https://github.com/cloudflare/agents ·
lang: typescript ·
LOC: ·
source: user_submitted
| Rule | Severity | Count |
|---|---|---|
AIC003 Duplicated implementation block across source files |
low | 30 |
MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) |
high | 14 |
SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from use… |
high | 4 |
MINED045 Ts Non Null Assertion |
info | 4 |
SEC118 UUIDv1 / UUIDv3 used for security-sensitive identifier |
low | 4 |
SEC040 innerHTML XSS — template literal with server-supplied data |
high | 4 |
SEC045 eval()/exec() on stored or user-supplied data |
medium | 4 |
MINED044 Js Console Log Prod |
info | 4 |
MINED056 React Key As Index |
info | 4 |
SEC128 Async function without await — fire-and-forget Promise (AI … |
high | 4 |
MINED035
Js New Function
CWE-95
packages/codemode/src/iframe-runtime.ts:131
· conf 1.00
[MINED035] Js New Function: new Function(...) compiles strings to functions.MINED004
Weak Crypto
CWE-327
packages/shell/src/backend.ts:151
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).MINED004
Weak Crypto
CWE-327
packages/shell/src/prompt.ts:34
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).MINED031
React Direct State Mutation
CWE-682
openai-sdk/chess-app/src/chess.tsx:84
· conf 1.00
[MINED031] React Direct State Mutation: this.state.X = Y mutates without setState. React wont re-render.MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
examples/mcp-worker-authenticated/src/auth-handler.ts:128
· conf 0.80
[MINED113] Express POST /authorize has no auth: Express route POST /authorize declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/bonk.yml:24
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/bonk.yml:27
· conf 0.90
[MINED115] Action `ask-bonk/ask-bonk/github` pinned to mutable ref `@main`: `uses: ask-bonk/ask-bonk/github@main` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/nightly.yml:20
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/nightly.yml:33
· conf 0.90
[MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/nightly.yml:55
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/pullrequest.yml:23
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/pullrequest.yml:29
· conf 0.90
[MINED115] Action `nrwl/nx-set-shas` pinned to mutable ref `@v5`: `uses: nrwl/nx-set-shas@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/pullrequest.yml:33
· conf 0.90
[MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/pullrequest.yml:49
· conf 0.90
[MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:27
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:43
· conf 0.90
[MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:56
· conf 0.90
[MINED115] Action `changesets/action` pinned to mutable ref `@v1.7.0`: `uses: changesets/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that mad…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/semgrep.yml:47
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/semgrep.yml:51
· conf 0.90
[MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions…SEC020
Secret Printed to Logs
examples/cross-domain/src/client.tsx:35
· conf 0.85
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC020
Secret Printed to Logs
examples/cross-domain/src/server.ts:61
· conf 0.85
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
examples/a2a/src/server.ts:192
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
examples/assistant/src/auth.ts:35
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
examples/auth-agent/src/auth.ts:35
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC040
innerHTML XSS — template literal with server-supplied data
experimental/gadgets-subagents/src/server.ts:285
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC040
innerHTML XSS — template literal with server-supplied data
packages/agents/src/experimental/memory/session/providers/postgres-search.ts:67
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC040
innerHTML XSS — template literal with server-supplied data
packages/agents/src/experimental/memory/session/search.ts:114
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC085
JS: child_process.exec with non-literal
examples/codemode/src/tools.ts:158
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC085
JS: child_process.exec with non-literal
examples/playground/src/demos/core/sql-agent.ts:56
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC085
JS: child_process.exec with non-literal
experimental/gadgets-gatekeeper/src/server.ts:87
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC100
CORS permissive Access-Control-Allow-Origin: *
examples/a2a/src/server.ts:201
· conf 1.00
[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `A…SEC100
CORS permissive Access-Control-Allow-Origin: *
examples/cross-domain/src/server.ts:5
· conf 1.00
[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `A…SEC100
CORS permissive Access-Control-Allow-Origin: *
examples/mcp-server/src/index.ts:33
· conf 1.00
[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `A…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
examples/playground/src/demos/multi-agent/room-agent.ts:51
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
examples/playground/src/demos/multi-agent/WorkersDemo.tsx:134
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
packages/agents/src/chat/abort-registry.ts:49
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC135
Auth/permission check missing on AI-generated endpoint
examples/mcp-worker-authenticated/src/auth-handler.ts:128
· conf 1.00
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…AGT006
React interval is created without an explicit cleanup
examples/playground/src/demos/core/ScheduleDemo.tsx:98
· conf 0.78
React interval is created without an explicit cleanupERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
examples/playground/src/demos/core/CallableDemo.tsx:279
· conf 0.45
[ERR002] Empty Catch Block: Empty catch blocks hide errors.ERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
examples/voice-agent/src/use-sfu-voice.ts:184
· conf 0.45
[ERR002] Empty Catch Block: Empty catch blocks hide errors.JRN002
Browser storage is used for session token material
site/ai-playground/src/components/McpServers.tsx:70
· conf 0.82
Browser storage is used for session token materialJRN002
Browser storage is used for session token material
site/ai-playground/src/components/McpServers.tsx:342
· conf 0.82
Browser storage is used for session token materialSEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
examples/mcp-worker-authenticated/src/auth-handler.ts:97
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
examples/playground/src/demos/core/ConnectionsDemo.tsx:133
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
examples/playground/src/demos/core/RoutingDemo.tsx:133
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC045
eval()/exec() on stored or user-supplied data
examples/a2a/src/server.ts:62
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC045
eval()/exec() on stored or user-supplied data
examples/codemode/src/tools.ts:6
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC045
eval()/exec() on stored or user-supplied data
examples/playground/src/demos/core/sql-agent.ts:17
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC087
JS: weak Math.random for crypto
site/agents/src/components/agent-visual.tsx:186
· conf 1.00
[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…SEC134
AI scaffold leftover — Lorem ipsum / example.com / John Doe in code
