Leaderboard github.com
JuliusBrussee/caveman
🪨 why use many token when few token do trick. Viral skill + proxy for coding agents that cuts 65% of tokens by talking like a caveman.
AI provenance
95%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
71/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
54/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
95% explicit
Explicit AI attribution on 95% of first-party code added; an estimated 95% including velocity signals.
How the score is built
- Explicitly attributed share95%
- Unattributed share in AI-pace bursts2%
- Estimated AI-generated share95%
- AI tool configuration files30
- Work sessions at AI pace24
- Releases at AI pace4
- Coding-style index (1.0+ means possible)0.28
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 1,462 | 447,920 | 2026-04-04 | 2026-11-13 |
| OpenAI Codex | 34 | 3,770 | 2026-08-05 | 2026-08-29 |
| Cursor agent | 6 | 2,459 | 2026-08-18 | 2026-10-27 |
| GitHub Copilot coding agent | 1 | 1 | 2026-11-05 | 2026-11-05 |
Lines added per month all AI-attributed share
- 2026-047,643 · 56% AI
- 2026-054,554 · 34% AI
- 2026-062,117 · 78% AI
- 2026-073,577 · 72% AI
- 2026-08247,093 · 95% AI
- 2026-09117,926 · 97% AI
- 2026-1086,490 · 99% AI
- 2026-117,872 · 97% AI
Findings in AI-attributed lines vs the rest
From git blame: 145,193 lines trace to AI-attributed commits, 5,658 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 1.11 | 2.47 | 0.45× |
| Security | 1.75 | 8.13 | 0.22× |
Evidence by analyzer
Explicit AI attributionok29 items
- Claude Code: 1462 attributed commits, 447,920 lines added
- OpenAI Codex: 34 attributed commits, 3,770 lines added
- Cursor agent: 6 attributed commits, 2,459 lines added
- GitHub Copilot coding agent: 1 attributed commits, 1 lines added
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: author email [email protected]
- Claude Code: committer email [email protected]
- Claude Code: author email [email protected]
- Claude Code: committer email [email protected]
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: on merged branch (6852cf1fb4)
- Claude Code: on merged branch (46d3d8802f)
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- attributed_commit_share
- 84.8%
- attributed_commits
- 1,502
- attributed_loc
- 452,841
- attributed_loc_share
- 94.9%
- commits
- 1,771
- effective_loc
- 477,272
- tools_detected
- 4
AI tool configurationok30 items
- CLAUDE.md (claude-code configuration)
- browse/CLAUDE.md (claude-code configuration)
- engine/CLAUDE.md (claude-code configuration)
- extension/CLAUDE.md (claude-code configuration)
- integrations/CLAUDE.md (claude-code configuration)
- mcp/CLAUDE.md (claude-code configuration)
- mem/CLAUDE.md (claude-code configuration)
- packages/cli/CLAUDE.md (claude-code configuration)
- packages/sdk/parity/CLAUDE.md (claude-code configuration)
- packages/sdk/python/CLAUDE.md (claude-code configuration)
- packages/sdk/typescript/CLAUDE.md (claude-code configuration)
- packages/shared/contracts/CLAUDE.md (claude-code configuration)
- proxy/CLAUDE.md (claude-code configuration)
- shared/provider-catalog/CLAUDE.md (claude-code configuration)
- shrink/CLAUDE.md (claude-code configuration)
- skills/caveman-learn/CLAUDE.md (claude-code configuration)
- AGENTS.md (generic-agent configuration)
- engine/AGENTS.md (generic-agent configuration)
- extension/AGENTS.md (generic-agent configuration)
- mcp/AGENTS.md (generic-agent configuration)
- mem/AGENTS.md (generic-agent configuration)
- packages/cli/AGENTS.md (generic-agent configuration)
- packages/sdk/parity/AGENTS.md (generic-agent configuration)
- packages/sdk/python/AGENTS.md (generic-agent configuration)
- packages/sdk/typescript/AGENTS.md (generic-agent configuration)
- packages/shared/contracts/AGENTS.md (generic-agent configuration)
- proxy/AGENTS.md (generic-agent configuration)
- shared/provider-catalog/AGENTS.md (generic-agent configuration)
- shrink/AGENTS.md (generic-agent configuration)
- GEMINI.md (gemini configuration)
- artifacts
- 30
- earliest_adoption
- 2026-04-11
- tools_configured
- 3
- workflow_agents
- 0
Commit velocityok15 items
- 13,895 lines of first-party code in ~0.7h (18,623 lines/hour, 37 commit session)
- 3,258 lines of first-party code in ~0.6h (5,445 lines/hour, 6 commit session)
- 7,971 lines of first-party code in ~2.0h (4,079 lines/hour, 6 commit session)
- 5,192 lines of first-party code in ~1.6h (3,177 lines/hour, 4 commit session)
- 19,752 lines of first-party code in ~8.7h (2,272 lines/hour, 48 commit session)
- 1,680 lines of first-party code in ~0.8h (2,149 lines/hour, 1 commit session)
- 2,360 lines of first-party code in ~1.3h (1,776 lines/hour, 8 commit session)
- 3,894 lines of first-party code in ~2.4h (1,621 lines/hour, 15 commit session)
- 17,291 lines of first-party code in ~11.2h (1,539 lines/hour, 161 commit session)
- 6,309 lines of first-party code in ~4.3h (1,468 lines/hour, 5 commit session)
- 5,828 lines of first-party code in ~4.0h (1,443 lines/hour, 27 commit session)
- 2,403 lines of first-party code in ~1.8h (1,345 lines/hour, 3 commit session)
- 5,152 lines of first-party code in ~4.0h (1,279 lines/hour, 12 commit session)
- 5,571 lines of first-party code in ~5.0h (1,122 lines/hour, 21 commit session)
- 2,603 lines of first-party code in ~2.4h (1,101 lines/hour, 27 commit session)
- excluded_import_loc
- 260,290
- flagged_loc
- 134,493
- flagged_loc_share
- 62.0%
- flagged_units
- 24
- max_loc_per_hour
- 18,623.23
- measured_loc
- 216,982
- median_loc_per_hour
- 75.64
- pr_timed_units
- 24
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 347
Release velocityok4 items
- cli-v1.2.2 → bin-v1.1.2: 6,349 lines in 1.54 days (4,126.5 lines/day)
- sdk-python-v1.2.0 → v3.1.0: 6,484 lines in 2.09 days (3,096.8 lines/day)
- cli-v2.0.1 → bin-v2.1.0: 17,056 lines in 4.93 days (3,456.6 lines/day)
- cli-v2.1.0 → bin-v4.0.0: 57,589 lines in 5.45 days (10,567.6 lines/day)
- flagged_releases
- 4
- max_loc_per_day
- 29,952.60
- releases
- 84
Coding styleok6 items
- step-by-step narration comment: # Step 1: Compress (body only, frontmatter excluded)
- step-by-step narration comment: # Step 2: Validate + Retry. Each candidate is staged and validated next
- step-by-step narration comment: // first, so this mount cannot be used as a route oracle (see Server.proxy).
