← Legacy view v2 (rp.*)

vivekchand/clawmetry

https://github.com/vivekchand/clawmetry · lang: python · source: corpus_mined

Quality

71.7

Grade B

Security

40.7

Findings

0 critical · 3 high

Status

completed

May 15, 2026 08:40

high: 3 low: 2 info: 1

Top rules by occurrence

Rule	Severity	Count
`SEC004` SQL Injection Risk	high	3
`SEC006` XSS Risk	high	2
`SEC020` Secret Printed to Logs	high	1

First 6 findings (severity-sorted)

high SEC004 SQL Injection Risk

clawmetry/adapters/hermes.py:212 · conf 1.00

[SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection.

high SEC004 SQL Injection Risk

history.py:239 · conf 0.50

[SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection.

high SEC020 Secret Printed to Logs

clawmetry/cli.py:586 · conf 0.92

[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…

low SEC006 XSS Risk

clawmetry/static/js/alerts.js:155 · conf 0.40

[SEC006] XSS Risk: Direct HTML injection without sanitization.

low SEC006 XSS Risk

dashboard_claudecode.py:1097 · conf 0.40

[SEC006] XSS Risk: Direct HTML injection without sanitization.

info SEC004 SQL Injection Risk

routes/alerts.py:367 · conf 0.10

[SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection.

Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/b8d6d8db-1a9e-4d5e-8189-6d0592eb62cf/.