Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

trycua/cua

https://github.com/trycua/cua · scanned 2026-06-16 00:44 UTC (2 months, 1 week ago)

728 raw signals (0 security + 728 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 562 actionable findings from 1 signal source. 166 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
35.7
/100
Security checks
36
0 findings
System graph
36
100.0% cov · 562 findings
Critical
7
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 7 High 87 Medium 251 Low 162 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 562 Crowd 0 Layer: Software 20 Frontend 35 Network 1 Hardware 18 Security 230 Cicd 4 Quality 190 Api 64
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 35.7/100 with 100.0% coverage. It contains 11585 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 728 findings — concentrated in security (230), quality (207), cicd (148). Risk profile is high: 7 critical, 89 high, 325 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 506 of 562 actionable findings. 728 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Secrets conf 1.00 Possible secret in .github/workflows/cd-swift-cua-driver.yml
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
.github/workflows/cd-swift-cua-driver.yml:99
critical System graph security Secrets conf 1.00 Possible secret in .github/workflows/cd-swift-lume.yml
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
.github/workflows/cd-swift-lume.yml:101
critical System graph security Secrets conf 1.00 Possible secret in libs/cua-bench/tasks/winarena_adapter/evaluators/getters/vlc.py
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
libs/cua-bench/tasks/winarena_adapter/evaluators/getters/vlc.py:20
critical System graph security Secrets conf 1.00 Possible secret in libs/cuabot/src/telemetry.ts
Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager.
libs/cuabot/src/telemetry.ts:16
critical System graph security Secrets conf 1.00 Possible secret in libs/lumier/src/lib/utils.sh
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
libs/lumier/src/lib/utils.sh:81
critical System graph security Secrets conf 1.00 Possible secret in libs/python/core/cua_core/telemetry/posthog.py
Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager.
libs/python/core/cua_core/telemetry/posthog.py:20
critical System graph security Secrets conf 1.00 Possible secret in libs/typescript/core/src/telemetry/clients/posthog.ts
Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager.
libs/typescript/core/src/telemetry/clients/posthog.ts:18
high System graph quality Integrity conf 1.00 Blocking `requests.get(...)` inside `async def _download_setup` — libs/cua-bench/tasks/winarena_adapter/setup_controller.py:88
Sync I/O inside an async function blocks the event loop. While `requests.get(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_th…
libs/cua-bench/tasks/winarena_adapter/setup_controller.py:88 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def _run` — libs/cua-bench/cua_bench/scripts/benchmark_workers.py:241
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
libs/cua-bench/cua_bench/scripts/benchmark_workers.py:241 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def main` — libs/cua-bench/scripts/diagnose_daytona.py:105
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
libs/cua-bench/scripts/diagnose_daytona.py:105 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def main` — libs/python/computer-server/computer_server/diorama/diorama.py:540
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
libs/python/computer-server/computer_server/diorama/diorama.py:540 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def resume` — libs/python/cua-sandbox/cua_sandbox/runtime/qemu.py:693
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
libs/python/cua-sandbox/cua_sandbox/runtime/qemu.py:693 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def start` — libs/python/cua-sandbox/cua_sandbox/runtime/qemu.py:374
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
libs/python/cua-sandbox/cua_sandbox/runtime/qemu.py:374 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `urllib.request.urlopen(...)` inside `async def _execute_native_interactive` — libs/cua-bench/cua_bench/cli/commands/interact.py:356
Sync I/O inside an async function blocks the event loop. While `urllib.request.urlopen(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asy…
libs/cua-bench/cua_bench/cli/commands/interact.py:356 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `urllib.request.urlopen(...)` inside `async def main` — libs/cua-bench/scripts/diagnose_daytona.py:99
Sync I/O inside an async function blocks the event loop. While `urllib.request.urlopen(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asy…
libs/cua-bench/scripts/diagnose_daytona.py:99 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `urllib.request.urlopen(...)` inside `async def test_status` — libs/cua-bench/scripts/diagnose_daytona.py:45
Sync I/O inside an async function blocks the event loop. While `urllib.request.urlopen(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asy…
libs/cua-bench/scripts/diagnose_daytona.py:45 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `urllib.request.urlretrieve(...)` inside `async def _install_apk` — libs/python/cua-sandbox/cua_sandbox/transport/cloud.py:519
Sync I/O inside an async function blocks the event loop. While `urllib.request.urlretrieve(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await…
libs/python/cua-sandbox/cua_sandbox/transport/cloud.py:519 Sync io in asyncPerformance
