https://github.com/alumnium-hq/alumnium ·
lang: typescript ·
LOC: ·
source: user_submitted
| Rule | Severity | Count |
|---|---|---|
MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) |
high | 25 |
MINED108 self.attribute used but never assigned in __init__ |
high | 25 |
AIC003 Duplicated implementation block across source files |
low | 13 |
MINED106 Phantom test coverage (assertion-free test) |
high | 5 |
MINED050 Stub Only Function |
info | 4 |
SEC132 String concat where the language has interpolation (AI styl… |
low | 4 |
MINED044 Js Console Log Prod |
info | 4 |
MINED054 Ts As Any |
info | 4 |
MINED045 Ts Non Null Assertion |
info | 4 |
COMP001 [COMP001] High cognitive complexity: Function `load_yfinanc… |
low | 4 |
COMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
packages/python/src/alumnium/accessibility/chromium_accessibility_tree.py:65
· conf 0.95
[COMP001] High cognitive complexity: Function `_node_to_xml` has cognitive complexity 27 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested…MINED106
Phantom test coverage (assertion-free test)
CWE-1126
packages/python/examples/pytest/drag_slider_test.py:11
· conf 1.00
[MINED106] Phantom test coverage: test_drag_slider: Test function `test_drag_slider` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage wi…MINED106
Phantom test coverage (assertion-free test)
CWE-1126
packages/python/examples/pytest/execute_javascript_test.py:7
· conf 1.00
[MINED106] Phantom test coverage: test_execute_javascript_to_scroll: Test function `test_execute_javascript_to_scroll` runs code but contains no assert / expect / should call — it passes regardless o…MINED106
Phantom test coverage (assertion-free test)
CWE-1126
packages/python/examples/pytest/frames_test.py:21
· conf 1.00
[MINED106] Phantom test coverage: test_cross_origin_iframe: Test function `test_cross_origin_iframe` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds …MINED106
Phantom test coverage (assertion-free test)
CWE-1126
packages/python/examples/pytest/select_test.py:13
· conf 1.00
[MINED106] Phantom test coverage: test_select_option: Test function `test_select_option` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverag…MINED106
Phantom test coverage (assertion-free test)
CWE-1126
packages/python/examples/pytest/waiting_test.py:19
· conf 1.00
[MINED106] Phantom test coverage: test_waiting_for_requests_and_form_updates: Test function `test_waiting_for_requests_and_form_updates` runs code but contains no assert / expect / should call — it p…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/chromium_accessibility_tree.py:53
· conf 1.00
[MINED108] `self._node_to_xml` used but never assigned in __init__: Method `to_str` of class `ChromiumAccessibilityTree` reads `self._node_to_xml`, but no assignment to it exists in __init__ (and no …MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/chromium_accessibility_tree.py:89
· conf 1.00
[MINED108] `self._to_str` used but never assigned in __init__: Method `_node_to_xml` of class `ChromiumAccessibilityTree` reads `self._to_str`, but no assignment to it exists in __init__ (and no clas…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/chromium_accessibility_tree.py:101
· conf 1.00
[MINED108] `self._to_str` used but never assigned in __init__: Method `_node_to_xml` of class `ChromiumAccessibilityTree` reads `self._to_str`, but no assignment to it exists in __init__ (and no clas…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/chromium_accessibility_tree.py:106
· conf 1.00
[MINED108] `self._to_str` used but never assigned in __init__: Method `_node_to_xml` of class `ChromiumAccessibilityTree` reads `self._to_str`, but no assignment to it exists in __init__ (and no clas…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/chromium_accessibility_tree.py:112
· conf 1.00
[MINED108] `self._node_to_xml` used but never assigned in __init__: Method `_node_to_xml` of class `ChromiumAccessibilityTree` reads `self._node_to_xml`, but no assignment to it exists in __init__ (a…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/chromium_accessibility_tree.py:119
· conf 1.00
[MINED108] `self._node_to_xml` used but never assigned in __init__: Method `_node_to_xml` of class `ChromiumAccessibilityTree` reads `self._node_to_xml`, but no assignment to it exists in __init__ (a…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/chromium_accessibility_tree.py:141
· conf 1.00
