https://github.com/holaboss-ai/holaOS ·
lang: typescript ·
LOC: ·
source: both
| Rule | Severity | Count |
|---|---|---|
AIC003 Duplicated implementation block across source files |
low | 30 |
MINED116 GHA pull_request workflow leaks secrets to forks |
critical | 25 |
MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) |
high | 25 |
MINED113 Express POST/PUT/DELETE/PATCH route without auth |
high | 25 |
AGT007 localStorage write failures are swallowed silently |
medium | 8 |
SEC020 Secret Printed to Logs |
high | 4 |
SEC045 eval()/exec() on stored or user-supplied data |
medium | 4 |
SEC040 innerHTML XSS — template literal with server-supplied data |
high | 4 |
MINED044 Js Console Log Prod |
info | 4 |
MINED045 Ts Non Null Assertion |
info | 4 |
MINED018
Unsafe Deserialization Pickle
CWE-502
runtime/api-server/src/composio-tool-registry.ts:48
· conf 1.00
[MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLoader) / unmarshal of network/file data — RCE.MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:222
· conf 0.90
[MINED116] Workflow uses `secrets.HOLABOSS_RELEASES_REPO_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.HOLABO…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:266
· conf 0.90
[MINED116] Workflow uses `secrets.MAC_CERTIFICATE` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.MAC_CERTIFICATE }` …MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:267
· conf 0.90
[MINED116] Workflow uses `secrets.MAC_CERTIFICATE_PASSWORD` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.MAC_CERTIF…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:268
· conf 0.90
[MINED116] Workflow uses `secrets.APPLE_ID` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.APPLE_ID }` lets a PR from…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:269
· conf 0.90
[MINED116] Workflow uses `secrets.APPLE_APP_SPECIFIC_PASSWORD` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.APPLE_A…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:270
· conf 0.90
[MINED116] Workflow uses `secrets.APPLE_TEAM_ID` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.APPLE_TEAM_ID }` lets…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:294
· conf 0.90
[MINED116] Workflow uses `secrets.SENTRY_DSN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.SENTRY_DSN }` lets a PR …MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:302
· conf 0.90
[MINED116] Workflow uses `secrets.SENTRY_AUTH_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.SENTRY_AUTH_TOKEN…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:340
· conf 0.90
[MINED116] Workflow uses `secrets.SENTRY_DSN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.SENTRY_DSN }` lets a PR …MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:364
· conf 0.90
[MINED116] Workflow uses `secrets.SENTRY_AUTH_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.SENTRY_AUTH_TOKEN…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:600
· conf 0.90
[MINED116] Workflow uses `secrets.AZURE_TENANT_ID` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.AZURE_TENANT_ID }` …MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:601
· conf 0.90
[MINED116] Workflow uses `secrets.AZURE_CLIENT_ID` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.AZURE_CLIENT_ID }` …MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:602
· conf 0.90
[MINED116] Workflow uses `secrets.AZURE_CLIENT_SECRET` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.AZURE_CLIENT_SE…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:662
· conf 0.90
[MINED116] Workflow uses `secrets.AZURE_TENANT_ID` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.AZURE_TENANT_ID }` …MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:663
· conf 0.90
[MINED116] Workflow uses `secrets.AZURE_CLIENT_ID` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.AZURE_CLIENT_ID }` …MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:664
· conf 0.90
[MINED116] Workflow uses `secrets.AZURE_CLIENT_SECRET` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.AZURE_CLIENT_SE…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:750
· conf 0.90
[MINED116] Workflow uses `secrets.AZURE_TENANT_ID` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.AZURE_TENANT_ID }` …MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:751
· conf 0.90
[MINED116] Workflow uses `secrets.AZURE_CLIENT_ID` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.AZURE_CLIENT_ID }` …MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:752
· conf 0.90
[MINED116] Workflow uses `secrets.AZURE_CLIENT_SECRET` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.AZURE_CLIENT_SE…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:753
· conf 0.90
[MINED116] Workflow uses `secrets.SENTRY_DSN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.SENTRY_DSN }` lets a PR …MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:845
· conf 0.90
[MINED116] Workflow uses `secrets.SENTRY_AUTH_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.SENTRY_AUTH_TOKEN…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:943
· conf 0.90
