.

ruflo/src/ruvocal/mcp-bridge/index.js:1742

high Security checks quality Quality conf 0.80 ✓ Repobility [MINED113] Express POST /chat/completions has no auth: Express route POST /chat/completions declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

Add an auth middleware: app.post('/chat/completions', requireAuth, handler) — or mount the router under app.use('/api', authMiddleware) and ensure the path is covered. If truly public, mark with a comment.

ruflo/src/mcp-bridge/index.js:1537

high Security checks quality Quality conf 0.80 ✓ Repobility 5 occurrences [MINED113] Express POST /mcp has no auth: Express route POST /mcp declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

Add an auth middleware: app.post('/mcp', requireAuth, handler) — or mount the router under app.use('/api', authMiddleware) and ensure the path is covered. If truly public, mark with a comment.

5 files, 5 locations

ruflo/src/mcp-bridge/index.js:926

ruflo/src/ruvocal/mcp-bridge/index.js:1102

v3/@claude-flow/mcp/src/transport/http.ts:249

v3/@claude-flow/shared/src/mcp/transport/http.ts:306

v3/mcp/transport/http.ts:280

high Security checks quality Quality conf 0.80 ✓ Repobility 3 occurrences [MINED113] Express POST /rpc has no auth: Express route POST /rpc declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A01:2021 broken access control.

Add an auth middleware: app.post('/rpc', requireAuth, handler) — or mount the router under app.use('/api', authMiddleware) and ensure the path is covered. If truly public, mark with a comment.

3 files, 3 locations

v3/@claude-flow/mcp/src/transport/http.ts:245

v3/@claude-flow/shared/src/mcp/transport/http.ts:301

v3/mcp/transport/http.ts:275

high Security checks software dependencies conf 0.90 ✓ Repobility 18 occurrences [MINED118] Dockerfile FROM `ghcr.io/huggingface/chat-ui-db:latest` not pinned by digest: `FROM ghcr.io/huggingface/chat-ui-db:latest` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Replace with: `FROM ghcr.io/huggingface/chat-ui-db:latest@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot).

12 files, 18 locations

ruflo/src/ruvocal/Dockerfile:3, 41, 62 (3 hits)

v3/@claude-flow/cli/docker/Dockerfile:17, 93 (2 hits)

v3/@claude-flow/cli/docker/Dockerfile.appliance:16, 99 (2 hits)

v3/@claude-flow/cli/docker/Dockerfile.full:11, 33 (2 hits)

v3/@claude-flow/cli/docker/Dockerfile.headless:14, 75 (2 hits)

ruflo/src/chat-ui/Dockerfile:1

ruflo/src/mcp-bridge/Dockerfile:1

ruflo/src/nginx/Dockerfile:1

high Security checks cicd CI/CD security conf 0.84 Database service publishes a host port

Use `expose` for service-to-service access, bind to 127.0.0.1 for local-only access, or protect the port with firewall rules.

ruflo/src/ruvocal/docker-compose.yml:3 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.84 Database service publishes a host port

Use `expose` for service-to-service access, bind to 127.0.0.1 for local-only access, or protect the port with firewall rules.

ruflo/docker-compose.yml:9 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.92 3 occurrences Dockerfile copies the entire context without .dockerignore

Create .dockerignore before using broad context copies, or copy only the required files and directories.

3 files, 3 locations

ruflo/src/ruvocal/Dockerfile:56

tests/docker-regression/Dockerfile:75

v3/@claude-flow/browser/docker/Dockerfile:13

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.90 ✓ Repobility 4 occurrences GitHub Action is tag-pinned rather than SHA-pinned

[MINED115] Action `huggingface/doc-builder/.github/workflows/build_main_documentation.yml` pinned to mutable ref `@main`: `uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@main` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…

4 files, 4 locations

ruflo/src/ruvocal/.github/workflows/build-docs.yml:11

ruflo/src/ruvocal/.github/workflows/build-pr-docs.yml:15

ruflo/src/ruvocal/.github/workflows/trufflehog.yml:15

ruflo/src/ruvocal/.github/workflows/upload-pr-documentation.yml:11

CI/CD securitySupply chainGitHub Actions

high System graph api Wiring conf 1.00 Dangling fetch: DELETE https://api.pinata.cloud/pinning/unpin/${cid} (v3/@claude-flow/cli/src/transfer/ipfs/upload.ts:347)

