agentforce314/clawcodex

[MINED107] Missing import: `stat` used but not imported: The file uses `stat.something(...)` but never imports `stat`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `warnings` used but not imported: The file uses `warnings.something(...)` but never imports `warnings`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `queue` used but not imported: The file uses `queue.something(...)` but never imports `queue`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `warnings` used but not imported: The file uses `warnings.something(...)` but never imports `warnings`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `warnings` used but not imported: The file uses `warnings.something(...)` but never imports `warnings`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `stat` used but not imported: The file uses `stat.something(...)` but never imports `stat`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `glob` used but not imported: The file uses `glob.something(...)` but never imports `glob`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `stat` used but not imported: The file uses `stat.something(...)` but never imports `stat`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `signal` used but not imported: The file uses `signal.something(...)` but never imports `signal`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `signal` used but not imported: The file uses `signal.something(...)` but never imports `signal`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `signal` used but not imported: The file uses `signal.something(...)` but never imports `signal`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes.

[MINED107] Missing import: `select` used but not imported: The file uses `select.something(...)` but never imports `select`. This raises NameError at runtime the first time the line executes.

LLM memory extraction can be prompt-injected into storing fake facts

[COMP001] High cognitive complexity: Function `main` has cognitive complexity 40 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branche…

[MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.

[MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.

[MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.

[MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.

[MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.

[MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.

[MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of Decimal.

[MINED014] Disabled Tls Verify: verify=False in requests, rejectUnauthorized:false in node, InsecureSkipVerify:true in Go.

[MINED014] Disabled Tls Verify: verify=False in requests, rejectUnauthorized:false in node, InsecureSkipVerify:true in Go.

[MINED014] Disabled Tls Verify: verify=False in requests, rejectUnauthorized:false in node, InsecureSkipVerify:true in Go.

[MINED106] Phantom test coverage: test_preconnect_does_not_raise_on_network_error: Test function `test_preconnect_does_not_raise_on_network_error` runs code but contains no assert / expect / should c…

[MINED106] Phantom test coverage: test_cache_clearing: Test function `test_cache_clearing` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line cover…

[MINED106] Phantom test coverage: test_bare_mode_disables: Test function `test_bare_mode_disables` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds li…

[MINED106] Phantom test coverage: test_clear_is_safe_when_prompt_assembly_unavailable: Test function `test_clear_is_safe_when_prompt_assembly_unavailable` runs code but contains no assert / expect / …

[MINED106] Phantom test coverage: test_pre_action_invokes_init: Test function `test_pre_action_invokes_init` runs code but contains no assert / expect / should call — it passes regardless of behaviou…

[MINED106] Phantom test coverage: test_import_modes: Test function `test_import_modes` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage …

[MINED106] Phantom test coverage: test_import_rules: Test function `test_import_rules` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage …

[MINED106] Phantom test coverage: test_state_mismatch_raises: Test function `test_state_mismatch_raises` runs code but contains no assert / expect / should call — it passes regardless of behaviour. A…

[MINED106] Phantom test coverage: test_error_param_raises_with_description: Test function `test_error_param_raises_with_description` runs code but contains no assert / expect / should call — it passe…

[MINED106] Phantom test coverage: test_missing_code_raises: Test function `test_missing_code_raises` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds …

[MINED106] Phantom test coverage: test_timeout_raises: Test function `test_timeout_raises` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line cover…

[MINED106] Phantom test coverage: test_check_permissions_passes_through_for_memory_md: Test function `test_check_permissions_passes_through_for_memory_md` runs code but contains no assert / expect / …

[MINED106] Phantom test coverage: test_check_permissions_unchanged_for_outside_path: Test function `test_check_permissions_unchanged_for_outside_path` runs code but contains no assert / expect / shou…

[MINED106] Phantom test coverage: test_missing_manifest: Test function `test_missing_manifest` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line c…

[MINED106] Phantom test coverage: test_invalid_json: Test function `test_invalid_json` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage …

[MINED106] Phantom test coverage: test_invalid_manifest: Test function `test_invalid_manifest` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line c…

[MINED106] Phantom test coverage: test_cli_module_import_populates_prefetch_handles: Test function `test_cli_module_import_populates_prefetch_handles` runs code but contains no assert / expect / shou…