[MINED116] Workflow uses `secrets.HOLABOSS_RELEASES_REPO_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.HOLABO…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:1079
· conf 0.90
[MINED116] Workflow uses `secrets.R2_ACCESS_KEY_ID` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.R2_ACCESS_KEY_ID }…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:1080
· conf 0.90
[MINED116] Workflow uses `secrets.R2_SECRET_ACCESS_KEY` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.R2_SECRET_ACCE…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:1085
· conf 0.90
[MINED116] Workflow uses `secrets.R2_ENDPOINT_URL` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.R2_ENDPOINT_URL }` …SEC079
Python: yaml.load without SafeLoader
runtime/api-server/src/composio-tool-registry.ts:48
· conf 1.00
[SEC079] Python: yaml.load without SafeLoader: yaml.load() without explicit SafeLoader can execute arbitrary Python objects (CVE-2017-18342). Ported from bandit B506 / dlint DUO109 (Apache-2.0 / BSD-…SEC084
JS: require() with non-literal
runtime/deploy/build_runtime_root.sh:19
· conf 1.00
[SEC084] JS: require() with non-literal: require(<variable>) loads arbitrary modules — equivalent to eval at module scope. Ported from eslint-plugin-security detect-non-literal-require (Apache-2.0).SEC116
Ruby YAML.load / Marshal.load on untrusted input
runtime/api-server/src/composio-tool-registry.ts:48
· conf 1.00
[SEC116] Ruby YAML.load / Marshal.load on untrusted input: `YAML.load` (pre-3.1) and `Marshal.load` instantiate arbitrary Ruby classes — direct RCE on untrusted input. `unsafe_load` is even more dang…AGT002
LLM memory extraction can be prompt-injected into storing fake facts
runtime/api-server/src/evolve-skill-review.ts:446
· conf 0.82
LLM memory extraction can be prompt-injected into storing fake factsAGT002
LLM memory extraction can be prompt-injected into storing fake facts
runtime/api-server/src/memory-writeback-extractor.ts:57
· conf 0.82
LLM memory extraction can be prompt-injected into storing fake factsJRN004
Consent is collected in UI without visible backend audit persistence
runtime/api-server/src/memory-recall-index.ts:39
· conf 0.78
Consent is collected in UI without visible backend audit persistenceJRN009
Secret-like setting is echoed into a password input value
apps/desktop/src/components/auth/AuthPanel.tsx:3420
· conf 0.83
Secret-like setting is echoed into a password input valueJRN009
Secret-like setting is echoed into a password input value
apps/desktop/src/components/auth/AuthPanel.tsx:3828
· conf 0.83
Secret-like setting is echoed into a password input valueMINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:4818
· conf 0.80
[MINED113] Express PUT /api/v1/runtime/config has no auth: Express route PUT /api/v1/runtime/config declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATC…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:4839
· conf 0.80
[MINED113] Express PUT /api/v1/runtime/profile has no auth: Express route PUT /api/v1/runtime/profile declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PA…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:4858
· conf 0.80
[MINED113] Express POST /api/v1/runtime/profile/auth-fallback has no auth: Express route POST /api/v1/runtime/profile/auth-fallback declared without an auth middleware in its handler chain. Destructi…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:4892
· conf 0.80
[MINED113] Express POST /api/v1/capabilities/browser/tools/:toolId has no auth: Express route POST /api/v1/capabilities/browser/tools/:toolId declared without an auth middleware in its handler chain.…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:4958
· conf 0.80
[MINED113] Express POST /api/v1/terminal-sessions has no auth: Express route POST /api/v1/terminal-sessions declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DEL…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5047
· conf 0.80
[MINED113] Express POST /api/v1/terminal-sessions/:terminalId/input has no auth: Express route POST /api/v1/terminal-sessions/:terminalId/input declared without an auth middleware in its handler chai…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5070
· conf 0.80
[MINED113] Express POST /api/v1/terminal-sessions/:terminalId/resize has no auth: Express route POST /api/v1/terminal-sessions/:terminalId/resize declared without an auth middleware in its handler ch…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5094
· conf 0.80
[MINED113] Express POST /api/v1/terminal-sessions/:terminalId/signal has no auth: Express route POST /api/v1/terminal-sessions/:terminalId/signal declared without an auth middleware in its handler ch…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5117
· conf 0.80
[MINED113] Express POST /api/v1/terminal-sessions/:terminalId/close has no auth: Express route POST /api/v1/terminal-sessions/:terminalId/close declared without an auth middleware in its handler chai…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5238
· conf 0.80
[MINED113] Express POST /api/v1/integrations/connections has no auth: Express route POST /api/v1/integrations/connections declared without an auth middleware in its handler chain. Destructive methods…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5264
