https://github.com/vercel/ai ·
lang: typescript ·
LOC: ·
source: both
| Rule | Severity | Count |
|---|---|---|
AIC003 Duplicated implementation block across source files |
low | 30 |
SEC045 eval()/exec() on stored or user-supplied data |
medium | 4 |
MINED054 Ts As Any |
info | 4 |
SEC135 Auth/permission check missing on AI-generated endpoint |
high | 4 |
MINED049 Print Pii |
info | 4 |
SEC087 JS: weak Math.random for crypto |
medium | 4 |
MINED044 Js Console Log Prod |
info | 4 |
MINED045 Ts Non Null Assertion |
info | 4 |
SEC020 Secret Printed to Logs |
high | 4 |
MINED056 React Key As Index |
info | 4 |
MINED024
Js Eval Usage
CWE-95
examples/ai-functions/src/generate-text/amazon-bedrock/anthropic-multiple-tools.ts:40
· conf 1.00
[MINED024] Js Eval Usage: eval() executes arbitrary code. Code injection risk.MINED024
Js Eval Usage
CWE-95
examples/ai-functions/src/generate-text/openai/reasoning-tools.ts:21
· conf 1.00
[MINED024] Js Eval Usage: eval() executes arbitrary code. Code injection risk.MINED024
Js Eval Usage
CWE-95
examples/ai-functions/src/generate-text/openai/tool-call-with-tools-context.ts:42
· conf 1.00
[MINED024] Js Eval Usage: eval() executes arbitrary code. Code injection risk.MINED035
Js New Function
CWE-95
examples/next-workflow/workflow/agent-chat.ts:57
· conf 1.00
[MINED035] Js New Function: new Function(...) compiles strings to functions.MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/auto-merge-release-prs.yml:29
· conf 0.90
[MINED116] Workflow uses `secrets.GR2M_PR_REVIEW_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.GR2M_PR_REVIEW…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/ci.yml:225
· conf 0.90
[MINED116] Workflow uses `secrets.TURBO_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.TURBO_TOKEN }` lets a P…MINED116
GHA pull_request workflow leaks secrets to forks
CWE-829
.github/workflows/slack-team-review-notification.yml:34
· conf 0.90
[MINED116] Workflow uses `secrets.SLACK_PR_REVIEW_REQUEST_URL` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.SLACK_P…COMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
examples/next-fastapi/api/index.py:31
· conf 0.95
[COMP001] High cognitive complexity: Function `stream_text` has cognitive complexity 61 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested …MINED112
FastAPI POST/PUT/DELETE/PATCH endpoint without auth
CWE-306CWE-862
examples/next-fastapi/api/index.py:129
· conf 0.80
[MINED112] FastAPI POST /api/chat has no auth: Handler `handle_chat_data` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the funct…MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
packages/devtools/src/viewer/server.ts:164
· conf 0.80
[MINED113] Express POST /api/clear has no auth: Express route POST /api/clear declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated …MINED113
Express POST/PUT/DELETE/PATCH route without auth
CWE-306CWE-862
packages/devtools/src/viewer/server.ts:232
· conf 0.80
[MINED113] Express POST /api/notify has no auth: Express route POST /api/notify declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticate…SEC020
Secret Printed to Logs
examples/ai-functions/src/agent/openai/generate-tools-context-call-options.ts:18
· conf 0.85
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC020
Secret Printed to Logs
examples/ai-functions/src/agent/openai/generate-tools-context.ts:18
· conf 0.85
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC020
Secret Printed to Logs
examples/ai-functions/src/generate-text/openai/tool-call-with-tools-context.ts:19
· conf 0.85
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
examples/ai-e2e-next/app/api/chat/mcp-with-auth/route.ts:34
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
examples/ai-e2e-next/app/api/download-container-file/azure/route.ts:2
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
examples/ai-e2e-next/app/api/download-container-file/openai/route.ts:2
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC085
JS: child_process.exec with non-literal
examples/mcp/src/mcp-with-auth/client.ts:48
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC128
Async function without await — fire-and-forget Promise (AI mistake)
examples/ai-e2e-next/app/api/chat/mcp-elicitation/elicitation-store.ts:45
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
examples/ai-e2e-next/app/chat/upload-file/page.tsx:117
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
examples/ai-e2e-next/app/stream-object/actions.ts:18