- step-by-step narration comment: // first, then consult the GET-only metadata allowlist.
- step-by-step narration comment: # Step 1: Compress (body only, frontmatter excluded)
- step-by-step narration comment: # Step 2: Validate + Retry. Each candidate is staged and validated next
- count:assistant_voice
- 0
- count:emoji_in_code
- 73
- count:narrated_steps
- 6
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 14
- files:narrated_steps
- 4
- files:placeholder
- 0
- index
- 0.28
- lines_scanned
- 150,851
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.48
- per_kloc:narrated_steps
- 0.04
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 145,193
- blame_failures
- 0
- files_blamed
- 523
- other_lines
- 5,658
- quality:ai_findings
- 161
- quality:ai_per_kloc
- 1.11
- quality:other_findings
- 14
- quality:other_per_kloc
- 2.47
- quality:ratio
- 0.45
- security:ai_findings
- 254
- security:ai_per_kloc
- 1.75
- security:other_findings
- 46
- security:other_per_kloc
- 8.13
- security:ratio
- 0.22
Code quality
71 adequate
Code quality is adequate: test-to-source ratio 1.16, CI runs tests; 28% of function code in complex or long functions; 7% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity44
- Duplication67
- Lint and smells76
- Tests and CI100
- Documentation80
- Type safety27
- Review process63
Evidence by analyzer
Complexity (lizard)ok10 items
- proxy in proxy/internal/gateway/proxy.go: complexity 266, 711 lines
- uninstall in installer/install.js: complexity 161, 378 lines
- onboard in packages/cli/src/modules/onboard.ts: complexity 82, 147 lines
- leaves in packages/middleware/python/caveman_middleware/_native.py: complexity 80, 89 lines
- TransformAnthropic in engine/pixel/transform_anthropic.go: complexity 78, 333 lines
- chatGPTAuto in proxy/internal/gateway/chatgpt_auto.go: complexity 77, 189 lines
- BuildStatsReport in proxy/internal/store/stats.go: complexity 76, 209 lines
- optimize in packages/sdk/python/caveman_cloud/middleware/runtime.py: complexity 75, 137 lines
- checkPlan in packages/sdk/typescript/src/middleware/validate.ts: complexity 74, 39 lines
- compatForRoutedModel in packages/pi-extension/src/provider-compat.ts: complexity 73, 46 lines
- complex_functions
- 415
- function_nloc
- 98,061
- functions
- 7,572
- long_functions
- 59
- many_param_functions
- 46
- mean_ccn
- 4.94
- p90_ccn
- 11
- risky_nloc_share
- 27.5%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: .codex/codex-sessionstart.js:83 and src/hooks/caveman-activate.js:99
- 6+ duplicated lines: agents/compile.mjs:19 and integrations/compile.mjs:28
- 6+ duplicated lines: agents/delegate/portable-process.mjs:17 and packages/subagent-tax/lib/process-tree.mjs:13
- 6+ duplicated lines: agents/delegate/portable-process.mjs:39 and installer/lib/portable-process.js:36
- 6+ duplicated lines: agents/delegate/portable-process.mjs:75 and packages/cli/src/portable-command.ts:49
- 6+ duplicated lines: benchmarks/run.py:14 and evals/llm_run.py:67
- 6+ duplicated lines: browse/bin/caveman-browse.mjs:25 and mcp/bin/caveman-mcp.mjs:25
- 6+ duplicated lines: browse/cdp.go:165 and browse/cdp.go:177
- 6+ duplicated lines: browse/cmd/caveman-browse/main.go:14 and proxy/internal/runstate/runstate.go:17
- 6+ duplicated lines: browse/cmd/caveman-browse/main.go:108 and mcp/cmd/caveman-mcp/main.go:73
- compared_lines
- 115,584
- duplicated_lines
- 7,730
- duplicated_share
- 6.7%
- files
- 523
Lintok
- category:best-practice
- 13
- category:correctness
- 141
- category:maintainability
- 21
- findings
- 175
- scanned_lines
- 148,410
- weighted_findings
- 163.75
Tests and CIok12 items
- CI config: .github/workflows/agent-conformance.yml
.github/workflows/agent-conformance.yml - CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/codeql.yml
.github/workflows/codeql.yml - CI config: .github/workflows/docs-links.yml
.github/workflows/docs-links.yml - CI config: .github/workflows/engine-ci.yml
.github/workflows/engine-ci.yml - CI config: .github/workflows/middleware-canary.yml
.github/workflows/middleware-canary.yml - CI config: .github/workflows/middleware-conformance.yml
.github/workflows/middleware-conformance.yml - CI config: .github/workflows/middleware-python.yml
.github/workflows/middleware-python.yml - CI config: .github/workflows/profiles.yml
.github/workflows/profiles.yml - CI config: .github/workflows/provider-catalog.yml
.github/workflows/provider-catalog.yml - CI runs tests (pytest, npm test, npm run test, go test, unittest)
- CI runs linters (pyright, go vet)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- yes
- ci_files
- 17
- cochange_commits
- 189
- cochange_share
- 86.8%
- source_lines
- 150,851
- test_lines
- 174,281
- test_ratio
- 1.16
Documentationok3 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 265
Type safetyok1 item
- TypeScript strict type checking: packages/pi-extension/tsconfig.json
packages/pi-extension/tsconfig.json
- check:low_escape_density
- no
- check:strict_config
- no
- escapes
- 221
- escapes_per_kloc
- 6.84
Security
54 weak
Security posture is weak: 65 known vulnerabilities in 12 dependencies; 27 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: dependencies.
How the score is built
- Secrets48
- Static analysis (SAST)69
- Vulnerable dependencies31
- CI workflows39
- Security posture100
- OpenSSF Scorecard68
Evidence by analyzer
OpenSSF Scorecardok18 items
- Scorecard Maintained: 10/10 (30 commit(s) and 25 issue activity found in the last 90 days -- score normalized to 10)
- Scorecard Security-Policy: 10/10 (security policy file detected)
- Scorecard Code-Review: 1/10 (Found 2/16 approved changesets -- score normalized to 1)
- Scorecard Dependency-Update-Tool: 10/10 (update tool detected)
- Scorecard Dangerous-Workflow: 10/10 (no dangerous workflow patterns detected)
- Scorecard Token-Permissions: 9/10 (detected GitHub workflow tokens with excessive permissions)
- Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)
- Scorecard Pinned-Dependencies: 6/10 (dependency not pinned by hash detected -- score normalized to 6)
- Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)
- Scorecard Signed-Releases: 0/10 (Project has not signed or included provenance with any releases.)
