{"data":{"skill":{"slug":"benjitaylor-stageshow","name":"stageshow","icon":"📦","repo":"https://github.com/benjitaylor/skills/tree/802057409787133703c56001080169e347305572/stageshow","status":"approved","author":"benjitaylor","authorVersion":null,"skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"945115c8-b709-4a91-b365-6d5a47b3ade4","skill_id":"aa1926a3-a522-4f58-b82a-3b0aaeaf1b4a","version":1,"content_hash":"v3:2248333d85aa37e3eccaa477a113c86a0285b02e:a9b790ab20631961dcc71ae5955710d5bda10d62469f43767a6a38c650e5e9d7:a31b7ae96d97f0f456b72ac7c79acce3ec78904175ce88d68e95bbaea76f3869:736b696c6c732f62656e6a697461796c6f722f737461676573686f77:7bded508c20892d4069e3e23407f883c","risk_level":"medium","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 400 presented static findings are false positives involving illustration code, assets, dependency metadata, or expected local tooling. One additional finding identifies unescaped scene labels that can inject HTML into contact sheets; no evidence found of keylogging, credential theft, or audit manipulation. The analyzer capped review at 400 of 2,018 matches; the remaining 1,618 are unconfirmed and require manual review before automatic publishing. Static review was capped at 400/2018 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.","remediation":[{"issue":"Static review capped","severity":"medium","suggestion":"Manually review the omitted 1618 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication."},{"issue":"Scene labels are inserted as HTML into generated contact sheets.","severity":"medium","suggestion":"In scripts/film.mjs, render captions with textContent or HTML escaping, and test labels containing markup. Disable scripting and external requests when rendering sheets."},{"issue":"The static analysis cap leaves 1,618 matches unconfirmed.","severity":"medium","suggestion":"Complete manual adjudication of the omitted matches before automatic publishing. Keep the distinction between reviewed findings and unconfirmed matches visible."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"examples/ai-cards/index.tsx","line_end":88,"line_start":88},{"file":"examples/ai-cards/index.tsx","line_end":106,"line_start":106},{"file":"examples/annotations/composed.tsx","line_end":20,"line_start":20},{"file":"examples/annotations/composed.tsx","line_end":47,"line_start":47},{"file":"examples/annotations/composed.tsx","line_end":52,"line_start":52},{"file":"examples/annotations/composed.tsx","line_end":65,"line_start":65},{"file":"examples/annotations/composed.tsx","line_end":68,"line_start":68},{"file":"examples/annotations/index.tsx","line_end":35,"line_start":35},{"file":"examples/annotations/index.tsx","line_end":79,"line_start":79},{"file":"examples/annotations/index.tsx","line_end":105,"line_start":105},{"file":"examples/annotations/index.tsx","line_end":180,"line_start":180},{"file":"examples/annotations/index.tsx","line_end":192,"line_start":192},{"file":"examples/annotations/index.tsx","line_end":193,"line_start":193},{"file":"examples/annotations/index.tsx","line_end":199,"line_start":199},{"file":"examples/annotations/index.tsx","line_end":200,"line_start":200},{"file":"examples/annotations/index.tsx","line_end":221,"line_start":221},{"file":"examples/annotations/index.tsx","line_end":222,"line_start":222},{"file":"examples/annotations/index.tsx","line_end":227,"line_start":227},{"file":"examples/annotations/index.tsx","line_end":228,"line_start":228},{"file":"examples/annotations/index.tsx","line_end":243,"line_start":243},{"file":"examples/annotations/index.tsx","line_end":246,"line_start":246},{"file":"examples/annotations/index.tsx","line_end":276,"line_start":276},{"file":"examples/backgrounds/index.tsx","line_end":67,"line_start":67},{"file":"examples/bento/index.tsx","line_end":38,"line_start":38},{"file":"examples/bento/index.tsx","line_end":263,"line_start":263},{"file":"examples/bento/index.tsx","line_end":360,"line_start":360},{"file":"examples/bento/index.tsx","line_end":372,"line_start":372},{"file":"examples/bento/index.tsx","line_end":373,"line_start":373},{"file":"examples/brand-marks/index.tsx","line_end":34,"line_start":34},{"file":"examples/calendar/index.tsx","line_end":21,"line_start":21},{"file":"examples/calendar/index.tsx","line_end":39,"line_start":39},{"file":"examples/calendar/index.tsx","line_end":43,"line_start":43},{"file":"examples/calendar/index.tsx","line_end":58,"line_start":58},{"file":"examples/calendar/index.tsx","line_end":182,"line_start":182},{"file":"examples/calendar/index.tsx","line_end":189,"line_start":189},{"file":"examples/chart-scrub/index.tsx","line_end":35,"line_start":35},{"file":"examples/choreography/index.tsx","line_end":68,"line_start":68},{"file":"examples/choreography/index.tsx","line_end":83,"line_start":83},{"file":"examples/controls/index.tsx","line_end":182,"line_start":182},{"file":"examples/cursor-morph/cursor-morph.tsx","line_end":67,"line_start":67},{"file":"examples/cursor-morph/cursor-morph.tsx","line_end":68,"line_start":68},{"file":"examples/cursor-morph/cursor-morph.tsx","line_end":123,"line_start":123},{"file":"examples/cursor-morph/index.tsx","line_end":23,"line_start":23},{"file":"examples/cursor-morph/index.tsx","line_end":47,"line_start":47},{"file":"examples/cursors/index.tsx","line_end":103,"line_start":103},{"file":"examples/cursors/index.tsx","line_end":113,"line_start":113},{"file":"examples/cursors/index.tsx","line_end":114,"line_start":114},{"file":"examples/dark-bento/index.tsx","line_end":59,"line_start":59},{"file":"examples/dark-bento/index.tsx","line_end":69,"line_start":69},{"file":"examples/dark-hero/index.tsx","line_end":84,"line_start":84}]},{"factor":"filesystem","evidence":[{"file":"examples/ai-cards/index.tsx","line_end":1,"line_start":1},{"file":"examples/ai-chat/index.tsx","line_end":11,"line_start":11},{"file":"examples/annotations/composed.tsx","line_end":2,"line_start":2},{"file":"examples/annotations/index.tsx","line_end":2,"line_start":2},{"file":"examples/annotations/index.tsx","line_end":6,"line_start":6},{"file":"examples/backgrounds/index.tsx","line_end":2,"line_start":2},{"file":"examples/bento/index.tsx","line_end":2,"line_start":2},{"file":"examples/bento/index.tsx","line_end":3,"line_start":3},{"file":"examples/bento/index.tsx","line_end":4,"line_start":4},{"file":"examples/brand-marks/index.tsx","line_end":2,"line_start":2},{"file":"examples/calendar/index.tsx","line_end":1,"line_start":1},{"file":"examples/chart-scrub/index.tsx","line_end":2,"line_start":2},{"file":"examples/choreography/index.tsx","line_end":2,"line_start":2},{"file":"examples/chrome/index.tsx","line_end":2,"line_start":2},{"file":"examples/close-up/index.tsx","line_end":1,"line_start":1},{"file":"examples/controls/index.tsx","line_end":1,"line_start":1},{"file":"examples/corner-chip/index.tsx","line_end":1,"line_start":1},{"file":"examples/cursor-morph/cursor-morph.tsx","line_end":5,"line_start":5},{"file":"examples/cursor-morph/index.tsx","line_end":4,"line_start":4},{"file":"examples/cursor-resize/index.tsx","line_end":1,"line_start":1},{"file":"examples/cursors/index.tsx","line_end":1,"line_start":1},{"file":"examples/dark-bento/index.tsx","line_end":1,"line_start":1},{"file":"examples/dark-hero/index.tsx","line_end":3,"line_start":3},{"file":"examples/device-pair/index.tsx","line_end":1,"line_start":1},{"file":"examples/dynamic-island/index.tsx","line_end":2,"line_start":2},{"file":"examples/excel/index.tsx","line_end":1,"line_start":1},{"file":"examples/fade-crop/index.tsx","line_end":1,"line_start":1},{"file":"examples/figma/index.tsx","line_end":2,"line_start":2},{"file":"examples/finder-glass/index.tsx","line_end":27,"line_start":27},{"file":"examples/finder-glass/index.tsx","line_end":345,"line_start":345},{"file":"examples/finder-glass/index.tsx","line_end":346,"line_start":346},{"file":"examples/finder/index.tsx","line_end":21,"line_start":21},{"file":"examples/finder/index.tsx","line_end":293,"line_start":293},{"file":"examples/finder/index.tsx","line_end":294,"line_start":294},{"file":"examples/form-error/index.tsx","line_end":1,"line_start":1},{"file":"examples/freeform-drag/index.tsx","line_end":1,"line_start":1},{"file":"examples/glass/index.tsx","line_end":1,"line_start":1},{"file":"examples/gmail/index.tsx","line_end":1,"line_start":1},{"file":"examples/google-calendar/index.tsx","line_end":1,"line_start":1},{"file":"examples/google-docs/index.tsx","line_end":2,"line_start":2},{"file":"examples/google-docs/index.tsx","line_end":122,"line_start":122},{"file":"examples/hero-demo/HeroDemo.tsx","line_end":1,"line_start":1},{"file":"examples/hero-grid/index.tsx","line_end":2,"line_start":2},{"file":"examples/imessage/index.tsx","line_end":2,"line_start":2},{"file":"examples/kit-extras/index.tsx","line_end":1,"line_start":1},{"file":"examples/kit-extras/index.tsx","line_end":3,"line_start":3},{"file":"examples/linear/index.tsx","line_end":3,"line_start":3},{"file":"examples/loading/index.tsx","line_end":2,"line_start":2},{"file":"examples/looks/index.tsx","line_end":1,"line_start":1},{"file":"examples/looks/studies.tsx","line_end":1,"line_start":1}]},{"factor":"network","evidence":[{"file":"examples/controls/index.tsx","line_end":13,"line_start":13},{"file":"examples/wikipedia/index.tsx","line_end":410,"line_start":410},{"file":"kit/brands/1password-dark.svg","line_end":1,"line_start":1},{"file":"kit/brands/1password.svg","line_end":1,"line_start":1},{"file":"kit/brands/amex.svg","line_end":1,"line_start":1},{"file":"kit/brands/bankofamerica-dark.svg","line_end":1,"line_start":1},{"file":"kit/brands/bankofamerica.svg","line_end":1,"line_start":1},{"file":"kit/brands/barclays.svg","line_end":1,"line_start":1},{"file":"kit/brands/bitcoin.svg","line_end":1,"line_start":1},{"file":"kit/brands/chase.svg","line_end":1,"line_start":1},{"file":"kit/brands/monzo-dark.svg","line_end":1,"line_start":1},{"file":"kit/brands/monzo.svg","line_end":1,"line_start":1},{"file":"kit/brands/revolut-dark.svg","line_end":1,"line_start":1},{"file":"kit/brands/revolut.svg","line_end":1,"line_start":1},{"file":"kit/brands/solana.svg","line_end":1,"line_start":1},{"file":"kit/brands/wellsfargo.svg","line_end":1,"line_start":1},{"file":"kit/cursors.tsx","line_end":56,"line_start":56},{"file":"kit/cursors.tsx","line_end":58,"line_start":58},{"file":"kit/cursors.tsx","line_end":73,"line_start":73},{"file":"package-lock.json","line_end":34,"line_start":34},{"file":"package-lock.json","line_end":49,"line_start":49},{"file":"package-lock.json","line_end":59,"line_start":59},{"file":"package-lock.json","line_end":85,"line_start":85},{"file":"package-lock.json","line_end":90,"line_start":90},{"file":"package-lock.json","line_end":107,"line_start":107},{"file":"package-lock.json","line_end":124,"line_start":124},{"file":"package-lock.json","line_end":134,"line_start":134},{"file":"package-lock.json","line_end":148,"line_start":148},{"file":"package-lock.json","line_end":166,"line_start":166},{"file":"package-lock.json","line_end":176,"line_start":176},{"file":"package-lock.json","line_end":186,"line_start":186},{"file":"package-lock.json","line_end":196,"line_start":196},{"file":"package-lock.json","line_end":206,"line_start":206},{"file":"package-lock.json","line_end":220,"line_start":220},{"file":"package-lock.json","line_end":236,"line_start":236},{"file":"package-lock.json","line_end":252,"line_start":252},{"file":"package-lock.json","line_end":268,"line_start":268},{"file":"package-lock.json","line_end":283,"line_start":283},{"file":"package-lock.json","line_end":302,"line_start":302},{"file":"package-lock.json","line_end":316,"line_start":316},{"file":"package-lock.json","line_end":333,"line_start":333},{"file":"package-lock.json","line_end":350,"line_start":350},{"file":"package-lock.json","line_end":367,"line_start":367},{"file":"package-lock.json","line_end":384,"line_start":384},{"file":"package-lock.json","line_end":401,"line_start":401},{"file":"package-lock.json","line_end":418,"line_start":418},{"file":"package-lock.json","line_end":435,"line_start":435},{"file":"package-lock.json","line_end":452,"line_start":452},{"file":"package-lock.json","line_end":469,"line_start":469},{"file":"package-lock.json","line_end":486,"line_start":486}]},{"factor":"env_access","evidence":[{"file":"examples/ruled-bento/index.tsx","line_end":96,"line_start":96},{"file":"kit/util.ts","line_end":4,"line_start":4},{"file":"kit/util.ts","line_end":8,"line_start":8},{"file":"kit/util.ts","line_end":4,"line_start":4},{"file":"kit/util.ts","line_end":8,"line_start":8},{"file":"scripts/browser.mjs","line_end":13,"line_start":13},{"file":"scripts/browser.mjs","line_end":13,"line_start":13},{"file":"scripts/film.mjs","line_end":131,"line_start":131},{"file":"scripts/film.mjs","line_end":131,"line_start":131},{"file":"scripts/film.mjs","line_end":136,"line_start":136}]},{"factor":"scripts","evidence":[{"file":"kit/code.tsx","line_end":24,"line_start":24},{"file":"kit/motion/Count.tsx","line_end":25,"line_start":25},{"file":"playground/main.tsx","line_end":17,"line_start":17},{"file":"playground/main.tsx","line_end":22,"line_start":22},{"file":"playground/main.tsx","line_end":83,"line_start":83},{"file":"playground/preview.tsx","line_end":14,"line_start":14},{"file":"scripts/browser.mjs","line_end":8,"line_start":8},{"file":"scripts/class-clash.mjs","line_end":36,"line_start":36},{"file":"scripts/film.mjs","line_end":176,"line_start":176},{"file":"scripts/film.mjs","line_end":142,"line_start":142}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Unescaped Scene Labels Can Alter Capture Evidence","locations":[{"file":"scripts/film.mjs","line_end":609,"line_start":602},{"file":"scripts/film.mjs","line_end":655,"line_start":644}],"confidence":0.94,"description":"State capture reads page-controlled data-mark values and inserts them unescaped into contact-sheet HTML. Crafted labels can inject styles or scripts, falsifying review images or initiating browser requests.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The source directly connects data-mark attributes to shot labels and interpolates those labels into setContent without escaping. Exploitation requires control of a captured label; no malicious payload was observed."