[MINED106] Phantom test coverage: test_pre_aborted_signal_short_circuits_before_request: Test function `test_pre_aborted_signal_short_circuits_before_request` runs code but contains no assert / expec…

[MINED106] Phantom test coverage: test_handle_command_clear: Test function `test_handle_command_clear` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Add…

[MINED106] Phantom test coverage: test_chat_uses_query_engine_for_code_task: Test function `test_chat_uses_query_engine_for_code_task` runs code but contains no assert / expect / should call — it pas…

[MINED106] Phantom test coverage: test_chat_uses_query_engine_on_stream_init_failure: Test function `test_chat_uses_query_engine_on_stream_init_failure` runs code but contains no assert / expect / sh…

[MINED106] Phantom test coverage: test_save_session: Test function `test_save_session` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage …

[MINED106] Phantom test coverage: test_returns_none_when_no_managed_file: Test function `test_returns_none_when_no_managed_file` runs code but contains no assert / expect / should call — it passes re…

[MINED106] Phantom test coverage: test_disarm_after_fire_is_safe: Test function `test_disarm_after_fire_is_safe` runs code but contains no assert / expect / should call — it passes regardless of beha…

[MINED106] Phantom test coverage: test_task_state_base_is_kw_only: Test function `test_task_state_base_is_kw_only` runs code but contains no assert / expect / should call — it passes regardless of be…

[MINED108] `self.load_global` used but never assigned in __init__: Method `get_merged` of class `ConfigManager` reads `self.load_global`, but no assignment to it exists in __init__ (and no class-leve…

[MINED108] `self.load_project` used but never assigned in __init__: Method `get_merged` of class `ConfigManager` reads `self.load_project`, but no assignment to it exists in __init__ (and no class-le…

[MINED108] `self.load_local` used but never assigned in __init__: Method `get_merged` of class `ConfigManager` reads `self.load_local`, but no assignment to it exists in __init__ (and no class-level …

[MINED108] `self.get_merged` used but never assigned in __init__: Method `get` of class `ConfigManager` reads `self.get_merged`, but no assignment to it exists in __init__ (and no class-level fallbac…

[MINED108] `self.load_global` used but never assigned in __init__: Method `set_global` of class `ConfigManager` reads `self.load_global`, but no assignment to it exists in __init__ (and no class-leve…

[MINED108] `self.save_global` used but never assigned in __init__: Method `set_global` of class `ConfigManager` reads `self.save_global`, but no assignment to it exists in __init__ (and no class-leve…

[MINED108] `self.load_project` used but never assigned in __init__: Method `set_project` of class `ConfigManager` reads `self.load_project`, but no assignment to it exists in __init__ (and no class-l…

[MINED108] `self.save_project` used but never assigned in __init__: Method `set_project` of class `ConfigManager` reads `self.save_project`, but no assignment to it exists in __init__ (and no class-l…

[MINED108] `self.all` used but never assigned in __init__: Method `__iter__` of class `RuntimeTaskRegistry` reads `self.all`, but no assignment to it exists in __init__ (and no class-level fallback).…

[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_detects_png` of class `TestMagicByteFormatDetection` reads `self.assertEqual`, but no assignment to it exists in __init…

[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_detects_jpeg` of class `TestMagicByteFormatDetection` reads `self.assertEqual`, but no assignment to it exists in __ini…

[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_detects_gif` of class `TestMagicByteFormatDetection` reads `self.assertEqual`, but no assignment to it exists in __init…

[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_detects_webp` of class `TestMagicByteFormatDetection` reads `self.assertEqual`, but no assignment to it exists in __ini…

[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_detects_real_pillow_png` of class `TestMagicByteFormatDetection` reads `self.assertEqual`, but no assignment to it exis…

[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_detects_real_pillow_jpeg` of class `TestMagicByteFormatDetection` reads `self.assertEqual`, but no assignment to it exi…

[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_unknown_falls_back_to_png` of class `TestMagicByteFormatDetection` reads `self.assertEqual`, but no assignment to it ex…

[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_handles_truncated_buffer` of class `TestMagicByteFormatDetection` reads `self.assertEqual`, but no assignment to it exi…

[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_handles_truncated_buffer` of class `TestMagicByteFormatDetection` reads `self.assertEqual`, but no assignment to it exi…

[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_handles_truncated_buffer` of class `TestMagicByteFormatDetection` reads `self.assertEqual`, but no assignment to it exi…