high System graph quality Integrity conf 1.00 Blocking `urllib.request.urlretrieve(...)` inside `async def _resolve_apk` — libs/python/cua-sandbox/cua_sandbox/runtime/android_emulator.py:782
Sync I/O inside an async function blocks the event loop. While `urllib.request.urlretrieve(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await…
libs/python/cua-sandbox/cua_sandbox/runtime/android_emulator.py:782 Sync io in asyncPerformance
high System graph api Wiring conf 1.00 Dangling fetch: DELETE /v1/playground/chats/${chatId} (libs/typescript/playground/src/adapters/cloud.ts:86)
`libs/typescript/playground/src/adapters/cloud.ts:86` calls `DELETE /v1/playground/chats/${chatId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/playground/chats/<p>` If this points at an external API, prefix it w…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/chat/${sessionId}/export (libs/typescript/playground/src/components/modals/ExportTrajectoryModal.tsx:45)
`libs/typescript/playground/src/components/modals/ExportTrajectoryModal.tsx:45` calls `GET /api/chat/${sessionId}/export` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/chat/<p>/export` If this points at an external…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/chat/${sessionId}/export (libs/typescript/playground/src/components/modals/ReplayTrajectoryModal.tsx:95)
`libs/typescript/playground/src/components/modals/ReplayTrajectoryModal.tsx:95` calls `GET /api/chat/${sessionId}/export` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/chat/<p>/export` If this points at an external…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /v1/vms/${computerId}/health (libs/typescript/playground/src/adapters/cloud.ts:198)
`libs/typescript/playground/src/adapters/cloud.ts:198` calls `GET /v1/vms/${computerId}/health` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/vms/<p>/health` If this points at an external API, prefix it with `https…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://localhost:${port}/status (libs/cuabot/src/client.ts:188)
`libs/cuabot/src/client.ts:188` calls `GET http://localhost:${port}/status` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/localhost:/<p>/status` If this points at an external API, prefix it with `https://` so…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://localhost:${port}/status (libs/cuabot/src/client.ts:253)
`libs/cuabot/src/client.ts:253` calls `GET http://localhost:${port}/status` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/localhost:/<p>/status` If this points at an external API, prefix it with `https://` so…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/chat/${sessionId}/export (libs/typescript/playground/src/components/modals/ExportTrajectoryModal.tsx:93)
`libs/typescript/playground/src/components/modals/ExportTrajectoryModal.tsx:93` calls `POST /api/chat/${sessionId}/export` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/chat/<p>/export` If this points at an externa…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/chat/${sessionId}/export (libs/typescript/playground/src/components/modals/ReplayTrajectoryModal.tsx:142)
`libs/typescript/playground/src/components/modals/ReplayTrajectoryModal.tsx:142` calls `POST /api/chat/${sessionId}/export` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/chat/<p>/export` If this points at an extern…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://localhost:${port}/stop (libs/cuabot/src/cuabotd.ts:1208)
`libs/cuabot/src/cuabotd.ts:1208` calls `POST http://localhost:${port}/stop` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/localhost:/<p>/stop` If this points at an external API, prefix it with `https://` so …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://localhost:${port}/telemetry (libs/cuabot/src/telemetry.ts:291)
`libs/cuabot/src/telemetry.ts:291` calls `POST http://localhost:${port}/telemetry` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/localhost:/<p>/telemetry` If this points at an external API, prefix it with `ht…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.anthropic.com/v1/messages (libs/typescript/cua-cli/src/commands/skills.ts:358)
`libs/typescript/cua-cli/src/commands/skills.ts:358` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.anthropic.com/v1/messages` If this points at an exter…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.openai.com/v1/chat/completions (libs/typescript/cua-cli/src/commands/skills.ts:472)
`libs/typescript/cua-cli/src/commands/skills.ts:472` calls `POST https://api.openai.com/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.openai.com/v1/chat/completions` If this points a…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: PUT /v1/playground/chats/${chatId}/messages (libs/typescript/playground/src/adapters/cloud.ts:90)
`libs/typescript/playground/src/adapters/cloud.ts:90` calls `PUT /v1/playground/chats/${chatId}/messages` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/playground/chats/<p>/messages` If this points at an external A…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: PUT /v1/playground/settings/${key} (libs/typescript/playground/src/adapters/cloud.ts:109)
`libs/typescript/playground/src/adapters/cloud.ts:109` calls `PUT /v1/playground/settings/${key}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/playground/settings/<p>` If this points at an external API, prefix it …
Dangling fetchFetch
high System graph hardware Supply chain conf 1.00 3 occurrences Dockerfile pipes a remote installer into a shell
Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature.