`v3/@claude-flow/cli/src/transfer/ipfs/upload.ts:347` calls `DELETE https://api.pinata.cloud/pinning/unpin/${cid}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.pinata.cloud/pinning/unpin/<p>` If this po…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.anthropic.com/... (v3/@claude-flow/cli/src/mcp-tools/agent-execute-core.ts:456)

`v3/@claude-flow/cli/src/mcp-tools/agent-execute-core.ts:456` calls `GET https://api.anthropic.com/...` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.anthropic.com/...` If this points at an external API,…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.npmjs.org/downloads/point/last-week/${encodeURIComponent(packageName)} (v3/@claude-flow/cli/cloud-functions/publish-registry/index.js:102)

`v3/@claude-flow/cli/cloud-functions/publish-registry/index.js:102` calls `GET https://api.npmjs.org/downloads/point/last-week/${encodeURIComponent(packageName)}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://huggingface.co/api/whoami-v2 (ruflo/src/ruvocal/src/lib/server/auth.ts:478)

`ruflo/src/ruvocal/src/lib/server/auth.ts:478` calls `GET https://huggingface.co/api/whoami-v2` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/huggingface.co/api/whoami-v2` If this points at an external API, …

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://huggingface.co/oauth/userinfo (ruflo/src/ruvocal/src/routes/api/v2/user/billing-orgs/+server.ts:22)

`ruflo/src/ruvocal/src/routes/api/v2/user/billing-orgs/+server.ts:22` calls `GET https://huggingface.co/oauth/userinfo` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/huggingface.co/oauth/userinfo` If this po…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://registry.npmjs.org/${encodeURIComponent(packageName)} (v3/@claude-flow/cli/src/update/checker.ts:66)

`v3/@claude-flow/cli/src/update/checker.ts:66` calls `GET https://registry.npmjs.org/${encodeURIComponent(packageName)}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/registry.npmjs.org/<p>` If this points a…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest (v3/@claude-flow/cli/cloud-functions/publish-registry/index.js:105)

`v3/@claude-flow/cli/cloud-functions/publish-registry/index.js:105` calls `GET https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/registry.npm…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: HEAD /widget.css (v3/goal_ui/src/pages/Demo.tsx:55)

`v3/goal_ui/src/pages/Demo.tsx:55` calls `HEAD /widget.css` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/widget.css` If this points at an external API, prefix it with `https://` so the matcher skips it.

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: HEAD /widget.js (v3/goal_ui/src/pages/Demo.tsx:54)

`v3/goal_ui/src/pages/Demo.tsx:54` calls `HEAD /widget.js` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/widget.js` If this points at an external API, prefix it with `https://` so the matcher skips it.

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://ai.gateway.lovable.dev/v1/chat/completions (v3/goal_ui/supabase/functions/generate-action-items/index.ts:114)

`v3/goal_ui/supabase/functions/generate-action-items/index.ts:114` calls `POST https://ai.gateway.lovable.dev/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/ai.gateway.lovable.dev/v1/chat…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://ai.gateway.lovable.dev/v1/chat/completions (v3/goal_ui/supabase/functions/generate-research-goal/index.ts:79)

`v3/goal_ui/supabase/functions/generate-research-goal/index.ts:79` calls `POST https://ai.gateway.lovable.dev/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/ai.gateway.lovable.dev/v1/chat…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://ai.gateway.lovable.dev/v1/chat/completions (v3/goal_ui/supabase/functions/optimize-research-config/index.ts:118)

`v3/goal_ui/supabase/functions/optimize-research-config/index.ts:118` calls `POST https://ai.gateway.lovable.dev/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/ai.gateway.lovable.dev/v1/c…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://ai.gateway.lovable.dev/v1/chat/completions (v3/goal_ui/supabase/functions/research-api/index.ts:197)

`v3/goal_ui/supabase/functions/research-api/index.ts:197` calls `POST https://ai.gateway.lovable.dev/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/ai.gateway.lovable.dev/v1/chat/completi…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://ai.gateway.lovable.dev/v1/chat/completions (v3/goal_ui/supabase/functions/research-step/index.ts:249)

`v3/goal_ui/supabase/functions/research-step/index.ts:249` calls `POST https://ai.gateway.lovable.dev/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/ai.gateway.lovable.dev/v1/chat/complet…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.anthropic.com/v1/messages (v3/@claude-flow/cli/src/mcp-tools/agent-execute-core.ts:143)