[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_base64_variant_decodes_and_sniffs` of class `TestMagicByteFormatDetection` reads `self.assertEqual`, but no assignment …

[MINED108] `self.tmp` used but never assigned in __init__: Method `setUp` of class `TestReadFileBytes` reads `self.tmp`, but no assignment to it exists in __init__ (and no class-level fallback). This…

[MINED108] `self.root` used but never assigned in __init__: Method `setUp` of class `TestReadFileBytes` reads `self.root`, but no assignment to it exists in __init__ (and no class-level fallback). Th…

[MINED108] `self.tmp` used but never assigned in __init__: Method `setUp` of class `TestReadFileBytes` reads `self.tmp`, but no assignment to it exists in __init__ (and no class-level fallback). This…

[MINED108] `self.tmp` used but never assigned in __init__: Method `tearDown` of class `TestReadFileBytes` reads `self.tmp`, but no assignment to it exists in __init__ (and no class-level fallback). T…

[MINED108] `self.root` used but never assigned in __init__: Method `test_unbounded_returns_full_file` of class `TestReadFileBytes` reads `self.root`, but no assignment to it exists in __init__ (and n…

[MINED110] Blocking call `requests.append` inside async function `test_permission_request_fires_callback`: `requests.append` is a synchronous (blocking) call. When invoked inside an `async def` it st…

[MINED110] Blocking call `time.sleep` inside async function `test_reload_if_changed`: `time.sleep` is a synchronous (blocking) call. When invoked inside an `async def` it stalls the event loop, preve…

[SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection.

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…

[SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.

[SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.

[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…

[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…

[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…

Agent auto-approve or skip-permissions mode is easy to enable

Agent auto-approve or skip-permissions mode is easy to enable

Agent auto-approve or skip-permissions mode is easy to enable

Remote install command pipes network code directly to a shell

Codex session log reader may expose prompts or tool-call content

[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

[COMP001] High cognitive complexity: Function `main` has cognitive complexity 18 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branche…

No CI/CD configuration found

[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.

[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.

[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing man-in-the-middle attacks.

[SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing man-in-the-middle attacks.

[SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing man-in-the-middle attacks.

[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.

[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.

[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.

[SEC031] Catastrophic Backtracking Regex (ReDoS): Regex contains nested quantifiers like `(a+)+` or quantified alternation with overlapping branches. On adversarial input these patterns exhibit expon…

[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…

[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…

[SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't…

[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unf…

[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unf…

[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unf…

Duplicated implementation block across source files

Duplicated implementation block across source files

Duplicated implementation block across source files

Duplicated implementation block across source files

Duplicated implementation block across source files

Duplicated implementation block across source files

Duplicated implementation block across source files

Duplicated implementation block across source files

Duplicated implementation block across source files

[COMP001] High cognitive complexity: Function `repair` has cognitive complexity 13 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branc…

[COMP001] High cognitive complexity (and 261 more): Same pattern found in 261 additional files. Review if needed.

[ERR001] Silent Exception Swallowing (and 32 more): Same pattern found in 32 additional files. Review if needed.

[MINED001] Bare Except Pass (and 59 more): Same pattern found in 59 additional files. Review if needed.

[MINED043] Http Not Https (and 2 more): Same pattern found in 2 additional files. Review if needed.

[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.

[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.

[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.

[MINED050] Stub Only Function (and 86 more): Same pattern found in 86 additional files. Review if needed.

[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.

[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.

[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.

[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.

[MINED062] Python Dataclass No Fields (and 111 more): Same pattern found in 111 additional files. Review if needed.

[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.

[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.

[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.

[MINED064] Python Input Call (and 4 more): Same pattern found in 4 additional files. Review if needed.

[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services.

[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services.

[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services.

[MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in.

[MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in.

[MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in.

[MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles.

[MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles.

[SEC016] LLM Prompt Injection — User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prompt (e.g. OpenAI, Anthropic, or local model). This is the AI equivalent of SQL i…

[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…

[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input (and 16 more): Same pattern found in 16 additional files. Review if needed.

[SEC128] Async function without await — fire-and-forget Promise (AI mistake) (and 13 more): Same pattern found in 13 additional files. Review if needed.

[SEC136] AI-typical over-broad exception handler swallowing all errors (and 8 more): Same pattern found in 8 additional files. Review if needed.