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":356,"total_lines":52755,"audit_model":"codex","audited_at":"2026-11-01T14:40:56.957+00:00","created_at":"2026-11-01T16:04:49.100204+00:00","static_findings":[{"id":"blocker:examples/hero-demo/HeroDemo.tsx:258:keylogger-keywords","file":"examples/hero-demo/HeroDemo.tsx","pattern":"Keylogger keywords","snippet":"{/* A paste arrives as one operation after its keystroke. */}","category":"blocker","line_end":258,"severity":"critical","line_start":258},{"id":"blocker:kit/act.ts:69:keylogger-keywords","file":"kit/act.ts","pattern":"Keylogger keywords","snippet":"* Show a keystroke as keycaps: 'cmd+k', 'enter', 'shift+cmd+p'. Resolves","category":"blocker","line_end":69,"severity":"critical","line_start":69},{"id":"blocker:kit/controls/Field.css:167:keylogger-keywords","file":"kit/controls/Field.css","pattern":"Keylogger keywords","snippet":"/* Solid while typing (each keystroke remounts it), blinking once it rests */","category":"blocker","line_end":167,"severity":"critical","line_start":167},{"id":"blocker:kit/controls/Field.tsx:82:keylogger-keywords","file":"kit/controls/Field.tsx","pattern":"Keylogger keywords","snippet":"{/* Keyed on the value, so every keystroke restarts the blink from solid */}","category":"blocker","line_end":82,"severity":"critical","line_start":82},{"id":"blocker:kit/keys.css:1:keylogger-keywords","file":"kit/keys.css","pattern":"Keylogger keywords","snippet":"/* Keystrokes (act.key): the keycap rows. */","category":"blocker","line_end":1,"severity":"critical","line_start":1},{"id":"blocker:kit/keys.tsx:3:keylogger-keywords","file":"kit/keys.tsx","pattern":"Keylogger keywords","snippet":"// Keystrokes shown as keycaps (act.key): the caps for a combo, and the rows","category":"blocker","line_end":3,"severity":"critical","line_start":3},{"id":"blocker:kit/keys.tsx:9:keylogger-keywords","file":"kit/keys.tsx","pattern":"Keylogger keywords","snippet":"// Each keystroke is its own row of caps, so one still fading out never","category":"blocker","line_end":9,"severity":"critical","line_start":9},{"id":"sensitive:kit/brands/index.ts:76:1password-data","file":"kit/brands/index.ts","pattern":"1Password data","snippet":"name: \"1Password\", category: 'Apps',","category":"sensitive","line_end":76,"severity":"critical","line_start":76},{"id":"blocker:scripts/layout.mjs:14:screen-capture-upload","file":"scripts/layout.mjs","pattern":"Screen capture upload","snippet":"if (arg === '--help') { console.log('usage: node scripts/layout.mjs <url> [--select body] [--width 1","category":"blocker","line_end":14,"severity":"high","line_start":14},{"id":"sensitive:examples/brand-marks/index.tsx:5:certificate-key-files","file":"examples/brand-marks/index.tsx","pattern":"Certificate/key files","snippet":"const names = Object.keys(brandMarks) as BrandName[]","category":"sensitive","line_end":5,"severity":"high","line_start":5},{"id":"sensitive:examples/calendar/index.tsx:112:certificate-key-files","file":"examples/calendar/index.tsx","pattern":"Certificate/key files","snippet":"await a.key('cmd+z')","category":"sensitive","line_end":112,"severity":"high","line_start":112},{"id":"sensitive:examples/excel/index.tsx:74:certificate-key-files","file":"examples/excel/index.tsx","pattern":"Certificate/key files","snippet":"await a.key('cmd+z')","category":"sensitive","line_end":74,"severity":"high","line_start":74},{"id":"sensitive:examples/figma/index.tsx:97:certificate-key-files","file":"examples/figma/index.tsx","pattern":"Certificate/key files","snippet":"await a.key('cmd+z')","category":"sensitive","line_end":97,"severity":"high","line_start":97},{"id":"sensitive:examples/finder-glass/index.tsx:115:certificate-key-files","file":"examples/finder-glass/index.tsx","pattern":"Certificate/key files","snippet":"await a.key('space')","category":"sensitive","line_end":115,"severity":"high","line_start":115},{"id":"sensitive:examples/finder-glass/index.tsx:121:certificate-key-files","file":"examples/finder-glass/index.tsx","pattern":"Certificate/key files","snippet":"await a.key('space')","category":"sensitive","line_end":121,"severity":"high","line_start":121},{"id":"sensitive:examples/finder/index.tsx:85:certificate-key-files","file":"examples/finder/index.tsx","pattern":"Certificate/key files","snippet":"await a.key('space')","category":"sensitive","line_end":85,"severity":"high","line_start":85},{"id":"sensitive:examples/finder/index.tsx:91:certificate-key-files","file":"examples/finder/index.tsx","pattern":"Certificate/key files","snippet":"await a.key('space')","category":"sensitive","line_end":91,"severity":"high","line_start":91},{"id":"sensitive:examples/finder/index.tsx:117:certificate-key-files","file":"examples/finder/index.tsx","pattern":"Certificate/key files","snippet":"await a.key('cmd+z')","category":"sensitive","line_end":117,"severity":"high","line_start":117},{"id":"sensitive:examples/hero-demo/HeroDemo.tsx:134:certificate-key-files","file":"examples/hero-demo/HeroDemo.tsx","pattern":"Certificate/key files","snippet":"await a.key('cmd+v')","category":"sensitive","line_end":134,"severity":"high","line_start":134},{"id":"sensitive:kit/act.ts:647:certificate-key-files","file":"kit/act.ts","pattern":"Certificate/key files","snippet":"for (const k of Object.keys(a) as (keyof Act<S>)[]) {","category":"sensitive","line_end":647,"severity":"high","line_start":647},{"id":"sensitive:kit/act.ts:664:certificate-key-files","file":"kit/act.ts","pattern":"Certificate/key files","snippet":"const changed = Object.keys(initial).filter(","category":"sensitive","line_end":664,"severity":"high","line_start":664},{"id":"sensitive:kit/cursor.tsx:71:certificate-key-files","file":"kit/cursor.tsx","pattern":"Certificate/key files","snippet":"{style !== 'circle' && style !== 'touch' && (Object.keys(GLYPHS) as CursorKind[]).map((k) => {","category":"sensitive","line_end":71,"severity":"high","line_start":71},{"id":"sensitive:kit/keys.css:1:certificate-key-files","file":"kit/keys.css","pattern":"Certificate/key files","snippet":"/* Keystrokes (act.key): the keycap rows. */","category":"sensitive","line_end":1,"severity":"high","line_start":1},{"id":"sensitive:kit/keys.tsx:3:certificate-key-files","file":"kit/keys.tsx","pattern":"Certificate/key files","snippet":"// Keystrokes shown as keycaps (act.key): the caps for a combo, and the rows","category":"sensitive","line_end":3,"severity":"high","line_start":3},{"id":"sensitive:kit/measure.ts:103:certificate-key-files","file":"kit/measure.ts","pattern":"Certificate/key files","snippet":"const ka = Object.keys(a)","category":"sensitive","line_end":103,"severity":"high","line_start":103},{"id":"sensitive:kit/measure.ts:104:certificate-key-files","file":"kit/measure.ts","pattern":"Certificate/key files","snippet":"if (ka.length !== Object.keys(b).length) return false","category":"sensitive","line_end":104,"severity":"high","line_start":104},{"id":"sensitive:kit/motion/Expand.tsx:51:certificate-key-files","file":"kit/motion/Expand.tsx","pattern":"Certificate/key files","snippet":"const moving = last.current.key === key || last.current.open !== open || open","category":"sensitive","line_end":51,"severity":"high","line_start":51},{"id":"sensitive:kit/motion/Roll.tsx:112:certificate-key-files","file":"kit/motion/Roll.tsx","pattern":"Certificate/key files","snippet":"const key = view.key + 1","category":"sensitive","line_end":112,"severity":"high","line_start":112},{"id":"sensitive:kit/motion/Roll.tsx:117:certificate-key-files","file":"kit/motion/Roll.tsx","pattern":"Certificate/key files","snippet":"const id = setTimeout(() => setView((v) => (v.key === key ? { ...v, old: '' } : v)), 700)","category":"sensitive","line_end":117,"severity":"high","line_start":117},{"id":"sensitive:playground/catalog.ts:86:certificate-key-files","file":"playground/catalog.ts","pattern":"Certificate/key files","snippet":"const extra = Object.keys(import.meta.glob('../examples/*/index.tsx'))","category":"sensitive","line_end":86,"severity":"high","line_start":86},{"id":"sensitive:references/motion.md:126:certificate-key-files","file":"references/motion.md","pattern":"Certificate/key files","snippet":"- **Keyboard stories show the keys** with `act.key('cmd+k')`; the cursor can rest or leave (`example","category":"sensitive","line_end":126,"severity":"high","line_start":126},{"id":"sensitive:scripts/film-checks.mjs:1307:certificate-key-files","file":"scripts/film-checks.mjs","pattern":"Certificate/key files","snippet":"const bled = Object.keys(m).filter((k) => m[k] < -1)","category":"sensitive","line_end":1307,"severity":"high","line_start":1307},{"id":"sensitive:scripts/film.mjs:511:certificate-key-files","file":"scripts/film.mjs","pattern":"Certificate/key files","snippet":"return { key, label: stage.label, coverage: sample, findings: [...scaleNotes.filter((note) => note.k","category":"sensitive","line_end":511,"severity":"high","line_start":511},{"id":"sensitive:scripts/film.mjs:515:certificate-key-files","file":"scripts/film.mjs","pattern":"Certificate/key files","snippet":"printCoverage(stage.key, stage.coverage)","category":"sensitive","line_end":515,"severity":"high","line_start":515},{"id":"sensitive:scripts/film.mjs:516:certificate-key-files","file":"scripts/film.mjs","pattern":"Certificate/key files","snippet":"for (const line of stage.findings) console.log(`[${stage.key}] ${line}`)","category":"sensitive","line_end":516,"severity":"high","line_start":516},{"id":"sensitive:scripts/film.mjs:517:certificate-key-files","file":"scripts/film.mjs","pattern":"Certificate/key files","snippet":"for (const line of stage.manual) console.log(`[${stage.key}] manual: ${line}`)","category":"sensitive","line_end":517,"severity":"high","line_start":517},{"id":"sensitive:scripts/jumps.mjs:39:certificate-key-files","file":"scripts/jumps.mjs","pattern":"Certificate/key files","snippet":"await page.waitForFunction(() => Object.keys(window.__ssVerification.stages).length || window.__ssVe","category":"sensitive","line_end":39,"severity":"high","line_start":39},{"id":"sensitive:scripts/jumps.mjs:57:certificate-key-files","file":"scripts/jumps.mjs","pattern":"Certificate/key files","snippet":"printCoverage(stage.key, stage.coverage)","category":"sensitive","line_end":57,"severity":"high","line_start":57},{"id":"sensitive:scripts/jumps.mjs:58:certificate-key-files","file":"scripts/jumps.mjs","pattern":"Certificate/key files","snippet":"for (const line of stage.findings) console.log(`[${stage.key}] ${line}`)","category":"sensitive","line_end":58,"severity":"high","line_start":58},{"id":"sensitive:scripts/jumps.mjs:59:certificate-key-files","file":"scripts/jumps.mjs","pattern":"Certificate/key files","snippet":"for (const line of stage.manual) console.log(`[${stage.key}] manual: ${line}`)","category":"sensitive","line_end":59,"severity":"high","line_start":59},{"id":"sensitive:scripts/layout-core.mjs:17:certificate-key-files","file":"scripts/layout-core.mjs","pattern":"Certificate/key files","snippet":"a.effect.getKeyframes().some((frame) => Object.keys(frame).some((property) => geometry.test(property","category":"sensitive","line_end":17,"severity":"high","line_start":17},{"id":"sensitive:kit/util.ts:4:environment-file-access","file":"kit/util.ts","pattern":"Environment file access","snippet":"// process.env.NODE_ENV, so a production build never warns; with no bundler","category":"sensitive","line_end":4,"severity":"high","line_start":4},{"id":"sensitive:kit/util.ts:8:environment-file-access","file":"kit/util.ts","pattern":"Environment file access","snippet":"return process.env.NODE_ENV !== 'production'","category":"sensitive","line_end":8,"severity":"high","line_start":8},{"id":"sensitive:scripts/browser.mjs:13:environment-file-access","file":"scripts/browser.mjs","pattern":"Environment file access","snippet":"const path = process.env.CHROME_PATH","category":"sensitive","line_end":13,"severity":"high","line_start":13},{"id":"sensitive:scripts/film.mjs:131:environment-file-access","file":"scripts/film.mjs","pattern":"Environment file access","snippet":"if (!process.env.FILM_CHILD) {","category":"sensitive","line_end":131,"severity":"high","line_start":131},{"id":"sensitive:scripts/film.mjs:136:environment-file-access","file":"scripts/film.mjs","pattern":"Environment file access","snippet":"last = spawnSync(process.execPath, process.argv.slice(1), { env: { ...process.env, FILM_CHILD: '1' }","category":"sensitive","line_end":136,"severity":"high","line_start":136},{"id":"obfuscation:assets/app-icons.ts:7:heuristic-extremely-long-line-11148-chars-likely","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Extremely long line (11148 chars) - likely obfuscated","snippet":"export const calendar = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAYAAAA5ZDbSAAAgS0lEQ","category":"obfuscation","line_end":7,"severity":"high","line_start":7},{"id":"obfuscation:assets/app-icons.ts:11:heuristic-extremely-long-line-12089-chars-likely","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Extremely long line (12089 chars) - likely obfuscated","snippet":"export const slack = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAYAAAA5ZDbSAAAjD0lEQVR4","category":"obfuscation","line_end":11,"severity":"high","line_start":11},{"id":"obfuscation:assets/app-icons.ts:5:heuristic-extremely-long-line-14276-chars-likely","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Extremely long line (14276 chars) - likely obfuscated","snippet":"export const mail = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAYAAAA5ZDbSAAApeUlEQVR4n","category":"obfuscation","line_end":5,"severity":"high","line_start":5},{"id":"obfuscation:assets/app-icons.ts:13:heuristic-extremely-long-line-14749-chars-likely","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Extremely long line (14749 chars) - likely obfuscated","snippet":"export const figma = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAYAAAA5ZDbSAAAACXBIWXMA","category":"obfuscation","line_end":13,"severity":"high","line_start":13},{"id":"obfuscation:kit/brands/discover.svg:1:heuristic-extremely-long-line-2077-chars-likely-","file":"kit/brands/discover.svg","pattern":"[HEURISTIC] Extremely long line (2077 chars) - likely obfuscated","snippet":"<svg width=\"780\" height=\"500\" enable-background=\"new 0 0 780 500\" version=\"1.1\" viewBox=\"0 0 780 500","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:assets/app-icons.ts:9:heuristic-extremely-long-line-22018-chars-likely","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Extremely long line (22018 chars) - likely obfuscated","snippet":"export const testFlight = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAYAAAA5ZDbSAABAIkl","category":"obfuscation","line_end":9,"severity":"high","line_start":9},{"id":"obfuscation:kit/brands/barclays.svg:1:heuristic-extremely-long-line-2331-chars-likely-","file":"kit/brands/barclays.svg","pattern":"[HEURISTIC] Extremely long line (2331 chars) - likely obfuscated","snippet":"<svg fill=\"#00AEEF\" role=\"img\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\"><title>Barclay","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:kit/brands/amex.svg:1:heuristic-extremely-long-line-2402-chars-likely-","file":"kit/brands/amex.svg","pattern":"[HEURISTIC] Extremely long line (2402 chars) - likely obfuscated","snippet":"<svg version=\"1.1\" id=\"Layer_1\" xmlns=\"http://www.w3.org/2000/svg\" x=\"0\" y=\"0\" width=\"45\" height=\"45","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:kit/brands/wellsfargo.svg:1:heuristic-extremely-long-line-2446-chars-likely-","file":"kit/brands/wellsfargo.svg","pattern":"[HEURISTIC] Extremely long line (2446 chars) - likely obfuscated","snippet":"<svg fill=\"#D71E28\" role=\"img\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\"><title>Wells F","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:kit/cursors.tsx:72:heuristic-extremely-long-line-2788-chars-likely-","file":"kit/cursors.tsx","pattern":"[HEURISTIC] Extremely long line (2788 chars) - likely obfuscated","snippet":"        <path d=\"m3.44281398 1.68449726c-.74326136.27630142-1.05584685.8131257-1.07636853 1.38003696","category":"obfuscation","line_end":72,"severity":"high","line_start":72},{"id":"obfuscation:examples/telegram/telegram.css:47:heuristic-extremely-long-line-3465-chars-likely-","file":"examples/telegram/telegram.css","pattern":"[HEURISTIC] Extremely long line (3465 chars) - likely obfuscated","snippet":"    background: url('data:image/svg+xml,%3Csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"240\" height","category":"obfuscation","line_end":47,"severity":"high","line_start":47},{"id":"obfuscation:kit/cursors.tsx:73:heuristic-extremely-long-line-4823-chars-likely-","file":"kit/cursors.tsx","pattern":"[HEURISTIC] Extremely long line (4823 chars) - likely obfuscated","snippet":"        <path d=\"m7.31951013 1.62138197c.20710357.04234751.44724204.20083012.51632974.31990811.08404","category":"obfuscation","line_end":73,"severity":"high","line_start":73},{"id":"obfuscation:assets/app-icons.ts:15:heuristic-extremely-long-line-9934-chars-likely-","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Extremely long line (9934 chars) - likely obfuscated","snippet":"export const notion = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAQAAACTbf5ZAAAACXBIWXM","category":"obfuscation","line_end":15,"severity":"high","line_start":15},{"id":"obfuscation:assets/app-icons.ts:1:heuristic-high-file-entropy-6-01-bits-possible-b","file":"assets/app-icons.ts","pattern":"[HEURISTIC] High file entropy (6.01 bits) - possible binary/encrypted content","snippet":"File: assets/app-icons.ts","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/film.mjs:1:heuristic-multiple-bracket-chains-11-jsfuck-obfu","file":"scripts/film.mjs","pattern":"[HEURISTIC] Multiple bracket chains (11) - JSFuck/obfuscation pattern","snippet":")))), [])[, ])))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/film-checks.