`v3/@claude-flow/cli/src/mcp-tools/agent-execute-core.ts:143` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.anthropic.com/v1/messages` If this points at…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.anthropic.com/v1/messages (v3/@claude-flow/mcp/src/sampling.ts:324)

`v3/@claude-flow/mcp/src/sampling.ts:324` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.anthropic.com/v1/messages` If this points at an external API, pr…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.pinata.cloud/pinning/pinByHash (v3/@claude-flow/cli/src/transfer/ipfs/upload.ts:302)

`v3/@claude-flow/cli/src/transfer/ipfs/upload.ts:302` calls `POST https://api.pinata.cloud/pinning/pinByHash` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.pinata.cloud/pinning/pinbyhash` If this points …

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.pinata.cloud/pinning/pinFileToIPFS (v3/@claude-flow/cli/src/transfer/ipfs/upload.ts:168)

`v3/@claude-flow/cli/src/transfer/ipfs/upload.ts:168` calls `POST https://api.pinata.cloud/pinning/pinFileToIPFS` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.pinata.cloud/pinning/pinfiletoipfs` If this…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.pinata.cloud/pinning/pinJSONToIPFS (v3/@claude-flow/cli/src/commands/neural.ts:1181)

`v3/@claude-flow/cli/src/commands/neural.ts:1181` calls `POST https://api.pinata.cloud/pinning/pinJSONToIPFS` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.pinata.cloud/pinning/pinjsontoipfs` If this poi…

Dangling fetchFetch

high System graph cicd CI/CD security conf 1.00 4 occurrences GitHub Action tracks a moving branch

huggingface/doc-builder/.github/workflows/build_main_documentation.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

4 files, 4 locations

ruflo/src/ruvocal/.github/workflows/build-docs.yml:11

ruflo/src/ruvocal/.github/workflows/build-pr-docs.yml:15

ruflo/src/ruvocal/.github/workflows/trufflehog.yml:15

ruflo/src/ruvocal/.github/workflows/upload-pr-documentation.yml:11

CI/CD securitySupply chainGithub actions

high System graph security security conf 1.00 Insecure pattern 'eval_used' in v3/@claude-flow/browser/src/mcp-tools/browser-tools.ts:685

Found a known-risky pattern (eval_used). Review and replace if possible.

v3/@claude-flow/browser/src/mcp-tools/browser-tools.ts:685 Eval used

high System graph security security conf 1.00 Insecure pattern 'eval_used' in v3/@claude-flow/cli/src/commands/analyze.ts:355

Found a known-risky pattern (eval_used). Review and replace if possible.

v3/@claude-flow/cli/src/commands/analyze.ts:355 Eval used

high System graph security security conf 1.00 Insecure pattern 'eval_used' in v3/@claude-flow/cli/src/commands/neural.ts:1540

Found a known-risky pattern (eval_used). Review and replace if possible.

v3/@claude-flow/cli/src/commands/neural.ts:1540 Eval used

high System graph security security conf 1.00 Insecure pattern 'eval_used' in v3/@claude-flow/cli/src/commands/security.ts:145

Found a known-risky pattern (eval_used). Review and replace if possible.

v3/@claude-flow/cli/src/commands/security.ts:145 Eval used

high System graph security security conf 1.00 Insecure pattern 'eval_used' in v3/@claude-flow/guidance/src/analyzer.ts:2709

Found a known-risky pattern (eval_used). Review and replace if possible.

v3/@claude-flow/guidance/src/analyzer.ts:2709 Eval used

high System graph security security conf 1.00 Insecure pattern 'exec_used' in .github/supply-chain/accepted-findings.json:38

Found a known-risky pattern (exec_used). Review and replace if possible.