- Scorecard Fuzzing: 10/10 (project is fuzzed)
- Scorecard Vulnerabilities: 0/10 (57 existing vulnerabilities detected)
- Scorecard Packaging: 10/10 (packaging workflow detected)
- Scorecard License: 10/10 (license file detected)
- Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)
- Scorecard SAST: 9/10 (SAST tool detected but not run on all commits)
- Scorecard CI-Tests: 8/10 (13 out of 15 merged PRs checked by a CI test -- score normalized to 8)
- Scorecard Contributors: 10/10 (project has 8 contributing companies or organizations)
- aggregate
- 6.60
- check:Binary-Artifacts
- yes
- check:Branch-Protection
- no
- check:CI-Tests
- yes
- check:CII-Best-Practices
- no
- check:Code-Review
- yes
- check:Contributors
- yes
- check:Dangerous-Workflow
- yes
- check:Dependency-Update-Tool
- yes
- check:Fuzzing
- yes
- check:License
- yes
- check:Maintained
- yes
- check:Packaging
- yes
- check:Pinned-Dependencies
- yes
- check:SAST
- yes
- check:Security-Policy
- yes
- check:Signed-Releases
- no
- check:Token-Permissions
- yes
- check:Vulnerabilities
- no
Package registriesok
- checked
- 38
- declared
- 38
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 22
Static analysis (opengrep)ok
- findings
- 565
- findings_high
- 27
- findings_low
- 2
- findings_medium
- 536
- parse_errors
- 3
- scanned_lines
- 148,410
- weighted_findings
- 158.22
Dependencies (osv-scanner)ok
- penalty
- 71
- vulnerabilities
- 65
- vulnerable_packages
- 12
- vulns_critical
- 0
- vulns_high
- 21
- vulns_low
- 6
- vulns_medium
- 38
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 29
- findings_high
- 5
- findings_low
- 13
- findings_medium
- 11
- penalty
- 56.20
- workflows
- 17
Security postureok16 items
- Security policy: SECURITY.md
SECURITY.md - Dependency updates: .github/dependabot.yml
.github/dependabot.yml - browse/package.json has no lockfile alongside it (unpinned dependencies)
browse/package.json - mcp/package.json has no lockfile alongside it (unpinned dependencies)
mcp/package.json - mem/js/package.json has no lockfile alongside it (unpinned dependencies)
mem/js/package.json - packages/cli/package.json has no lockfile alongside it (unpinned dependencies)
packages/cli/package.json - packages/middleware/typescript/package.json has no lockfile alongside it (unpinned dependencies)
packages/middleware/typescript/package.json - packages/shared/contracts/package.json has no lockfile alongside it (unpinned dependencies)
packages/shared/contracts/package.json - packages/subagent-tax/package.json has no lockfile alongside it (unpinned dependencies)
packages/subagent-tax/package.json - shared/provider-catalog/package.json has no lockfile alongside it (unpinned dependencies)
shared/provider-catalog/package.json - shrink/package.json has no lockfile alongside it (unpinned dependencies)
shrink/package.json - skills/caveman-explore/package.json has no lockfile alongside it (unpinned dependencies)
skills/caveman-explore/package.json - skills/caveman-learn/package.json has no lockfile alongside it (unpinned dependencies)
skills/caveman-learn/package.json - src/hooks/package.json has no lockfile alongside it (unpinned dependencies)
src/hooks/package.json - src/mcp-servers/caveman-shrink/package.json has no lockfile alongside it (unpinned dependencies)
src/mcp-servers/caveman-shrink/package.json - src/plugins/opencode/package.json has no lockfile alongside it (unpinned dependencies)
src/plugins/opencode/package.json
- check:dependency_updates
- yes
- check:lockfiles
- no
- check:security_policy
- yes
- check:signed_commits
- yes
- signed_commit_share
- 97.0%
- unpinned_manifests
- 14
Release downloadsok5 items
- release v4.1.0 ships caveman-browser-1.3.0.zip (429 downloads)
- release v4.1.0 ships caveman-browser-firefox-1.3.0.zip (89 downloads)
- release bin-v4.1.0 ships THIRD_PARTY_GO_LICENSES.tar.gz (669 downloads)
- release bin-v4.0.2 ships THIRD_PARTY_GO_LICENSES.tar.gz (1248 downloads)
- release v4.0.1 ships caveman-browser-1.3.0.zip (1344 downloads)
- binary_assets
- 12
- signals
- 1
- suspicious
- 0
Findings
62 high449 medium78 low2 info
591 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
.blocks/release-smoke.py:124 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
benchmarks/run.py:135 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
benchmarks/run.py:318 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
packages/middleware/python/caveman_middleware/openai.py:171 | function `session_for` is defined inside a function but never used | Lint |
| high | opengrep/typescript.lang.correctness.useless-ternary |
packages/middleware/typescript/src/common.ts:152 | It looks like no matter how event === 'completed' is evaluated, this expression returns usage. This is probably a copy-paste error. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
plugins/caveman/skills/caveman-compress/scripts/compress.py:241 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
plugins/caveman/skills/caveman-compress/scripts/compress.py:777 | Using 'prompt_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'prompt_file.name' is used. Use '.flush()' or close the file before using 'prompt_file.name'. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
skills/caveman-compress/scripts/compress.py:241 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
skills/caveman-compress/scripts/compress.py:777 | Using 'prompt_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'prompt_file.name' is used. Use '.flush()' or close the file before using 'prompt_file.name'. | Lint |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
.blocks/release-smoke.py:111 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
.blocks/release-smoke.py:66 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | zizmor/cache-poisoning |
.github/workflows/release-binaries.yml:31 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release-binaries.yml:34 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release-packages.yml:186 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release-packages.yml:456 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release-packages.yml:52 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
browse/cmd/caveman-browse/main.go:305 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
browse/cmd/caveman-browse/main.go:342 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli |
engine/ccr/store_repair.go:127 | Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli |
engine/ccr/store_repair.go:156 | Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli |
engine/ccr/store_repair.go:580 | Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli |
engine/ccr/store_sqlite.go:551 | Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli |
engine/ccr/store_sqlite.go:562 | Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli |
engine/ccr/store_sqlite.go:565 | Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
evals/llm_run.py:152 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
evals/llm_run.py:153 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
evals/llm_run.py:166 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
evals/reminder_run.py:107 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
evals/reminder_run.py:108 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.audit.dangerous-spawn-shell |
installer/install.js:329 | Detected non-literal calls to child_process.spawnSync(). This could lead to a command injection vulnerability. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-child-process |
installer/install.js:468 | Detected calls to child_process from a function argument `args`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized... | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-child-process |
installer/install.js:468 | Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized... | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-child-process |
installer/install.js:468 | Detected calls to child_process from a function argument `opts`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized... | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-child-process |
installer/install.js:473 | Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized... | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-child-process |
installer/install.js:550 | Detected calls to child_process from a function argument `executable`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
mem/py/cavemem.py:39 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
plugins/caveman/skills/caveman-compress/scripts/compress.py:598 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
plugins/caveman/skills/caveman-compress/scripts/compress.py:703 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | osv/GHSA-27r3-jxmh-p828 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 | Dependencies (osv-scanner) |
| high | osv/GHSA-2883-xcg3-v3hh |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh | Dependencies (osv-scanner) |
| high | osv/GHSA-2m5v-pch6-74hx |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx | Dependencies (osv-scanner) |
| high | osv/GHSA-2m5v-pch6-74hx |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx | Dependencies (osv-scanner) |
| high | osv/GHSA-46jr-4wx8-v453 |
pnpm-lock.yaml | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-46jr-4wx8-v453 | Dependencies (osv-scanner) |
| high | osv/GHSA-4w7w-5xrc-9h26 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26 | Dependencies (osv-scanner) |
| high | osv/GHSA-4w7w-5xrc-9h26 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26 | Dependencies (osv-scanner) |
| high | osv/GHSA-5jgf-p345-68v8 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-5jgf-p345-68v8 | Dependencies (osv-scanner) |
| high | osv/GHSA-f65p-4m7j-42xc |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-f65p-4m7j-42xc | Dependencies (osv-scanner) |
| high | osv/GHSA-f897-62hf-6gxq |
pnpm-lock.yaml | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-f897-62hf-6gxq | Dependencies (osv-scanner) |
| high | osv/GHSA-fph4-wmhf-6fwf |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-fph4-wmhf-6fwf | Dependencies (osv-scanner) |
| high | osv/GHSA-jm63-cq47-j5jp |
pnpm-lock.yaml | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-jm63-cq47-j5jp | Dependencies (osv-scanner) |
| high | osv/GHSA-jqff-g426-hqxp |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-jqff-g426-hqxp | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm | Dependencies (osv-scanner) |
| high | osv/GHSA-qw65-cvwx-89v3 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-qw65-cvwx-89v3 | Dependencies (osv-scanner) |
| high | osv/GHSA-rfgv-xxqx-mfg5 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-rfgv-xxqx-mfg5 | Dependencies (osv-scanner) |
| high | osv/GHSA-w293-vg96-wgc3 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-w293-vg96-wgc3 | Dependencies (osv-scanner) |
| high | osv/GHSA-xjj6-f33q-929c |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-xjj6-f33q-929c | Dependencies (osv-scanner) |
| high | osv/GHSA-xjj6-f33q-929c |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-xjj6-f33q-929c | Dependencies (osv-scanner) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
proxy/internal/nativehook/hook.go:399 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
skills/caveman-compress/scripts/compress.py:598 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
skills/caveman-compress/scripts/compress.py:703 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
.github/scripts/verify-codex-route.mjs:83 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
benchmarks/render_charts.py:113 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
benchmarks/render_charts.py:148 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
browse/cmd/caveman-browse/main.go:122 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
browse/cmd/caveman-browse/main.go:321 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
browse/cmd/caveman-browse/main.go:454 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
engine/cmd/caveman-engine/main.go:779 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
