← Legacy view v2 (rp.*)

browser-use/bux

https://github.com/browser-use/bux.git · lang: python · LOC: · source: both

Quality
73.4
Grade B
Security
95.5
Findings
4
0 critical · 1 high
Status
completed
May 16, 2026 02:09
low: 3 high: 1
Top rules by occurrence
RuleSeverityCount
SEC006 XSS Risk high 2
SEC017 Unbounded Input to LLM/External API medium 1
SEC016 LLM Prompt Injection — User Input in AI Prompt high 1
First 4 findings (severity-sorted)
high SEC016 LLM Prompt Injection — User Input in AI Prompt
agent/telegram_bot.py:5328 · conf 0.90 
[SEC016] LLM Prompt Injection — User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prompt (e.g. OpenAI, Anthropic, or local model). This is the AI equivalent of SQL i…
low SEC006 XSS Risk
agent/mini_app_static/concepts.js:91 · conf 0.40 
[SEC006] XSS Risk: Direct HTML injection without sanitization.
low SEC006 XSS Risk
agent/mini_app_static/tinder.js:196 · conf 0.40 
[SEC006] XSS Risk: Direct HTML injection without sanitization.
low SEC017 Unbounded Input to LLM/External API
agent/telegram_bot.py:5328 · conf 0.30 
[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.) without any visible length or size validation. This creates two risks: (1) Co…

Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/1f5b13ca-c511-4c41-a7cc-9a49b786811e/.