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC135
Auth/permission check missing on AI-generated endpoint
examples/angular/src/server.ts:12
· conf 1.00
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…SEC135
Auth/permission check missing on AI-generated endpoint
examples/express/src/server.ts:27
· conf 1.00
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…SEC135
Auth/permission check missing on AI-generated endpoint
examples/mcp/src/elicitation-multi-step/server.ts:144
· conf 1.00
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…AUC001
[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.COMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
examples/next-fastapi/api/utils/prompt.py:14
· conf 0.95
[COMP001] High cognitive complexity: Function `convert_to_openai_messages` has cognitive complexity 17 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to under…CORE_NO_README
No README file found
No README file foundERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
examples/ai-e2e-next/agent/openai/apply-patch-agent.ts:17
· conf 0.45
[ERR002] Empty Catch Block: Empty catch blocks hide errors.SEC034
Log Injection / Log Forging — unsanitized user input in log
examples/ai-functions/src/generate-text/openai/output-object-request-body.ts:27
· conf 1.00
[SEC034] Log Injection / Log Forging — unsanitized user input in log: User input is logged without sanitizing newlines or control characters. Attackers inject `\n` to forge fake log entries, hide tra…SEC034
Log Injection / Log Forging — unsanitized user input in log
examples/ai-functions/src/generate-text/openai/request-body.ts:12
· conf 1.00
[SEC034] Log Injection / Log Forging — unsanitized user input in log: User input is logged without sanitizing newlines or control characters. Attackers inject `\n` to forge fake log entries, hide tra…SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
examples/ai-e2e-next/app/chat/custom-sources/page.tsx:31
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
examples/ai-e2e-next/app/chat/mcp-apps/page.tsx:54
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
examples/ai-e2e-next/app/chat/mcp-with-auth/page.tsx:15
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC045
eval()/exec() on stored or user-supplied data
examples/ai-functions/src/generate-text/amazon-bedrock/anthropic-multiple-tools.ts:40
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC045
eval()/exec() on stored or user-supplied data
examples/ai-functions/src/generate-text/openai/reasoning-tools.ts:21
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC045
eval()/exec() on stored or user-supplied data
examples/ai-functions/src/generate-text/openai/tool-call-with-tools-context.ts:42
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC087
JS: weak Math.random for crypto
examples/ai-e2e-next/app/chat/tools/page.tsx:33
· conf 1.00
[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…SEC087
JS: weak Math.random for crypto
examples/ai-functions/src/agent/openai/generate-tools-context-call-options.ts:18
· conf 1.00
[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…SEC087
JS: weak Math.random for crypto
examples/ai-functions/src/agent/openai/generate-tools-context.ts:18
· conf 1.00
[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…SEC125
AI placeholder credential left in source (your-api-key-here style)
examples/ai-functions/src/generate-text/amazon-bedrock/api-key.ts:38
· conf 1.00
[SEC125] AI placeholder credential left in source (your-api-key-here style): AI coding assistants frequently emit placeholder credentials shaped like `API_KEY = "your-api-key-here"` instead of pullin…SEC134
AI scaffold leftover — Lorem ipsum / example.com / John Doe in code
examples/ai-e2e-next/app/api/chat/custom-sources/route.ts:22
· conf 1.00
[SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't…SEC134
AI scaffold leftover — Lorem ipsum / example.com / John Doe in code
examples/ai-functions/src/generate-video/klingai/motion-control-pro.ts:21
· conf 1.00
[SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't…SEC134
AI scaffold leftover — Lorem ipsum / example.com / John Doe in code
examples/ai-functions/src/generate-video/klingai/motion-control-v3.ts:21
· conf 1.00
[SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't…WEB003
Public web service has no security.txt
.well-known/security.txt
· conf 0.78
Public web service has no security.txtWEB015
Public web app has no Content Security Policy