evals/plot.py:134 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
extension/scripts/firefox-e2e.mjs:235 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
installer/install.js:2094 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
installer/lib/owned-install.js:23 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
mcp/cmd/caveman-mcp/main.go:85 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
mem/store.go:101 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
packages/cli/src/modules/onboard.ts:287 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/cli/src/modules/provider-logins.ts:133 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/cli/src/modules/provider-logins.ts:133 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
packages/middleware/python/caveman_middleware/_httpx2.py:194 | Is "is_stream_consumed" a function or an attribute? If it is a function, you may have meant response.is_stream_consumed() because response.is_stream_consumed is always true. | Lint |
| medium | opengrep/python.lang.correctness.cannot-cache-generators |
packages/middleware/python/caveman_middleware/_httpx2.py:26 | Generators can only be consumed once, so in most cases, caching them will cause an error when the already-consumed generator is retrieved from cache. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
packages/middleware/python/caveman_middleware/_native.py:291 | Is "is_registered" a function or an attribute? If it is a function, you may have meant self.is_registered() because self.is_registered is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
packages/middleware/python/caveman_middleware/_native.py:298 | Is "is_registered" a function or an attribute? If it is a function, you may have meant self.is_registered() because self.is_registered is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
packages/middleware/python/caveman_middleware/autogen.py:266 | Is "is_error" a function or an attribute? If it is a function, you may have meant result.is_error() because result.is_error is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
packages/middleware/python/caveman_middleware/crewai.py:156 | Is "is_litellm" a function or an attribute? If it is a function, you may have meant delegate.is_litellm() because delegate.is_litellm is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
packages/middleware/python/caveman_middleware/crewai.py:331 | Is "is_litellm" a function or an attribute? If it is a function, you may have meant self.delegate.is_litellm() because self.delegate.is_litellm is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
packages/middleware/python/caveman_middleware/llama_index.py:221 | Is "is_error" a function or an attribute? If it is a function, you may have meant result.is_error() because result.is_error is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
packages/middleware/python/caveman_middleware/llama_index.py:752 | Is "is_error" a function or an attribute? If it is a function, you may have meant result.tool_output.is_error() because result.tool_output.is_error is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
packages/middleware/python/caveman_middleware/mcp.py:110 | Is "is_error" a function or an attribute? If it is a function, you may have meant result.is_error() because result.is_error is always true. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/google.ts:132 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/google.ts:64 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/langchain-model.ts:89 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/langchain-model.ts:92 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/langchain-model.ts:92 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/langchain-model.ts:94 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/mcp.ts:111 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/mcp.ts:111 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/strands.ts:121 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/strands.ts:75 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/strands.ts:75 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/strands.ts:76 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/strands.ts:77 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/middleware/typescript/src/strands.ts:78 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
packages/sdk/python/caveman_cloud/core.py:359 | `return` only makes sense inside a function | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1147 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1695 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1697 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1698 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1704 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1706 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1707 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1707 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1712 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1712 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1713 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1716 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1716 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1717 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1717 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1718 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1718 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1776 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1776 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1779 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1781 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1787 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1791 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1792 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1793 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/index.ts:1794 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/middleware/runtime.ts:510 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/middleware/runtime.ts:510 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/middleware/runtime.ts:511 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/middleware/runtime.ts:511 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/middleware/runtime.ts:511 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/sdk/typescript/src/middleware/runtime.ts:511 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/shared/contracts/conformance/run.mjs:255 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/shared/contracts/scripts/validate-schemas.mjs:201 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/shared/contracts/scripts/validate-schemas.mjs:201 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/shared/contracts/scripts/validate-schemas.mjs:82 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/shared/contracts/scripts/validate-schemas.mjs:82 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/subagent-tax/lib/sink.mjs:112 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/subagent-tax/lib/sink.mjs:172 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/subagent-tax/lib/sink.mjs:215 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/subagent-tax/lib/sink.mjs:217 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/subagent-tax/lib/sink.mjs:274 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
plugins/caveman/skills/caveman-compress/scripts/benchmark.py:34 | Is "is_valid" a function or an attribute? If it is a function, you may have meant result.is_valid() because result.is_valid is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
plugins/caveman/skills/caveman-compress/scripts/compress.py:1273 | Is "is_valid" a function or an attribute? If it is a function, you may have meant result.is_valid() because result.is_valid is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
plugins/caveman/skills/caveman-compress/scripts/validate.py:430 | Is "is_valid" a function or an attribute? If it is a function, you may have meant res.is_valid() because res.is_valid is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
plugins/caveman/skills/caveman-compress/scripts/validate.py:45 | Is "is_valid" a function or an attribute? If it is a function, you may have meant self.is_valid() because self.is_valid is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
plugins/caveman/skills/caveman-compress/scripts/validate.py:50 | Is "is_valid" a function or an attribute? If it is a function, you may have meant self.is_valid() because self.is_valid is always true. | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/cmd/caveman-proxy/learn_wire.go:80 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/cmd/caveman-proxy/main.go:1079 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/cmd/caveman-proxy/main.go:1188 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/cmd/caveman-proxy/main.go:1217 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/cmd/caveman-proxy/main.go:1349 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/cmd/caveman-proxy/recovery_store.go:39 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.best-practice.hidden-goroutine |
proxy/internal/cloudlink/warm.go:54 | Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'. | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/gateway/capture.go:83 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/nativehook/hook.go:368 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/nativeruntime/marker.go:31 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/nativeruntime/marker.go:34 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/nativeruntime/receipt.go:212 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/nativeruntime/receipt.go:215 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/nativeruntime/server_unix.go:46 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/nativeruntime/server_unix.go:49 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/pool/chatgpt.go:348 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/pool/pool.go:238 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/pool/pool.go:283 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/runstate/runstate.go:146 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/runstate/runstate.go:149 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/store/report.go:102 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/store/report.go:120 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/store/report.go:43 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/store/report.go:84 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/store/stats_report.go:25 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
proxy/internal/store/trial_store.go:570 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
shrink/shrink.go:91 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
skills/caveman-compress/scripts/benchmark.py:34 | Is "is_valid" a function or an attribute? If it is a function, you may have meant result.is_valid() because result.is_valid is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
skills/caveman-compress/scripts/compress.py:1273 | Is "is_valid" a function or an attribute? If it is a function, you may have meant result.is_valid() because result.is_valid is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
skills/caveman-compress/scripts/validate.py:430 | Is "is_valid" a function or an attribute? If it is a function, you may have meant res.is_valid() because res.is_valid is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
skills/caveman-compress/scripts/validate.py:45 | Is "is_valid" a function or an attribute? If it is a function, you may have meant self.is_valid() because self.is_valid is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
skills/caveman-compress/scripts/validate.py:50 | Is "is_valid" a function or an attribute? If it is a function, you may have meant self.is_valid() because self.is_valid is always true. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
skills/compile.mjs:287 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