.github/supply-chain/accepted-findings.json:38 Exec used

high System graph security security conf 1.00 Insecure pattern 'exec_used' in v3/@claude-flow/cli/src/commands/analyze.ts:356

Found a known-risky pattern (exec_used). Review and replace if possible.

v3/@claude-flow/cli/src/commands/analyze.ts:356 Exec used

high System graph security security conf 1.00 Insecure pattern 'exec_used' in v3/@claude-flow/cli/src/commands/neural.ts:1540

Found a known-risky pattern (exec_used). Review and replace if possible.

v3/@claude-flow/cli/src/commands/neural.ts:1540 Exec used

high System graph security security conf 1.00 Insecure pattern 'exec_used' in v3/@claude-flow/cli/src/commands/security.ts:330

Found a known-risky pattern (exec_used). Review and replace if possible.

v3/@claude-flow/cli/src/commands/security.ts:330 Exec used

high System graph security security conf 1.00 Insecure pattern 'exec_used' in v3/@claude-flow/security/src/CVE-REMEDIATION.ts:89

Found a known-risky pattern (exec_used). Review and replace if possible.

v3/@claude-flow/security/src/CVE-REMEDIATION.ts:89 Exec used

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them.

high Security checks security auth conf 0.74 [AUC002] Low visible authorization coverage in route inventory: Only 15.6% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

Review the access matrix and add explicit framework auth declarations or policy-file exceptions for intentionally public routes.

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /autopilot/detail/:token.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

ruflo/src/ruvocal/mcp-bridge/index.js:1729

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /autopilot/detail/:token.

Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.

ruflo/src/mcp-bridge/index.js:1524

medium Security checks quality Error handling conf 1.00 3 occurrences [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

3 files, 3 locations

v3/@claude-flow/cli/.claude/helpers/hook-handler.cjs:283

v3/@claude-flow/cli/scripts/bench-rvagent.mjs:226

v3/@claude-flow/cli/src/appliance/rvfa-runner.ts:62

low Security checks security Deserialization conf 1.00 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.

Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data.

scripts/smoke-workflows-yaml.mjs:40

low Security checks security Deserialization conf 1.00 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.

Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data.

ruflo/src/ruvocal/scripts/updateLocalEnv.ts:7

medium Security checks quality Quality conf 1.00 [SEC086] JS: bidirectional Unicode (Trojan Source): Bidirectional Unicode override chars in source — Trojan Source attack (CVE-2021-42574). Ported from eslint-plugin-security detect-bidi-characters (Apache-2.0).

Remove the bidi chars or encode them explicitly. Use `cargo geiger`-style CI lint for new commits.

v3/@claude-flow/security/src/tool-output-guardrail.ts:183

medium Security checks quality Quality conf 1.00 3 occurrences [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).

Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).

3 files, 3 locations

plugins/ruflo-adr/scripts/import.mjs:220

v3/@claude-flow/cli/src/transfer/anonymization/index.ts:173

v3/@claude-flow/hooks/src/registry/index.ts:238

low Security checks quality Quality conf 1.00 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws — wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated.

Catch the specific exception type, log at error level with full exception info, and return a failure-shaped result. If the operation is genuinely best-effort, log at warning and document why in a comment so the next reader (or scanner) knows.

scripts/audit-wrapper-dep-ranges.mjs:46

medium Security checks cicd CI/CD security conf 0.94 Compose service `adminer` image uses the latest tag

Pin to a maintained version tag or digest and update it deliberately through dependency automation.

v3/@claude-flow/plugins/examples/ruvector/docker-compose.yml:55 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.56 Compose service contains a literal secret environment value

Rotate the value if real. Move it to Docker Compose secrets, a platform secret manager, or an uncommitted environment file.

v3/@claude-flow/plugins/examples/ruvector/docker-compose.yml:20 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.88 Database service has no healthcheck

Add a database-native healthcheck such as pg_isready, mysqladmin ping, redis-cli ping, or the vendor's readiness command.

ruflo/docker-compose.yml:9 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.90 Docker build context has no .dockerignore

Add .dockerignore with at least .git, .env, private keys, dependency folders, build outputs, and local databases.

.dockerignore CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.82 5 occurrences Docker final stage has no non-root USER

Add a non-root USER in the final runtime stage after files and permissions are prepared.