· conf 0.80
[MINED113] Express PATCH /api/v1/integrations/connections/:connectionId has no auth: Express route PATCH /api/v1/integrations/connections/:connectionId declared without an auth middleware in its hand…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5316
· conf 0.80
[MINED113] Express POST /api/v1/integrations/connections/:connectionId/merge has no auth: Express route POST /api/v1/integrations/connections/:connectionId/merge declared without an auth middleware i…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5342
· conf 0.80
[MINED113] Express DELETE /api/v1/integrations/connections/:connectionId has no auth: Express route DELETE /api/v1/integrations/connections/:connectionId declared without an auth middleware in its ha…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5372
· conf 0.80
[MINED113] Express PUT /api/v1/integrations/bindings/:workspaceId/:targetType/:targetId/:integrationKey has no auth: Express route PUT /api/v1/integrations/bindings/:workspaceId/:targetType/:targetId…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5430
· conf 0.80
[MINED113] Express DELETE /api/v1/integrations/bindings/:bindingId has no auth: Express route DELETE /api/v1/integrations/bindings/:bindingId declared without an auth middleware in its handler chain.…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5471
· conf 0.80
[MINED113] Express POST /api/v1/integrations/broker/token has no auth: Express route POST /api/v1/integrations/broker/token declared without an auth middleware in its handler chain. Destructive metho…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5490
· conf 0.80
[MINED113] Express POST /api/v1/integrations/broker/proxy has no auth: Express route POST /api/v1/integrations/broker/proxy declared without an auth middleware in its handler chain. Destructive metho…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5532
· conf 0.80
[MINED113] Express PUT /api/v1/integrations/oauth/configs/:providerId has no auth: Express route PUT /api/v1/integrations/oauth/configs/:providerId declared without an auth middleware in its handler …MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5557
· conf 0.80
[MINED113] Express DELETE /api/v1/integrations/oauth/configs/:providerId has no auth: Express route DELETE /api/v1/integrations/oauth/configs/:providerId declared without an auth middleware in its ha…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5563
· conf 0.80
[MINED113] Express POST /api/v1/integrations/oauth/authorize has no auth: Express route POST /api/v1/integrations/oauth/authorize declared without an auth middleware in its handler chain. Destructive…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5577
· conf 0.80
[MINED113] Express POST /api/v1/integrations/composio/finalize has no auth: Express route POST /api/v1/integrations/composio/finalize declared without an auth middleware in its handler chain. Destruc…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5647
· conf 0.80
[MINED113] Express POST /api/v1/integrations/context-fetch has no auth: Express route POST /api/v1/integrations/context-fetch declared without an auth middleware in its handler chain. Destructive met…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5688
· conf 0.80
[MINED113] Express POST /api/v1/integrations/memory-clear has no auth: Express route POST /api/v1/integrations/memory-clear declared without an auth middleware in its handler chain. Destructive metho…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5811
· conf 0.80
[MINED113] Express POST /api/v1/capabilities/runtime-tools/onboarding/alignment-report has no auth: Express route POST /api/v1/capabilities/runtime-tools/onboarding/alignment-report declared without …MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
runtime/api-server/src/app.ts:5832
· conf 0.80
[MINED113] Express POST /api/v1/capabilities/runtime-tools/onboarding/alignment-question has no auth: Express route POST /api/v1/capabilities/runtime-tools/onboarding/alignment-question declared with…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:55
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:58
· conf 0.90
[MINED115] Action `oven-sh/setup-bun` pinned to mutable ref `@v2`: `uses: oven-sh/setup-bun@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:63
· conf 0.90
[MINED115] Action `actions/setup-node` pinned to mutable ref `@v6`: `uses: actions/setup-node@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:78
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:81
· conf 0.90
[MINED115] Action `oven-sh/setup-bun` pinned to mutable ref `@v2`: `uses: oven-sh/setup-bun@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:86
· conf 0.90
[MINED115] Action `actions/setup-node` pinned to mutable ref `@v6`: `uses: actions/setup-node@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:110
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:113
· conf 0.90
[MINED115] Action `oven-sh/setup-bun` pinned to mutable ref `@v2`: `uses: oven-sh/setup-bun@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:118
· conf 0.90