packages/agents/src/browser/shared.ts:244
· conf 1.00
[SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't…WEB003
Public web service has no security.txt
.well-known/security.txt
· conf 0.78
Public web service has no security.txtWEB015
Public web app has no Content Security Policy
index.html
· conf 0.70
Public web app has no Content Security PolicyAIC003
Duplicated implementation block across source files
experimental/forever-fibers/src/app.tsx:23
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/gadgets-chat/src/client.tsx:441
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/gadgets-gatekeeper/src/client.tsx:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/gadgets-sandbox/src/client.tsx:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/gadgets-sandbox/src/client.tsx:129
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/gadgets-sandbox/src/server.ts:313
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/gadgets-subagents/src/client.tsx:5
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/gadgets-subagents/src/client.tsx:7
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/gadgets-subagents/src/client.tsx:246
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/gadgets-subagents/src/server.ts:240
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-memory/src/client.tsx:85
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-memory/src/client.tsx:86
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-multichat/src/client.tsx:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-multichat/src/client.tsx:40
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-multichat/src/client.tsx:91
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-multichat/src/server.ts:8
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-planetscale/src/client.tsx:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-planetscale/src/client.tsx:86
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-planetscale/src/client.tsx:87
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-planetscale/src/client.tsx:440
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-search/src/client.tsx:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-search/src/client.tsx:85
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-search/src/client.tsx:86
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-search/src/server.ts:50
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-search/src/server.ts:58
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-skills/src/client.tsx:36
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-skills/src/client.tsx:81
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-skills/src/client.tsx:82
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
experimental/session-skills/src/server.ts:41
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
guides/human-in-the-loop/vite.config.ts:8
· conf 0.86
Duplicated implementation block across source filesWEB001
Public web app has no robots.txt
robots.txt
· conf 0.74
Public web app has no robots.txtWEB008
Public docs site has no llms.txt
llms.txt
· conf 0.64
Public docs site has no llms.txtWEB011
Public web app has no humans.txt
humans.txt
· conf 0.50
Public web app has no humans.txtMINED043
Http Not Https
CWE-319
packages/agents/src/sub-routing.ts:182
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED044
Js Console Log Prod
CWE-532
[MINED044] Js Console Log Prod (and 77 more): Same pattern found in 77 additional files. Review if needed.MINED044
Js Console Log Prod
CWE-532
examples/cross-domain/src/client.tsx:32
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
.github/resolve-workspace-versions.ts:35
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
.github/version-script.ts:5
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED045
Ts Non Null Assertion
CWE-476
[MINED045] Ts Non Null Assertion (and 11 more): Same pattern found in 11 additional files. Review if needed.MINED045
Ts Non Null Assertion
CWE-476
packages/agents/src/browser/cdp-session.ts:74
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
packages/agents/src/browser/shared.ts:334
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
packages/agents/src/chat/abort-registry.ts:27
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED049
Print Pii
CWE-532
examples/cross-domain/src/client.tsx:35
· conf 1.00
[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.MINED049
Print Pii
CWE-532
examples/cross-domain/src/server.ts:61
· conf 1.00
[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.MINED052
Ts Any Typed
CWE-704
openai-sdk/call-my-agent/src/client.tsx:16
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED054
Ts As Any
CWE-704
experimental/session-skills/src/server.ts:79
· conf 1.00
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.MINED054
Ts As Any
CWE-704
packages/agents/src/experimental/memory/session/skills.ts:82
· conf 1.00
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.MINED054
Ts As Any
CWE-704
packages/voice/src/voice-input.ts:107
· conf 1.00
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.MINED056
React Key As Index
CWE-682
[MINED056] React Key As Index (and 8 more): Same pattern found in 8 additional files. Review if needed.MINED056
React Key As Index
CWE-682
examples/playground/src/components/CodeExplanation.tsx:83
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
examples/playground/src/demos/core/ConnectionsDemo.tsx:233
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
examples/playground/src/demos/core/StateDemo.tsx:280
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED058
React Dangerously Set Html
CWE-79
examples/playground/src/components/CodeExplanation.tsx:61
· conf 1.00
[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data.SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input (and 34 more): Same pattern found in 34 additional files. Review if needed.SEC040
innerHTML XSS — template literal with server-supplied data
[SEC040] innerHTML XSS — template literal with server-supplied data (and 4 more): Same pattern found in 4 additional files. Review if needed.SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer" (and 2 more): Same pattern found in 2 additional files. Review if needed.SEC045
eval()/exec() on stored or user-supplied data
[SEC045] eval()/exec() on stored or user-supplied data (and 2 more): Same pattern found in 2 additional files. Review if needed.SEC118
UUIDv1 / UUIDv3 used for security-sensitive identifier
[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier (and 24 more): Same pattern found in 24 additional files. Review if needed.SEC118
UUIDv1 / UUIDv3 used for security-sensitive identifier
examples/a2a/src/server.ts:143
· conf 0.10
[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable.SEC118
UUIDv1 / UUIDv3 used for security-sensitive identifier
examples/agents-as-tools/src/server.ts:43
· conf 0.10
[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable.SEC118
UUIDv1 / UUIDv3 used for security-sensitive identifier
examples/assistant/src/auth.ts:195
· conf 0.10
[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable.SEC128
Async function without await — fire-and-forget Promise (AI mistake)
[SEC128] Async function without await — fire-and-forget Promise (AI mistake) (and 4 more): Same pattern found in 4 additional files. Review if needed.Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/3b58000f-bd23-4495-babe-c5bc135de534/.