[MINED108] `self.to_str` used but never assigned in __init__: Method `element_by_id` of class `ChromiumAccessibilityTree` reads `self.to_str`, but no assignment to it exists in __init__ (and no class…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/chromium_accessibility_tree.py:172
· conf 1.00
[MINED108] `self.to_str` used but never assigned in __init__: Method `scope_to_area` of class `ChromiumAccessibilityTree` reads `self.to_str`, but no assignment to it exists in __init__ (and no class…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/chromium_accessibility_tree.py:203
· conf 1.00
[MINED108] `self._from_xml` used but never assigned in __init__: Method `scope_to_area` of class `ChromiumAccessibilityTree` reads `self._from_xml`, but no assignment to it exists in __init__ (and no…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/uiautomator2_accessibility_tree.py:31
· conf 1.00
[MINED108] `self._add_raw_ids` used but never assigned in __init__: Method `to_str` of class `UIAutomator2AccessibilityTree` reads `self._add_raw_ids`, but no assignment to it exists in __init__ (and…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/uiautomator2_accessibility_tree.py:43
· conf 1.00
[MINED108] `self._add_raw_ids` used but never assigned in __init__: Method `_add_raw_ids` of class `UIAutomator2AccessibilityTree` reads `self._add_raw_ids`, but no assignment to it exists in __init_…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/uiautomator2_accessibility_tree.py:56
· conf 1.00
[MINED108] `self.to_str` used but never assigned in __init__: Method `element_by_id` of class `UIAutomator2AccessibilityTree` reads `self.to_str`, but no assignment to it exists in __init__ (and no c…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/uiautomator2_accessibility_tree.py:85
· conf 1.00
[MINED108] `self.to_str` used but never assigned in __init__: Method `scope_to_area` of class `UIAutomator2AccessibilityTree` reads `self.to_str`, but no assignment to it exists in __init__ (and no c…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/xcuitest_accessibility_tree.py:22
· conf 1.00
[MINED108] `self._add_raw_ids` used but never assigned in __init__: Method `to_str` of class `XCUITestAccessibilityTree` reads `self._add_raw_ids`, but no assignment to it exists in __init__ (and no …MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/xcuitest_accessibility_tree.py:34
· conf 1.00
[MINED108] `self._add_raw_ids` used but never assigned in __init__: Method `_add_raw_ids` of class `XCUITestAccessibilityTree` reads `self._add_raw_ids`, but no assignment to it exists in __init__ (a…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/xcuitest_accessibility_tree.py:47
· conf 1.00
[MINED108] `self.to_str` used but never assigned in __init__: Method `element_by_id` of class `XCUITestAccessibilityTree` reads `self.to_str`, but no assignment to it exists in __init__ (and no class…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/accessibility/xcuitest_accessibility_tree.py:75
· conf 1.00
[MINED108] `self.to_str` used but never assigned in __init__: Method `scope_to_area` of class `XCUITestAccessibilityTree` reads `self.to_str`, but no assignment to it exists in __init__ (and no class…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/clients/http_client.py:86
· conf 1.00
[MINED108] `self._stop_server` used but never assigned in __init__: Method `quit` of class `HttpClient` reads `self._stop_server`, but no assignment to it exists in __init__ (and no class-level fallb…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/clients/http_client.py:229
· conf 1.00
[MINED108] `self._build_server_pid_name` used but never assigned in __init__: Method `_resolve_url` of class `HttpClient` reads `self._build_server_pid_name`, but no assignment to it exists in __init…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/clients/http_client.py:242
· conf 1.00
[MINED108] `self._stop_server` used but never assigned in __init__: Method `_resolve_url` of class `HttpClient` reads `self._stop_server`, but no assignment to it exists in __init__ (and no class-lev…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/drivers/selenium_driver.py:59
· conf 1.00
[MINED108] `self._wait_for_page_to_load` used but never assigned in __init__: Method `accessibility_tree` of class `SeleniumDriver` reads `self._wait_for_page_to_load`, but no assignment to it exists…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/drivers/selenium_driver.py:63
· conf 1.00