src/hooks/caveman-activate.js:37 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
src/hooks/caveman-activate.js:47 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
src/hooks/caveman-host-session-start.js:29 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
src/hooks/caveman-mode-tracker.js:20 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
src/hooks/caveman-mode-tracker.js:29 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
src/tools/caveman-init.js:97 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
.blocks/release-smoke.py:116 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
.codex/codex-sessionstart.js:122 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
.codex/codex-sessionstart.js:125 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
.codex/codex-sessionstart.js:85 | Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
.codex/codex-sessionstart.js:87 | Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:15 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:30 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:42 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:5 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:83 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:173 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:223 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:24 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:99 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/profiles.yml:20 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/provider-catalog.yml:20 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
agents/drift-report.mjs:119 | Detected the use of a regular expression `^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
agents/drift-report.mjs:126 | Detected the use of a regular expression `^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
agents/drift-report.mjs:131 | Detected the use of a regular expression `^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
agents/drift-report.mjs:59 | Detected the use of a regular expression `^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
engine/ccr/sqlite_parent_security_windows.go:74 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.database.string-formatted-query |
engine/ccr/store_reclaim.go:198 | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.database.string-formatted-query |
engine/ccr/store_repair.go:127 | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
engine/ccr/store_repair.go:273 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
engine/ccr/store_repair.go:84 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.database.string-formatted-query |
engine/ccr/store_sqlite.go:551 | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.database.string-formatted-query |
engine/ccr/store_sqlite.go:562 | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.database.string-formatted-query |
engine/ccr/store_sqlite.go:565 | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
engine/pixel/internal/atlasgen/extract-atlas.mjs:28 | RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
engine/pixel/internal/atlasgen/extract-atlas.mjs:35 | RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1020 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1020 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1022 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1022 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1025 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1025 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1083 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1083 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1160 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1212 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1213 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
installer/install.js:1260 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1273 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1273 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1275 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1275 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1373 | Detected that function argument `root` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1424 | Detected that function argument `repoRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1424 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1436 | Detected that function argument `pluginDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1447 | Detected that function argument `pluginDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1447 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1448 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1448 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1449 | Detected that function argument `pluginDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1449 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1451 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1453 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1454 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1454 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1454 | Detected that function argument `pluginDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1454 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1457 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1458 | Detected that function argument `pluginDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1459 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1461 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1462 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1462 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1462 | Detected that function argument `pluginDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1462 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1465 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1466 | Detected that function argument `pluginDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1467 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1469 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1470 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1471 | Detected that function argument `pluginDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1471 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1471 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1475 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1476 | Detected that function argument `pluginDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1477 | Detected that function argument `pluginDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1477 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1541 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1542 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1543 | Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1544 | Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1590 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1591 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1591 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1594 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1594 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1595 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1595 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1597 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1597 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1599 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1599 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1606 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1609 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1609 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1622 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1623 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1626 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1635 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1654 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1820 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1821 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1822 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1827 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1829 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1837 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1842 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1852 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1853 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1857 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1858 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1898 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1906 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1906 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1922 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1922 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1923 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:1923 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1933 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1934 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1935 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1936 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:1979 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:2044 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2048 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2114 | Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2117 | Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2118 | Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2134 | Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2145 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2301 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2340 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2343 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2351 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2675 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2679 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2686 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2691 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2693 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2696 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:2706 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
installer/install.js:356 | RegExp() called with a `needle` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
installer/install.js:369 | RegExp() called with a `needle` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:375 | Detected that function argument `root` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
installer/install.js:381 | RegExp() called with a `needle` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:393 | Detected that function argument `root` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:395 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:395 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:405 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:407 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:439 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