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"scripts/film-checks.mjs","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":"})(), })(), ()))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:package-lock.json:487:heuristic-very-high-entropy-string-5-50-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.50 bits) - likely encoded/encrypted payload","snippet":"sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/...","category":"obfuscation","line_end":487,"severity":"high","line_start":487},{"id":"obfuscation:package-lock.json:903:heuristic-very-high-entropy-string-5-50-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.50 bits) - likely encoded/encrypted payload","snippet":"sha512-BI6/H7q3aP0I7S7GOrjyxTjgEJlSnovXE38+bdxBpuKN6z+d//uF+T+VQ3Q7ltJL/71p17ufa...","category":"obfuscation","line_end":903,"severity":"high","line_start":903},{"id":"obfuscation:package-lock.json:1085:heuristic-very-high-entropy-string-5-50-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.50 bits) - likely encoded/encrypted payload","snippet":"sha512-8sT9PemIZfIMED4Vd4KGoOXVDj5CMSWNcGdbheRUx9TYS03yOWdT2Q0lXPyEyNBB9YTilwewI...","category":"obfuscation","line_end":1085,"severity":"high","line_start":1085},{"id":"obfuscation:package-lock.json:1253:heuristic-very-high-entropy-string-5-50-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.50 bits) - likely encoded/encrypted payload","snippet":"sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdE...","category":"obfuscation","line_end":1253,"severity":"high","line_start":1253},{"id":"obfuscation:package-lock.json:521:heuristic-very-high-entropy-string-5-51-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.51 bits) - likely encoded/encrypted payload","snippet":"sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8H...","category":"obfuscation","line_end":521,"severity":"high","line_start":521},{"id":"obfuscation:package-lock.json:691:heuristic-very-high-entropy-string-5-51-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.51 bits) - likely encoded/encrypted payload","snippet":"sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP...","category":"obfuscation","line_end":691,"severity":"high","line_start":691},{"id":"obfuscation:package-lock.json:931:heuristic-very-high-entropy-string-5-51-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.51 bits) - likely encoded/encrypted payload","snippet":"sha512-s8QTcZWgrl9haFzEGIqyE5BWyo89pFDGLMBFZ752WYxk8DJwNU/O1X6pZgPw829d9/sm6CCHy...","category":"obfuscation","line_end":931,"severity":"high","line_start":931},{"id":"obfuscation:package-lock.json:1057:heuristic-very-high-entropy-string-5-51-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.51 bits) - likely encoded/encrypted payload","snippet":"sha512-KvNDC0J6s4vVHhtJ6KrDXU0Er0au/hmRIBq/+1maCV8TseGupeKizq0bWcrbp2HE1T8xoknvN...","category":"obfuscation","line_end":1057,"severity":"high","line_start":1057},{"id":"obfuscation:package-lock.json:1821:heuristic-very-high-entropy-string-5-51-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.51 bits) - likely encoded/encrypted payload","snippet":"sha512-t8wonIOdQyOjtPd2VktlBu6QjTVTks6v8bSi7kd0r2Vll8TK1JYDZtRRdbmCHOAMphkZgrzK+...","category":"obfuscation","line_end":1821,"severity":"high","line_start":1821},{"id":"obfuscation:package-lock.json:50:heuristic-very-high-entropy-string-5-52-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.52 bits) - likely encoded/encrypted payload","snippet":"sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7...","category":"obfuscation","line_end":50,"severity":"high","line_start":50},{"id":"obfuscation:package-lock.json:108:heuristic-very-high-entropy-string-5-52-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.52 bits) - likely encoded/encrypted payload","snippet":"sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xr...","category":"obfuscation","line_end":108,"severity":"high","line_start":108},{"id":"obfuscation:package-lock.json:237:heuristic-very-high-entropy-string-5-52-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.52 bits) - likely encoded/encrypted payload","snippet":"sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk...","category":"obfuscation","line_end":237,"severity":"high","line_start":237},{"id":"obfuscation:package-lock.json:269:heuristic-very-high-entropy-string-5-52-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.52 bits) - likely encoded/encrypted payload","snippet":"sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N...","category":"obfuscation","line_end":269,"severity":"high","line_start":269},{"id":"obfuscation:package-lock.json:770:heuristic-very-high-entropy-string-5-52-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.52 bits) - likely encoded/encrypted payload","snippet":"sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx...","category":"obfuscation","line_end":770,"severity":"high","line_start":770},{"id":"obfuscation:package-lock.json:917:heuristic-very-high-entropy-string-5-52-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.52 bits) - likely encoded/encrypted payload","snippet":"sha512-W1vUprf09RWaVWnsFP1vlUkEWJzTZlpObOEAYZXt9Fq0UVAOYEkeGr7wBX7McKqqIQskXdBnp...","category":"obfuscation","line_end":917,"severity":"high","line_start":917},{"id":"obfuscation:package-lock.json:1155:heuristic-very-high-entropy-string-5-52-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.52 bits) - likely encoded/encrypted payload","snippet":"sha512-XfKYFWHIPs4HPODIMsGF1IKlS3H1e3WokUZIgpmn4+uNnZBlnRDDHEylNyazbQXwhMKZre68O...","category":"obfuscation","line_end":1155,"severity":"high","line_start":1155},{"id":"obfuscation:package-lock.json:1183:heuristic-very-high-entropy-string-5-52-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.52 bits) - likely encoded/encrypted payload","snippet":"sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgN...","category":"obfuscation","line_end":1183,"severity":"high","line_start":1183},{"id":"obfuscation:package-lock.json:1197:heuristic-very-high-entropy-string-5-52-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.52 bits) - likely encoded/encrypted payload","snippet":"sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY1...","category":"obfuscation","line_end":1197,"severity":"high","line_start":1197},{"id":"obfuscation:package-lock.json:1474:heuristic-very-high-entropy-string-5-52-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.52 bits) - likely encoded/encrypted payload","snippet":"sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k021...","category":"obfuscation","line_end":1474,"severity":"high","line_start":1474},{"id":"obfuscation:package-lock.json:538:heuristic-very-high-entropy-string-5-53-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.53 bits) - likely encoded/encrypted payload","snippet":"sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZK...","category":"obfuscation","line_end":538,"severity":"high","line_start":538},{"id":"obfuscation:package-lock.json:589:heuristic-very-high-entropy-string-5-53-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.53 bits) - likely encoded/encrypted payload","snippet":"sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMIn...","category":"obfuscation","line_end":589,"severity":"high","line_start":589},{"id":"obfuscation:package-lock.json:674:heuristic-very-high-entropy-string-5-53-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.53 bits) - likely encoded/encrypted payload","snippet":"sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxM...","category":"obfuscation","line_end":674,"severity":"high","line_start":674},{"id":"obfuscation:package-lock.json:1284:heuristic-very-high-entropy-string-5-53-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.53 bits) - likely encoded/encrypted payload","snippet":"sha512-yiVKDX+qCMRKBE084lXvq9EcwFUhKZ2nU8TK1EQQuOgPNR/lmbGxXOeDdlGUqC2Zz11Cs9rk1...","category":"obfuscation","line_end":1284,"severity":"high","line_start":1284},{"id":"obfuscation:package-lock.json:187:heuristic-very-high-entropy-string-5-54-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90N...","category":"obfuscation","line_end":187,"severity":"high","line_start":187},{"id":"obfuscation:package-lock.json:385:heuristic-very-high-entropy-string-5-54-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqF...","category":"obfuscation","line_end":385,"severity":"high","line_start":385},{"id":"obfuscation:package-lock.json:402:heuristic-very-high-entropy-string-5-54-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3y...","category":"obfuscation","line_end":402,"severity":"high","line_start":402},{"id":"obfuscation:package-lock.json:453:heuristic-very-high-entropy-string-5-54-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2Se...","category":"obfuscation","line_end":453,"severity":"high","line_start":453},{"id":"obfuscation:package-lock.json:781:heuristic-very-high-entropy-string-5-54-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5h...","category":"obfuscation","line_end":781,"severity":"high","line_start":781},{"id":"obfuscation:package-lock.json:1029:heuristic-very-high-entropy-string-5-54-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"sha512-Vblw84TbX7RS4la1Y4+yQ7aore/oSyaNtFbppuBr5Vs/4LfBeXKq9dIfoExw6zOvRERqd2rRA...","category":"obfuscation","line_end":1029,"severity":"high","line_start":1029},{"id":"obfuscation:package-lock.json:1263:heuristic-very-high-entropy-string-5-54-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCU...","category":"obfuscation","line_end":1263,"severity":"high","line_start":1263},{"id":"obfuscation:package-lock.json:1715:heuristic-very-high-entropy-string-5-54-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"sha512-QVCvQUTGDN6JRwi3jVGCY3H4aTHvi9rX0LyoBMkGUvdh/Z6O51CzcLz85BWZaTCDGhl6ySGqY...","category":"obfuscation","line_end":1715,"severity":"high","line_start":1715},{"id":"obfuscation:package-lock.json:1761:heuristic-very-high-entropy-string-5-54-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/...","category":"obfuscation","line_end":1761,"severity":"high","line_start":1761},{"id":"obfuscation:package-lock.json:135:heuristic-very-high-entropy-string-5-55-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.55 bits) - likely encoded/encrypted payload","snippet":"sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/Em...","category":"obfuscation","line_end":135,"severity":"high","line_start":135},{"id":"obfuscation:package-lock.json:317:heuristic-very-high-entropy-string-5-55-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.55 bits) - likely encoded/encrypted payload","snippet":"sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOBy...","category":"obfuscation","line_end":317,"severity":"high","line_start":317},{"id":"obfuscation:package-lock.json:470:heuristic-very-high-entropy-string-5-55-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.55 bits) - likely encoded/encrypted payload","snippet":"sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKT...","category":"obfuscation","line_end":470,"severity":"high","line_start":470},{"id":"obfuscation:package-lock.json:759:heuristic-very-high-entropy-string-5-55-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.55 bits) - likely encoded/encrypted payload","snippet":"sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+...","category":"obfuscation","line_end":759,"severity":"high","line_start":759},{"id":"obfuscation:package-lock.json:826:heuristic-very-high-entropy-string-5-55-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.55 bits) - likely encoded/encrypted payload","snippet":"sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2F...","category":"obfuscation","line_end":826,"severity":"high","line_start":826},{"id":"obfuscation:package-lock.json:1331:heuristic-very-high-entropy-string-5-55-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.55 bits) - likely encoded/encrypted payload","snippet":"sha512-LFUqIIAwpzsIuevnKnsR9qnStBcgzPShTX61lBwN9uFkkf8o8zLiebEjbW8AYtZiF+1YKDWfd...","category":"obfuscation","line_end":1331,"severity":"high","line_start":1331},{"id":"obfuscation:package-lock.json:1456:heuristic-very-high-entropy-string-5-55-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.55 bits) - likely encoded/encrypted payload","snippet":"sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiw...","category":"obfuscation","line_end":1456,"severity":"high","line_start":1456},{"id":"obfuscation:package-lock.json:708:heuristic-very-high-entropy-string-5-56-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.56 bits) - likely encoded/encrypted payload","snippet":"sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKeb...","category":"obfuscation","line_end":708,"severity":"high","line_start":708},{"id":"obfuscation:package-lock.json:959:heuristic-very-high-entropy-string-5-56-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.56 bits) - likely encoded/encrypted payload","snippet":"sha512-926SMeUcy4y18Rz/w2aJiUKOnyAnm6czg72bXkQEaeemsll+Wr0hnsjb2BGRpHvWgwAMYy5AC...","category":"obfuscation","line_end":959,"severity":"high","line_start":959},{"id":"obfuscation:package-lock.json:1379:heuristic-very-high-entropy-string-5-56-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.56 bits) - likely encoded/encrypted payload","snippet":"sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9...","category":"obfuscation","line_end":1379,"severity":"high","line_start":1379},{"id":"obfuscation:package-lock.json:1770:heuristic-very-high-entropy-string-5-56-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.56 bits) - likely encoded/encrypted payload","snippet":"sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArR...","category":"obfuscation","line_end":1770,"severity":"high","line_start":1770},{"id":"obfuscation:package-lock.json:657:heuristic-very-high-entropy-string-5-57-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.57 bits) - likely encoded/encrypted payload","snippet":"sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGX...","category":"obfuscation","line_end":657,"severity":"high","line_start":657},{"id":"obfuscation:package-lock.json:1651:heuristic-very-high-entropy-string-5-57-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.57 bits) - likely encoded/encrypted payload","snippet":"sha512-YUbWYCgErwnMAVkjUnYa+KlMBzGpHwiIt/DE7f0G33AuX2LH9UcTk6KgWxd3zRU+pN3u/C+Xl...","category":"obfuscation","line_end":1651,"severity":"high","line_start":1651},{"id":"obfuscation:package-lock.json:1790:heuristic-very-high-entropy-string-5-57-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.57 bits) - likely encoded/encrypted payload","snippet":"sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65...","category":"obfuscation","line_end":1790,"severity":"high","line_start":1790},{"id":"obfuscation:package-lock.json:303:heuristic-very-high-entropy-string-5-58-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.58 bits) - likely encoded/encrypted payload","snippet":"sha512-WCsemW40Cpc6gouC1SrY6PBaZ+oLRlEVY9XBvZBI7il/HyUrb2nJ505wE1MHEFyDZNnrWDEuy...","category":"obfuscation","line_end":303,"severity":"high","line_start":303},{"id":"obfuscation:package-lock.json:555:heuristic-very-high-entropy-string-5-58-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.58 bits) - likely encoded/encrypted payload","snippet":"sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxF...","category":"obfuscation","line_end":555,"severity":"high","line_start":555},{"id":"obfuscation:package-lock.json:1043:heuristic-very-high-entropy-string-5-58-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.58 bits) - likely encoded/encrypted payload","snippet":"sha512-7+gHjtONvKgwR9InTKFaLq53f6YzBJkgeMRBENdWTsQr+spahGqQm8HF5aXpq8i4JaRrOqYyv...","category":"obfuscation","line_end":1043,"severity":"high","line_start":1043},{"id":"obfuscation:package-lock.json:606:heuristic-very-high-entropy-string-5-59-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.59 bits) - likely encoded/encrypted payload","snippet":"sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoe...","category":"obfuscation","line_end":606,"severity":"high","line_start":606},{"id":"obfuscation:package-lock.json:1807:heuristic-very-high-entropy-string-5-59-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.59 bits) - likely encoded/encrypted payload","snippet":"sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhL...","category":"obfuscation","line_end":1807,"severity":"high","line_start":1807},{"id":"obfuscation:package-lock.json:1297:heuristic-very-high-entropy-string-5-60-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.60 bits) - likely encoded/encrypted payload","snippet":"sha512-2TcbbiwXEq+N0kD36tykpCfyyQigUXmuwNQbnPp4Xk4PX9JOqVIKjJlIDjpH7uY6tmRGoAd+a...","category":"obfuscation","line_end":1297,"severity":"high","line_start":1297},{"id":"obfuscation:package-lock.json:35:heuristic-very-high-entropy-string-5-61-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.61 bits) - likely encoded/encrypted payload","snippet":"sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+...","category":"obfuscation","line_end":35,"severity":"high","line_start":35},{"id":"obfuscation:package-lock.json:1705:heuristic-very-high-entropy-string-5-61-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.61 