[MINED108] `self._get_all_frame_ids` used but never assigned in __init__: Method `accessibility_tree` of class `SeleniumDriver` reads `self._get_all_frame_ids`, but no assignment to it exists in __in…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/drivers/selenium_driver.py:71
· conf 1.00
[MINED108] `self._build_frame_hierarchy` used but never assigned in __init__: Method `accessibility_tree` of class `SeleniumDriver` reads `self._build_frame_hierarchy`, but no assignment to it exists…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/drivers/selenium_driver.py:85
· conf 1.00
[MINED108] `self._get_frame_chain` used but never assigned in __init__: Method `accessibility_tree` of class `SeleniumDriver` reads `self._get_frame_chain`, but no assignment to it exists in __init__…MINED108
self.attribute used but never assigned in __init__
CWE-476
packages/python/src/alumnium/tools/upload_tool.py:22
· conf 1.00
[MINED108] `self._normalize_paths` used but never assigned in __init__: Method `invoke` of class `UploadTool` reads `self._normalize_paths`, but no assignment to it exists in __init__ (and no class-l…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci-java.yml:57
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci-java.yml:81
· conf 0.90
[MINED115] Action `mxschmitt/action-tmate` pinned to mutable ref `@v3`: `uses: mxschmitt/action-tmate@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci-java.yml:91
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci-java.yml:106
· conf 0.90
[MINED115] Action `mxschmitt/action-tmate` pinned to mutable ref `@v3`: `uses: mxschmitt/action-tmate@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:30
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:41
· conf 0.90
[MINED115] Action `actions-cool/check-user-permission` pinned to mutable ref `@v2`: `uses: actions-cool/check-user-permission@v2` resolves at workflow-run time. Tags and branches can be re-pushed by …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/ci.yml:93
· conf 0.90
[MINED115] Action `mxschmitt/action-tmate` pinned to mutable ref `@v3`: `uses: mxschmitt/action-tmate@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/deployment.yml:25
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/deployment.yml:26
· conf 0.90
[MINED115] Action `jdx/mise-action` pinned to mutable ref `@v4`: `uses: jdx/mise-action@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-act…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/deployment.yml:33
· conf 0.90
[MINED115] Action `actions/upload-pages-artifact` pinned to mutable ref `@v5`: `uses: actions/upload-pages-artifact@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/deployment.yml:47
· conf 0.90
[MINED115] Action `actions/deploy-pages` pinned to mutable ref `@v5`: `uses: actions/deploy-pages@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:45
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:59
· conf 0.90
[MINED115] Action `pypa/gh-action-pypi-publish` pinned to mutable ref `@release/v1`: `uses: pypa/gh-action-pypi-publish@release/v1` resolves at workflow-run time. Tags and branches can be re-pushed b…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:64
· conf 0.90
[MINED115] Action `pypa/gh-action-pypi-publish` pinned to mutable ref `@release/v1`: `uses: pypa/gh-action-pypi-publish@release/v1` resolves at workflow-run time. Tags and branches can be re-pushed b…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:70
· conf 0.90
[MINED115] Action `mxschmitt/action-tmate` pinned to mutable ref `@v3`: `uses: mxschmitt/action-tmate@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:85
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:101
· conf 0.90
[MINED115] Action `mxschmitt/action-tmate` pinned to mutable ref `@v3`: `uses: mxschmitt/action-tmate@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:115
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:133
· conf 0.90
[MINED115] Action `mxschmitt/action-tmate` pinned to mutable ref `@v3`: `uses: mxschmitt/action-tmate@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:149
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:199
· conf 0.90
[MINED115] Action `actions/attest-build-provenance` pinned to mutable ref `@v3`: `uses: actions/attest-build-provenance@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the ac…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:207
· conf 0.90