2 files, 3 locations
libs/cuabot/Dockerfile:143, 146 (2 hits)
libs/qemu-docker/android/Dockerfile:59
containersRemote installer
high System graph security auth conf 1.00 FastAPI DELETE `pty_kill` without auth dependency — libs/python/computer-server/computer_server/main.py:866
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/python/computer-server/computer_server/main.py:866 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `agent_response_endpoint` without auth dependency — libs/python/computer-server/computer_server/main.py:1035
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/python/computer-server/computer_server/main.py:1035 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `cmd_endpoint` without auth dependency — libs/python/computer-server/computer_server/main.py:680
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/python/computer-server/computer_server/main.py:680 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `complete_call` without auth dependency — libs/python/agent/cua_agent/human_tool/server.py:213
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/python/agent/cua_agent/human_tool/server.py:213 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `fail_call` without auth dependency — libs/python/agent/cua_agent/human_tool/server.py:225
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/python/agent/cua_agent/human_tool/server.py:225 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `playwright_exec_endpoint` without auth dependency — libs/python/computer-server/computer_server/main.py:1366
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/python/computer-server/computer_server/main.py:1366 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `pty_create` without auth dependency — libs/python/computer-server/computer_server/main.py:813
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/python/computer-server/computer_server/main.py:813 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `pty_resize` without auth dependency — libs/python/computer-server/computer_server/main.py:899
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/python/computer-server/computer_server/main.py:899 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `pty_stdin` without auth dependency — libs/python/computer-server/computer_server/main.py:881
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/python/computer-server/computer_server/main.py:881 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `queue_completion` without auth dependency — libs/python/agent/cua_agent/human_tool/server.py:190
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/python/agent/cua_agent/human_tool/server.py:190 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `reset` without auth dependency — libs/cua-bench/cua_bench/workers/worker_server.py:306
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/cua-bench/cua_bench/workers/worker_server.py:306 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `shutdown` without auth dependency — libs/cua-bench/cua_bench/workers/worker_server.py:433
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/cua-bench/cua_bench/workers/worker_server.py:433 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `step` without auth dependency — libs/cua-bench/cua_bench/workers/worker_server.py:363
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
libs/cua-bench/cua_bench/workers/worker_server.py:363 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 Flask mutation route `activate_window` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1476
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1476 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `are_all_images_tagged` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1925
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1925 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `change_wallpaper` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1363
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1363 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `clear_task_files` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1573
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1573 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `close_all_windows` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1623
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1623 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `close_window` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1659
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1659 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_file` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1100
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1100 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_folder` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1083
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1083 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `download_file` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1411
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1411 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `end_recording` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1746
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1746 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `execute_command_windows` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:180
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:180 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `execute_command` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:211
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:211 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `execute_command` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:212
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:212 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_are_files_sorted_by_modified_time` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1841
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1841 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_check_if_timer_started` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1976
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1976 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_check_if_world_clock_exists` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:2007
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:2007 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_desktop_path` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1045
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1045 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_directory_tree` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1286
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1286 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_documents_path` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1064
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1064 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_file_exists` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1172
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1172 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_file_explorer_is_details_view` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1192
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1192 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_file` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1325
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1325 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_folder_exists` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1146
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1146 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_library_folders` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1959
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1959 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_screen_size` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1005
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1005 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_wallpaper` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1228
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1228 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `get_window_size` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1018
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1018 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `is_directory_read_only_for_user` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1901
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1901 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `launch_app` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:290
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:290 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `open_file` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1448
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1448 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `recycle_file` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1134
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1134 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `revert_to_snapshot` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1813
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1813 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `save_state` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1778
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1778 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `shutdown_endpoint` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:276
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:276 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `start_recording` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1706
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1706 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `update_computer` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:138
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:138 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `upload_file` without `@login_required` — libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1341
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1341 securityAuth flask unauth route
high System graph security security conf 1.00 Insecure pattern 'eval_used' in libs/cua-bench/tasks/winarena_adapter/evaluators/getters/fileexplorer.py:96
Found a known-risky pattern (eval_used). Review and replace if possible.
libs/cua-bench/tasks/winarena_adapter/evaluators/getters/fileexplorer.py:96 Eval used
high System graph security security conf 1.00 Insecure pattern 'eval_used' in libs/cua-bench/tasks/winarena_adapter/evaluators/metrics/basic_os.py:4
Found a known-risky pattern (eval_used). Review and replace if possible.
libs/cua-bench/tasks/winarena_adapter/evaluators/metrics/basic_os.py:4 Eval used
high System graph security security conf 1.00 Insecure pattern 'eval_used' in libs/cua-driver/rust/crates/platform-windows/src/tools/page_bookmark.rs:165
Found a known-risky pattern (eval_used). Review and replace if possible.
libs/cua-driver/rust/crates/platform-windows/src/tools/page_bookmark.rs:165 Eval used
high System graph security security conf 1.00 Insecure pattern 'eval_used' in libs/python/agent/cua_agent/loops/uitars.py:306
Found a known-risky pattern (eval_used). Review and replace if possible.
libs/python/agent/cua_agent/loops/uitars.py:306 Eval used
high System graph security security conf 1.00 Insecure pattern 'eval_used' in scripts/docs-generators/extract_python_docs.py:202
Found a known-risky pattern (eval_used). Review and replace if possible.
scripts/docs-generators/extract_python_docs.py:202 Eval used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in libs/cua-bench/cua_bench/computers/webtop.py:301
Found a known-risky pattern (exec_used). Review and replace if possible.
libs/cua-bench/cua_bench/computers/webtop.py:301 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:194
Found a known-risky pattern (exec_used). Review and replace if possible.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:194 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in libs/cuabot/src/cuabotd.ts:172
Found a known-risky pattern (exec_used). Review and replace if possible.
