https://github.com/BigBodyCobain/Shadowbroker.git ·
lang: python ·
LOC: ·
source: both
| Rule | Severity | Count |
|---|---|---|
AIC003 Duplicated implementation block across source files |
low | 16 |
JRN003 Frontend API reference is not matched by discovered backend… |
medium | 15 |
AGT007 localStorage write failures are swallowed silently |
medium | 6 |
AUC009 [AUC009] Sensitive function route lacks elevated authorizat… |
medium | 4 |
MINED003 Rust Unwrap In Prod |
high | 3 |
MINED067 Python Requests No Timeout |
info | 3 |
MINED006 Overcatch Baseexception |
high | 3 |
SEC040 innerHTML XSS — template literal with server-supplied data |
high | 3 |
ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. |
medium | 3 |
MINED063 Toctou Os Path Exists |
info | 3 |
MINED018
Unsafe Deserialization Pickle
CWE-502
backend/services/infonet/governance/dsl_executor.py:204
· conf 1.00
[MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLoader) / unmarshal of network/file data — RCE.MINED030
Python Pickle Loads
CWE-502
backend/services/infonet/governance/dsl_executor.py:204
· conf 1.00
[MINED030] Python Pickle Loads: pickle.loads() can execute arbitrary code via __reduce__.SEC001
Hardcoded Password
desktop-shell/tauri-skeleton/build.sh:48
· conf 0.90
[SEC001] Hardcoded Password: Hardcoded password found in source code.SEC081
Python: pickle.loads / marshal.loads on untrusted data
backend/services/infonet/governance/dsl_executor.py:204
· conf 1.00
[SEC081] Python: pickle.loads / marshal.loads on untrusted data: pickle.load(s) and marshal.load(s) execute arbitrary code on untrusted input. Ported from dlint DUO103 / DUO120 (BSD-3).AGT002
LLM memory extraction can be prompt-injected into storing fake facts
backend/services/mesh/mesh_wormhole_ratchet.py:56
· conf 0.82
LLM memory extraction can be prompt-injected into storing fake factsCOMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
backend/node_state.py:159
· conf 0.95
[COMP001] High cognitive complexity: Function `_refresh_node_peer_store` has cognitive complexity 33 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to underst…DKR006
Dockerfile pipes a remote script into a shell
backend/Dockerfile:27
· conf 0.92
Dockerfile pipes a remote script into a shellJRN009
Secret-like setting is echoed into a password input value
frontend/src/components/MeshChat/index.tsx:1329
· conf 0.83
Secret-like setting is echoed into a password input valueMINED001
Bare Except Pass
CWE-755
backend/auth.py:460
· conf 1.00
[MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.MINED001
Bare Except Pass
CWE-755
backend/main.py:1192
· conf 1.00
[MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.MINED001
Bare Except Pass
CWE-755
backend/routers/admin.py:290
· conf 1.00
[MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.MINED003
Rust Unwrap In Prod
CWE-755
desktop-shell/tauri-skeleton/src-tauri/src/backend_runtime.rs:523
· conf 1.00
[MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky elsewhere.MINED003
Rust Unwrap In Prod
CWE-755
desktop-shell/tauri-skeleton/src-tauri/src/companion.rs:298
· conf 1.00
[MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky elsewhere.MINED003
Rust Unwrap In Prod
CWE-755
desktop-shell/tauri-skeleton/src-tauri/src/companion_server.rs:244
· conf 1.00
[MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky elsewhere.MINED004
Weak Crypto
CWE-327
backend/main.py:3541
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).MINED004
Weak Crypto
CWE-327
backend/services/fetchers/earth_observation.py:999
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).MINED006
Overcatch Baseexception
CWE-705
backend/routers/ai_intel.py:2681
· conf 1.00
[MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.MINED006
Overcatch Baseexception
CWE-705
backend/services/mesh/mesh_hashchain.py:102
· conf 1.00
[MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.MINED006
Overcatch Baseexception
CWE-705
backend/services/mesh/mesh_peer_store.py:37
· conf 1.00
[MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.MINED009
Floats For Money
CWE-682
backend/services/infonet/markets/data_unavailable.py:75
· conf 1.00
[MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of Decimal.MINED009
Floats For Money
CWE-682
backend/services/infonet/markets/dispute.py:124
· conf 1.00
[MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of Decimal.MINED009
Floats For Money
CWE-682
backend/services/infonet/markets/resolution.py:88
· conf 1.00
[MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of Decimal.MINED036
Python Os System Call
CWE-78
backend/services/infonet/governance/dsl_executor.py:202
· conf 1.00
[MINED036] Python Os System Call: os.system() invokes shell with no escaping.SEC013