5 files, 5 locations

ruflo/src/nginx/Dockerfile:1

ruflo/src/ruvocal/.devcontainer/Dockerfile:1

ruflo/src/ruvocal/Dockerfile:79

tests/docker-regression/Dockerfile:4

v3/@claude-flow/browser/docker/Dockerfile:4

CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.94 Dockerfile base image uses the latest tag

Pin to a maintained version tag or digest and update it deliberately through dependency automation.

ruflo/src/chat-ui/Dockerfile:1 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.90 Dockerfile installs dependencies after copying the full source tree

Copy dependency manifests first, install dependencies in a cached layer, then copy the rest of the source tree.

v3/@claude-flow/browser/docker/Dockerfile:19 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.86 Dockerfile separates apt update from install

Combine update and install in the same RUN instruction and clean package indexes in that layer.

ruflo/src/ruvocal/Dockerfile:23 CI/CD securitycontainers

medium Security checks quality Quality conf 0.70 Public web app has no Content Security Policy

Add a Content-Security-Policy header through the web framework or hosting config. For static apps, add a CSP meta tag that restricts default-src, script-src, connect-src, img-src, and frame-ancestors.

index.html

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

Add /.well-known/security.txt with Contact, Expires, Canonical, Preferred-Languages, and Policy fields. Keep the contact endpoint monitored.

.well-known/security.txt

medium Security checks quality Quality conf 0.72 Service worker is present without a web app manifest

Add a valid manifest.json or site.webmanifest and reference it from the document head. Include name, icons, start_url, display, and theme colors.

manifest.json

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — v3/@claude-flow/cli/src/commands/analyze.ts:358

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — v3/@claude-flow/cli/src/commands/security.ts:147

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — v3/@claude-flow/hooks/src/workers/index.ts:1496

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — v3/goal_ui/src/components/ui/chart.tsx:70

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — v3/plugins/agentic-qe/__tests__/tools/security-scan.test.ts:96

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/mcp-bridge/test-harness.js:53

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/mcp-bridge/test-harness.js:53

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/src/hooks.server.ts:30

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/src/lib/server/auth.ts:478

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/src/lib/server/endpoints/openai/endpointOai.ts:81

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/src/lib/server/hooks/fetch.ts:17

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/src/lib/server/models.ts:126

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/src/lib/server/sendSlack.ts:10

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts:318

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/src/lib/stores/settings.ts:63

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/src/routes/api/transcribe/+server.ts:62

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/src/routes/models/[...model]/+page.ts:4

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — ruflo/src/ruvocal/static/wasm/rvagent_wasm.js:1531

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/@claude-flow/cli/__tests__/ruvector/ast-analyzer.test.ts:503

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/@claude-flow/cli/cloud-functions/publish-registry/index.js:66

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/@claude-flow/cli/scripts/publish-registry.ts:157

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/@claude-flow/cli/src/appliance/rvfa-distribution.ts:368

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/@claude-flow/cli/src/benchmarks/gaia-judge.ts:21

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/@claude-flow/cli/src/commands/neural.ts:1181

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/@claude-flow/cli/src/mcp-tools/agent-execute-core.ts:323

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/@claude-flow/cli/src/transfer/ipfs/upload.ts:104

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/@claude-flow/mcp/src/oauth.ts:188

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/@claude-flow/mcp/src/sampling.ts:324

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/goal_ui/supabase/functions/generate-action-items/index.ts:114

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/goal_ui/supabase/functions/generate-research-goal/index.ts:79

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/goal_ui/supabase/functions/optimize-research-config/index.ts:118

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/goal_ui/supabase/functions/research-api/index.ts:197

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/goal_ui/supabase/functions/research-step/index.ts:249

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — v3/plugins/prime-radiant/src/wasm-bridge.ts:252

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph frontend Frontend quality conf 1.00 Custom React Flow node registered without explicit width/height — tests/rvf-capability-verify.test.ts:266

When you register a custom node type via `nodeTypes`, the RFNode object you build must include `width` and `height` props. Without them, MiniMap renders ZERO mini-nodes for that type and `fitView` underestimates the bounds (cuts off lane labels, etc.). Add `width: …, height: …` to the node object. …

Fq rfnode no dims

medium System graph frontend Frontend quality conf 1.00 Custom React Flow node registered without explicit width/height — v3/@claude-flow/cli/src/transfer/models/seraphine.ts:332

When you register a custom node type via `nodeTypes`, the RFNode object you build must include `width` and `height` props. Without them, MiniMap renders ZERO mini-nodes for that type and `fitView` underestimates the bounds (cuts off lane labels, etc.). Add `width: …, height: …` to the node object. …

Fq rfnode no dims

medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: ghcr.io/huggingface/chat-ui-db:latest