libs/cuabot/src/cuabotd.ts:172 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in libs/cuabot/src/onboarding.tsx:401
Found a known-risky pattern (exec_used). Review and replace if possible.
libs/cuabot/src/onboarding.tsx:401 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in libs/cuabot/src/utils.ts:262
Found a known-risky pattern (exec_used). Review and replace if possible.
libs/cuabot/src/utils.ts:262 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in libs/python/computer/computer/computer.py:1404
Found a known-risky pattern (exec_used). Review and replace if possible.
libs/python/computer/computer/computer.py:1404 Exec used
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — docs/src/app/layout.tsx:39
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — docs/src/components/mermaid.tsx:43
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — docs/src/components/doc-actions-menu.tsx:23
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — docs/src/lib/posthog-query.ts:41
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — docs/src/lib/slack-reporter.ts:72
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — libs/cuabot/src/client.ts:68
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — libs/typescript/agent/src/client.ts:148
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — libs/typescript/cua-cli/src/auth.ts:25
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — libs/typescript/cua-cli/src/commands/image.ts:245
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — libs/typescript/cua-cli/src/commands/skills.ts:358
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — libs/typescript/cua-cli/src/http.ts:21
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — libs/typescript/playground/src/adapters/cloud.ts:109
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — libs/typescript/playground/src/components/modals/ReplayTrajectoryModal.tsx:95
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — libs/typescript/playground/src/components/TrajectoryViewer/index.tsx:918
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/docs-generators/lume.ts:700
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/click-button/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/click-button/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/click-icon/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/click-icon/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/color-picker/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/color-picker/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/date-picker/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/date-picker/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/drag-drop/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/drag-drop/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/drag-slider/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/drag-slider/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/fill-form/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/fill-form/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/right-click-menu/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/right-click-menu/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/select-dropdown/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/select-dropdown/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/spreadsheet-cell/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/spreadsheet-cell/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/toggle-switch/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/toggle-switch/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/typing-input/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/typing-input/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/datasets/cua-bench-basic/video-player/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/datasets/cua-bench-basic/video-player/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cua-bench/example_tasks/minesweeper_game_env/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cua-bench/example_tasks/minesweeper_game_env/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: libs/cuabot/src/prompts/.mcp.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
libs/cuabot/src/prompts/.mcp.json VerificationMcp config
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: trycua/qemu-local:latest
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
libs/qemu-docker/linux/Dockerfile:1 containersPinned dependencies
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: trycua/windows-local:latest
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
libs/qemu-docker/windows/Dockerfile:13 containersPinned dependencies
medium System graph hardware Security conf 1.00 Dockerfile runs as root: Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: libs/kasm/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: libs/lumier/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: libs/qemu-docker/android/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: libs/qemu-docker/linux/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: libs/qemu-docker/windows/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: libs/xfce/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph cicd CI/CD security conf 1.00 48 occurrences GitHub Action is tag-pinned rather than SHA-pinned
softprops/action-gh-release@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
12 files, 40 locations
.github/workflows/docker-reusable-publish.yml:66, 69, 77, 89, 99, 114, 127, 172, +3 more (11 hits)
.github/workflows/docs-mcp-server-build-push.yml:56, 63, 66, 74, 99, 111, 152, 158, +2 more (10 hits)
.github/workflows/ts-reusable-publish.yml:46, 52, 76 (3 hits)
.github/workflows/ci-check-docs-links.yml:24, 58 (2 hits)
.github/workflows/ci-check-links.yml:19, 86 (2 hits)
.github/workflows/ci-cold-start-benchmark.yml:14, 34 (2 hits)
.github/workflows/ci-test-models.yml:87, 379 (2 hits)
.github/workflows/claude-auto-fix.yml:159, 196 (2 hits)
CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 28 occurrences GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
12 files, 12 locations
.github/workflows/cd-py-agent.yml
.github/workflows/cd-py-auto.yml
.github/workflows/cd-py-bench-ui.yml
.github/workflows/cd-py-bench.yml
.github/workflows/cd-py-cli.yml
.github/workflows/cd-py-computer-server.yml
.github/workflows/cd-py-computer.yml
.github/workflows/cd-py-core.yml
CI/CD securitySupply chainGithub actions
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in docs/scripts/docs-mcp-server/main.py:506
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
docs/scripts/docs-mcp-server/main.py:506 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in docs/scripts/modal_app.py:1970
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
docs/scripts/modal_app.py:1970 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in libs/cua-bench/cua_bench/cli/commands/trace.py:466
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
libs/cua-bench/cua_bench/cli/commands/trace.py:466 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in libs/cua-bench/cua_bench/workers/worker_server.py:75
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
libs/cua-bench/cua_bench/workers/worker_server.py:75 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in libs/cuabot/src/cuabotd.ts:966
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
libs/cuabot/src/cuabotd.ts:966 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in libs/python/agent/cua_agent/playground/server.py:46
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
libs/python/agent/cua_agent/playground/server.py:46 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in libs/python/computer-server/computer_server/main.py:182
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
libs/python/computer-server/computer_server/main.py:182 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in docs/src/app/layout.tsx:39
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
docs/src/app/layout.tsx:39 Dangerous innerhtml
medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in docs/src/components/mermaid.tsx:43
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
docs/src/components/mermaid.tsx:43 Dangerous innerhtml
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/cua-bench/cua_bench/www/environment-detail.html:416
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/cua-bench/cua_bench/www/environment-detail.html:416 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/cua-bench/cua_bench/www/environments.html:306