bits) - likely encoded/encrypted payload","snippet":"sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0W...","category":"obfuscation","line_end":1705,"severity":"high","line_start":1705},{"id":"obfuscation:package-lock.json:623:heuristic-very-high-entropy-string-5-62-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.62 bits) - likely encoded/encrypted payload","snippet":"sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9Bz...","category":"obfuscation","line_end":623,"severity":"high","line_start":623},{"id":"obfuscation:package-lock.json:1218:heuristic-very-high-entropy-string-5-62-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.62 bits) - likely encoded/encrypted payload","snippet":"sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNS...","category":"obfuscation","line_end":1218,"severity":"high","line_start":1218},{"id":"obfuscation:package-lock.json:1228:heuristic-very-high-entropy-string-5-62-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.62 bits) - likely encoded/encrypted payload","snippet":"sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8X...","category":"obfuscation","line_end":1228,"severity":"high","line_start":1228},{"id":"obfuscation:package-lock.json:149:heuristic-very-high-entropy-string-5-63-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.63 bits) - likely encoded/encrypted payload","snippet":"sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYot...","category":"obfuscation","line_end":149,"severity":"high","line_start":149},{"id":"obfuscation:package-lock.json:1553:heuristic-very-high-entropy-string-5-63-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.63 bits) - likely encoded/encrypted payload","snippet":"sha512-6koYRhnM2N0GGZIdXzSeiNwguv1gt/FAjZOiPl76roBi3xKEXa4WmfpxgQwTTL4KipXjefrnf...","category":"obfuscation","line_end":1553,"severity":"high","line_start":1553},{"id":"obfuscation:package-lock.json:1372:heuristic-very-high-entropy-string-5-64-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.64 bits) - likely encoded/encrypted payload","snippet":"sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX...","category":"obfuscation","line_end":1372,"severity":"high","line_start":1372},{"id":"obfuscation:package-lock.json:1543:heuristic-very-high-entropy-string-5-64-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.64 bits) - likely encoded/encrypted payload","snippet":"sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI...","category":"obfuscation","line_end":1543,"severity":"high","line_start":1543},{"id":"obfuscation:package-lock.json:351:heuristic-very-high-entropy-string-5-65-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.65 bits) - likely encoded/encrypted payload","snippet":"sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ...","category":"obfuscation","line_end":351,"severity":"high","line_start":351},{"id":"obfuscation:package-lock.json:889:heuristic-very-high-entropy-string-5-65-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.65 bits) - likely encoded/encrypted payload","snippet":"sha512-A0NfMj6Cuh/9BE5k3awJKv6HoxFVXIcLAb6SZqAMoxUHPA1ZNNK4RsGuUPD/vL7nEAm9LG+Zz...","category":"obfuscation","line_end":889,"severity":"high","line_start":889},{"id":"obfuscation:package-lock.json:1127:heuristic-very-high-entropy-string-5-66-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.66 bits) - likely encoded/encrypted payload","snippet":"sha512-ArwvgFAbjKcDM7qqotZ4OVYf+UMT9xH2YzkCzK4+AuZSDihMlz1Ekoe4INwBVXzn2mnJzuIYO...","category":"obfuscation","line_end":1127,"severity":"high","line_start":1127},{"id":"obfuscation:package-lock.json:1531:heuristic-very-high-entropy-string-5-66-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.66 bits) - likely encoded/encrypted payload","snippet":"sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UI...","category":"obfuscation","line_end":1531,"severity":"high","line_start":1531},{"id":"obfuscation:assets/app-icons.ts:5:heuristic-very-high-entropy-string-6-00-bits-lik","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Very high entropy string (6.00 bits) - likely encoded/encrypted payload","snippet":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAYAAAA5ZDbSAAApeUlEQVR4nO...","category":"obfuscation","line_end":5,"severity":"high","line_start":5},{"id":"obfuscation:assets/app-icons.ts:7:heuristic-very-high-entropy-string-6-00-bits-lik","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Very high entropy string (6.00 bits) - likely encoded/encrypted payload","snippet":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAYAAAA5ZDbSAAAgS0lEQVR4nO...","category":"obfuscation","line_end":7,"severity":"high","line_start":7},{"id":"obfuscation:assets/app-icons.ts:9:heuristic-very-high-entropy-string-6-00-bits-lik","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Very high entropy string (6.00 bits) - likely encoded/encrypted payload","snippet":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAYAAAA5ZDbSAABAIklEQVR4nO...","category":"obfuscation","line_end":9,"severity":"high","line_start":9},{"id":"obfuscation:assets/app-icons.ts:11:heuristic-very-high-entropy-string-6-00-bits-lik","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Very high entropy string (6.00 bits) - likely encoded/encrypted payload","snippet":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAYAAAA5ZDbSAAAjD0lEQVR4nO...","category":"obfuscation","line_end":11,"severity":"high","line_start":11},{"id":"obfuscation:assets/app-icons.ts:13:heuristic-very-high-entropy-string-6-00-bits-lik","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Very high entropy string (6.00 bits) - likely encoded/encrypted payload","snippet":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAYAAAA5ZDbSAAAACXBIWXMAAA...","category":"obfuscation","line_end":13,"severity":"high","line_start":13},{"id":"obfuscation:assets/app-icons.ts:15:heuristic-very-high-entropy-string-6-00-bits-lik","file":"assets/app-icons.ts","pattern":"[HEURISTIC] Very high entropy string (6.00 bits) - likely encoded/encrypted payload","snippet":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAB4CAQAAACTbf5ZAAAACXBIWXMAAA...","category":"obfuscation","line_end":15,"severity":"high","line_start":15},{"id":"env_access:examples/ruled-bento/index.tsx:96:database-connection-strings","file":"examples/ruled-bento/index.tsx","pattern":"Database connection strings","snippet":"<span className=\"dim\">{wide ? 'DATABASE_URL  ' : ''}</span>","category":"env_access","line_end":96,"severity":"high","line_start":96},{"id":"external_commands:scripts/dev.mjs:2:node-js-child-process-module","file":"scripts/dev.mjs","pattern":"Node.js child_process module","snippet":"import { spawn } from 'node:child_process'","category":"external_commands","line_end":2,"severity":"high","line_start":2},{"id":"external_commands:scripts/film.mjs:125:node-js-child-process-module","file":"scripts/film.mjs","pattern":"Node.js child_process module","snippet":"import { spawnSync } from 'node:child_process'","category":"external_commands","line_end":125,"severity":"high","line_start":125},{"id":"filesystem:examples/ai-cards/index.tsx:1:path-traversal-sequence","file":"examples/ai-cards/index.tsx","pattern":"Path traversal sequence","snippet":"import { Bar, Check, Collapse, Field, Stage, Text, Window, type Act } from '../../kit'","category":"filesystem","line_end":1,"severity":"high","line_start":1},{"id":"filesystem:examples/ai-chat/index.tsx:11:path-traversal-sequence","file":"examples/ai-chat/index.tsx","pattern":"Path traversal sequence","snippet":"} from \"../../kit\";","category":"filesystem","line_end":11,"severity":"high","line_start":11},{"id":"filesystem:examples/annotations/composed.tsx:2:path-traversal-sequence","file":"examples/annotations/composed.tsx","pattern":"Path traversal sequence","snippet":"import { Connector, Icon, Stage, States, type Act } from '../../kit'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:examples/annotations/index.tsx:2:path-traversal-sequence","file":"examples/annotations/index.tsx","pattern":"Path traversal sequence","snippet":"import { Connector, Follow, Icon, Stage, States, type Act, type Rect } from '../../kit'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:examples/annotations/index.tsx:6:path-traversal-sequence","file":"examples/annotations/index.tsx","pattern":"Path traversal sequence","snippet":"const lakePhoto = new URL('../wikipedia/kawaguchiko.jpg', import.meta.url).href","category":"filesystem","line_end":6,"severity":"high","line_start":6},{"id":"filesystem:examples/backgrounds/index.tsx:2:path-traversal-sequence","file":"examples/backgrounds/index.tsx","pattern":"Path traversal sequence","snippet":"import { Icon, Stage } from '../../kit'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:examples/bento/index.tsx:2:path-traversal-sequence","file":"examples/bento/index.tsx","pattern":"Path traversal sequence","snippet":"import { Avatar, Badge, Bar, BrandMark, Icon, Meter, Connector, Count, Stage, States, Text, Window, ","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:examples/bento/index.tsx:3:path-traversal-sequence","file":"examples/bento/index.tsx","pattern":"Path traversal sequence","snippet":"import type { Act, Layout, Rect } from '../../kit'","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:examples/bento/index.tsx:4:path-traversal-sequence","file":"examples/bento/index.tsx","pattern":"Path traversal sequence","snippet":"import { figma, notion, slack } from '../../assets/app-icons'","category":"filesystem","line_end":4,"severity":"high","line_start":4},{"id":"filesystem:examples/brand-marks/index.tsx:2:path-traversal-sequence","file":"examples/brand-marks/index.tsx","pattern":"Path traversal sequence","snippet":"import { BrandMark, Stage, brandMarks, type BrandName } from '../../kit'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:kit/controls/Field.tsx:2:path-traversal-sequence","file":"kit/controls/Field.tsx","pattern":"Path traversal sequence","snippet":"import { Icon } from '../parts/Icon'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:kit/controls/Segmented.tsx:2:path-traversal-sequence","file":"kit/controls/Segmented.tsx","pattern":"Path traversal sequence","snippet":"import type { CursorKind } from '../cursor'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:kit/motion/Camera.tsx:2:path-traversal-sequence","file":"kit/motion/Camera.tsx","pattern":"Path traversal sequence","snippet":"import { useReducedMotion } from '../reduced-motion'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:kit/motion/Camera.tsx:3:path-traversal-sequence","file":"kit/motion/Camera.tsx","pattern":"Path traversal sequence","snippet":"import type { Rect } from '../measure'","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:kit/motion/Camera.tsx:4:path-traversal-sequence","file":"kit/motion/Camera.tsx","pattern":"Path traversal sequence","snippet":"import { css, type Bezier, type EaseName } from '../ease'","category":"filesystem","line_end":4,"severity":"high","line_start":4},{"id":"filesystem:kit/motion/Connector.tsx:2:path-traversal-sequence","file":"kit/motion/Connector.tsx","pattern":"Path traversal sequence","snippet":"import type { Point } from '../measure'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:kit/motion/Count.tsx:2:path-traversal-sequence","file":"kit/motion/Count.tsx","pattern":"Path traversal sequence","snippet":"import { useReducedMotion } from '../reduced-motion'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:kit/motion/Expand.tsx:2:path-traversal-sequence","file":"kit/motion/Expand.tsx","pattern":"Path traversal sequence","snippet":"import { useReducedMotion } from '../reduced-motion'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:kit/motion/Expand.tsx:3:path-traversal-sequence","file":"kit/motion/Expand.tsx","pattern":"Path traversal sequence","snippet":"import type { Rect } from '../measure'","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:kit/motion/Fly.tsx:2:path-traversal-sequence","file":"kit/motion/Fly.tsx","pattern":"Path traversal sequence","snippet":"import { useReducedMotion } from '../reduced-motion'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:playground/catalog.ts:86:path-traversal-sequence","file":"playground/catalog.ts","pattern":"Path traversal sequence","snippet":"const extra = Object.keys(import.meta.glob('../examples/*/index.tsx'))","category":"filesystem","line_end":86,"severity":"high","line_start":86},{"id":"filesystem:playground/main.tsx:1:path-traversal-sequence","file":"playground/main.tsx","pattern":"Path traversal sequence","snippet":"import { installVirtualClock } from '../kit/clock'","category":"filesystem","line_end":1,"severity":"high","line_start":1},{"id":"filesystem:playground/preview.tsx:3:path-traversal-sequence","file":"playground/preview.tsx","pattern":"Path traversal sequence","snippet":"import { StillContext } from '../kit/reduced-motion'","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:playground/preview.tsx:6:path-traversal-sequence","file":"playground/preview.tsx","pattern":"Path traversal sequence","snippet":"const modules = import.meta.glob<{ default: React.ComponentType }>('../examples/*/index.tsx')","category":"filesystem","line_end":6,"severity":"high","line_start":6},{"id":"filesystem:playground/preview.tsx:14:path-traversal-sequence","file":"playground/preview.tsx","pattern":"Path traversal sequence","snippet":"const load = name === 'contrasts' ? () => import('../teaching/contrasts') : modules[`../examples/${n","category":"filesystem","line_end":14,"severity":"high","line_start":14},{"id":"filesystem:playground/tsconfig.json:3:path-traversal-sequence","file":"playground/tsconfig.json","pattern":"Path traversal sequence","snippet":"\"include\": [\".\", \"../kit\", \"../examples\", \"../teaching\"]","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:teaching/composition.tsx:1:path-traversal-sequence","file":"teaching/composition.tsx","pattern":"Path traversal sequence","snippet":"import { Avatar, Row, Stage } from '../kit'","category":"filesystem","line_end":1,"severity":"high","line_start":1},{"id":"filesystem:teaching/continuity.tsx:2:path-traversal-sequence","file":"teaching/continuity.tsx","pattern":"Path traversal sequence","snippet":"import { Roll, Stage, type Act } from '../kit'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:teaching/continuity.tsx:3:path-traversal-sequence","file":"teaching/continuity.tsx","pattern":"Path traversal sequence","snippet":"import { MacPointer } from '../kit/cursors'","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:teaching/continuity.tsx:4:path-traversal-sequence","file":"teaching/continuity.tsx","pattern":"Path traversal sequence","snippet":"import { Cursor } from '../kit/cursor'","category":"filesystem","line_end":4,"severity":"high","line_start":4},{"id":"filesystem:teaching/contrasts.tsx:2:path-traversal-sequence","file":"teaching/contrasts.tsx","pattern":"Path traversal sequence","snippet":"import { Collapse, Fly, Roll, Stage, type Act, type Rect } from '../kit'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:teaching/contrasts.tsx:3:path-traversal-sequence","file":"teaching/contrasts.tsx","pattern":"Path traversal sequence","snippet":"import { MacPointer } from '../kit/cursors'","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:teaching/contrasts.tsx:13:path-traversal-sequence","file":"teaching/contrasts.tsx","pattern":"Path traversal sequence","snippet":"import { ChoreographyComparison, choreographyLessons } from '../examples/choreography'","category":"filesystem","line_end":13,"severity":"high","line_start":13},{"id":"filesystem:teaching/details.tsx:3:path-traversal-sequence","file":"teaching/details.tsx","pattern":"Path traversal sequence","snippet":"import { Stage, type Act } from '../kit'","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:teaching/edges.tsx:2:path-traversal-sequence","file":"teaching/edges.tsx","pattern":"Path traversal sequence","snippet":"import { Stage, type Act } from '../kit'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"filesystem:teaching/relationships.tsx:2:path-traversal-sequence","file":"teaching/relationships.tsx","pattern":"Path traversal sequence","snippet":"import { Collapse, Roll, Stage, type Act } from '../kit'","category":"filesystem","line_end":2,"severity":"high","line_start":2},{"id":"external_commands:kit/code.tsx:24:process-exec","file":"kit/code.tsx","pattern":"Process exec","snippet":"while ((m = re.exec(line))) {","category":"external_commands","line_end":24,"severity":"high","line_start":24},{"id":"external_commands:kit/motion/Count.tsx:25:process-exec","file":"kit/motion/Count.tsx","pattern":"Process exec","snippet":"const m = /^(.