installer/install.js:439 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:493 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:494 | Detected that function argument `configDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:574 | Detected that function argument `settingsPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:574 | Detected that function argument `settingsPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:574 | Detected that function argument `settingsPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:617 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:617 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:621 | Detected that function argument `ctx` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:641 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:683 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:686 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:741 | Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:741 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/install.js:82 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/install.js:953 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/cursor-native.js:108 | Detected that function argument `{ repoRoot, home = os.homedir(), node = process.execPath, withHooks = true, force = false, dryRun = false, note = () => {}, }` has entered the fs module. An attacker could potentially control the... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/cursor-native.js:108 | Detected that function argument `{ file, readonly }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/cursor-native.js:108 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/cursor-native.js:108 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/cursor-native.js:109 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/cursor-native.js:32 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/cursor-native.js:45 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/cursor-native.js:87 | Detected that function argument `root` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/cursor-native.js:96 | Detected that function argument `root` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/host-hooks.js:28 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/host-hooks.js:28 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/host-hooks.js:29 | Detected that function argument `source` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/host-hooks.js:29 | Detected that function argument `stage` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/host-hooks.js:29 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/host-hooks.js:31 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/host-hooks.js:32 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/host-hooks.js:38 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:100 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:100 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:102 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:103 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:103 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:106 | Detected that function argument `expectedStat` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:106 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:107 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:120 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:127 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:129 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:131 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:142 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:150 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:150 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
installer/lib/openclaw.js:184 | RegExp() called with a `key` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:216 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:249 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:364 | Detected that function argument `{ workspace, repoRoot, dryRun = false, force = false, log = noopLog(), version } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:370 | Detected that function argument `{ workspace, repoRoot, dryRun = false, force = false, log = noopLog(), version } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:373 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:374 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:375 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:379 | Detected that function argument `{ workspace, repoRoot, dryRun = false, force = false, log = noopLog(), version } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:384 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:396 | Detected that function argument `{ workspace, repoRoot, dryRun = false, force = false, log = noopLog(), version } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:398 | Detected that function argument `{ workspace, repoRoot, dryRun = false, force = false, log = noopLog(), version } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:41 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:423 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:424 | Detected that function argument `{ workspace, repoRoot, dryRun = false, force = false, log = noopLog(), version } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:425 | Detected that function argument `{ workspace, repoRoot, dryRun = false, force = false, log = noopLog(), version } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:433 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:434 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:436 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:440 | Detected that function argument `{ workspace, dryRun = false, log = noopLog() } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:445 | Detected that function argument `{ workspace, dryRun = false, log = noopLog() } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:446 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:46 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:477 | Detected that function argument `{ workspace, dryRun = false, log = noopLog() } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:477 | Detected that function argument `{ workspace, dryRun = false, log = noopLog() } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:65 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:72 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:74 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:76 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:80 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:87 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/openclaw.js:87 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:90 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:91 | Detected that function argument `expectedStat` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:91 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:92 | Detected that function argument `expectedStat` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:92 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:93 | Detected that function argument `expectedStat` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/openclaw.js:93 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:105 | Detected that function argument `journalPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:11 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:111 | Detected that function argument `journalPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:141 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:142 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:145 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:156 | Detected that function argument `dirs` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:156 | Detected that function argument `dirs` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:167 | Detected that function argument `backupRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:170 | Detected that function argument `backupRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:173 | Detected that function argument `backupRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:173 | Detected that function argument `relative` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:32 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:32 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:33 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:37 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:39 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:39 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:41 | Detected that function argument `relativePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:41 | Detected that function argument `root` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:49 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:54 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:54 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:54 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:59 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:72 | Detected that function argument `source` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:75 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:76 | Detected that function argument `source` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:76 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:76 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:76 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
installer/lib/owned-install.js:76 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:80 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:81 | Detected that function argument `source` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:81 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:85 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:89 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:92 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:93 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:93 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
installer/lib/owned-install.js:95 | Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | osv/GHSA-g3hv-75wg-m249 |
packages/pi-extension/package-lock.json | [email protected] (npm) is affected by GHSA-g3hv-75wg-m249; also in pnpm-lock.yaml | Dependencies (osv-scanner) |
| medium | osv/GHSA-2jfj-6hjv-fm6j |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-2jfj-6hjv-fm6j | Dependencies (osv-scanner) |
| medium | osv/GHSA-2vr4-cq9g-pvrc |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-2vr4-cq9g-pvrc | Dependencies (osv-scanner) |
| medium | osv/GHSA-3wwx-pv8p-q78v |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-3wwx-pv8p-q78v | Dependencies (osv-scanner) |
| medium | osv/GHSA-3xpg-4rpp-hhhm |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-3xpg-4rpp-hhhm | Dependencies (osv-scanner) |
| medium | osv/GHSA-46wx-v44x-9hh2 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-46wx-v44x-9hh2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4h7h-rv7c-7m2v |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4h7h-rv7c-7m2v | Dependencies (osv-scanner) |
| medium | osv/GHSA-4m76-xfj5-7975 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4m76-xfj5-7975 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4mjr-xmp4-gh2g |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4mjr-xmp4-gh2g | Dependencies (osv-scanner) |
| medium | osv/GHSA-4qv8-2p9j-2685 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4qv8-2p9j-2685 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4qv8-2p9j-2685 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4qv8-2p9j-2685 | Dependencies (osv-scanner) |
| medium | osv/GHSA-55wc-3pg8-jfw6 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-55wc-3pg8-jfw6 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-5r4p-p66f-jhc7 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-5r4p-p66f-jhc7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6pq8-jhm2-2vcw |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-6pq8-jhm2-2vcw | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fm3-97px-rjf6 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-9fm3-97px-rjf6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fm3-97px-rjf6 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-9fm3-97px-rjf6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-crvj-82cr-hjcx |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-crvj-82cr-hjcx | Dependencies (osv-scanner) |
| medium | osv/GHSA-f72v-6w45-q472 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-f72v-6w45-q472 | Dependencies (osv-scanner) |
| medium | osv/GHSA-f72v-6w45-q472 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-f72v-6w45-q472 | Dependencies (osv-scanner) |
| medium | osv/GHSA-g6gw-c38x-mqfc |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-g6gw-c38x-mqfc | Dependencies (osv-scanner) |