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/cua-bench/cua_bench/www/environments.html:306 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/cua-bench/cua_bench/www/generate.html:486
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/cua-bench/cua_bench/www/generate.html:486 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/cua-bench/cua_bench/www/trace_viewer.html:599
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/cua-bench/cua_bench/www/trace_viewer.html:599 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/cua-bench/tasks/slack_env/gui/index.html:2003
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/cua-bench/tasks/slack_env/gui/index.html:2003 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/ansible/linux/logs/transcript/index.html:318
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/ansible/linux/logs/transcript/index.html:318 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/ansible/linux/logs/transcript/page-001.html:1133
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/ansible/linux/logs/transcript/page-001.html:1133 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/apache-cassandra/linux/logs/transcript/index.html:324
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/apache-cassandra/linux/logs/transcript/index.html:324 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/apache-cassandra/linux/logs/transcript/page-001.html:1456
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/apache-cassandra/linux/logs/transcript/page-001.html:1456 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/azure-data-studio/linux/logs/transcript/index.html:309
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/azure-data-studio/linux/logs/transcript/index.html:309 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/azure-data-studio/linux/logs/transcript/page-001.html:1991
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/azure-data-studio/linux/logs/transcript/page-001.html:1991 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/chef/linux/logs/transcript/index.html:319
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/chef/linux/logs/transcript/index.html:319 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/chef/linux/logs/transcript/page-001.html:1609
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/chef/linux/logs/transcript/page-001.html:1609 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/dbeaver/linux/logs/transcript/index.html:319
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/dbeaver/linux/logs/transcript/index.html:319 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/dbeaver/linux/logs/transcript/page-001.html:2101
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/dbeaver/linux/logs/transcript/page-001.html:2101 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/docker/linux/logs/transcript/index.html:311
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/docker/linux/logs/transcript/index.html:311 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/docker/linux/logs/transcript/page-001.html:1631
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/docker/linux/logs/transcript/page-001.html:1631 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/eclipse-ide/linux/logs/transcript/index.html:319
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/eclipse-ide/linux/logs/transcript/index.html:319 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/eclipse-ide/linux/logs/transcript/page-001.html:996
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/eclipse-ide/linux/logs/transcript/page-001.html:996 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/elasticsearch/linux/logs/transcript/index.html:315
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/elasticsearch/linux/logs/transcript/index.html:315 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/elasticsearch/linux/logs/transcript/page-001.html:2035
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/elasticsearch/linux/logs/transcript/page-001.html:2035 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/emacs/linux/logs/transcript/index.html:309
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/emacs/linux/logs/transcript/index.html:309 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/emacs/linux/logs/transcript/page-001.html:697
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/emacs/linux/logs/transcript/page-001.html:697 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/featurewiz/linux/logs/transcript/index.html:284
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/featurewiz/linux/logs/transcript/index.html:284 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/featurewiz/linux/logs/transcript/page-001.html:239
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/featurewiz/linux/logs/transcript/page-001.html:239 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gawk/linux/logs/transcript/index.html:322
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gawk/linux/logs/transcript/index.html:322 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gawk/linux/logs/transcript/page-001.html:1106
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gawk/linux/logs/transcript/page-001.html:1106 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/genie3/linux/logs/transcript/index.html:288
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/genie3/linux/logs/transcript/index.html:288 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/genie3/linux/logs/transcript/page-001.html:276
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/genie3/linux/logs/transcript/page-001.html:276 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gin/linux/logs/transcript/index.html:286
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gin/linux/logs/transcript/index.html:286 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gin/linux/logs/transcript/page-001.html:251
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gin/linux/logs/transcript/page-001.html:251 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/git/linux/logs/transcript/index.html:339
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/git/linux/logs/transcript/index.html:339 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/git/linux/logs/transcript/page-001.html:774
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/git/linux/logs/transcript/page-001.html:774 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/github-actions/linux/logs/transcript/index.html:332
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/github-actions/linux/logs/transcript/index.html:332 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/github-actions/linux/logs/transcript/page-001.html:1416
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/github-actions/linux/logs/transcript/page-001.html:1416 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gitlab/linux/logs/transcript/index.html:377
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gitlab/linux/logs/transcript/index.html:377 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gitlab/linux/logs/transcript/page-001.html:4931
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gitlab/linux/logs/transcript/page-001.html:4931 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/godot-engine/linux/logs/transcript/index.html:300
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/godot-engine/linux/logs/transcript/index.html:300 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/godot-engine/linux/logs/transcript/page-001.html:1072
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/godot-engine/linux/logs/transcript/page-001.html:1072 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/intellij-idea/linux/logs/transcript/index.html:335
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/intellij-idea/linux/logs/transcript/index.html:335 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/intellij-idea/linux/logs/transcript/page-001.html:2498
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/intellij-idea/linux/logs/transcript/page-001.html:2498 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/jenkins/linux/logs/transcript/index.html:313
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/jenkins/linux/logs/transcript/index.html:313 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/jenkins/linux/logs/transcript/page-001.html:1877
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/jenkins/linux/logs/transcript/page-001.html:1877 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/kubernetes/linux/logs/transcript/index.html:330
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/kubernetes/linux/logs/transcript/index.html:330 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/kubernetes/linux/logs/transcript/page-001.html:2140