Path Traversal — User Input in File Path
backend/services/mesh/mesh_wormhole_prekey.py:139
· conf 0.80
[SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
backend/auth.py:1321
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
backend/main.py:1382
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
backend/routers/cctv.py:80
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC040
innerHTML XSS — template literal with server-supplied data
desktop-shell/tauri-skeleton/scripts/write-release-manifest.cjs:139
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC040
innerHTML XSS — template literal with server-supplied data
frontend/src/components/InfonetTerminal/AIQueryView.tsx:145
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC040
innerHTML XSS — template literal with server-supplied data
frontend/src/components/MaplibreViewer.tsx:5242
· conf 1.00
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…SEC078
Python: requests without timeout
backend/services/cctv_pipeline.py:633
· conf 1.00
[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-…SEC078
Python: requests without timeout
backend/services/feed_ingester.py:157
· conf 1.00
[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-…SEC078
Python: requests without timeout
backend/services/fetchers/aircraft_database.py:48
· conf 1.00
[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-…SEC080
Python: tarfile.extractall without filter
backend/services/tor_hidden_service.py:112
· conf 1.00
[SEC080] Python: tarfile.extractall without filter: tarfile.extract*() without filter='data' allows path-traversal (CVE-2007-4559, fixed via PEP 706 in 3.12). Ported from bandit B202 (Apache-2.0).SEC083
JS: new RegExp() with non-literal
frontend/src/components/MeshTerminal.tsx:4913
· conf 1.00
[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0).SEC085
JS: child_process.exec with non-literal
frontend/scripts/vite-no-net-use.cjs:5
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC085
JS: child_process.exec with non-literal
frontend/src/components/MeshTerminal.tsx:4819
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC100
CORS permissive Access-Control-Allow-Origin: *
backend/main.py:8163
· conf 1.00
[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `A…SEC100
CORS permissive Access-Control-Allow-Origin: *
backend/routers/cctv.py:182
· conf 1.00
[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `A…SEC103
LDAP injection — non-constant search filter
backend/services/cctv_pipeline.py:589
· conf 1.00
[SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.SEC103
LDAP injection — non-constant search filter
backend/services/fetchers/news.py:156
· conf 1.00
[SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.SEC103
LDAP injection — non-constant search filter
backend/services/fetchers/satellites.py:1010
· conf 1.00
[SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts.SEC128
Async function without await — fire-and-forget Promise (AI mistake)
backend/main.py:1343
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
backend/node_state.py:281
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
backend/routers/data.py:229
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC135
Auth/permission check missing on AI-generated endpoint
backend/routers/infonet.py:173
· conf 1.00
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…AGT007
localStorage write failures are swallowed silently
frontend/src/components/InfonetTerminal/InfonetShell.tsx:97
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
frontend/src/components/InfonetTerminal/MessagesView.tsx:281
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
frontend/src/components/MeshChat/useMeshChatController.ts:283
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
frontend/src/components/SarModeChooserModal.tsx:85
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
frontend/src/components/ShodanPanel.tsx:246
· conf 0.80
localStorage write failures are swallowed silentlyAGT007
localStorage write failures are swallowed silently
frontend/src/components/WorldviewLeftPanel.tsx:482
· conf 0.80
localStorage write failures are swallowed silentlyAGT012
Agent control bridge may listen on a network interface without visible auth
backend/services/radio_intercept.py:25
· conf 0.72
Agent control bridge may listen on a network interface without visible authAUC001
[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.AUC002
[AUC002] Low visible authorization coverage in route inventory: Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
[AUC002] Low visible authorization coverage in route inventory: Only 28.6% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