index.html
· conf 0.70
Public web app has no Content Security PolicyAIC003
Duplicated implementation block across source files
packages/ai/src/embed/embed.ts:48
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/ai/src/generate-object/stream-object.ts:81
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/ai/src/generate-text/generate-text.test-d.ts:127
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/ai/src/generate-text/step-result.ts:69
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/ai/src/generate-text/stream-text.test-d.ts:241
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/ai/src/generate-text/stream-text.test-d.ts:268
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/ai/src/registry/provider-registry.test-d.ts:131
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/ai/src/ui/last-assistant-message-is-complete-with-tool-calls.ts:3
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/amazon-bedrock/src/amazon-bedrock-image-model.ts:205
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/amazon-bedrock/src/anthropic/amazon-bedrock-anthropic-provider.ts:76
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/amazon-bedrock/src/mantle/bedrock-mantle-provider.ts:60
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/amazon-bedrock/src/mantle/bedrock-mantle-provider.ts:86
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic-aws/src/anthropic-aws-fetch.ts:21
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic-aws/src/anthropic-aws-provider.ts:56
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic-aws/src/anthropic-aws-provider.ts:85
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic-aws/tsup.config.ts:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/anthropic-provider.ts:102
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/anthropic-provider.ts:106
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/tool/bash_20250124.test-d.ts:37
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/tool/bash_20250124.ts:66
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/tool/code-execution_20250825.ts:10
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/tool/code-execution_20260120.ts:8
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/tool/code-execution_20260120.ts:10
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/tool/computer_20251124.ts:8
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/tool/text-editor_20250124.ts:8
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/tool/text-editor_20250728.ts:15
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/tool/web-fetch-20260209.ts:19
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/src/tool/web-search_20260209.ts:8
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/anthropic/tsup.config.ts:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
packages/assemblyai/tsup.config.ts:1
· conf 0.86
Duplicated implementation block across source filesWEB001
Public web app has no robots.txt
robots.txt
· conf 0.74
Public web app has no robots.txtWEB002
Public web app has no sitemap
sitemap.xml
· conf 0.72
Public web app has no sitemapWEB011
Public web app has no humans.txt
humans.txt
· conf 0.50
Public web app has no humans.txtMINED024
Js Eval Usage
CWE-95
[MINED024] Js Eval Usage (and 1 more): Same pattern found in 1 additional files. Review if needed.MINED044
Js Console Log Prod
CWE-532
[MINED044] Js Console Log Prod (and 1181 more): Same pattern found in 1181 additional files. Review if needed.MINED044
Js Console Log Prod
CWE-532
.github/scripts/cleanup-examples-changesets.mjs:22
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
.github/scripts/notify-released/index.mjs:16
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
.github/workflows/actions/verify-changesets/index.js:25
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED045
Ts Non Null Assertion
CWE-476
[MINED045] Ts Non Null Assertion (and 12 more): Same pattern found in 12 additional files. Review if needed.MINED045
Ts Non Null Assertion
CWE-476
examples/ai-e2e-next/app/api/chat/human-in-the-loop/utils.ts:70
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
examples/ai-e2e-next/app/api/chat/xai-image-edit/route.ts:36
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
examples/ai-functions/src/generate-text/anthropic/chatbot-websearch.ts:10
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED049
Print Pii
CWE-532