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

ruflo/src/chat-ui/Dockerfile:1 containersPinned dependencies

medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: local_db_${INCLUDE_DB}

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

ruflo/src/ruvocal/Dockerfile:79 containersPinned dependencies

medium System graph hardware Security conf 1.00 Dockerfile runs as root: ruflo/src/chat-ui/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: ruflo/src/nginx/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: ruflo/src/ruvocal/.devcontainer/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: ruflo/src/ruvocal/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: tests/docker-regression/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph hardware Security conf 1.00 Dockerfile runs as root: v3/@claude-flow/browser/docker/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph cicd CI/CD security conf 1.00 38 occurrences GitHub Action is tag-pinned rather than SHA-pinned

dtolnay/rust-toolchain@stable can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

5 files, 38 locations

ruflo/src/ruvocal/.github/workflows/build-image.yml:40, 52, 55, 59, 66, 69, 101, 113, +4 more (14 hits)

ruflo/src/ruvocal/.github/workflows/deploy-prod.yml:14, 21, 30, 33, 36, 57, 69 (10 hits)

.github/workflows/v3-ci.yml:289, 346, 380, 444, 518, 573 (6 hits)

ruflo/src/ruvocal/.github/workflows/deploy-dev.yml:24, 30, 38, 46, 49 (6 hits)

.github/workflows/federation-peer-rust.yml:36, 67 (2 hits)

CI/CD securitySupply chainGitHub Actions

medium System graph cicd CI/CD security conf 1.00 3 occurrences GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

3 files, 3 locations

.github/workflows/clone-tracker.yml

.github/workflows/pages.yml

ruflo/src/ruvocal/.github/workflows/build-image.yml

CI/CD securitySupply chainGithub actions

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in v3/@claude-flow/cli/src/commands/analyze.ts:358

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

v3/@claude-flow/cli/src/commands/analyze.ts:358 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in v3/@claude-flow/cli/src/commands/security.ts:147

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

v3/@claude-flow/cli/src/commands/security.ts:147 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in v3/@claude-flow/hooks/src/workers/index.ts:1496

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

v3/@claude-flow/hooks/src/workers/index.ts:1496 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in v3/goal_ui/src/components/ui/chart.tsx:70

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

v3/goal_ui/src/components/ui/chart.tsx:70 Dangerous innerhtml

medium System graph cicd CI/CD security conf 1.00 Install-time lifecycle script performs network/shell-sensitive actions

preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.

v3/@claude-flow/browser/package.json CI/CD securitySupply chainNpm

medium System graph network Security conf 1.00 Privileged port 10 in use

Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

plugins/ruflo-neural-trader/scripts/runtime-smoke.sh Ports

medium System graph network Security conf 1.00 Privileged port 1000 in use

Port 1000 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

ruflo/src/ruvocal/Dockerfile Ports

low Security checks cicd CI/CD security conf 0.68 App service does not wait for database health

Give the database a healthcheck and change the dependency to `depends_on: { db: { condition: service_healthy } }`.

ruflo/docker-compose.yml:77 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.56 14 occurrences Compose service does not declare a runtime user

Set a non-root `user:` in Compose or ensure the final image stage has a non-root USER directive.

4 files, 14 locations

tests/docker-regression/docker-compose.yml:7, 35, 62, 78, 102, 121 (6 hits)

ruflo/docker-compose.yml:20, 60, 77 (3 hits)

v3/@claude-flow/browser/docker/docker-compose.yml:3, 16, 32 (3 hits)

v3/@claude-flow/plugins/examples/ruvector/docker-compose.yml:20, 55 (2 hits)

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.62 16 occurrences Compose service lacks no-new-privileges hardening

Add `security_opt: ["no-new-privileges:true"]` unless the service has a documented need for privilege escalation.

5 files, 16 locations

tests/docker-regression/docker-compose.yml:7, 35, 62, 78, 102, 121 (6 hits)

ruflo/docker-compose.yml:20, 60, 77 (3 hits)

v3/@claude-flow/browser/docker/docker-compose.yml:3, 16, 32 (3 hits)

v3/@claude-flow/cli/docker/docker-compose.yml:17, 43, 76 (3 hits)

v3/@claude-flow/plugins/examples/ruvector/docker-compose.yml:55

CI/CD securitycontainers

low Security checks cicd CI/CD security conf 0.72 3 occurrences Dockerfile installs recommended OS packages

Add `--no-install-recommends` and explicitly list only packages the image needs.