[MINED115] Action `mxschmitt/action-tmate` pinned to mutable ref `@v3`: `uses: mxschmitt/action-tmate@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:223
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:241
· conf 0.90
[MINED115] Action `actions/attest` pinned to mutable ref `@v4`: `uses: actions/attest@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actio…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:282
· conf 0.90
[MINED115] Action `mxschmitt/action-tmate` pinned to mutable ref `@v3`: `uses: mxschmitt/action-tmate@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that m…MINED118
Dockerfile FROM not pinned by sha256 digest
CWE-829
Dockerfile:1
· conf 0.90
[MINED118] Dockerfile FROM `debian:bookworm-slim` not pinned by digest: `FROM debian:bookworm-slim` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so eve…MINED119
Dockerfile ADD pulls remote URL with no integrity check
CWE-829CWE-494
Dockerfile:6
· conf 0.90
[MINED119] Dockerfile `ADD https://github.com/krallin/tini/releases/download/v0.19.0/tini-${TARGETARCH}`: Dockerfile `ADD <url>` downloads a remote artifact into the image with no integrity check. If…MINED122
package.json dep pulled from git URL or tarball
CWE-829
packages/typescript/tests/npm/cjs/package.json:1
· conf 0.90
[MINED122] package.json dep `alumnium` pulled from URL/Git: `dependencies.alumnium` = `file:../../../dist/npm-alumnium` bypasses the npm registry. No integrity hash, no version locking, no registry-s…MINED122
package.json dep pulled from git URL or tarball
CWE-829
packages/typescript/tests/npm/esm/package.json:1
· conf 0.90
[MINED122] package.json dep `alumnium` pulled from URL/Git: `dependencies.alumnium` = `file:../../../dist/npm-alumnium` bypasses the npm registry. No integrity hash, no version locking, no registry-s…MINED134
[MINED134] Binary file `bin/ref/ScriptoriaCommonDefs.dll` committed in source repo: `bin/ref/ScriptoriaCommonDefs.dll` is a .dll binary (29,208 bytes) committed to a repo that otherwise has 1643 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
packages/java/gradle/wrapper/gradle-wrapper.jar:1
· conf 0.90
[MINED134] Binary file `packages/java/gradle/wrapper/gradle-wrapper.jar` committed in source repo: `packages/java/gradle/wrapper/gradle-wrapper.jar` is a .jar binary (48,966 bytes) committed to a rep…SEC020
Secret Printed to Logs
packages/typescript/src/server/LlmFactory.ts:335
· conf 0.92
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC024
XML External Entity (XXE) — Java parser default
packages/java/src/main/java/ai/alumnium/accessibility/ChromiumAccessibilityTree.java:245
· conf 1.00
[SEC024] XML External Entity (XXE) — Java parser default: Java XML parsers accept external entity references by default. An attacker can craft XML input that reads server files (file://), exfiltrates…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
packages/python/src/alumnium/clients/http_client.py:33
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
packages/python/src/alumnium/drivers/appium_driver.py:123
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
packages/python/src/alumnium/drivers/base_driver.py:62
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC040
innerHTML XSS — template literal with server-supplied data
packages/typescript/src/drivers/AppiumDriver.ts:205
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC040
innerHTML XSS — template literal with server-supplied data
packages/typescript/src/server/agents/PlannerAgent.ts:155
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC040
innerHTML XSS — template literal with server-supplied data
packages/typescript/src/tools/BaseTool.ts:30
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC083
JS: new RegExp() with non-literal
packages/typescript/src/server/agents/RetrieverAgent.ts:156
· conf 1.00
[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0).SEC085
JS: child_process.exec with non-literal
packages/typescript/src/server/cache/ElementsCache/ElementsCacheMask.ts:127
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC114
path.join / Path() on user-controlled segment without containment check
packages/typescript/src/mcp/tools/startMcpTool.ts:81
· conf 1.00
[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../e…SEC114
path.join / Path() on user-controlled segment without containment check
packages/typescript/src/standalone/setupEmbeddedDependencies.ts:188
· conf 1.00
[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../e…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