| medium | osv/GHSA-gqvv-2mrq-wpjv |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-gqvv-2mrq-wpjv | Dependencies (osv-scanner) |
| medium | osv/GHSA-h3mg-xc3c-68pw |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-h3mg-xc3c-68pw | Dependencies (osv-scanner) |
| medium | osv/GHSA-h7mg-cq63-vhpq |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-h7mg-cq63-vhpq | Dependencies (osv-scanner) |
| medium | osv/GHSA-hrr3-gc8f-f4qj |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-hrr3-gc8f-f4qj | Dependencies (osv-scanner) |
| medium | osv/GHSA-hxh3-vqpv-xpqv |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-hxh3-vqpv-xpqv | Dependencies (osv-scanner) |
| medium | osv/GHSA-j6r3-76f7-8jcv |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-j6r3-76f7-8jcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-jpvv-r467-5p4w |
pnpm-lock.yaml | @hono/[email protected] (npm) is affected by GHSA-jpvv-r467-5p4w | Dependencies (osv-scanner) |
| medium | osv/GHSA-pmjh-fq2x-6v4x |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-pmjh-fq2x-6v4x | Dependencies (osv-scanner) |
| medium | osv/GHSA-qv5m-9pm6-hqp3 |
pnpm-lock.yaml | @hono/[email protected] (npm) is affected by GHSA-qv5m-9pm6-hqp3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-rmxm-3fg6-px4f |
pnpm-lock.yaml | @hono/[email protected] (npm) is affected by GHSA-rmxm-3fg6-px4f | Dependencies (osv-scanner) |
| medium | osv/GHSA-rpw4-54j3-4h4q |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-rpw4-54j3-4h4q | Dependencies (osv-scanner) |
| medium | osv/GHSA-rvq5-wwqv-78pq |
pnpm-lock.yaml | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-rvq5-wwqv-78pq | Dependencies (osv-scanner) |
| medium | osv/GHSA-rx4f-c7p8-82vq |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-rx4f-c7p8-82vq | Dependencies (osv-scanner) |
| medium | osv/GHSA-rxp7-6hxx-x8q5 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-rxp7-6hxx-x8q5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w74x-v6f9-j3xg |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg | Dependencies (osv-scanner) |
| medium | osv/GHSA-wjr9-j795-jxcr |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-wjr9-j795-jxcr | Dependencies (osv-scanner) |
| medium | osv/GHSA-x5fp-wj9c-mxmx |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-x5fp-wj9c-mxmx | Dependencies (osv-scanner) |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.github/scripts/verify-codex-route.mjs:62 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.github/scripts/verify-codex-route.mjs:62 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
agents/compile.mjs:567 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
agents/compile.mjs:567 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/go.lang.correctness.eqeq-is-bad |
engine/compressors/config.go:99 | Detected useless comparison operation `dropped == dropped` or `dropped != dropped`. This will always return 'True' or 'False' and therefore is not necessary. Instead, remove this comparison operation or use another comparison expression... | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
extension/scripts/firefox-e2e.mjs:147 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
extension/scripts/firefox-e2e.mjs:147 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
extension/scripts/firefox-e2e.mjs:216 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
extension/scripts/firefox-e2e.mjs:216 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
extension/scripts/firefox-e2e.mjs:226 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
extension/scripts/firefox-e2e.mjs:226 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
installer/install.js:1348 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
installer/install.js:34 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
integrations/compile.mjs:152 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
integrations/compile.mjs:152 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/cli/src/agent-mcp.ts:572 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/cli/src/agent-mcp.ts:572 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/cli/src/agent-mcp.ts:580 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/cli/src/agent-mcp.ts:580 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/middleware/typescript/scripts/cjs-types.mjs:9 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/middleware/typescript/scripts/cjs-types.mjs:9 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/sdk/typescript/scripts/cjs-types.mjs:25 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/sdk/typescript/scripts/cjs-types.mjs:25 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/subagent-tax/lib/harnesses.mjs:104 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/subagent-tax/lib/harnesses.mjs:104 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/subagent-tax/lib/harnesses.mjs:104 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/subagent-tax/lib/harnesses.mjs:104 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/subagent-tax/lib/harnesses.mjs:166 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/subagent-tax/lib/harnesses.mjs:166 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/subagent-tax/lib/harnesses.mjs:167 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/subagent-tax/lib/harnesses.mjs:168 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/subagent-tax/lib/harnesses.mjs:169 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/subagent-tax/lib/harnesses.mjs:173 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/probe-native-codex-recovery.mjs:124 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/probe-native-codex-recovery.mjs:124 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/compile.mjs:166 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
src/mcp-servers/caveman-shrink/index.js:29 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
src/mcp-servers/caveman-shrink/index.js:30 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
src/mcp-servers/caveman-shrink/index.js:31 | `const` is assigned twice; the first assignment is useless | Lint |
| low | zizmor/adhoc-packages |
.github/workflows/agent-conformance.yml:47 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | zizmor/adhoc-packages |
.github/workflows/ci.yml:67 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | zizmor/adhoc-packages |
.github/workflows/middleware-canary.yml:40 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | zizmor/adhoc-packages |
.github/workflows/profiles.yml:36 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | zizmor/adhoc-packages |
.github/workflows/release-packages.yml:228 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | zizmor/adhoc-packages |
.github/workflows/release-packages.yml:234 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | zizmor/adhoc-packages |
.github/workflows/release-packages.yml:243 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | zizmor/adhoc-packages |
.github/workflows/release-packages.yml:264 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | zizmor/adhoc-packages |
.github/workflows/release-packages.yml:466 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | zizmor/adhoc-packages |
.github/workflows/verify-codex.yml:45 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | zizmor/adhoc-packages |
.github/workflows/verify-codex.yml:48 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
cacheengine/cachebench/cachebench_test.go:129 | Possible generic-api-key secret in history (commit 82864c8f4c); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
packages/agent/tests/framework.runtime.mjs:1654 | Possible generic-api-key secret in history (commit 82864c8f4c); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
packages/cli/tests/fixtures/receipts-bundle.json:6 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/private-key |
packages/cli/tests/proxy-fetch.runtime.mjs:20 | Possible private-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
packages/sdk/parity/fixtures.json:456 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
packages/sdk/parity/runtime-policy.fixtures.json:21 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | osv/GHSA-2gqq-gqf2-x968 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-2gqq-gqf2-x968 | Dependencies (osv-scanner) |
| low | osv/GHSA-333x-w4r6-6crp |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-333x-w4r6-6crp | Dependencies (osv-scanner) |
| low | osv/GHSA-3gg2-335m-rxc6 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-3gg2-335m-rxc6 | Dependencies (osv-scanner) |
| low | osv/GHSA-8436-99hf-9mmv |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-8436-99hf-9mmv | Dependencies (osv-scanner) |
| low | osv/GHSA-r53p-7pc4-xj5r |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-r53p-7pc4-xj5r | Dependencies (osv-scanner) |
| low | osv/GHSA-xhq7-xmqj-769h |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-xhq7-xmqj-769h | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
proxy/internal/config/config_test.go:90 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
proxy/internal/config/middleware_test.go:117 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
proxy/internal/gateway/route_pool_test.go:653 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
proxy/internal/gateway/websocket_route_test.go:24 | Possible generic-api-key secret in history (commit 1b2cd59de3); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
proxy/internal/standalone/auth_token_test.go:17 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
shared/platform/objectstore/objectstore_test.go:14 | Possible generic-api-key secret in history (commit 82864c8f4c); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/github-pat |
shared/platform/redact/payload_test.go:630 | Possible github-pat secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
shared/platform/redact/payload_test.go:665 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/github-oauth |
shared/platform/redact/payload_test.go:667 | Possible github-oauth secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/github-app-token |
shared/platform/redact/payload_test.go:668 | Possible github-app-token secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/github-refresh-token |
shared/platform/redact/payload_test.go:669 | Possible github-refresh-token secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/private-key |
shared/platform/redact/redact_test.go:110 | Possible private-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
shared/platform/redact/redact_test.go:278 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/github-pat |
shared/platform/redact/residual_test.go:227 | Possible github-pat secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
shared/platform/redact/residual_test.go:258 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/stripe-access-token |
shared/platform/redact/residual_test.go:351 | Possible stripe-access-token secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| info | zizmor/template-injection |
.github/workflows/release-packages.yml:238 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/release-packages.yml:265 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 175 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 29 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 65 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 300 | |
| OpenSSF Scorecard | Security | ok | scorecard v5.6.0 | 0 | |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 22 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | b4ee71d557d9 | prov-5+qual-2+sec-2 | 95% | 71 | 54 |
Full text report
- Repository: https://github.com/JuliusBrussee/caveman
- Commit:
b4ee71d557d96e3cbc14f88fa6e953a1362865f5 - Generated: 2026-11-14T16:00:41+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 95 | explicit | 95% | 100% |
| Code quality | 71 | adequate | 90% | 100% |
| Security | 54 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 95% of first-party code added; an estimated 95% including velocity signals.
