← Legacy view v2 (rp.*)

carbon-design-system/carbon-components-svelte

https://github.com/carbon-design-system/carbon-components-svelte · lang: typescript · LOC: · source: user_submitted

Quality

86.8

Grade A-

Security

97.0

Findings

0 critical · 6 high

Status

completed

May 31, 2026 01:26

low: 31 high: 6 info: 4 medium: 2

Top rules by occurrence

Rule	Severity	Count
`AIC003` Duplicated implementation block across source files	low	30
`SEC128` Async function without await — fire-and-forget Promise (AI …	high	3
`MINED044` Js Console Log Prod	info	3
`MINED126` GHA workflow container/services image unpinned	high	1
`SEC029` Server-Side Request Forgery (SSRF) — outbound HTTP from use…	high	1
`WEB015` Public web app has no Content Security Policy	medium	1
`SEC040` innerHTML XSS — template literal with server-supplied data	high	1
`WEB011` Public web app has no humans.txt	low	1
`MINED045` Ts Non Null Assertion	info	1
`WEB003` Public web service has no security.txt	medium	1

First 43 findings (severity-sorted)

high MINED126 GHA workflow container/services image unpinned CWE-829

.github/workflows/checks.yml:115 · conf 0.90

[MINED126] Workflow container/services image `mcr.microsoft.com/playwright:v1.59.0-noble` unpinned: `container/services image: mcr.microsoft.com/playwright:v1.59.0-noble` without `@sha256:...` pulls …

high SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from user input

scripts/release-changelog.ts:26 · conf 1.00

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…

high SEC040 innerHTML XSS — template literal with server-supplied data

scripts/release-changelog.ts:95 · conf 1.00

[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…

high SEC128 Async function without await — fire-and-forget Promise (AI mistake)

src/DataTable/data-table-utils.js:176 · conf 1.00

[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…

high SEC128 Async function without await — fire-and-forget Promise (AI mistake)

src/Modal/modalStore.js:27 · conf 1.00

[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…

high SEC128 Async function without await — fire-and-forget Promise (AI mistake)

src/RadioButton/RadioButtonRegistry.js:64 · conf 1.00

[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…

medium WEB003 Public web service has no security.txt

.well-known/security.txt · conf 0.78

Public web service has no security.txt

medium WEB015 Public web app has no Content Security Policy

index.html · conf 0.70

Public web app has no Content Security Policy