[MINED115] Action `actions/setup-node` pinned to mutable ref `@v6`: `uses: actions/setup-node@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:139
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:142
· conf 0.90
[MINED115] Action `oven-sh/setup-bun` pinned to mutable ref `@v2`: `uses: oven-sh/setup-bun@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:147
· conf 0.90
[MINED115] Action `actions/setup-node` pinned to mutable ref `@v6`: `uses: actions/setup-node@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:179
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:273
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:278
· conf 0.90
[MINED115] Action `oven-sh/setup-bun` pinned to mutable ref `@v2`: `uses: oven-sh/setup-bun@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:283
· conf 0.90
[MINED115] Action `actions/setup-node` pinned to mutable ref `@v6`: `uses: actions/setup-node@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:552
· conf 0.90
[MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v7`: `uses: actions/upload-artifact@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:574
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:579
· conf 0.90
[MINED115] Action `oven-sh/setup-bun` pinned to mutable ref `@v2`: `uses: oven-sh/setup-bun@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:584
· conf 0.90
[MINED115] Action `actions/setup-node` pinned to mutable ref `@v6`: `uses: actions/setup-node@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:884
· conf 0.90
[MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v7`: `uses: actions/upload-artifact@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:924
· conf 0.90
[MINED115] Action `actions/download-artifact` pinned to mutable ref `@v8`: `uses: actions/download-artifact@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:930
· conf 0.90
[MINED115] Action `actions/download-artifact` pinned to mutable ref `@v8`: `uses: actions/download-artifact@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:936
· conf 0.90
[MINED115] Action `actions/download-artifact` pinned to mutable ref `@v8`: `uses: actions/download-artifact@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/publish-linux-runtime.yml:67
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
apps/desktop/electron/authPopupPreload.ts:107
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
apps/desktop/electron/bff-fetch.ts:81
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
apps/desktop/electron-builder.config.cjs:219
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC040
innerHTML XSS — template literal with server-supplied data
apps/desktop/src/components/panes/ChatPane/Composer/ThinkingValueSelect.tsx:35
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC040
innerHTML XSS — template literal with server-supplied data
runtime/api-server/src/apply-app-schema.ts:171
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC040
innerHTML XSS — template literal with server-supplied data
runtime/api-server/src/composio-tool-registry.ts:80
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC078
Python: requests without timeout
apps/desktop/electron/browser-pane/tab-observability.ts:129
· conf 1.00
[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-…SEC085
JS: child_process.exec with non-literal
apps/desktop/src/components/marketplace/markdownFenceNormalization.mjs:5
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC085
JS: child_process.exec with non-literal
apps/desktop/src/components/panes/ChatPane/helpers.ts:82
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC085
JS: child_process.exec with non-literal
apps/desktop/src/components/panes/ChatPane/skeletons.tsx:303
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC114
path.join / Path() on user-controlled segment without containment check
apps/desktop/scripts/runtime-bundle-state.mjs:170
· conf 1.00
[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../e…SEC114
path.join / Path() on user-controlled segment without containment check
runtime/api-server/src/runner-prep.ts:73
· conf 1.00
[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../e…SEC114
path.join / Path() on user-controlled segment without containment check
runtime/api-server/src/session-scratchpad.ts:71
· conf 1.00
[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../e…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
apps/desktop/electron/browser-pane/tab-observability.ts:158
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
apps/desktop/electron/browser-pane/user-lock.ts:246
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
apps/desktop/src/components/layout/new-shell/useShellNotifications.ts:151
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…AGT007
localStorage write failures are swallowed silently
apps/desktop/src/components/layout/AppShell.tsx:1441
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
apps/desktop/src/components/layout/new-shell/useSettingsState.ts:97
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
apps/desktop/src/components/layout/SettingsScreenRoot.tsx:915
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
apps/desktop/src/components/panes/ChatPane/index.tsx:5320