3 files, 3 locations

ruflo/src/ruvocal/.devcontainer/Dockerfile:4

ruflo/src/ruvocal/Dockerfile:24

tests/docker-regression/Dockerfile:7

CI/CD securitycontainers

low Security checks quality Quality conf 0.60 26 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

12 files, 12 locations

plugins/ruflo-graph-intelligence/src/adapters/cost-attribution-adapter.ts:63

plugins/ruflo-graph-intelligence/src/adapters/observability-span-adapter.ts:70

plugins/ruflo-neural-trader/src/signed-attribution.ts:57

ruflo/src/ruvocal/mcp-bridge/mcp-stdio-kernel.js:1

ruflo/src/ruvocal/mcp-bridge/test-harness.js:1

ruflo/src/ruvocal/src/lib/components/chat/ChatIntroduction.svelte:99

ruflo/src/ruvocal/src/lib/components/chat/UrlFetchModal.svelte:122

ruflo/src/ruvocal/src/lib/components/icons/IconFast.svelte:1

duplicationquality

low Security checks quality Quality conf 0.64 Public docs site has no llms.txt

Add llms.txt with the product summary, canonical docs, API endpoints, security guidance, and preferred CLI workflow for AI agents.

llms.txt

low Security checks quality Quality conf 0.50 Public web app has no humans.txt

Add humans.txt with team ownership, contact URL, key documentation links, and the last-updated date.

humans.txt

low Security checks quality Quality conf 0.74 Public web app has no robots.txt

Add robots.txt at the web root or a framework-native robots route. Include an explicit Sitemap directive and disallow only private paths.

robots.txt

low Security checks quality Quality conf 0.72 Public web app has no sitemap

Add sitemap.xml, a sitemap index, or a framework-native sitemap route and reference it from robots.txt.

sitemap.xml

low System graph quality Integrity conf 1.00 137 env vars used in code but missing from .env.example

Drift between code and config docs. The first few: `ADAPTER`, `ALLOW_IFRAME`, `ANTHROPIC_BASE_URL`, `ANTHROPIC_MODEL`, `APPDATA`, `APP_BASE`, `AUTOPILOT_COOLDOWN`, `AUTOPILOT_DETAIL_TTL` + 129 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break.

config drift

low System graph quality Maintenance conf 1.00 46 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/devcontainers/typescript-node:1-22-bookworm

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

ruflo/src/ruvocal/.devcontainer/Dockerfile:1 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/playwright:v1.40.0-jammy

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

v3/@claude-flow/browser/docker/Dockerfile:3 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: mongo:7

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

ruflo/src/ruvocal/Dockerfile:62 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: nginx:1.27-alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

ruflo/src/nginx/Dockerfile:1 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:20-slim

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

ruflo/src/ruvocal/mcp-bridge/Dockerfile:1 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:20-slim

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

ruflo/src/mcp-bridge/Dockerfile:1 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 2 occurrences Docker base image is tag-pinned but not digest-pinned: node:22-alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

lines 17, 93

v3/@claude-flow/cli/docker/Dockerfile:17, 93 (2 hits)

containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:24

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

ruflo/src/ruvocal/Dockerfile:41 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:24-slim

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

ruflo/src/ruvocal/Dockerfile:3 containersPinned dependencies

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/postcss.config.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/scripts/setups/vitest-setup-client.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/scripts/setups/vitest-setup-server.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/ambient.d.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/app.d.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/hooks.server.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/hooks.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/constants/mcpExamples.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/constants/mime.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/constants/pagination.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/constants/publicSepToken.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/constants/routerExamples.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/stores/backgroundGenerations.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/stores/errors.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/stores/isAborted.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/stores/isPro.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/stores/loading.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/stores/pendingChatInput.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/stores/pendingMessage.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/stores/titleUpdate.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/AbortedGeneration.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Assistant.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/AssistantStats.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/ConfigKey.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Conversation.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/ConversationStats.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/ConvSidebar.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Message.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/MessageEvent.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/MigrationResult.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Model.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Report.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Review.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Semaphore.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Session.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Settings.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/SharedConversation.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Template.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Timestamps.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/TokenCache.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/Tool.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/UrlDependency.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/types/User.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/utils/mergeAsyncGenerators.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/utils/template.spec.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/utils/timeout.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/utils/toolProgress.spec.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/utils/tree/convertLegacyConversation.spec.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: ruflo/src/ruvocal/src/lib/wasm/tests/wasm-capabilities.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph software Dead code candidate conf 1.00 File has no detected symbols: tests/rvf-migration.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph cicd CI/CD security conf 1.00 113 occurrences GitHub Action is tag-pinned rather than SHA-pinned

actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

12 files, 106 locations

.github/workflows/integration-tests.yml:49, 52, 138, 154, 157, 166, 287, 303, +12 more (24 hits)