frontend/src/app/api/admin/session/route.ts:61
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
frontend/src/app/api/admin/session/route.ts:87
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
frontend/src/app/api/admin/session/route.ts:100
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
frontend/src/app/api/[...path]/route.ts:289
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
frontend/src/app/api/[...path]/route.ts:293
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
frontend/src/app/api/[...path]/route.ts:297
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
frontend/src/app/api/[...path]/route.ts:301
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…COMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
backend/routers/cctv.py:85
· conf 0.95
[COMP001] High cognitive complexity: Function `_cctv_proxy_profile_for_url` has cognitive complexity 23 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to unde…DKR003
Dockerfile base image uses the latest tag
docker-compose.yml:9
· conf 0.94
Compose service `backend` image uses the latest tagDKR003
Dockerfile base image uses the latest tag
docker-compose.yml:60
· conf 0.94
Compose service `frontend` image uses the latest tagDKR013
Dockerfile ADD downloads remote content
backend/Dockerfile:36
· conf 0.84
Dockerfile ADD downloads remote contentDKR014
Dockerfile copies the entire context without .dockerignore
frontend/Dockerfile:12
· conf 0.76
Dockerfile copies broad context with incomplete .dockerignoreERR001
[ERR001] Silent Exception Swallowing (and 2 more): Same pattern found in 2 additional files. Review if needed.
backend/auth.py:460
· conf 1.00
[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.ERR001
[ERR001] Silent Exception Swallowing (and 2 more): Same pattern found in 2 additional files. Review if needed.
backend/main.py:1192
· conf 1.00
[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.ERR001
[ERR001] Silent Exception Swallowing (and 2 more): Same pattern found in 2 additional files. Review if needed.
backend/routers/admin.py:290
· conf 1.00
[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.ERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
backend/ais_proxy.js:45
· conf 1.00
[ERR002] Empty Catch Block: Empty catch blocks hide errors.ERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
frontend/src/components/SettingsPanel.tsx:298
· conf 1.00
[ERR002] Empty Catch Block: Empty catch blocks hide errors.ERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
frontend/src/components/TimelinePanel.tsx:93
· conf 1.00
[ERR002] Empty Catch Block: Empty catch blocks hide errors.JRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/settingsHandlers.ts:15
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/settingsHandlers.ts:17
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/settingsHandlers.ts:23
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/settingsHandlers.ts:25
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/settingsHandlers.ts:30
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/settingsHandlers.ts:31
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/settingsHandlers.ts:33
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/settingsHandlers.ts:39
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/updateHandlers.ts:6
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/wormholeHandlers.ts:25
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/wormholeHandlers.ts:27
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/wormholeHandlers.ts:29
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/wormholeHandlers.ts:31
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/wormholeHandlers.ts:35
· conf 0.74
Frontend API reference is not matched by discovered backend routesJRN003
Frontend API reference is not matched by discovered backend routes
desktop-shell/src/handlers/wormholeHandlers.ts:41
· conf 0.74
Frontend API reference is not matched by discovered backend routesSEC005
Command Injection Risk
frontend/src/components/MeshTerminal.tsx:4819
· conf 0.50
[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input.SEC007
Unsafe Deserialization
backend/services/infonet/governance/dsl_executor.py:204
· conf 1.00
[SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.SEC012
ZipSlip — Archive Path Traversal
backend/services/tor_hidden_service.py:112
· conf 1.00
[SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation allows writing files outside the target directory.SEC012
ZipSlip — Archive Path Traversal
backend/services/updater.py:228
· conf 1.00
[SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation allows writing files outside the target directory.SEC015