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/kubernetes/linux/logs/transcript/page-001.html:2140 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/lit/linux/logs/transcript/index.html:286
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/lit/linux/logs/transcript/index.html:286 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/lit/linux/logs/transcript/page-001.html:224
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/lit/linux/logs/transcript/page-001.html:224 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mariadb/linux/logs/transcript/index.html:311
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mariadb/linux/logs/transcript/index.html:311 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mariadb/linux/logs/transcript/page-001.html:1070
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mariadb/linux/logs/transcript/page-001.html:1070 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/metasploit/linux/logs/transcript/index.html:335
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/metasploit/linux/logs/transcript/index.html:335 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/metasploit/linux/logs/transcript/page-001.html:2548
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/metasploit/linux/logs/transcript/page-001.html:2548 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mysql/linux/logs/transcript/index.html:312
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mysql/linux/logs/transcript/index.html:312 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mysql/linux/logs/transcript/page-001.html:2165
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mysql/linux/logs/transcript/page-001.html:2165 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/neovim/linux/logs/transcript/index.html:301
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/neovim/linux/logs/transcript/index.html:301 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/neovim/linux/logs/transcript/page-001.html:894
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/neovim/linux/logs/transcript/page-001.html:894 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/netbeans/linux/logs/transcript/index.html:315
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/netbeans/linux/logs/transcript/index.html:315 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/netbeans/linux/logs/transcript/page-001.html:2876
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/netbeans/linux/logs/transcript/page-001.html:2876 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/nmap/linux/logs/transcript/index.html:314
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/nmap/linux/logs/transcript/index.html:314 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/nmap/linux/logs/transcript/page-001.html:750
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/nmap/linux/logs/transcript/page-001.html:750 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/openshot/linux/logs/transcript/index.html:321
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/openshot/linux/logs/transcript/index.html:321 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/openshot/linux/logs/transcript/page-001.html:936
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/openshot/linux/logs/transcript/page-001.html:936 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/pgadmin/linux/logs/transcript/index.html:315
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/pgadmin/linux/logs/transcript/index.html:315 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/postgresql/linux/logs/transcript/index.html:307
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/postgresql/linux/logs/transcript/index.html:307 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/postgresql/linux/logs/transcript/page-001.html:1479
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/postgresql/linux/logs/transcript/page-001.html:1479 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/puppet/linux/logs/transcript/index.html:314
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/puppet/linux/logs/transcript/index.html:314 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/puppet/linux/logs/transcript/page-001.html:967
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/puppet/linux/logs/transcript/page-001.html:967 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/pycharm/linux/logs/transcript/index.html:313
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/pycharm/linux/logs/transcript/index.html:313 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/raneto/linux/logs/transcript/index.html:332
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/raneto/linux/logs/transcript/index.html:332 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/raneto/linux/logs/transcript/page-001.html:1950
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/raneto/linux/logs/transcript/page-001.html:1950 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/redis/linux/logs/transcript/index.html:305
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/redis/linux/logs/transcript/index.html:305 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/redis/linux/logs/transcript/page-001.html:1113
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/redis/linux/logs/transcript/page-001.html:1113 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/sqlite/linux/logs/transcript/index.html:324
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/sqlite/linux/logs/transcript/index.html:324 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/sqlite/linux/logs/transcript/page-001.html:1435
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/sqlite/linux/logs/transcript/page-001.html:1435 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/systemd-hostnamed/linux/logs/transcript/index.html:309
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/systemd-hostnamed/linux/logs/transcript/index.html:309 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/systemd-hostnamed/linux/logs/transcript/page-001.html:1234
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/systemd-hostnamed/linux/logs/transcript/page-001.html:1234 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/torch-points3d/linux/logs/transcript/index.html:295
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/torch-points3d/linux/logs/transcript/index.html:295 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/torch-points3d/linux/logs/transcript/page-001.html:289
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/torch-points3d/linux/logs/transcript/page-001.html:289 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/unity/linux/logs/transcript/index.html:306
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/unity/linux/logs/transcript/index.html:306 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/unity/linux/logs/transcript/page-001.html:2363
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/unity/linux/logs/transcript/page-001.html:2363 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/vim/linux/logs/transcript/index.html:303
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/vim/linux/logs/transcript/index.html:303 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/vim/linux/logs/transcript/page-001.html:878
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/vim/linux/logs/transcript/page-001.html:878 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/visual-studio-code/linux/logs/transcript/index.html:313
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/visual-studio-code/linux/logs/transcript/index.html:313 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/visual-studio-code/linux/logs/transcript/page-001.html:1565
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/visual-studio-code/linux/logs/transcript/page-001.html:1565 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/wazuh/linux/logs/transcript/index.html:327
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/wazuh/linux/logs/transcript/index.html:327 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/wireshark/linux/logs/transcript/index.html:312
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/wireshark/linux/logs/transcript/index.html:312 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/wireshark/linux/logs/transcript/page-001.html:867
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/wireshark/linux/logs/transcript/page-001.html:867 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/cua-bench/cua_bench/www/trace_viewer.html:320
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/cua-bench/cua_bench/www/trace_viewer.html:320 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/ansible/linux/logs/transcript/index.html:384