.github/workflows/verification-pipeline.yml:35, 40, 57, 73, 76, 82, 111, 126, +12 more (20 hits)

.github/workflows/ci.yml:22, 25, 64, 67, 86, 98, 101, 130, +6 more (14 hits)

.github/workflows/rollback-manager.yml:55, 60, 159, 176, 181, 274, 293, 299, +6 more (14 hits)

.github/workflows/v3-ci.yml:286, 294, 332, 343, 351, 377, 385, 400, +6 more (14 hits)

ruflo/src/ruvocal/.github/workflows/lint-and-test.yml:15, 16, 35, 36, 52 (5 hits)

ruflo/src/ruvocal/.github/workflows/build-image.yml:26, 87 (4 hits)

.github/workflows/status-badges.yml:19, 24, 167 (3 hits)

CI/CD securitySupply chainGitHub Actions

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `breakingNonDeprecated` in v3/@claude-flow/testing/src/v2-compat/cli-compat.test.ts:417

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `checkAndMigrateLegacy` in v3/@claude-flow/cli/src/memory/memory-initializer.ts:1179

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `F_old` in v3/@claude-flow/cli/src/memory/ewc-consolidation.ts:530

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `flash_attention_v2` in v3/@claude-flow/plugins/src/integrations/ruvector/attention-executor.ts:386

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `flash_attention_v2` in v3/@claude-flow/plugins/src/integrations/ruvector/attention.ts:745

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `flash_attention_v2` in v3/@claude-flow/plugins/src/integrations/ruvector/types.ts:362

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `formula_v2` in v3/plugins/gastown-bridge/tests/wasm-loader.test.ts:1078

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `fstate_legacy` in v3/@claude-flow/cli/__tests__/q-state-encoder-2239.test.ts:50

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `gat_v2` in v3/@claude-flow/plugins/__tests__/ruvector-bridge.test.ts:502

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `gat_v2` in v3/@claude-flow/plugins/src/integrations/ruvector/gnn.ts:48

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `isOld` in v3/@claude-flow/memory/src/domain/services/memory-domain-service.ts:203

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `migrateFromLegacy` in v3/@claude-flow/cli/__tests__/mcp-tools-deep.test.ts:84

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `my_schema_v2` in v3/@claude-flow/cli/__tests__/security-verification.test.ts:438

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `name_v2` in v3/@claude-flow/security/__tests__/unit/path-validator.test.ts:500

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `retrievedOld` in v3/@claude-flow/guidance/tests/temporal.test.ts:560

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `wasLegacy` in v3/@claude-flow/cli/src/mcp-tools/agentdb-tools.ts:337

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts

preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.

ruflo/src/ruvocal/package.json CI/CD securitySupply chainNpm

low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts

preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.

v3/@claude-flow/cli/package.json CI/CD securitySupply chainNpm

low System graph frontend Frontend quality conf 1.00 React Flow <Controls> without dark theming — v3/goal_ui/src/components/agents/PlanVisualization.tsx:87

`<Controls>` ships with white buttons. Override `.react-flow__controls` and `.react-flow__controls-button` in your stylesheet or pass a styled wrapper. Why: P1 in CHECKLIST.md — vendor defaults bleed light through. Rule id: fq.controls.no-bg

Fq controls no bg

low System graph frontend Frontend quality conf 1.00 React Flow <MiniMap> without dark background — v3/goal_ui/src/components/agents/PlanVisualization.tsx:88

A bare <MiniMap> renders with the vendor's white default in dark themes. Wrap the canvas in a class that overrides `.react-flow__minimap` background, or pass an explicit `style`/`maskColor`/`bgColor`. Why: P1 in CHECKLIST.md — vendor defaults bleed light through. Rule id: fq.minimap.no-bg

Fq minimap no bg

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — ruflo/src/mcp-bridge/index.js:151