Insecure Randomness for Security
backend/services/privacy_core_client.py:387
· conf 1.00
[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.SEC015
Insecure Randomness for Security
frontend/src/components/InfonetTerminal/ExchangeView.tsx:361
· conf 1.00
[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
frontend/src/components/InfonetTerminal/MarketView.tsx:380
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
frontend/src/components/MaplibreViewer.tsx:5930
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
frontend/src/components/PredictionsPanel.tsx:444
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC045
eval()/exec() on stored or user-supplied data
backend/services/infonet/governance/dsl_executor.py:193
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC045
eval()/exec() on stored or user-supplied data
desktop-shell/src/handlers/settingsHandlers.ts:15
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC045
eval()/exec() on stored or user-supplied data
desktop-shell/src/handlers/updateHandlers.ts:6
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC087
JS: weak Math.random for crypto
frontend/src/components/InfonetTerminal/ExchangeView.tsx:205
· conf 1.00
[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…SEC087
JS: weak Math.random for crypto
frontend/src/components/InfonetTerminal/MessagesView.tsx:202
· conf 1.00
[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…SEC087
JS: weak Math.random for crypto
frontend/src/components/MeshTerminal.tsx:2143
· conf 1.00
[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…SEC119
World-writable / world-readable file permissions
backend/services/tor_hidden_service.py:202
· conf 1.00
[SEC119] World-writable / world-readable file permissions: World-writable files let any local user (or container neighbor) tamper with data; world-readable files leak secrets.SEC119
World-writable / world-readable file permissions
backend/services/updater.py:307
· conf 1.00
[SEC119] World-writable / world-readable file permissions: World-writable files let any local user (or container neighbor) tamper with data; world-readable files leak secrets.SEC127
AI agent stub — TODO: implement / pass placeholder body
backend/services/infonet/privacy/dex.py:36
· conf 1.00
[SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as TODO/pass/raise NotImplementedError after an AI scaffolding pass. The route appears to exist (and may even pass…SEC127
AI agent stub — TODO: implement / pass placeholder body
backend/services/infonet/privacy/ringct.py:61
· conf 1.00
[SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as TODO/pass/raise NotImplementedError after an AI scaffolding pass. The route appears to exist (and may even pass…SEC127
AI agent stub — TODO: implement / pass placeholder body
backend/services/infonet/privacy/shielded_balance.py:33
· conf 1.00
[SEC127] AI agent stub — TODO: implement / pass placeholder body: Function body left as TODO/pass/raise NotImplementedError after an AI scaffolding pass. The route appears to exist (and may even pass…SEC136
AI-typical over-broad exception handler swallowing all errors
backend/main.py:2818
· conf 1.00
[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unf…SEC136
AI-typical over-broad exception handler swallowing all errors
backend/routers/mesh_public.py:442
· conf 1.00
[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unf…SEC136
AI-typical over-broad exception handler swallowing all errors
backend/services/fetchers/earth_observation.py:952
· conf 1.00
[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unf…AIC003
Duplicated implementation block across source files
backend/routers/tools.py:12
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
backend/services/infonet/gates/shutdown/__init__.py:13
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
backend/services/infonet/governance/upgrade_hash.py:29
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
backend/services/infonet/schema.py:36
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
backend/services/privacy_core_client.py:493
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
backend/services/tinygs_fetcher.py:135
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
frontend/src/components/InfonetTerminal/MarketView.tsx:203
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
frontend/src/components/InfonetTerminal/UpgradeView.tsx:138
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
frontend/src/components/map/hooks/useDynamicMapLayersWorker.ts:8
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
frontend/src/components/map/staticMapLayers.worker.ts:117
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