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/ansible/linux/logs/transcript/index.html:384 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/apache-cassandra/linux/logs/transcript/index.html:390
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/apache-cassandra/linux/logs/transcript/index.html:390 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/azure-data-studio/linux/logs/transcript/index.html:375
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/azure-data-studio/linux/logs/transcript/index.html:375 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/chef/linux/logs/transcript/index.html:385
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/chef/linux/logs/transcript/index.html:385 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/dbeaver/linux/logs/transcript/index.html:385
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/dbeaver/linux/logs/transcript/index.html:385 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/docker/linux/logs/transcript/index.html:377
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/docker/linux/logs/transcript/index.html:377 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/eclipse-ide/linux/logs/transcript/index.html:385
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/eclipse-ide/linux/logs/transcript/index.html:385 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/elasticsearch/linux/logs/transcript/index.html:381
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/elasticsearch/linux/logs/transcript/index.html:381 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/emacs/linux/logs/transcript/index.html:375
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/emacs/linux/logs/transcript/index.html:375 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/featurewiz/linux/logs/transcript/index.html:350
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/featurewiz/linux/logs/transcript/index.html:350 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gawk/linux/logs/transcript/index.html:388
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gawk/linux/logs/transcript/index.html:388 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/genie3/linux/logs/transcript/index.html:354
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/genie3/linux/logs/transcript/index.html:354 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gin/linux/logs/transcript/index.html:352
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gin/linux/logs/transcript/index.html:352 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/git/linux/logs/transcript/index.html:405
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/git/linux/logs/transcript/index.html:405 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/github-actions/linux/logs/transcript/index.html:398
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/github-actions/linux/logs/transcript/index.html:398 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gitlab/linux/logs/transcript/index.html:443
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gitlab/linux/logs/transcript/index.html:443 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/godot-engine/linux/logs/transcript/index.html:366
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/godot-engine/linux/logs/transcript/index.html:366 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/intellij-idea/linux/logs/transcript/index.html:401
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/intellij-idea/linux/logs/transcript/index.html:401 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/jenkins/linux/logs/transcript/index.html:379
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/jenkins/linux/logs/transcript/index.html:379 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/kubernetes/linux/logs/transcript/index.html:396
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/kubernetes/linux/logs/transcript/index.html:396 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/lit/linux/logs/transcript/index.html:352
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/lit/linux/logs/transcript/index.html:352 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mariadb/linux/logs/transcript/index.html:377
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mariadb/linux/logs/transcript/index.html:377 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/metasploit/linux/logs/transcript/index.html:401
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/metasploit/linux/logs/transcript/index.html:401 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mysql/linux/logs/transcript/index.html:378
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/mysql/linux/logs/transcript/index.html:378 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/neovim/linux/logs/transcript/index.html:367
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/neovim/linux/logs/transcript/index.html:367 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/netbeans/linux/logs/transcript/index.html:381
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/netbeans/linux/logs/transcript/index.html:381 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/nmap/linux/logs/transcript/index.html:380
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/nmap/linux/logs/transcript/index.html:380 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/openshot/linux/logs/transcript/index.html:387
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/openshot/linux/logs/transcript/index.html:387 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/pgadmin/linux/logs/transcript/index.html:381
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/pgadmin/linux/logs/transcript/index.html:381 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/postgresql/linux/logs/transcript/index.html:373
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/postgresql/linux/logs/transcript/index.html:373 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/puppet/linux/logs/transcript/index.html:380
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/puppet/linux/logs/transcript/index.html:380 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/pycharm/linux/logs/transcript/index.html:379
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/pycharm/linux/logs/transcript/index.html:379 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/raneto/linux/logs/transcript/index.html:398
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/raneto/linux/logs/transcript/index.html:398 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/redis/linux/logs/transcript/index.html:371
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/redis/linux/logs/transcript/index.html:371 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/sqlite/linux/logs/transcript/index.html:390
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/sqlite/linux/logs/transcript/index.html:390 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/systemd-hostnamed/linux/logs/transcript/index.html:375
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/systemd-hostnamed/linux/logs/transcript/index.html:375 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/torch-points3d/linux/logs/transcript/index.html:361
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/torch-points3d/linux/logs/transcript/index.html:361 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/unity/linux/logs/transcript/index.html:372
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/unity/linux/logs/transcript/index.html:372 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/vim/linux/logs/transcript/index.html:369
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/vim/linux/logs/transcript/index.html:369 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/visual-studio-code/linux/logs/transcript/index.html:379
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/visual-studio-code/linux/logs/transcript/index.html:379 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/wazuh/linux/logs/transcript/index.html:393
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/wazuh/linux/logs/transcript/index.html:393 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'domparser_html_parse' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/wireshark/linux/logs/transcript/index.html:378
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/wireshark/linux/logs/transcript/index.html:378 Domparser html parse
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in libs/cuabot/src/client.ts:6
Found a known-risky pattern (node_child_process). Review and replace if possible.