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
apps/desktop/src/components/publish/usePublishDraft.ts:97
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
apps/desktop/src/features/workspace-onboarding/preferences.ts:30
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
apps/desktop/src/lib/chat/useChatComposerModelSelection.ts:197
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
apps/desktop/src/lib/workspaceSelection.tsx:26
· conf 0.80
localStorage write failures are swallowed silentlyAGT012
Agent control bridge may listen on a network interface without visible auth
runtime/api-server/src/runner-worker.ts:219
· conf 0.72
Agent control bridge may listen on a network interface without visible authAGT012
Agent control bridge may listen on a network interface without visible auth
runtime/deploy/bootstrap/shared.sh:57
· conf 0.72
Agent control bridge may listen on a network interface without visible authDKR001
Docker final stage has no non-root USER
runtime/deploy/Dockerfile:2
· conf 0.82
Docker final stage has no non-root USERDKR001
Docker final stage has no non-root USER
runtime/deploy/Dockerfile.toolchain:1
· conf 0.82
Docker final stage has no non-root USERDKR007
Docker build context has no .dockerignore
.dockerignore
· conf 0.90
Docker build context has no .dockerignoreERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
runtime/api-server/src/session-scratchpad.ts:147
· conf 1.00
[ERR002] Empty Catch Block: Empty catch blocks hide errors.SEC007
Unsafe Deserialization
runtime/api-server/src/composio-tool-registry.ts:48
· conf 1.00
[SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.SEC045
eval()/exec() on stored or user-supplied data
apps/desktop/src/components/marketplace/markdownFenceNormalization.mjs:5
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC045
eval()/exec() on stored or user-supplied data
apps/desktop/src/components/panes/ChatPane/helpers.ts:82
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC045
eval()/exec() on stored or user-supplied data
apps/desktop/src/components/panes/ChatPane/skeletons.tsx:303
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC087
JS: weak Math.random for crypto
runtime/harnesses/src/embedded-skills/app-builder-sdk/sdk-package/src/runtime/state.ts:103
· conf 1.00
[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…SEC087
JS: weak Math.random for crypto
sdk/app-builder-sdk/src/runtime/state.ts:103
· conf 1.00
[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…AIC003
Duplicated implementation block across source files
apps/desktop/src/components/layout/new-shell/NewAppShell.tsx:220
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
apps/desktop/src/components/layout/new-shell/SearchDialog.tsx:230
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
apps/desktop/src/components/layout/new-shell/WorkspaceDashboardPane.tsx:21
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
apps/desktop/src/components/onboarding/IntegrationsList.tsx:67
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
apps/desktop/src/components/panes/AppSurfacePane.tsx:453
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
apps/desktop/src/components/panes/BrowserProfileImportButton.tsx:473
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
apps/desktop/src/components/panes/ChatPane/IssueThreadControls.tsx:36
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
apps/desktop/src/components/panes/ChatPane/IssueThreadControls.tsx:42
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
apps/desktop/src/components/panes/HtmlPreviewFrame.tsx:112
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
apps/desktop/src/components/panes/MarketplacePane.tsx:20
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
apps/desktop/src/components/panes/SpaceBrowserExplorerPane.tsx:143
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
apps/desktop/src/components/panes/useWorkspaceBrowser.ts:14
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/cron-worker.ts:605
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/image-generation-model.ts:79
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/integration-types.ts:25
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/main-session-event-worker.ts:466
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/memory.ts:64
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/memory-writeback-extractor.ts:63
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/queue-worker.ts:140
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/recall-embedding-backfill-worker.ts:159
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/recall-embedding-model.ts:37
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/resolved-app-bootstrap-shared.ts:40
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/runtime-sentry.ts:6
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/teammate-skill-files.ts:106
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/workspace-app-ui-lint.ts:39
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/api-server/src/workspace-mcp-host.ts:45
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/harnesses/src/desktop-browser-tools.ts:188