*\\d)(\\s*)([^\\d\\s.,]+)$/.exec(text)","category":"external_commands","line_end":25,"severity":"high","line_start":25},{"id":"external_commands:scripts/dev.mjs:46:process-spawn","file":"scripts/dev.mjs","pattern":"Process spawn","snippet":"const child = spawn(command.command, command.args, { cwd: command.cwd, stdio: 'inherit', shell: fals","category":"external_commands","line_end":46,"severity":"high","line_start":46},{"id":"scripts:kit/code.tsx:24:python-exec-function","file":"kit/code.tsx","pattern":"Python exec() function","snippet":"while ((m = re.exec(line))) {","category":"scripts","line_end":24,"severity":"high","line_start":24},{"id":"scripts:kit/motion/Count.tsx:25:python-exec-function","file":"kit/motion/Count.tsx","pattern":"Python exec() function","snippet":"const m = /^(.*\\d)(\\s*)([^\\d\\s.,]+)$/.exec(text)","category":"scripts","line_end":25,"severity":"high","line_start":25},{"id":"external_commands:scripts/film.mjs:136:synchronous-spawn","file":"scripts/film.mjs","pattern":"Synchronous spawn","snippet":"last = spawnSync(process.execPath, process.argv.slice(1), { env: { ...process.env, FILM_CHILD: '1' }","category":"external_commands","line_end":136,"severity":"high","line_start":136},{"id":"blocker:examples/backgrounds/index.tsx:32:at-command-scheduling","file":"examples/backgrounds/index.tsx","pattern":"at command scheduling","snippet":"<div className=\"bg-digest-heading\"><span className=\"bg-digest-icon\"><Icon name=\"calendar\" size={18} ","category":"blocker","line_end":32,"severity":"medium","line_start":32},{"id":"blocker:examples/bento/bento.css:5:at-command-scheduling","file":"examples/bento/bento.css","pattern":"at command scheduling","snippet":"queries on the section); each picture is its own Stage at 1:1, pinned to","category":"blocker","line_end":5,"severity":"medium","line_start":5},{"id":"blocker:examples/bento/index.tsx:20:at-command-scheduling","file":"examples/bento/index.tsx","pattern":"at command scheduling","snippet":"// kind, across and down. Each picture is its own Stage at 1:1, pinned to its","category":"blocker","line_end":20,"severity":"medium","line_start":20},{"id":"blocker:examples/ruled-bento/grid.css:6:at-command-scheduling","file":"examples/ruled-bento/grid.css","pattern":"at command scheduling","snippet":"Stage at 1:1, pinned to its cell's bottom and cropped by the cell. */","category":"blocker","line_end":6,"severity":"medium","line_start":6},{"id":"blocker:examples/ruled-bento/index.tsx:19:at-command-scheduling","file":"examples/ruled-bento/index.tsx","pattern":"at command scheduling","snippet":"// to itself. Each picture is its own Stage at 1:1, pinned to its cell's","category":"blocker","line_end":19,"severity":"medium","line_start":19},{"id":"blocker:examples/ruled-bento/index.tsx:243:at-command-scheduling","file":"examples/ruled-bento/index.tsx","pattern":"at command scheduling","snippet":"// Two minutes a bar from 13:00: the handle stops at 14:02, the table went at 14:04","category":"blocker","line_end":243,"severity":"medium","line_start":243},{"id":"blocker:examples/staggered-bento/grid.css:6:at-command-scheduling","file":"examples/staggered-bento/grid.css","pattern":"at command scheduling","snippet":"picture is its own Stage at 1:1, pinned to its tile's bottom. */","category":"blocker","line_end":6,"severity":"medium","line_start":6},{"id":"blocker:examples/staggered-bento/index.tsx:20:at-command-scheduling","file":"examples/staggered-bento/index.tsx","pattern":"at command scheduling","snippet":"// Each picture is its own Stage at 1:1, pinned to its tile's bottom. The","category":"blocker","line_end":20,"severity":"medium","line_start":20},{"id":"blocker:references/bento.md:20:at-command-scheduling","file":"references/bento.md","pattern":"at command scheduling","snippet":"12. **Shown at 1:1, one Stage per tile.** Each picture is its own `Stage`; the copy is page HTML bes","category":"blocker","line_end":20,"severity":"medium","line_start":20},{"id":"blocker:references/framing.md:38:at-command-scheduling","file":"references/framing.md","pattern":"at command scheduling","snippet":"| **Wide hero** | A 900 to 1100px window at 1:1, inset top, off the bottom and often both sides; rea","category":"blocker","line_end":38,"severity":"medium","line_start":38},{"id":"blocker:SKILL.md:34:at-command-scheduling","file":"SKILL.md","pattern":"at command scheduling","snippet":"1. **Medium and place.** Still or animation (loop, once in view, or hover). The page, its ground, it","category":"blocker","line_end":34,"severity":"medium","line_start":34},{"id":"blocker:examples/phones/index.tsx:16:template-injection-targeting-system-prompt","file":"examples/phones/index.tsx","pattern":"Template injection targeting system prompt","snippet":"<div style={{ font: '500 22px system-ui', textAlign: 'center', color: '#55607a' }}>Oak dining chair<","category":"blocker","line_end":16,"severity":"medium","line_start":16},{"id":"blocker:examples/phones/index.tsx:47:template-injection-targeting-system-prompt","file":"examples/phones/index.tsx","pattern":"Template injection targeting system prompt","snippet":"<div key={frame} style={{ display: 'grid', gap: 10, justifyItems: 'center', font: '500 12px system-u","category":"blocker","line_end":47,"severity":"medium","line_start":47},{"id":"sensitive:examples/dark-bento/bento.css:2:sqlite-database-file","file":"examples/dark-bento/bento.css","pattern":"SQLite database file","snippet":".db-card {","category":"sensitive","line_end":2,"severity":"medium","line_start":2},{"id":"sensitive:examples/dark-bento/bento.css:22:sqlite-database-file","file":"examples/dark-bento/bento.css","pattern":"SQLite database file","snippet":".db-window {","category":"sensitive","line_end":22,"severity":"medium","line_start":22},{"id":"sensitive:examples/dark-bento/bento.css:33:sqlite-database-file","file":"examples/dark-bento/bento.css","pattern":"SQLite database file","snippet":".db-window .ss-window__body {","category":"sensitive","line_end":33,"severity":"medium","line_start":33},{"id":"sensitive:examples/dark-bento/bento.css:37:sqlite-database-file","file":"examples/dark-bento/bento.css","pattern":"SQLite database file","snippet":".db-sidebar {","category":"sensitive","line_end":37,"severity":"medium","line_start":37},{"id":"sensitive:examples/dark-bento/bento.css:48:sqlite-database-file","file":"examples/dark-bento/bento.css","pattern":"SQLite database file","snippet":".db-nav {","category":"sensitive","line_end":48,"severity":"medium","line_start":48},{"id":"sensitive:examples/dark-bento/bento.css:56:sqlite-database-file","file":"examples/dark-bento/bento.css","pattern":"SQLite database file","snippet":".db-main {","category":"sensitive","line_end":56,"severity":"medium","line_start":56},{"id":"sensitive:examples/dark-bento/bento.css:62:sqlite-database-file","file":"examples/dark-bento/bento.css","pattern":"SQLite database file","snippet":".db-header {","category":"sensitive","line_end":62,"severity":"medium","line_start":62},{"id":"sensitive:examples/dark-bento/bento.css:69:sqlite-database-file","file":"examples/dark-bento/bento.css","pattern":"SQLite database file","snippet":".db-heading {","category":"sensitive","line_end":69,"severity":"medium","line_start":69},{"id":"sensitive:examples/dark-bento/bento.css:76:sqlite-database-file","file":"examples/dark-bento/bento.css","pattern":"SQLite database file","snippet":".db-title {","category":"sensitive","line_end":76,"severity":"medium","line_start":76},{"id":"sensitive:examples/dark-bento/bento.css:88:sqlite-database-file","file":"examples/dark-bento/bento.css","pattern":"SQLite database file","snippet":".db-art {","category":"sensitive","line_end":88,"severity":"medium","line_start":88},{"id":"sensitive:teaching/details.css:62:sqlite-database-file","file":"teaching/details.css","pattern":"SQLite database file","snippet":".tc-lessons .db-screen { align-self: start; width: 300px; height: 280px; margin-top: 20px; border-ra","category":"sensitive","line_end":62,"severity":"medium","line_start":62},{"id":"sensitive:teaching/details.css:63:sqlite-database-file","file":"teaching/details.css","pattern":"SQLite database file","snippet":".tc-lessons .db-top { display: flex; justify-content: space-between; padding: 14px 14px 0; }","category":"sensitive","line_end":63,"severity":"medium","line_start":63},{"id":"sensitive:teaching/details.css:64:sqlite-database-file","file":"teaching/details.css","pattern":"SQLite database file","snippet":".tc-lessons .db-round { display: grid; place-items: center; width: 34px; height: 34px; border-radius","category":"sensitive","line_end":64,"severity":"medium","line_start":64},{"id":"sensitive:teaching/details.css:65:sqlite-database-file","file":"teaching/details.css","pattern":"SQLite database file","snippet":".tc-lessons .db-title { padding: 8px 16px 6px; font: 700 26px/32px var(--ss-font); letter-spacing: -","category":"sensitive","line_end":65,"severity":"medium","line_start":65},{"id":"scripts:playground/main.tsx:17:dynamic-import-expression","file":"playground/main.tsx","pattern":"Dynamic import() expression","snippet":"const { mount } = await import('./preview')","category":"scripts","line_end":17,"severity":"medium","line_start":17},{"id":"scripts:playground/main.tsx:22:dynamic-import-expression","file":"playground/main.tsx","pattern":"Dynamic import() expression","snippet":"const { mount } = await import('./viewer')","category":"scripts","line_end":22,"severity":"medium","line_start":22},{"id":"scripts:playground/main.tsx:83:dynamic-import-expression","file":"playground/main.tsx","pattern":"Dynamic import() expression","snippet":"const { mount } = await import('./preview')","category":"scripts","line_end":83,"severity":"medium","line_start":83},{"id":"scripts:playground/preview.tsx:14:dynamic-import-expression","file":"playground/preview.tsx","pattern":"Dynamic import() expression","snippet":"const load = name === 'contrasts' ? () => import('../teaching/contrasts') : modules[`../examples/${n","category":"scripts","line_end":14,"severity":"medium","line_start":14},{"id":"scripts:scripts/browser.mjs:8:dynamic-import-expression","file":"scripts/browser.mjs","pattern":"Dynamic import() expression","snippet":";({ chromium } = await import('playwright-core'))","category":"scripts","line_end":8,"severity":"medium","line_start":8},{"id":"scripts:scripts/class-clash.mjs:36:dynamic-import-expression","file":"scripts/class-clash.mjs","pattern":"Dynamic import() expression","snippet":"const { default: postcss } = await import('postcss').catch(() => { throw new Error('PostCSS is missi","category":"scripts","line_end":36,"severity":"medium","line_start":36},{"id":"scripts:scripts/film.mjs:176:dynamic-import-expression","file":"scripts/film.mjs","pattern":"Dynamic import() expression","snippet":"const head = (await import('node:fs')).readFileSync(new URL(import.meta.url), 'utf8').split('\\n')","category":"scripts","line_end":176,"severity":"medium","line_start":176},{"id":"network:examples/wikipedia/index.tsx:410:hardcoded-ip-address","file":"examples/wikipedia/index.tsx","pattern":"Hardcoded IP address","snippet":"<path d=\"m17.835 19-1.248-3h-4.174l-1.248 3.001H9l4.577-11.005h1.846L20 19zm-4.59-5h2.51L14.5 10.982","category":"network","line_end":410,"severity":"medium","line_start":410},{"id":"network:kit/brands/1password-dark.svg:1:hardcoded-ip-address","file":"kit/brands/1password-dark.svg","pattern":"Hardcoded IP address","snippet":"<svg viewBox=\"0 0 32 32\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlin","category":"network","line_end":1,"severity":"medium","line_start":1},{"id":"network:kit/brands/1password.svg:1:hardcoded-ip-address","file":"kit/brands/1password.svg","pattern":"Hardcoded IP address","snippet":"<svg viewBox=\"0 0 32 32\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlin","category":"network","line_end":1,"severity":"medium","line_start":1},{"id":"network:kit/brands/amex.svg:1:hardcoded-ip-address","file":"kit/brands/amex.svg","pattern":"Hardcoded IP address","snippet":"<svg version=\"1.1\" id=\"Layer_1\" xmlns=\"http://www.w3.org/2000/svg\" x=\"0\" y=\"0\" width=\"45\" height=\"45","category":"network","line_end":1,"severity":"medium","line_start":1},{"id":"network:kit/brands/bankofamerica-dark.svg:1:hardcoded-ip-address","file":"kit/brands/bankofamerica-dark.svg","pattern":"Hardcoded IP address","snippet":"<svg fill=\"#FFFFFF\" role=\"img\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\"><title>Bank of","category":"network","line_end":1,"severity":"medium","line_start":1},{"id":"network:kit/brands/bankofamerica.svg:1:hardcoded-ip-address","file":"kit/brands/bankofamerica.svg","pattern":"Hardcoded IP address","snippet":"<svg fill=\"#012169\" role=\"img\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\"><title>Bank of","category":"network","line_end":1,"severity":"medium","line_start":1},{"id":"network:kit/brands/barclays.svg:1:hardcoded-ip-address","file":"kit/brands/barclays.svg","pattern":"Hardcoded IP address","snippet":"<svg fill=\"#00AEEF\" role=\"img\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\"><title>Barclay","category":"network","line_end":1,"severity":"medium","line_start":1},{"id":"network:kit/brands/bitcoin.svg:1:hardcoded-ip-address","file":"kit/brands/bitcoin.svg","pattern":"Hardcoded IP address","snippet":"<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 32 32\"><g fill=\"none\" fill-rule=\"evenodd\"><circ","category":"network","line_end":1,"severity":"medium","line_start":1},{"id":"network:kit/brands/chase.svg:1:hardcoded-ip-address","file":"kit/brands/chase.svg","pattern":"Hardcoded IP address","snippet":"<svg fill=\"#117ACA\" role=\"img\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\"><title>Chase</","category":"network","line_end":1,"severity":"medium","line_start":1},{"id":"network:kit/brands/monzo-dark.svg:1:hardcoded-ip-address","file":"kit/brands/monzo-dark.svg","pattern":"Hardcoded IP address","snippet":"<svg fill=\"#FFFFFF\" role=\"img\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\"><title>Monzo</","category":"network","line_end":1,"severity":"medium","line_start":1},{"id":"network:kit/brands/monzo.svg:1:hardcoded-ip-address","file":"kit/brands/monzo.svg","pattern":"Hardcoded IP address","snippet":"<svg fill=\"#14233C\" role=\"img\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\"><title>Monzo</","category":"network","line_end":1,"severity":"medium","line_start":1},{"id":"network:playground/vite.config.ts:3:hardcoded-ip-address","file":"playground/vite.config.ts","pattern":"Hardcoded IP address","snippet":"export default defineConfig({ plugins: [react()], build: { target: 'es2022' }, server: { host: '127.","category":"network","line_end":3,"severity":"medium","line_start":3},{"id":"filesystem:kit/ios.tsx:88:hidden-file-access","file":"kit/ios.tsx","pattern":"Hidden file access","snippet":"const auto = typed === '' || /[.!?]\\s$/.test(typed)","category":"filesystem","line_end":88,"severity":"medium","line_start":88},{"id":"filesystem:kit/motion/Count.tsx:25:hidden-file-access","file":"kit/motion/Count.tsx","pattern":"Hidden file access","snippet":"const m = /^(.*\\d)(\\s*)([^\\d\\s.,]+)$/.exec(text)","category":"filesystem","line_end":25,"severity":"medium","line_start":25},{"id":"filesystem:kit/motion/Roll.tsx:76:hidden-file-access","file":"kit/motion/Roll.tsx","pattern":"Hidden file access","snippet":"const flex = /flex/.test(p.display) && p.flexDirection.startsWith('row')","category":"filesystem","line_end":76,"severity":"medium","line_start":76},{"id":"filesystem:kit/motion/Roll.tsx:88:hidden-file-access","file":"kit/motion/Roll.tsx","pattern":"Hidden file access","snippet":"/right|end/.test(getComputedStyle(el).textAlign) ||","category":"filesystem","line_end":88,"severity":"medium","line_start":88},{"id":"filesystem:kit/motion/Roll.tsx:89:hidden-file-access","file":"kit/motion/Roll.tsx","pattern":"Hidden file access","snippet":"(flex && box === parent.lastElementChild && (/space-between|flex-end|^end/.test(p.justifyContent) ||","category":"filesystem","line_end":89,"severity":"medium","line_start":89},{"id":"filesystem:kit/motion/Roll.tsx:106:hidden-file-access","file":"kit/motion/Roll.tsx","pattern":"Hidden file access","snippet":"const numeric = /^[\\d.,$€£%+\\-−\\s]*$/.test(a.slice(head, a.length - tail) + b.slice(head, b.length -","category":"filesystem","line_end":106,"severity":"medium","line_start":106},{"id":"filesystem:kit/motion/Roll.tsx:108:hidden-file-access","file":"kit/motion/Roll.tsx","pattern":"Hidden file access","snippet":"const space = (c: string | undefined) => c === undefined || /\\s/.test(c)","category":"filesystem","line_end":108,"severity":"medium","line_start":108},{"id":"filesystem:scripts/class-clash-core.mjs:90:hidden-file-access","file":"scripts/class-clash-core.mjs","pattern":"Hidden file access","snippet":"const scopedBranch = branch >= 0 && /[.