frontend/src/components/SarModeChooserModal.tsx:137
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
frontend/src/components/WorldviewRightPanel.tsx:57
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
frontend/src/mesh/meshDmRatchet.ts:186
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
frontend/src/mesh/meshDmWorkerVault.ts:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
frontend/src/mesh/meshGateLocalRuntime.ts:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
frontend/src/mesh/meshGateWorkerVault.ts:31
· conf 0.86
Duplicated implementation block across source filesCOMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
backend/routers/admin.py:171
· conf 0.95
[COMP001] High cognitive complexity: Function `api_set_meshtastic_mqtt_settings` has cognitive complexity 11 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to…DKC006
Compose service does not declare a runtime user
docker-compose.yml:9
· conf 0.56
Compose service does not declare a runtime userDKC006
Compose service does not declare a runtime user
docker-compose.yml:60
· conf 0.56
Compose service does not declare a runtime userDKC010
Compose service lacks no-new-privileges hardening
docker-compose.yml:9
· conf 0.62
Compose service lacks no-new-privileges hardeningDKC010
Compose service lacks no-new-privileges hardening
docker-compose.yml:60
· conf 0.62
Compose service lacks no-new-privileges hardeningDKR008
.dockerignore misses sensitive defaults
.dockerignore
· conf 0.72
.dockerignore misses sensitive defaultsMINED043
Http Not Https
CWE-319
backend/main.py:2245
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED043
Http Not Https
CWE-319
backend/routers/cctv.py:123
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED043
Http Not Https
CWE-319
backend/routers/tools.py:206
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED044
Js Console Log Prod
CWE-532
backend/ais_proxy.js:8
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
desktop-shell/src/nativeControlRouter.ts:91
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
desktop-shell/tauri-skeleton/scripts/build-backend-runtime.cjs:104
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED045
Ts Non Null Assertion
CWE-476
desktop-shell/src/nativeControlRouter.ts:52
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
frontend/src/app/page.tsx:751
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED045
Ts Non Null Assertion
CWE-476
frontend/src/components/InfonetTerminal/ExchangeView.tsx:57
· conf 1.00
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.MINED047
Emoji In Source
backend/main.py:1425
· conf 1.00
[MINED047] Emoji In Source: Emoji ✅ ❌ 🚀 in code/comments — common AI output unless explicitly requested.MINED047
Emoji In Source
backend/services/env_check.py:342
· conf 1.00
[MINED047] Emoji In Source: Emoji ✅ ❌ 🚀 in code/comments — common AI output unless explicitly requested.MINED047
Emoji In Source
backend/services/sigint_bridge.py:632
· conf 1.00
[MINED047] Emoji In Source: Emoji ✅ ❌ 🚀 in code/comments — common AI output unless explicitly requested.MINED049
Print Pii
CWE-532
backend/scripts/rotate_secure_storage_secret.py:46
· conf 1.00
[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.MINED050
Stub Only Function
CWE-1188
backend/auth.py:461
· conf 1.00
[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.MINED050
Stub Only Function
CWE-1188
backend/main.py:1193
· conf 1.00
[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.MINED050
Stub Only Function
CWE-1188
backend/routers/ai_intel.py:2686
· conf 1.00
[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.MINED052
Ts Any Typed
CWE-704
frontend/src/components/AIIntelPanel.tsx:1631
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED052
Ts Any Typed
CWE-704
frontend/src/components/MaplibreViewer.tsx:791
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED052
Ts Any Typed
CWE-704
frontend/src/components/NewsFeed.tsx:382
· conf 1.00
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.MINED053
Placeholder Default Username
CWE-1392CWE-798
backend/services/env_check.py:185
· conf 1.00
[MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin / changeme — typical AI placeholder credentials.MINED053
Placeholder Default Username
CWE-1392CWE-798
backend/services/fetchers/earth_observation.py:705
· conf 1.00
[MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin / changeme — typical AI placeholder credentials.MINED053
Placeholder Default Username
CWE-1392CWE-798
desktop-shell/tauri-skeleton/src-tauri/src/backend_runtime.rs:416
· conf 1.00
[MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin / changeme — typical AI placeholder credentials.MINED054
Ts As Any
CWE-704
frontend/src/components/MaplibreViewer.tsx:5764