packages/python/src/alumnium/drivers/scripts/waiter.js:227
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
packages/typescript/src/drivers/scripts/waiter.js:227
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…AGT015
Remote install command pipes network code directly to a shell
websites/docs/src/content/blog/2026-05-13-release-0.20.0.md:27
· conf 0.70
Remote install command pipes network code directly to a shellCOMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
packages/python/examples/behave/features/environment.py:235
· conf 0.95
[COMP001] High cognitive complexity: Function `after_scenario` has cognitive complexity 16 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nest…DKR001
Docker final stage has no non-root USER
Dockerfile:1
· conf 0.82
Docker final stage has no non-root USERDKR003
Dockerfile base image uses the latest tag
telemetry/docker-compose.yml:1
· conf 0.94
Compose service `lgtm` image uses the latest tagDKR013
Dockerfile ADD downloads remote content
Dockerfile:7
· conf 0.84
Dockerfile ADD downloads remote contentERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
packages/typescript/src/server/ServerCommand.ts:281
· conf 1.00
[ERR002] Empty Catch Block: Empty catch blocks hide errors.MINED111
Bare except continues silently
packages/python/src/alumnium/accessibility/chromium_accessibility_tree.py:178
· conf 1.00
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.SEC045
eval()/exec() on stored or user-supplied data
packages/typescript/src/server/cache/ElementsCache/ElementsCacheMask.ts:127
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC127
AI agent stub — TODO: implement / pass placeholder body
packages/python/src/alumnium/drivers/appium_driver.py:64
· conf 1.00
[SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as TODO/pass/raise NotImplementedError after an AI scaffolding pass. The route appears to exist (and may even pass…AIC003
Duplicated implementation block across source files
packages/java/src/main/java/ai/alumnium/accessibility/XCUITestAccessibilityTree.java:14
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/java/src/main/java/ai/alumnium/Area.java:96
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/java/src/main/java/ai/alumnium/driver/SeleniumDriver.java:54
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/java/src/main/java/ai/alumnium/driver/SeleniumDriver.java:144
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/python/src/alumnium/accessibility/xcuitest_accessibility_tree.py:7
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/python/src/alumnium/drivers/playwright_driver.py:66
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/typescript/src/accessibility/XCUITestAccessibilityTree.ts:38
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/typescript/src/client/Area.ts:53
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/typescript/src/drivers/scripts/waiter.js:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/typescript/src/server/agents/LocatorAgent.ts:59
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/typescript/src/server/cache/ResponseCache.ts:111
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/typescript/src/tools/HoverTool.ts:7
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/typescript/src/tools/ScrollTool.ts:6
· conf 0.86
Duplicated implementation block across source filesCOMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
packages/python/examples/behave/features/environment.py:26
· conf 0.95
[COMP001] High cognitive complexity: Function `driver` has cognitive complexity 11 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branc…DKC006
Compose service does not declare a runtime user
telemetry/docker-compose.yml:1
· conf 0.56
Compose service does not declare a runtime userDKC010
Compose service lacks no-new-privileges hardening
telemetry/docker-compose.yml:1
· conf 0.62
Compose service lacks no-new-privileges hardeningDKR008
.dockerignore misses sensitive defaults
.dockerignore
· conf 0.72
.dockerignore misses sensitive defaultsSEC132
String concat where the language has interpolation (AI style drift)
packages/java/src/main/java/ai/alumnium/accessibility/ChromiumAccessibilityTree.java:183
· conf 1.00
[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…SEC132
String concat where the language has interpolation (AI style drift)
packages/java/src/main/java/ai/alumnium/accessibility/UIAutomator2AccessibilityTree.java:63
· conf 1.00