#](-?[_a-zA-Z][\\w-]*)/.test(stripped.slice(0, branch))","category":"filesystem","line_end":90,"severity":"medium","line_start":90},{"id":"filesystem:scripts/class-clash-core.mjs:91:hidden-file-access","file":"scripts/class-clash-core.mjs","pattern":"Hidden file access","snippet":"if (/\\\\|:(?:global|local)\\(/.test(stripped) || branch >= 0 && !scopedBranch) manual.push(`selector a","category":"filesystem","line_end":91,"severity":"medium","line_start":91},{"id":"filesystem:scripts/film-checks.mjs:62:hidden-file-access","file":"scripts/film-checks.mjs","pattern":"Hidden file access","snippet":"if (clipped && a !== n && /hidden|clip/.test(c.overflowX + c.overflowY)) {","category":"filesystem","line_end":62,"severity":"medium","line_start":62},{"id":"filesystem:scripts/film-checks.mjs:179:hidden-file-access","file":"scripts/film-checks.mjs","pattern":"Hidden file access","snippet":"if (ncs.animationName !== 'none' || (ncs.transform !== 'none' && !/^matrix\\(1, 0, 0, 1,/.test(ncs.tr","category":"filesystem","line_end":179,"severity":"medium","line_start":179},{"id":"filesystem:scripts/film-checks.mjs:318:hidden-file-access","file":"scripts/film-checks.mjs","pattern":"Hidden file access","snippet":"if (cs.transform !== 'none' && !/^matrix\\(1, 0, 0, 1,/.test(cs.transform)) return false","category":"filesystem","line_end":318,"severity":"medium","line_start":318},{"id":"filesystem:scripts/film-checks.mjs:426:hidden-file-access","file":"scripts/film-checks.mjs","pattern":"Hidden file access","snippet":"if (!/absolute|fixed/.test(getComputedStyle(p).position)) continue","category":"filesystem","line_end":426,"severity":"medium","line_start":426},{"id":"filesystem:scripts/film-checks.mjs:488:hidden-file-access","file":"scripts/film-checks.mjs","pattern":"Hidden file access","snippet":"if (!/flex|grid|block/.test(cs.display) || (cs.display.includes('flex') && cs.flexDirection !== 'col","category":"filesystem","line_end":488,"severity":"medium","line_start":488},{"id":"filesystem:scripts/film-checks.mjs:520:hidden-file-access","file":"scripts/film-checks.mjs","pattern":"Hidden file access","snippet":"if (!/flex|grid|block/.test(cs.display) || (cs.display.includes('flex') && cs.flexDirection !== 'col","category":"filesystem","line_end":520,"severity":"medium","line_start":520},{"id":"filesystem:scripts/film-checks.mjs:521:hidden-file-access","file":"scripts/film-checks.mjs","pattern":"Hidden file access","snippet":"if (/^(MAIN|SECTION|ARTICLE|HEADER|FOOTER|FORM)$/.test(n.tagName) || n.classList.contains('ss-thread","category":"filesystem","line_end":521,"severity":"medium","line_start":521},{"id":"filesystem:scripts/film-checks.mjs:553:hidden-file-access","file":"scripts/film-checks.mjs","pattern":"Hidden file access","snippet":"if (!surfaced(ds) && !(parseFloat(ds.borderBottomWidth) > 0) && !/^(INPUT|TEXTAREA)$/.test(d.tagName","category":"filesystem","line_end":553,"severity":"medium","line_start":553},{"id":"external_commands:examples/ai-cards/index.tsx:88:ruby-shell-backtick-execution","file":"examples/ai-cards/index.tsx","pattern":"Ruby/shell backtick execution","snippet":"<span key={d} className=\"aic-choice\" data-target={`day-${i}`} data-cursor=\"pointer\" data-on={s.day =","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:examples/ai-cards/index.tsx:106:ruby-shell-backtick-execution","file":"examples/ai-cards/index.tsx","pattern":"Ruby/shell backtick execution","snippet":"<span key={f.dep} className=\"aic-flight\" data-target={`flight-${i}`} data-cursor=\"pointer\" data-on={","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:examples/annotations/composed.tsx:20:ruby-shell-backtick-execution","file":"examples/annotations/composed.tsx","pattern":"Ruby/shell backtick execution","snippet":"const arrow = `M${to.x+6} ${to.y-4}L${to.x} ${to.y}L${to.x+6} ${to.y+4}`","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:examples/annotations/composed.tsx:47:ruby-shell-backtick-execution","file":"examples/annotations/composed.tsx","pattern":"Ruby/shell backtick execution","snippet":"const sources = rows.map((_, i) => rect(`usage-source-${i}`)), invoice = rect('usage-invoice'), fiel","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:examples/annotations/composed.tsx:52:ruby-shell-backtick-execution","file":"examples/annotations/composed.tsx","pattern":"Ruby/shell backtick execution","snippet":"const delivery = `M${junction.x} ${junction.y}H${outer-radius}Q${outer} ${junction.y} ${outer} ${jun","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:examples/annotations/composed.tsx:65:ruby-shell-backtick-execution","file":"examples/annotations/composed.tsx","pattern":"Ruby/shell backtick execution","snippet":"<div className=\"an-usage-sources\">{rows.map((row, i) => <div className=\"an-usage-source\" data-target","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:examples/annotations/composed.tsx:68:ruby-shell-backtick-execution","file":"examples/annotations/composed.tsx","pattern":"Ruby/shell backtick execution","snippet":"{sources.map((source, i) => <Connector key={i} className={`an-usage-feed an-fine-dotted an-usage-fee","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:examples/annotations/index.tsx:35:ruby-shell-backtick-execution","file":"examples/annotations/index.tsx","pattern":"Ruby/shell backtick execution","snippet":"return <Stage width={width} height={width < 480 ? 420 : 380} initial={{ selected: false }} poster={{","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:examples/annotations/index.tsx:79:ruby-shell-backtick-execution","file":"examples/annotations/index.tsx","pattern":"Ruby/shell backtick execution","snippet":"return <Stage key={compact ? 'compact' : 'wide'} width={width} height={compact ? 420 : 380} initial=","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:examples/annotations/index.tsx:105:ruby-shell-backtick-execution","file":"examples/annotations/index.tsx","pattern":"Ruby/shell backtick execution","snippet":"return <Stage width={width} height={compact ? 496 : 330} initial={{ step: 0 }} poster={{ step: 3 }} ","category":"external_commands","line_end":105,"severity":"medium","line_start":105},{"id":"external_commands:kit/act.ts:24:ruby-shell-backtick-execution","file":"kit/act.ts","pattern":"Ruby/shell backtick execution","snippet":"* Where a target is now, in stage pixels. With `layout`, where it sits in","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:kit/act.ts:30:ruby-shell-backtick-execution","file":"kit/act.ts","pattern":"Ruby/shell backtick execution","snippet":"* The character offset a text selection reaches with the pointer at `at`,","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:kit/act.ts:34:ruby-shell-backtick-execution","file":"kit/act.ts","pattern":"Ruby/shell backtick execution","snippet":"* the first pixel: `a.drag(end, (at) => a.put({ sel: a.caret('para', at) }))`.","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:kit/act.ts:40:ruby-shell-backtick-execution","file":"kit/act.ts","pattern":"Ruby/shell backtick execution","snippet":"* `path` sets the route in stage coordinates (eased 0 to 1 progress, the","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:kit/act.ts:42:ruby-shell-backtick-execution","file":"kit/act.ts","pattern":"Ruby/shell backtick execution","snippet":"* along a chart line. `onMove(at, from, t)` gets each point on the way, as drag's does, for anything","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:kit/act.ts:47:ruby-shell-backtick-execution","file":"kit/act.ts","pattern":"Ruby/shell backtick execution","snippet":"* Move (if given a target) and press. `double` presses twice, as a double","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:kit/act.ts:48:ruby-shell-backtick-execution","file":"kit/act.ts","pattern":"Ruby/shell backtick execution","snippet":"* click does (open a file, select a word). `right` is a secondary click: it","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:kit/act.ts:55:ruby-shell-backtick-execution","file":"kit/act.ts","pattern":"Ruby/shell backtick execution","snippet":"* way a trackpad does: the cursor stays put and the content moves. `to` is","category":"external_commands","line_end":55,"severity":"medium","line_start":55},{"id":"external_commands:kit/act.ts:57:ruby-shell-backtick-execution","file":"kit/act.ts","pattern":"Ruby/shell backtick execution","snippet":"* top (less `offset`). Once scrolled, its edges fade over what's hidden.","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:playground/main.tsx:9:ruby-shell-backtick-execution","file":"playground/main.tsx","pattern":"Ruby/shell backtick execution","snippet":"message.textContent = `This example could not load: ${errorText(error)}. Check the console for detai","category":"external_commands","line_end":9,"severity":"medium","line_start":9},{"id":"external_commands:playground/preview.tsx:14:ruby-shell-backtick-execution","file":"playground/preview.tsx","pattern":"Ruby/shell backtick execution","snippet":"const load = name === 'contrasts' ? () => import('../teaching/contrasts') : modules[`../examples/${n","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:playground/preview.tsx:15:ruby-shell-backtick-execution","file":"playground/preview.tsx","pattern":"Ruby/shell backtick execution","snippet":"if (!load) throw new Error(`Unknown example: ${name}`)","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:playground/viewer.tsx:26:ruby-shell-backtick-execution","file":"playground/viewer.tsx","pattern":"Ruby/shell backtick execution","snippet":"const source = useMemo(() => `?embed=${name}&still=${still ? 1 : 0}${name === 'contrasts' ? `&lesson","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:playground/viewer.tsx:72:ruby-shell-backtick-execution","file":"playground/viewer.tsx","pattern":"Ruby/shell backtick execution","snippet":"<div className=\"pg-canvas\" data-phone={phone || undefined} data-grid={selected.kind === 'Grid' || un","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:playground/viewer.tsx:85:ruby-shell-backtick-execution","file":"playground/viewer.tsx","pattern":"Ruby/shell backtick execution","snippet":"<section className=\"pg-caption\"><div><h2>{selected.name}</h2><p>{selected.note}</p></div><code>{name","category":"external_commands","line_end":85,"severity":"medium","line_start":85},{"id":"external_commands:scripts/browser.mjs:10:ruby-shell-backtick-execution","file":"scripts/browser.mjs","pattern":"Ruby/shell backtick execution","snippet":"console.error('Filming needs playwright-core: run `npm i -D playwright-core` (or pnpm/yarn) in this ","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:scripts/browser.mjs:17:ruby-shell-backtick-execution","file":"scripts/browser.mjs","pattern":"Ruby/shell backtick execution","snippet":"console.error(`Couldn't start Chrome${path ? ` at ${path}` : ''}. Install Google Chrome, or set CHRO","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:scripts/class-clash-core.mjs:74:ruby-shell-backtick-execution","file":"scripts/class-clash-core.mjs","pattern":"Ruby/shell backtick execution","snippet":"return parents.flatMap((parent) => splitSelectors(node.selector).map((selector) => selector.includes","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:scripts/class-clash-core.mjs:78:ruby-shell-backtick-execution","file":"scripts/class-clash-core.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (!match) { manual.push(`@scope at ${file}:${node.source.start.line} has a complex/implicit root; ","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:scripts/class-clash-core.mjs:79:ruby-shell-backtick-execution","file":"scripts/class-clash-core.mjs","pattern":"Ruby/shell backtick execution","snippet":"return parents.flatMap((parent) => splitSelectors(match[1]).map((scope) => `${parent} ${scope}`.trim","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:scripts/class-clash-core.mjs:91:ruby-shell-backtick-execution","file":"scripts/class-clash-core.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (/\\\\|:(?:global|local)\\(/.test(stripped) || branch >= 0 && !scopedBranch) manual.push(`selector a","category":"external_commands","line_end":91,"severity":"medium","line_start":91},{"id":"external_commands:scripts/class-clash-core.mjs:100:ruby-shell-backtick-execution","file":"scripts/class-clash-core.mjs","pattern":"Ruby/shell backtick execution","snippet":"definitions.push({ name, scope: /\\.module\\.css$/i.test(file) && !selector.includes(':global(') ? `mo","category":"external_commands","line_end":100,"severity":"medium","line_start":100},{"id":"external_commands:scripts/class-clash-core.mjs:125:ruby-shell-backtick-execution","file":"scripts/class-clash-core.mjs","pattern":"Ruby/shell backtick execution","snippet":"for (const item of [left, right]) overlaps.set(`${item.file}:${item.line}`, item)","category":"external_commands","line_end":125,"severity":"medium","line_start":125},{"id":"external_commands:scripts/class-clash.mjs:33:ruby-shell-backtick-execution","file":"scripts/class-clash.mjs","pattern":"Ruby/shell backtick execution","snippet":"} else if (args[i].startsWith('--')) throw new Error(`unknown option: ${args[i]}`)","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Bland.** A gray window with a cursor, whatever the brief said. The brief's look and energy (a bl","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"These are authored illustrations, not browser automation: `a.click()` draws the cursor pressing, `a.","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Build it the way a product designer builds a launch page they will be judged on. The gold examples i","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Medium and place.** Still or animation (loop, once in view, or hover). The page, its ground, it","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Look.** With the product's code or site at hand, map its tokens to the kit's (`references/looks","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **The story.** Its shape (`references/motion.md`, Story): how it feels to use, a flow, or what th","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Start from an example.** Find the closest gold example (the Gold table below) and film it (`nod","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **The screen.** Count the real strings, usually 3 to 7 (`references/craft.md`, Restraint): a budg","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. **Choreograph.** The `Act` API. Keep what appears mounted and toggle it so exits animate (`Bubble","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:teaching/composition.tsx:88:ruby-shell-backtick-execution","file":"teaching/composition.tsx","pattern":"Ruby/shell backtick execution","snippet":"return <svg className={`cp-symbol ${className}`} width=\"18\" height=\"18\" viewBox=\"0 0 20 20\" aria-hid","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:teaching/composition.tsx:127:ruby-shell-backtick-execution","file":"teaching/composition.tsx","pattern":"Ruby/shell backtick execution","snippet":"return <div className=\"cp-icon-list\" data-good={good || undefined}><h3>Workspace</h3>{items.map(item","category":"external_commands","line_end":127,"severity":"medium","line_start":127},{"id":"external_commands:teaching/continuity.tsx:64:ruby-shell-backtick-execution","file":"teaching/continuity.tsx","pattern":"Ruby/shell backtick execution","snippet":"<Stage<State> key={`${lessonId}-${revision}`} width={704} height={150} compact={{ below: 704, width:","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:teaching/contrasts.tsx:85:ruby-shell-backtick-execution","file":"teaching/contrasts.tsx","pattern":"Ruby/shell backtick execution","snippet":"const handoffTarget = (good: boolean, part: 'source' | 'destination' | 'slot') => `handoff-${good ? ","category":"external_commands","line_end":85,"severity":"medium","line_start":85},{"id":"external_commands:teaching/contrasts.tsx:104:ruby-shell-backtick-execution","file":"teaching/contrasts.tsx","pattern":"Ruby/shell backtick execution","snippet":"<span key={good ? 