· conf 1.00
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.MINED055
Npm Install No Lockfile
CWE-1357
meshnode.sh:37
· conf 1.00
[MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versions on every build) instead of npm ci.MINED055
Npm Install No Lockfile
CWE-1357
wormhole-start.sh:36
· conf 1.00
[MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versions on every build) instead of npm ci.MINED056
React Key As Index
CWE-682
frontend/src/app/LocateBar.tsx:223
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
frontend/src/components/AIIntelPanel.tsx:1632
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
frontend/src/components/ChangelogModal.tsx:322
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED059
Rust Expect In Prod
CWE-755
desktop-shell/tauri-skeleton/src-tauri/src/companion_server.rs:280
· conf 1.00
[MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message.MINED059
Rust Expect In Prod
CWE-755
desktop-shell/tauri-skeleton/src-tauri/src/gate_crypto.rs:1104
· conf 1.00
[MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message.MINED059
Rust Expect In Prod
CWE-755
desktop-shell/tauri-skeleton/src-tauri/src/main.rs:543
· conf 1.00
[MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message.MINED062
Python Dataclass No Fields
backend/services/infonet/gates/sacrifice.py:80
· conf 1.00
[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.MINED062
Python Dataclass No Fields
backend/services/infonet/gates/shutdown/shutdown.py:42
· conf 1.00
[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.MINED062
Python Dataclass No Fields
backend/services/infonet/gates/shutdown/suspend.py:34
· conf 1.00
[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.MINED063
Toctou Os Path Exists
CWE-367
backend/services/ai_pin_store.py:89
· conf 1.00
[MINED063] Toctou Os Path Exists: if os.path.exists(p): open(p) — file can be replaced/deleted between check and use.MINED063
Toctou Os Path Exists
CWE-367
backend/services/analysis_zone_store.py:67
· conf 1.00
[MINED063] Toctou Os Path Exists: if os.path.exists(p): open(p) — file can be replaced/deleted between check and use.MINED063
Toctou Os Path Exists
CWE-367
backend/services/stix_exporter.py:396
· conf 1.00
[MINED063] Toctou Os Path Exists: if os.path.exists(p): open(p) — file can be replaced/deleted between check and use.MINED065
Cors Wildcard
CWE-942CWE-346
backend/main.py:168
· conf 1.00
[MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser origin. Acceptable for public read-only endpoints; dangerous when paired with credentials or write endpoints.MINED065
Cors Wildcard
CWE-942CWE-346
backend/services/config.py:24
· conf 1.00
[MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser origin. Acceptable for public read-only endpoints; dangerous when paired with credentials or write endpoints.MINED065
Cors Wildcard
CWE-942CWE-346
backend/services/wormhole_supervisor.py:65
· conf 1.00
[MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser origin. Acceptable for public read-only endpoints; dangerous when paired with credentials or write endpoints.MINED066
Rust Panic Macro
CWE-755
desktop-shell/tauri-skeleton/src-tauri/src/policy.rs:363
· conf 1.00
[MINED066] Rust Panic Macro: panic!() unwinds the stack. Use Result for recoverable errors.MINED067
Python Requests No Timeout
CWE-400
backend/services/cctv_pipeline.py:633
· conf 1.00
[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.MINED067
Python Requests No Timeout
CWE-400
backend/services/feed_ingester.py:157
· conf 1.00
[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.MINED067
Python Requests No Timeout
CWE-400
backend/services/fetchers/aircraft_database.py:48
· conf 1.00
[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.MINED068
Rust Unsafe Block
CWE-119
desktop-shell/tauri-skeleton/src-tauri/src/local_custody.rs:412
· conf 1.00
[MINED068] Rust Unsafe Block: unsafe { ... } block. Compiler safety guarantees disabled inside.MINED068
Rust Unsafe Block
CWE-119
privacy-core/src/lib.rs:235
· conf 1.00
[MINED068] Rust Unsafe Block: unsafe { ... } block. Compiler safety guarantees disabled inside.MINED072
Python Pass Only Class
CWE-1188
backend/services/mesh/mesh_peer_store.py:24
· conf 1.00
[MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in.MINED072
Python Pass Only Class
CWE-1188
backend/services/mesh/mesh_signed_events.py:215
· conf 1.00
[MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in.MINED077
Python Open No Context
CWE-772
backend/services/wormhole_supervisor.py:483
· conf 1.00
[MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles.Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/ace85012-9f8f-420e-9261-5db673c5b483/.