[MINED049] Print Pii (and 286 more): Same pattern found in 286 additional files. Review if needed.MINED049
Print Pii
CWE-532
examples/ai-e2e-next/app/api/files/route.ts:42
· conf 1.00
[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.MINED049
Print Pii
CWE-532
examples/ai-functions/src/agent/openai/generate-just-bash-sandbox-compaction.ts:25
· conf 1.00
[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.MINED049
Print Pii
CWE-532
examples/ai-functions/src/agent/openai/generate-on-step-finish.ts:30
· conf 1.00
[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.MINED052
Ts Any Typed
CWE-704
[MINED052] Ts Any Typed (and 14 more): Same pattern found in 14 additional files. Review if needed.MINED052
Ts Any Typed
CWE-704
examples/ai-e2e-next/agent/openai/shell-agent.ts:48
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED052
Ts Any Typed
CWE-704
examples/ai-e2e-next/agent/openai/shell-skills-agent.ts:63
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED052
Ts Any Typed
CWE-704
examples/ai-e2e-next/app/api/chat/mcp-elicitation/route.ts:32
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED053
Placeholder Default Username
CWE-1392CWE-798
examples/mcp/src/http/server.ts:36
· conf 1.00
[MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin / changeme — typical AI placeholder credentials.MINED054
Ts As Any
CWE-704
[MINED054] Ts As Any (and 22 more): Same pattern found in 22 additional files. Review if needed.MINED054
Ts As Any
CWE-704
examples/ai-e2e-next/agent/anthropic/code-execution-agent.ts:25
· conf 1.00
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.MINED054
Ts As Any
CWE-704
examples/ai-e2e-next/agent/anthropic/programmatic-tool-calling-agent.ts:27
· conf 1.00
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.MINED054
Ts As Any
CWE-704
examples/ai-e2e-next/app/api/chat/mcp-with-auth/route.ts:25
· conf 1.00
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.MINED056
React Key As Index
CWE-682
[MINED056] React Key As Index (and 91 more): Same pattern found in 91 additional files. Review if needed.MINED056
React Key As Index
CWE-682
examples/ai-e2e-next/app/chat/anthropic-advisor-tool/page.tsx:28
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
examples/ai-e2e-next/app/chat/anthropic-code-execution-file-upload/page.tsx:179
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
examples/ai-e2e-next/app/chat/anthropic-code-execution/page.tsx:30
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED058
React Dangerously Set Html
CWE-79
examples/next-openai-kasada-bot-protection/kasada/kasada-client.tsx:7
· conf 1.00
[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data.SEC020
Secret Printed to Logs
[SEC020] Secret Printed to Logs (and 271 more): Same pattern found in 271 additional files. Review if needed.SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input (and 35 more): Same pattern found in 35 additional files. Review if needed.SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer" (and 3 more): Same pattern found in 3 additional files. Review if needed.SEC045
eval()/exec() on stored or user-supplied data
[SEC045] eval()/exec() on stored or user-supplied data (and 3 more): Same pattern found in 3 additional files. Review if needed.SEC087
JS: weak Math.random for crypto
[SEC087] JS: weak Math.random for crypto (and 2 more): Same pattern found in 2 additional files. Review if needed.SEC118
UUIDv1 / UUIDv3 used for security-sensitive identifier
examples/next-workflow/app/api/chat/route.ts:15
· conf 0.10
[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable.SEC118
UUIDv1 / UUIDv3 used for security-sensitive identifier
examples/next-workflow/app/api/telemetry-chat/route.ts:21
· conf 0.10
[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable.SEC128
Async function without await — fire-and-forget Promise (AI mistake)
[SEC128] Async function without await — fire-and-forget Promise (AI mistake) (and 3 more): Same pattern found in 3 additional files. Review if needed.SEC134
AI scaffold leftover — Lorem ipsum / example.com / John Doe in code
[SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code (and 2 more): Same pattern found in 2 additional files. Review if needed.SEC135
Auth/permission check missing on AI-generated endpoint
[SEC135] Auth/permission check missing on AI-generated endpoint (and 13 more): Same pattern found in 13 additional files. Review if needed.Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/9a1ae60a-ba5d-47ea-833b-bdc487805b97/.