'persistent' : state.phase} className=\"tc-tabs__highlight\" data-restart={!good || ","category":"external_commands","line_end":104,"severity":"medium","line_start":104},{"id":"external_commands:teaching/contrasts.tsx:130:ruby-shell-backtick-execution","file":"teaching/contrasts.tsx","pattern":"Ruby/shell backtick execution","snippet":"<div className=\"tc-reset__head\"><span><Roll>{`${state.count} ${state.count === 1 ? 'file' : 'files'}","category":"external_commands","line_end":130,"severity":"medium","line_start":130},{"id":"external_commands:teaching/contrasts.tsx:138:ruby-shell-backtick-execution","file":"teaching/contrasts.tsx","pattern":"Ruby/shell backtick execution","snippet":"return <div className={`tc-action${icon ? ' tc-action--icon' : ''}`}>","category":"external_commands","line_end":138,"severity":"medium","line_start":138},{"id":"external_commands:teaching/contrasts.tsx:172:ruby-shell-backtick-execution","file":"teaching/contrasts.tsx","pattern":"Ruby/shell backtick execution","snippet":"<header><div><h2>{title}</h2><p>{note}</p></div><button className=\"tc-replay\" type=\"button\" onClick=","category":"external_commands","line_end":172,"severity":"medium","line_start":172},{"id":"external_commands:teaching/details.tsx:87:ruby-shell-backtick-execution","file":"teaching/details.tsx","pattern":"Ruby/shell backtick execution","snippet":"const LINE = POINTS.map((y, i) => `${i ? 'L' : 'M'}${8 + i * 20},${y}`).join(' ')","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"scripts:scripts/film.mjs:142:sharedarraybuffer-spectre-risk","file":"scripts/film.mjs","pattern":"SharedArrayBuffer (Spectre risk)","snippet":"Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 1500 * attempt)","category":"scripts","line_end":142,"severity":"medium","line_start":142},{"id":"external_commands:scripts/film.mjs:374:shell-command-substitution","file":"scripts/film.mjs","pattern":"Shell command substitution","snippet":"if (await page.$('vite-error-overlay')) {","category":"external_commands","line_end":374,"severity":"medium","line_start":374},{"id":"external_commands:scripts/film.mjs:380:shell-command-substitution","file":"scripts/film.mjs","pattern":"Shell command substitution","snippet":"const el = await page.$('[data-film-target]')","category":"external_commands","line_end":380,"severity":"medium","line_start":380},{"id":"external_commands:scripts/film.mjs:432:shell-command-substitution","file":"scripts/film.mjs","pattern":"Shell command substitution","snippet":"const t = await root.$(`[data-target=\"${zoomTarget.name}\"]`)","category":"external_commands","line_end":432,"severity":"medium","line_start":432},{"id":"external_commands:scripts/film.mjs:600:shell-command-substitution","file":"scripts/film.mjs","pattern":"Shell command substitution","snippet":"const root = (await roots[0].$('.ss-stage')) ?? roots[0]","category":"external_commands","line_end":600,"severity":"medium","line_start":600},{"id":"filesystem:scripts/class-clash.mjs:9:synchronous-file-operations","file":"scripts/class-clash.mjs","pattern":"Synchronous file operations","snippet":"import { readFileSync, statSync, readdirSync, existsSync } from 'node:fs'","category":"filesystem","line_end":9,"severity":"medium","line_start":9},{"id":"filesystem:scripts/class-clash.mjs:42:synchronous-file-operations","file":"scripts/class-clash.mjs","pattern":"Synchronous file operations","snippet":"const result = classDefinitions(readFileSync(file, 'utf8'), file, postcss.parse)","category":"filesystem","line_end":42,"severity":"medium","line_start":42},{"id":"filesystem:scripts/dev.mjs:3:synchronous-file-operations","file":"scripts/dev.mjs","pattern":"Synchronous file operations","snippet":"import { existsSync, readFileSync, realpathSync } from 'node:fs'","category":"filesystem","line_end":3,"severity":"medium","line_start":3},{"id":"filesystem:scripts/dev.mjs:12:synchronous-file-operations","file":"scripts/dev.mjs","pattern":"Synchronous file operations","snippet":"const metadata = JSON.parse(readFileSync(resolve(directory, 'package.json'), 'utf8'))","category":"filesystem","line_end":12,"severity":"medium","line_start":12},{"id":"filesystem:scripts/film.mjs:123:synchronous-file-operations","file":"scripts/film.mjs","pattern":"Synchronous file operations","snippet":"import { mkdirSync, writeFileSync } from 'node:fs'","category":"filesystem","line_end":123,"severity":"medium","line_start":123},{"id":"filesystem:scripts/film.mjs:176:synchronous-file-operations","file":"scripts/film.mjs","pattern":"Synchronous file operations","snippet":"const head = (await import('node:fs')).readFileSync(new URL(import.meta.url), 'utf8').split('\\n')","category":"filesystem","line_end":176,"severity":"medium","line_start":176},{"id":"filesystem:scripts/film.mjs:530:synchronous-file-operations","file":"scripts/film.mjs","pattern":"Synchronous file operations","snippet":"writeFileSync(path, JSON.stringify(result, null, 2) + '\\n')","category":"filesystem","line_end":530,"severity":"medium","line_start":530},{"id":"filesystem:scripts/jumps.mjs:7:synchronous-file-operations","file":"scripts/jumps.mjs","pattern":"Synchronous file operations","snippet":"import { mkdirSync, writeFileSync } from 'node:fs'","category":"filesystem","line_end":7,"severity":"medium","line_start":7},{"id":"filesystem:scripts/jumps.mjs:66:synchronous-file-operations","file":"scripts/jumps.mjs","pattern":"Synchronous file operations","snippet":"writeFileSync(path, JSON.stringify(result, null, 2) + '\\n')","category":"filesystem","line_end":66,"severity":"medium","line_start":66},{"id":"external_commands:scripts/film.mjs:362:template-literal-with-command-substitution","file":"scripts/film.mjs","pattern":"Template literal with command substitution","snippet":"else if (k > 1.01) message = `scale: ${k.toFixed(2)}, grown past the design size`","category":"external_commands","line_end":410,"severity":"medium","line_start":362},{"id":"external_commands:scripts/film.mjs:410:template-literal-with-command-substitution","file":"scripts/film.mjs","pattern":"Template literal with command substitution","snippet":"await fail(`film: stage never reached data-mark=\"${at}\" in 30s (last seen: ${seen ?? 'none'}). Does ","category":"external_commands","line_end":434,"severity":"medium","line_start":410},{"id":"external_commands:scripts/film.mjs:590:template-literal-with-command-substitution","file":"scripts/film.mjs","pattern":"Template literal with command substitution","snippet":"console.log(`still${zoom || zoomTarget ? ` (zoom ${dsf}x)` : ''} -> ${out}`)","category":"external_commands","line_end":608,"severity":"medium","line_start":590},{"id":"blocker:examples/ai-chat/index.tsx:20:system-reconnaissance","file":"examples/ai-chat/index.tsx","pattern":"System reconnaissance","snippet":"// - Every word is laid out from the start (Stream), so the answer grows in","category":"blocker","line_end":20,"severity":"low","line_start":20},{"id":"blocker:examples/ai-chat/index.tsx:30:system-reconnaissance","file":"examples/ai-chat/index.tsx","pattern":"System reconnaissance","snippet":"const Q = \"Why did checkout conversion drop last week?\";","category":"blocker","line_end":30,"severity":"low","line_start":30},{"id":"blocker:examples/annotations/annotations.css:4:system-reconnaissance","file":"examples/annotations/annotations.css","pattern":"System reconnaissance","snippet":".an-picker select { appearance: none; box-sizing: border-box; flex: 1; min-width: 0; max-width: 270p","category":"blocker","line_end":4,"severity":"low","line_start":4},{"id":"blocker:examples/annotations/annotations.css:6:system-reconnaissance","file":"examples/annotations/annotations.css","pattern":"System reconnaissance","snippet":".an-picker select:focus-visible { outline: 2px solid transparent; border-color: #9eb5c8; box-shadow:","category":"blocker","line_end":6,"severity":"low","line_start":6},{"id":"blocker:examples/annotations/annotations.css:7:system-reconnaissance","file":"examples/annotations/annotations.css","pattern":"System reconnaissance","snippet":".an-picker button:focus-visible { outline: 1.5px solid #7ca9d1; outline-offset: 2px; }","category":"blocker","line_end":7,"severity":"low","line_start":7},{"id":"blocker:examples/annotations/annotations.css:9:system-reconnaissance","file":"examples/annotations/annotations.css","pattern":"System reconnaissance","snippet":".an-picker button { display: grid; place-items: center; flex: none; width: 34px; height: 34px; paddi","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:examples/annotations/annotations.css:14:system-reconnaissance","file":"examples/annotations/annotations.css","pattern":"System reconnaissance","snippet":".an-product-head { display: flex; justify-content: space-between; align-items: center; gap: 12px; mi","category":"blocker","line_end":14,"severity":"low","line_start":14},{"id":"blocker:examples/annotations/annotations.css:17:system-reconnaissance","file":"examples/annotations/annotations.css","pattern":"System reconnaissance","snippet":".an-chart-panel { position: absolute; inset: 42px 28px auto; height: 296px; border: 1px solid #dfe3e","category":"blocker","line_end":17,"severity":"low","line_start":17},{"id":"blocker:examples/annotations/annotations.css:20:system-reconnaissance","file":"examples/annotations/annotations.css","pattern":"System reconnaissance","snippet":".an-chart-note { position: absolute; top: 72px; right: 18px; display: grid; gap: 3px; width: 136px; ","category":"blocker","line_end":20,"severity":"low","line_start":20},{"id":"blocker:kit/act.ts:21:system-reconnaissance","file":"kit/act.ts","pattern":"System reconnaissance","snippet":"put(patch: Partial<S> | ((s: S) => Partial<S>)): void","category":"blocker","line_end":22,"severity":"low","line_start":21},{"id":"blocker:kit/act.ts:45:system-reconnaissance","file":"kit/act.ts","pattern":"System reconnaissance","snippet":"move(to: Target, opts?: { duration?: number; path?: (progress: number, from: Point, to: Point) => Po","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:kit/act.ts:80:system-reconnaissance","file":"kit/act.ts","pattern":"System reconnaissance","snippet":"mark(name: string): void","category":"blocker","line_end":81,"severity":"low","line_start":80},{"id":"blocker:kit/act.ts:94:system-reconnaissance","file":"kit/act.ts","pattern":"System reconnaissance","snippet":"place(to: Target): void","category":"blocker","line_end":95,"severity":"low","line_start":94},{"id":"blocker:kit/act.ts:128:system-reconnaissance","file":"kit/act.ts","pattern":"System reconnaissance","snippet":"place: (p: Point) => void","category":"blocker","line_end":129,"severity":"low","line_start":128},{"id":"blocker:kit/act.ts:129:system-reconnaissance","file":"kit/act.ts","pattern":"System reconnaissance","snippet":"remeasure: () => void","category":"blocker","line_end":130,"severity":"low","line_start":129},{"id":"blocker:kit/act.ts:130:system-reconnaissance","file":"kit/act.ts","pattern":"System reconnaissance","snippet":"ripple: (at: Point) => void","category":"blocker","line_end":131,"severity":"low","line_start":130},{"id":"blocker:kit/act.ts:155:system-reconnaissance","file":"kit/act.ts","pattern":"System reconnaissance","snippet":"const id = schedule(() => {","category":"blocker","line_end":155,"severity":"low","line_start":155},{"id":"blocker:kit/act.ts:204:system-reconnaissance","file":"kit/act.ts","pattern":"System reconnaissance","snippet":"// did falls back to the pointer once its marked elements are gone, so","category":"blocker","line_end":204,"severity":"low","line_start":204},{"id":"blocker:playground/catalog.ts:6:system-reconnaissance","file":"playground/catalog.ts","pattern":"System reconnaissance","snippet":"{ id: 'dark-bento', name: 'Dark card', kind: 'Scene', note: 'One signal said once; album art keeps i","category":"blocker","line_end":6,"severity":"low","line_start":6},{"id":"blocker:playground/catalog.ts:21:system-reconnaissance","file":"playground/catalog.ts","pattern":"System reconnaissance","snippet":"{ id: 'many-of-one', name: 'Many of one', kind: 'Scene', note: 'A grid of one thing off every edge, ","category":"blocker","line_end":21,"severity":"low","line_start":21},{"id":"blocker:playground/catalog.ts:79:system-reconnaissance","file":"playground/catalog.ts","pattern":"System reconnaissance","snippet":"['kit-extras', 'Kit extras', 'Chip, Swap, Avatar rings, Meter tones, Menu hover, Expand, solid glyph","category":"blocker","line_end":79,"severity":"low","line_start":79},{"id":"blocker:playground/catalog.ts:88:system-reconnaissance","file":"playground/catalog.ts","pattern":"System reconnaissance","snippet":".filter(id => !listed.has(id))","category":"blocker","line_end":88,"severity":"low","line_start":88},{"id":"blocker:playground/catalog.ts:90:system-reconnaissance","file":"playground/catalog.ts","pattern":"System reconnaissance","snippet":".map(id => ({ id, name: id.split('-').map(word => word[0].toUpperCase() + word.slice(1)).join(' '), ","category":"blocker","line_end":90,"severity":"low","line_start":90},{"id":"blocker:playground/catalog.ts:91:system-reconnaissance","file":"playground/catalog.ts","pattern":"System reconnaissance","snippet":"export const examples = [...curated.map(example => ({ ...example, group: example.id === 'contrasts' ","category":"blocker","line_end":91,"severity":"low","line_start":91},{"id":"blocker:playground/main.tsx:78:system-reconnaissance","file":"playground/main.tsx","pattern":"System reconnaissance","snippet":"if (data.step) void playback.step().then(() => send())","category":"blocker","line_end":78,"severity":"low","line_start":78},{"id":"blocker:playground/main.tsx:87:system-reconnaissance","file":"playground/main.tsx","pattern":"System reconnaissance","snippet":"if (!example) throw new Error('The example did not mount')","category":"blocker","line_end":87,"severity":"low","line_start":87},{"id":"blocker:playground/main.tsx:111:system-reconnaissance","file":"playground/main.tsx","pattern":"System reconnaissance","snippet":"void boot().catch(showFailure)","category":"blocker","line_end":111,"severity":"low","line_start":111},{"id":"blocker:references/annotations.md:11:system-reconnaissance","file":"references/annotations.md","pattern":"System reconnaissance","snippet":"| Usage into an invoice | Three usage sources connect, deliver their first combined result, then the","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:references/annotations.md:12:system-reconnaissance","file":"references/annotations.md","pattern":"System reconnaissance","snippet":"| A payout and its detail | Select a payout; its linked settlement opens; a leader explains its arri","category":"blocker","line_end":12,"severity":"low","line_start":12},{"id":"blocker:references/annotations.md:15:system-reconnaissance","file":"references/annotations.md","pattern":"System reconnaissance","snippet":"| A request and its reply | Send an event; the request draws; the acknowledgement returns after deli","category":"blocker","line_end":15,"severity":"low","line_start":15},{"id":"blocker:references/annotations.md:28:system-reconnaissance","file":"references/annotations.md","pattern":"System reconnaissance","snippet":"- **A record link joins two views of the same thing.** One row opens its settlement, and a fine dott","category":"blocker","line_end":28,"severity":"low","line_start":28},{"id":"blocker:references/annotations.md:59:system-reconnaissance","file":"references/annotations.md","pattern":"System reconnaissance","snippet":"Line styles mean different things: a solid request and a dashed acknowledgement separate direction a","category":"blocker","line_end":59,"severity":"low","line_start":59},{"id":"blocker:references/backgrounds.md:7:system-reconnaissance","file":"references/backgrounds.md","pattern":"System reconnaissance","snippet":"- **Quiet solid or tint:** gives dense UI room to read. Separate the foreground with a clear step in","category":"blocker","line_end":7,"severity":"low","line_start":7},{"id":"blocker:references/backgrounds.md:9:system-reconnaissance","file":"references/backgrounds.md","pattern":"System reconnaissance","snippet":"- **Colorful gradient:** choose its direction and color relationships on purpose. A diagonal transit","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/backgrounds.md:14:system-reconnaissance","file":"references/backgrounds.md","pattern":"System reconnaissance","snippet":"`examples/backgrounds/` holds the same small interface across twenty grounds, so you can compare tin","category":"blocker","line_end":14,"severity":"low","line_start":14},{"id":"blocker:references/backgrounds.md:20:system-reconnaissance","file":"references/backgrounds.md","pattern":"System reconnaissance","snippet":"The rules of the set (one hero, contrasting neighbors, grounds composed together, copy outside the p","category":"blocker","line_end":20,"severity":"low","line_start":20},{"id":"blocker:scripts/film-checks.mjs:184:system-reconnaissance","file":"scripts/film-checks.mjs","pattern":"System reconnaissance","snippet":"// containers above don't own its padding: it is laid over them","category":"blocker","line_end":184,"severity":"low","line_start":184},{"id":"blocker:scripts/film-checks.mjs:279:system-reconnaissance","file":"scripts/film-checks.mjs","pattern":"System reconnaissance","snippet":"const hid = (e) => { for (let a = e; a && a !