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/harness-host/src/contracts.ts:6
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/harness-host/src/contracts.ts:93
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
runtime/harness-host/src/harness-ai-monitoring.ts:49
· conf 0.86
Duplicated implementation block across source filesDKR002
Dockerfile base image has no explicit tag
runtime/deploy/Dockerfile:2
· conf 0.48
Dockerfile base image is selected through a build variableMINED043
Http Not Https
CWE-319
[MINED043] Http Not Https (and 1 more): Same pattern found in 1 additional files. Review if needed.MINED043
Http Not Https
CWE-319
apps/desktop/src/components/layout/new-shell/NewTabDialog.tsx:18
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED043
Http Not Https
CWE-319
apps/desktop/src/components/marketplace/KitEmoji.tsx:5
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED043
Http Not Https
CWE-319
runtime/api-server/src/composio-tool-registry.ts:285
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED044
Js Console Log Prod
CWE-532
[MINED044] Js Console Log Prod (and 32 more): Same pattern found in 32 additional files. Review if needed.MINED044
Js Console Log Prod
CWE-532
apps/desktop/scripts/ensure-app-sdk.mjs:53
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
apps/desktop/scripts/ensure-editor.mjs:53
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
apps/desktop/scripts/ensure-runtime-bundle.mjs:20
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED045
Ts Non Null Assertion
CWE-476
[MINED045] Ts Non Null Assertion (and 22 more): Same pattern found in 22 additional files. Review if needed.MINED045
Ts Non Null Assertion
CWE-476
apps/desktop/electron/browser-pane/agent-session-lifecycle.ts:318
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
apps/desktop/electron/workspace-git.ts:54
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
apps/desktop/src/components/panes/AddIntegrationDialog.tsx:80
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED049
Print Pii
CWE-532
apps/desktop/scripts/check-runtime-status.sh:81
· conf 1.00
[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.MINED055
Npm Install No Lockfile
CWE-1357
runtime/deploy/package_linux_runtime.sh:109
· conf 1.00
[MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versions on every build) instead of npm ci.MINED056
React Key As Index
CWE-682
[MINED056] React Key As Index (and 3 more): Same pattern found in 3 additional files. Review if needed.MINED056
React Key As Index
CWE-682
apps/desktop/src/components/layout/BootSplash.tsx:46
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
apps/desktop/src/components/marketplace/MarketplaceGallery.tsx:84
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
apps/desktop/src/components/onboarding/WorkspaceWizardLayout.tsx:75
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED058
React Dangerously Set Html
CWE-79
apps/desktop/src/components/marketplace/CodeBlock.tsx:236
· conf 1.00
[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data.MINED058
React Dangerously Set Html
CWE-79
sdk/ui/src/primitives/chart.tsx:93
· conf 1.00
[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data.MINED058
React Dangerously Set Html
CWE-79
website/docs/app/root.tsx:60
· conf 1.00
[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data.SEC020
Secret Printed to Logs
[SEC020] Secret Printed to Logs (and 3 more): Same pattern found in 3 additional files. Review if needed.SEC020
Secret Printed to Logs
apps/desktop/scripts/check-runtime-status.sh:81
· conf 0.15
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC020
Secret Printed to Logs
runtime/harnesses/src/embedded-skills/app-builder-sdk/reference/slack-messaging/e2e-bearer.ts:20
· conf 0.15
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC020
Secret Printed to Logs
runtime/harnesses/src/embedded-skills/app-builder-sdk/reference/telegram-messaging/e2e.ts:26
· conf 0.15
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input (and 31 more): Same pattern found in 31 additional files. Review if needed.SEC040
innerHTML XSS — template literal with server-supplied data
[SEC040] innerHTML XSS — template literal with server-supplied data (and 4 more): Same pattern found in 4 additional files. Review if needed.SEC045
eval()/exec() on stored or user-supplied data
[SEC045] eval()/exec() on stored or user-supplied data (and 5 more): Same pattern found in 5 additional files. Review if needed.SEC085
JS: child_process.exec with non-literal
[SEC085] JS: child_process.exec with non-literal (and 2 more): Same pattern found in 2 additional files. Review if needed.SEC114
path.join / Path() on user-controlled segment without containment check
[SEC114] path.join / Path() on user-controlled segment without containment check (and 1 more): Same pattern found in 1 additional files. Review if needed.SEC128
Async function without await — fire-and-forget Promise (AI mistake)
[SEC128] Async function without await — fire-and-forget Promise (AI mistake) (and 3 more): Same pattern found in 3 additional files. Review if needed.Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/2bb252b3-baf7-4896-a58a-4c45dc20c51c/.