- Explicitly attributed share (lower bound): 94.9%
- Unattributed share in AI-consistent velocity bursts: 1.8%
- Estimated AI-generated share: 94.9%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 1,462 | 447,920 |
| OpenAI Codex | 34 | 3,770 |
| Cursor agent | 6 | 2,459 |
| GitHub Copilot coding agent | 1 | 1 |
- AI tooling configured in repo: claude-code, gemini, generic-agent
Current source lines last changed by AI-attributed commits: 145,193 of 150,851.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 1.109 | 2.474 | 0.45x |
| Security | 1.749 | 8.13 | 0.22x |
- Stylometry index: 0.28 per 1,000 lines (narrated steps 6, placeholders 0, assistant phrasing 0, emoji 73). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-04 | 7,643 | 56% |
| 2026-05 | 4,554 | 34% |
| 2026-06 | 2,117 | 78% |
| 2026-07 | 3,577 | 72% |
| 2026-08 | 247,093 | 95% |
| 2026-09 | 117,926 | 97% |
| 2026-10 | 86,490 | 99% |
| 2026-11 | 7,872 | 97% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (b4ee71d557d9)
- Claude Code: trailer 'Co-Authored-By: Claude' (1774e1cd6676)
- Claude Code: author email [email protected] (7fe17aa7e62a)
- Claude Code: committer email [email protected] (4cfa05465a92)
- Claude Code: author email [email protected] (72152f953fa7)
- Claude Code: committer email [email protected] (24ed1c1ff324)
- Claude Code: trailer 'Co-Authored-By: Claude' (a83cc5171b6a)
- Claude Code: trailer 'Co-Authored-By: Claude' (e3e8b0f23c59)
- Claude Code: on merged branch (6852cf1fb4) (d1819fc01c92)
- Claude Code: on merged branch (46d3d8802f) (4bf8898b31c9)
- Claude Code: trailer 'Co-Authored-By: Claude' (b1764608b429)
- Claude Code: trailer 'Co-Authored-By: Claude' (a9e74b98263d)
- Claude Code: trailer 'Co-Authored-By: Claude' (81475c3fb6fe)
- Claude Code: trailer 'Co-Authored-By: Claude' (1bcc3925be60)
- Claude Code: trailer 'Co-Authored-By: Claude' (cc88124908d0)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 1.16, CI runs tests; 28% of function code in complex or long functions; 7% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 44 |
| Duplication | 67 |
| Code smells (Opengrep) | 76 |
| Tests and CI | 100 |
| Documentation | 80 |
| Type safety | 27 |
| Process (Scorecard review/maintenance) | 63 |
- Functions: 7,572; mean complexity 4.9, 90th percentile 11; 415 complex and 59 long functions
- Duplicated lines: 6.7% of 115,584 compared
- Tests: 174,281 test lines for 150,851 source lines (ratio 1.16); CI test commands: pytest, npm test, npm run test, go test; 87% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- proxy in proxy/internal/gateway/proxy.go: complexity 266, 711 lines
- uninstall in installer/install.js: complexity 161, 378 lines
- onboard in packages/cli/src/modules/onboard.ts: complexity 82, 147 lines
- leaves in packages/middleware/python/caveman_middleware/_native.py: complexity 80, 89 lines
- TransformAnthropic in engine/pixel/transform_anthropic.go: complexity 78, 333 lines
Security
Security posture is weak: 65 known vulnerabilities in 12 dependencies; 27 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: dependencies.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 48 |
| Static analysis (Opengrep) | 69 |
| Vulnerable dependencies (OSV) | 31 |
| CI workflows (zizmor) | 39 |
| Posture (policy, updates, signing, lockfiles) | 100 |
| OpenSSF Scorecard | 68 |
-
Known vulnerabilities: 65 in 12 packages (critical 0, high 21, medium 38, low 6)
-
Posture checks passed: security policy, dependency updates, signed commits; missing: lockfiles
-
OpenSSF Scorecard aggregate: 6.6/10 (published 2026-11-13T17:15:33Z)
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
.blocks/release-smoke.py:66 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
.blocks/release-smoke.py:111 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
browse/cmd/caveman-browse/main.go:305 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
browse/cmd/caveman-browse/main.go:342 |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli: Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use pre [confidence low] |
engine/ccr/store_repair.go:127 |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli: Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use pre [confidence low] |
engine/ccr/store_repair.go:156 |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli: Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use pre [confidence low] |
engine/ccr/store_repair.go:580 |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli: Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use pre [confidence low] |
engine/ccr/store_sqlite.go:551 |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli: Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use pre [confidence low] |
engine/ccr/store_sqlite.go:562 |
| high | opengrep/go.lang.security.audit.sqli.gosql-sqli: Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use pre [confidence low] |
engine/ccr/store_sqlite.go:565 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
evals/llm_run.py:152 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args: Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] |
evals/llm_run.py:153 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
evals/llm_run.py:166 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
evals/reminder_run.py:107 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args: Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] |
evals/reminder_run.py:108 |
| high | opengrep/javascript.lang.security.audit.dangerous-spawn-shell: Detected non-literal calls to child_process.spawnSync(). This could lead to a command injection vulnerability. [confidence low] |
installer/install.js:329 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument args. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
installer/install.js:468 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument cmd. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
installer/install.js:468 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument opts. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
installer/install.js:468 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument cmd. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
installer/install.js:473 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument executable. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
installer/install.js:550 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
mem/py/cavemem.py:39 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
plugins/caveman/skills/caveman-compress/scripts/compress.py:598 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
plugins/caveman/skills/caveman-compress/scripts/compress.py:703 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
proxy/internal/nativehook/hook.go:399 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v4.1.0 ships caveman-browser-1.3.0.zip (429 downloads)
- binary-release-asset: release v4.1.0 ships caveman-browser-firefox-1.3.0.zip (89 downloads)
- binary-release-asset: release bin-v4.1.0 ships THIRD_PARTY_GO_LICENSES.tar.gz (669 downloads)
- binary-release-asset: release bin-v4.0.2 ships THIRD_PARTY_GO_LICENSES.tar.gz (1248 downloads)
- binary-release-asset: release v4.0.1 ships caveman-browser-1.3.0.zip (1344 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 150,851; test lines: 174,281
| Language | Lines |
|---|---|
| Go | 192,178 |
| JavaScript | 81,662 |
| Python | 32,709 |
| TypeScript | 15,166 |
| SQL | 1,516 |
| Shell | 976 |
| PowerShell | 925 |