← Legacy view v2 (rp.*)

microsoft/playwright-mcp

https://github.com/microsoft/playwright-mcp · lang: typescript · LOC: · source: user_submitted

Quality

91.4

Grade A

Security

98.7

Findings

21

0 critical · 15 high

Status

completed

May 31, 2026 01:27

high: 15 info: 4 medium: 2

Top rules by occurrence

Rule	Severity	Count
`MINED115` GitHub Action pinned to mutable ref (not 40-char SHA)	high	14
`SEC020` Secret Printed to Logs	high	2
`MINED044` Js Console Log Prod	info	2
`MINED118` Dockerfile FROM not pinned by sha256 digest	high	1
`DKR007` Docker build context has no .dockerignore	medium	1
`AGT012` Agent control bridge may listen on a network interface with…	medium	1

First 21 findings (severity-sorted)

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/ci.yml:13 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/ci.yml:15 · conf 0.90

[MINED115] Action `actions/setup-node` pinned to mutable ref `@v5`: `uses: actions/setup-node@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/ci.yml:31 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/ci.yml:33 · conf 0.90

[MINED115] Action `actions/setup-node` pinned to mutable ref `@v5`: `uses: actions/setup-node@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/ci.yml:49 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/ci.yml:51 · conf 0.90

[MINED115] Action `actions/setup-node` pinned to mutable ref `@v5`: `uses: actions/setup-node@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/publish.yml:17 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/publish.yml:18 · conf 0.90

[MINED115] Action `actions/setup-node` pinned to mutable ref `@v5`: `uses: actions/setup-node@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/publish.yml:53 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/publish.yml:54 · conf 0.90

[MINED115] Action `actions/setup-node` pinned to mutable ref `@v5`: `uses: actions/setup-node@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/publish.yml:79 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/publish.yml:119 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/publish.yml:125 · conf 0.90

[MINED115] Action `azure/login` pinned to mutable ref `@v3`: `uses: azure/login@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/cha…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/publish.yml:142 · conf 0.90

[MINED115] Action `oras-project/setup-oras` pinned to mutable ref `@v2`: `uses: oras-project/setup-oras@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that…

high MINED118 Dockerfile FROM not pinned by sha256 digest CWE-829

Dockerfile:8 · conf 0.90

[MINED118] Dockerfile FROM `node:22-bookworm-slim` not pinned by digest: `FROM node:22-bookworm-slim` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so e…

medium AGT012 Agent control bridge may listen on a network interface without visible auth

config.d.ts:12 · conf 0.72

Agent control bridge may listen on a network interface without visible auth

medium DKR007 Docker build context has no .dockerignore

.dockerignore · conf 0.90

Docker build context has no .dockerignore

info MINED044 Js Console Log Prod CWE-532

roll.js:14 · conf 1.00

[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.

info MINED044 Js Console Log Prod CWE-532

update-readme.js:125 · conf 1.00

[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.

info SEC020 Secret Printed to Logs

roll.js:14 · conf 0.10

[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…

info SEC020 Secret Printed to Logs

update-readme.js:208 · conf 0.10

[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…

Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/3dd9583b-365f-4038-a5b9-ae84414fbb96/.