libs/cuabot/src/client.ts:6 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in libs/cuabot/src/cuabot.tsx:23
Found a known-risky pattern (node_child_process). Review and replace if possible.
libs/cuabot/src/cuabot.tsx:23 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in libs/cuabot/src/cuabotd.ts:10
Found a known-risky pattern (node_child_process). Review and replace if possible.
libs/cuabot/src/cuabotd.ts:10 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in libs/cuabot/src/onboarding.tsx:25
Found a known-risky pattern (node_child_process). Review and replace if possible.
libs/cuabot/src/onboarding.tsx:25 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in libs/cuabot/src/utils.ts:6
Found a known-risky pattern (node_child_process). Review and replace if possible.
libs/cuabot/src/utils.ts:6 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in libs/python/cua-sandbox/cua_sandbox/runtime/_bw_init.js:20
Found a known-risky pattern (node_child_process). Review and replace if possible.
libs/python/cua-sandbox/cua_sandbox/runtime/_bw_init.js:20 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in libs/typescript/cua-cli/src/commands/serve-mcp.ts:10
Found a known-risky pattern (node_child_process). Review and replace if possible.
libs/typescript/cua-cli/src/commands/serve-mcp.ts:10 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/docs-generators/cua-driver.ts:14
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/docs-generators/cua-driver.ts:14 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/docs-generators/generate-changelog.ts:16
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/docs-generators/generate-changelog.ts:16 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/docs-generators/generate-versioned-docs.ts:15
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/docs-generators/generate-versioned-docs.ts:15 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/docs-generators/lume.ts:14
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/docs-generators/lume.ts:14 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/docs-generators/python-sdk.ts:15
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/docs-generators/python-sdk.ts:15 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/docs-generators/runner.ts:17
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/docs-generators/runner.ts:17 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/docs-generators/typescript-sdk.ts:17
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/docs-generators/typescript-sdk.ts:17 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in scripts/typescript-typecheck.js:2
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/typescript-typecheck.js:2 Node child process
medium System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:297
Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.
libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:297 Subprocess shell true
medium System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in libs/python/computer-server/computer_server/handlers/generic.py:115
Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.
libs/python/computer-server/computer_server/handlers/generic.py:115 Subprocess shell true
medium System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in libs/python/computer/computer/providers/lume_api.py:77
Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.
libs/python/computer/computer/providers/lume_api.py:77 Subprocess shell true
medium System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in libs/python/cua-auto/cua_auto/shell.py:38
Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.
libs/python/cua-auto/cua_auto/shell.py:38 Subprocess shell true
medium System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in libs/python/cua-auto/cua_auto/window.py:187
Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.
libs/python/cua-auto/cua_auto/window.py:187 Subprocess shell true
medium System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in libs/python/cua-cli/cua_cli/auth/browser.py:95
Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.
libs/python/cua-cli/cua_cli/auth/browser.py:95 Subprocess shell true
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in libs/python/computer/computer/ui/gradio/app.py:497
Found a known-risky pattern (weak_hash). Review and replace if possible.
libs/python/computer/computer/ui/gradio/app.py:497 Weak hash
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gitlab/linux/logs/transcript/page-001.html:660
Found a known-risky pattern (weak_hash). Review and replace if possible.
libs/python/cua-sandbox-apps/cua_sandbox_apps/apps/gitlab/linux/logs/transcript/page-001.html:660 Weak hash
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — docs/scripts/modal_app.py:1040
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — libs/cua-bench/cua_bench/apps/kicad.py:317
`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness

Showing first 300 of 506. Refine filters or use the findings page for deep search.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/dc87fc1a-a054-4718-9b47-2af13e16c894/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/dc87fc1a-a054-4718-9b47-2af13e16c894/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.