[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…SEC132
String concat where the language has interpolation (AI style drift)
packages/java/src/main/java/ai/alumnium/accessibility/XCUITestAccessibilityTree.java:52
· conf 1.00
[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…COMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
[COMP001] High cognitive complexity (and 7 more): Same pattern found in 7 additional files. Review if needed.MINED043
Http Not Https
CWE-319
[MINED043] Http Not Https (and 2 more): Same pattern found in 2 additional files. Review if needed.MINED043
Http Not Https
CWE-319
packages/java/src/main/java/ai/alumnium/accessibility/ChromiumAccessibilityTree.java:257
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED043
Http Not Https
CWE-319
packages/python/src/alumnium/clients/http_client.py:245
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED043
Http Not Https
CWE-319
packages/typescript/src/server/ServerCommand.ts:151
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED044
Js Console Log Prod
CWE-532
[MINED044] Js Console Log Prod (and 4 more): Same pattern found in 4 additional files. Review if needed.MINED044
Js Console Log Prod
CWE-532
packages/python/src/alumnium/drivers/scripts/waiter.js:54
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
packages/typescript/src/cli/CliCommand.ts:49
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
packages/typescript/src/Env.ts:319
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED045
Ts Non Null Assertion
CWE-476
[MINED045] Ts Non Null Assertion (and 4 more): Same pattern found in 4 additional files. Review if needed.MINED045
Ts Non Null Assertion
CWE-476
packages/typescript/src/cli/CliCommand.ts:114
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
packages/typescript/src/Env.ts:309
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
packages/typescript/src/mcp/tools/checkMcpTool.ts:37
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED050
Stub Only Function
CWE-1188
[MINED050] Stub Only Function (and 4 more): Same pattern found in 4 additional files. Review if needed.MINED050
Stub Only Function
CWE-1188
packages/python/examples/behave/features/environment.py:140
· conf 1.00
[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.MINED050
Stub Only Function
CWE-1188
packages/python/src/alumnium/accessibility/base_accessibility_tree.py:9
· conf 1.00
[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.MINED050
Stub Only Function
CWE-1188
packages/python/src/alumnium/alumni.py:55
· conf 1.00
[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.MINED052
Ts Any Typed
CWE-704
[MINED052] Ts Any Typed (and 4 more): Same pattern found in 4 additional files. Review if needed.MINED052
Ts Any Typed
CWE-704
packages/typescript/src/client/Alumni.ts:64
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED052
Ts Any Typed
CWE-704
packages/typescript/src/mcp/McpServer.ts:53
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED052
Ts Any Typed
CWE-704
packages/typescript/src/server/ServerTelemetry.ts:30
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED054
Ts As Any
CWE-704
[MINED054] Ts As Any (and 2 more): Same pattern found in 2 additional files. Review if needed.MINED054
Ts As Any
CWE-704
packages/typescript/src/client/Alumni.ts:247
· conf 1.00
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.MINED054
Ts As Any
CWE-704
packages/typescript/src/mcp/McpServer.ts:52
· conf 1.00
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.MINED054
Ts As Any
CWE-704
packages/typescript/src/Xml.ts:16
· conf 1.00
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.MINED062
Python Dataclass No Fields
packages/python/src/alumnium/result.py:4
· conf 1.00
[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.SEC020
Secret Printed to Logs
packages/typescript/src/mcp/McpState.ts:113
· conf 0.15
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input (and 5 more): Same pattern found in 5 additional files. Review if needed.SEC118
UUIDv1 / UUIDv3 used for security-sensitive identifier
packages/typescript/src/server/session/Session.ts:171
· conf 0.10
[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable.SEC132
String concat where the language has interpolation (AI style drift)
[SEC132] String concat where the language has interpolation (AI style drift) (and 1 more): Same pattern found in 1 additional files. Review if needed.Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/53d869c3-eb18-4fe6-aa71-30c3aa648529/.