== p; a = a.parentElement) if (Number(getComputedStyle(","category":"blocker","line_end":279,"severity":"low","line_start":279},{"id":"blocker:scripts/film-checks.mjs:420:system-reconnaissance","file":"scripts/film-checks.mjs","pattern":"System reconnaissance","snippet":"// Inside a floating layer laid over the other (a popover's field over","category":"blocker","line_end":420,"severity":"low","line_start":420},{"id":"blocker:scripts/film-checks.mjs:489:system-reconnaissance","file":"scripts/film-checks.mjs","pattern":"System reconnaissance","snippet":"// A grid of cells (a sheet, a calendar, a board) is not a column of rows","category":"blocker","line_end":489,"severity":"low","line_start":489},{"id":"blocker:scripts/film-checks.mjs:736:system-reconnaissance","file":"scripts/film-checks.mjs","pattern":"System reconnaissance","snippet":"// painted content stops well above its visible bottom: a void","category":"blocker","line_end":737,"severity":"low","line_start":736},{"id":"blocker:scripts/film-checks.mjs:744:system-reconnaissance","file":"scripts/film-checks.mjs","pattern":"System reconnaissance","snippet":"// Clipped away by its own window (a side panel slid shut): not in frame","category":"blocker","line_end":744,"severity":"low","line_start":744},{"id":"blocker:scripts/film-checks.mjs:895:system-reconnaissance","file":"scripts/film-checks.mjs","pattern":"System reconnaissance","snippet":"// A satellite or overlay laid over another surface (a card straddling a window) is composed, not se","category":"blocker","line_end":895,"severity":"low","line_start":895},{"id":"blocker:scripts/film-checks.mjs:1005:system-reconnaissance","file":"scripts/film-checks.mjs","pattern":"System reconnaissance","snippet":"const id = owner?.getAttribute?.('data-vite-dev-id') || owner?.getAttribute?.('href') || ''","category":"blocker","line_end":1005,"severity":"low","line_start":1005},{"id":"blocker:scripts/film-checks.mjs:1006:system-reconnaissance","file":"scripts/film-checks.mjs","pattern":"System reconnaissance","snippet":"if (!id || /\\/kit\\/|\\/playground\\//.test(id)) continue","category":"blocker","line_end":1006,"severity":"low","line_start":1006},{"id":"blocker:SKILL.md:22:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"The fix: a full, structured screen in quiet grays, real words only on what the story is about, place","category":"blocker","line_end":22,"severity":"low","line_start":22},{"id":"blocker:SKILL.md:34:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"1. **Medium and place.** Still or animation (loop, once in view, or hover). The page, its ground, it","category":"blocker","line_end":34,"severity":"low","line_start":34},{"id":"blocker:SKILL.md:40:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"7. **Rehearse.** Set `poster` first: most people see only that frame (a thumbnail, reduced motion, a","category":"blocker","line_end":40,"severity":"low","line_start":40},{"id":"blocker:SKILL.md:64:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Dark still | `dark-bento` | One signal said once; album art keeps it a music app |","category":"blocker","line_end":64,"severity":"low","line_start":64},{"id":"blocker:SKILL.md:79:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Many of one | `many-of-one` | A grid of one thing off every edge, one tile in focus by depth, the ","category":"blocker","line_end":79,"severity":"low","line_start":79},{"id":"blocker:SKILL.md:98:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Feature grid | `bento` | One hero, one window, a stat, an object, a diagram |","category":"blocker","line_end":98,"severity":"low","line_start":98},{"id":"blocker:SKILL.md:99:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Dark ruled grid | `ruled-bento` | Shared rules and technical imagery |","category":"blocker","line_end":99,"severity":"low","line_start":99},{"id":"blocker:SKILL.md:100:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Consumer grid | `staggered-bento` | Offset tiles, graphic art, physical objects |","category":"blocker","line_end":100,"severity":"low","line_start":100},{"id":"blocker:SKILL.md:101:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Image-led hero grid | `hero-grid` | Different grounds and materials composed as one picture |","category":"blocker","line_end":101,"severity":"low","line_start":101},{"id":"blocker:teaching/composition.css:11:system-reconnaissance","file":"teaching/composition.css","pattern":"System reconnaissance","snippet":".tc-lessons .cp-export-window { position: absolute; left: 6px; top: 8px; width: 308px; border: 1px s","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:teaching/composition.css:12:system-reconnaissance","file":"teaching/composition.css","pattern":"System reconnaissance","snippet":".tc-lessons .cp-window-bar { position: relative; display: grid; place-items: center; height: 30px; b","category":"blocker","line_end":12,"severity":"low","line_start":12},{"id":"blocker:teaching/composition.css:18:system-reconnaissance","file":"teaching/composition.css","pattern":"System reconnaissance","snippet":".tc-lessons .cp-export-row { display: flex; align-items: center; gap: 9px; margin: 0 14px; padding: ","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:teaching/composition.css:27:system-reconnaissance","file":"teaching/composition.css","pattern":"System reconnaissance","snippet":".tc-lessons .cp-anatomy { width: 284px; padding: 16px; border: 1px solid #e9e9e9; border-radius: 8px","category":"blocker","line_end":27,"severity":"low","line_start":27},{"id":"blocker:teaching/composition.css:42:system-reconnaissance","file":"teaching/composition.css","pattern":"System reconnaissance","snippet":".tc-lessons .cp-anatomy[data-good] .cp-project-foot { flex-direction: row; justify-content: space-be","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:teaching/composition.css:44:system-reconnaissance","file":"teaching/composition.css","pattern":"System reconnaissance","snippet":".tc-lessons .cp-plan { width: 284px; padding: 14px; border: 2px solid #7598cb; border-radius: 10px; ","category":"blocker","line_end":44,"severity":"low","line_start":44},{"id":"blocker:teaching/composition.css:45:system-reconnaissance","file":"teaching/composition.css","pattern":"System reconnaissance","snippet":".tc-lessons .cp-plan-head { display: flex; align-items: center; justify-content: space-between; gap:","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:teaching/composition.css:48:system-reconnaissance","file":"teaching/composition.css","pattern":"System reconnaissance","snippet":".tc-lessons .cp-plan-price { display: flex; align-items: baseline; gap: 5px; margin-top: 12px; paddi","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"blocker:teaching/composition.css:51:system-reconnaissance","file":"teaching/composition.css","pattern":"System reconnaissance","snippet":".tc-lessons .cp-plan-seats { display: flex; justify-content: space-between; gap: 12px; margin: 10px ","category":"blocker","line_end":51,"severity":"low","line_start":51},{"id":"obfuscation:examples/figma/index.tsx:30:array-join-empty-string","file":"examples/figma/index.tsx","pattern":"Array join empty string","snippet":"return [f(5), f(3), f(1)].map((c) => Math.round(c * 255).toString(16).padStart(2, '0')).join('').toU","category":"obfuscation","line_end":30,"severity":"low","line_start":30},{"id":"obfuscation:scripts/film.mjs:654:array-join-empty-string","file":"scripts/film.mjs","pattern":"Array join empty string","snippet":".join('')}","category":"obfuscation","line_end":654,"severity":"low","line_start":654},{"id":"obfuscation:scripts/jumps-core.mjs:73:array-join-empty-string","file":"scripts/jumps-core.mjs","pattern":"Array join empty string","snippet":"const words = [...el.childNodes].filter((c) => c.nodeType === 3).map((c) => c.textContent).join('')","category":"obfuscation","line_end":73,"severity":"low","line_start":73},{"id":"obfuscation:scripts/motion-watch.mjs:196:array-join-empty-string","file":"scripts/motion-watch.mjs","pattern":"Array join empty string","snippet":"const words = [...el.childNodes].filter((c) => c.nodeType === 3).map((c) => c.textContent.trim()).jo","category":"obfuscation","line_end":196,"severity":"low","line_start":196},{"id":"obfuscation:scripts/film-checks.mjs:688:unicode-code-point-escape","file":"scripts/film-checks.mjs","pattern":"Unicode code point escape","snippet":"const emojiRe = /^(?:\\p{Extended_Pictographic}|\\p{Emoji_Presentation})(?:\\uFE0F|\\u200D\\p{Extended_Pi","category":"obfuscation","line_end":688,"severity":"low","line_start":688},{"id":"obfuscation:scripts/film-checks.mjs:688:unicode-escape-sequence","file":"scripts/film-checks.mjs","pattern":"Unicode escape sequence","snippet":"const emojiRe = /^(?:\\p{Extended_Pictographic}|\\p{Emoji_Presentation})(?:\\uFE0F|\\u200D\\p{Extended_Pi","category":"obfuscation","line_end":688,"severity":"low","line_start":688},{"id":"obfuscation:scripts/film.mjs:195:url-decode","file":"scripts/film.mjs","pattern":"URL decode","snippet":"if (select === '#example' && slug) select = `#example[data-example=\"${decodeURIComponent(slug)}\"]`","category":"obfuscation","line_end":195,"severity":"low","line_start":195},{"id":"env_access:kit/util.ts:4:environment-variable-access-dot-notation","file":"kit/util.ts","pattern":"Environment variable access (dot notation)","snippet":"// process.env.NODE_ENV, so a production build never warns; with no bundler","category":"env_access","line_end":4,"severity":"low","line_start":4},{"id":"env_access:kit/util.ts:8:environment-variable-access-dot-notation","file":"kit/util.ts","pattern":"Environment variable access (dot notation)","snippet":"return process.env.NODE_ENV !== 'production'","category":"env_access","line_end":8,"severity":"low","line_start":8},{"id":"env_access:scripts/browser.mjs:13:environment-variable-access-dot-notation","file":"scripts/browser.mjs","pattern":"Environment variable access (dot notation)","snippet":"const path = process.env.CHROME_PATH","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"env_access:scripts/film.mjs:131:environment-variable-access-dot-notation","file":"scripts/film.mjs","pattern":"Environment variable access (dot notation)","snippet":"if (!process.env.FILM_CHILD) {","category":"env_access","line_end":131,"severity":"low","line_start":131},{"id":"env_access:kit/util.ts:4:environment-variable-object","file":"kit/util.ts","pattern":"Environment variable object","snippet":"// process.env.NODE_ENV, so a production build never warns; with no bundler","category":"env_access","line_end":4,"severity":"low","line_start":4},{"id":"env_access:kit/util.ts:8:environment-variable-object","file":"kit/util.ts","pattern":"Environment variable object","snippet":"return process.env.NODE_ENV !== 'production'","category":"env_access","line_end":8,"severity":"low","line_start":8},{"id":"env_access:scripts/browser.mjs:13:environment-variable-object","file":"scripts/browser.mjs","pattern":"Environment variable object","snippet":"const path = process.env.CHROME_PATH","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"env_access:scripts/film.mjs:131:environment-variable-object","file":"scripts/film.mjs","pattern":"Environment variable object","snippet":"if (!process.env.FILM_CHILD) {","category":"env_access","line_end":131,"severity":"low","line_start":131},{"id":"env_access:scripts/film.mjs:136:environment-variable-object","file":"scripts/film.mjs","pattern":"Environment variable object","snippet":"last = spawnSync(process.execPath, process.argv.slice(1), { env: { ...process.env, FILM_CHILD: '1' }","category":"env_access","line_end":136,"severity":"low","line_start":136},{"id":"network:examples/controls/index.tsx:13:fetch-api-call","file":"examples/controls/index.tsx","pattern":"Fetch API call","snippet":"{ text: '  let r = fetch(id)', kind: 'del' as const },","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:package-lock.json:34:hardcoded-url","file":"package-lock.json","pattern":"Hardcoded URL","snippet":"\"resolved\": \"https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz\",","category":"network","line_end":34,"severity":"low","line_start":34},{"id":"network:package-lock.json:49:hardcoded-url","file":"package-lock.json","pattern":"Hardcoded URL","snippet":"\"resolved\": \"https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz\",","category":"network","line_end":49,"severity":"low","line_start":49},{"id":"network:package-lock.json:59:hardcoded-url","file":"package-lock.json","pattern":"Hardcoded URL","snippet":"\"resolved\": \"https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz\",","category":"network","line_end":59,"severity":"low","line_start":59},{"id":"network:package-lock.json:85:hardcoded-url","file":"package-lock.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://opencollective.com/babel\"","category":"network","line_end":85,"severity":"low","line_start":85},{"id":"network:package-lock.json:90:hardcoded-url","file":"package-lock.json","pattern":"Hardcoded URL","snippet":"\"resolved\": \"https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz\",","category":"network","line_end":90,"severity":"low","line_start":90},{"id":"network:package-lock.json:107:hardcoded-url","file":"package-lock.json","pattern":"Hardcoded URL","snippet":"\"resolved\": \"https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targe","category":"network","line_end":107,"severity":"low","line_start":107},{"id":"network:package-lock.json:124:hardcoded-url","file":"package-lock.json","pattern":"Hardcoded URL","snippet":"\"resolved\": \"https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz\",","category":"network","line_end":124,"severity":"low","line_start":124},{"id":"network:package-lock.json:134:hardcoded-url","file":"package-lock.json","pattern":"Hardcoded URL","snippet":"\"resolved\": \"https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.","category":"network","line_end":134,"severity":"low","line_start":134},{"id":"network:package-lock.json:148:hardcoded-url","file":"package-lock.json","pattern":"Hardcoded URL","snippet":"\"resolved\": \"https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7","category":"network","line_end":148,"severity":"low","line_start":148},{"id":"network:playground/playback.ts:98:http-client-library","file":"playground/playback.ts","pattern":"HTTP client library","snippet":"frame = request(async (timestamp) => {","category":"network","line_end":98,"severity":"low","line_start":98}],"finding_verdicts":[{"id":"blocker:examples/hero-demo/HeroDemo.tsx:258:keylogger-keywords","reason":"The matched comment describes scripted keycap or caret animation. These components display authored keystrokes and do not record user keyboard input.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/act.ts:69:keylogger-keywords","reason":"The matched comment describes scripted keycap or caret animation. These components display authored keystrokes and do not record user keyboard input.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/controls/Field.css:167:keylogger-keywords","reason":"The matched comment describes scripted keycap or caret animation. These components display authored keystrokes and do not record user keyboard input.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/controls/Field.tsx:82:keylogger-keywords","reason":"The matched comment describes scripted keycap or caret animation. These components display authored keystrokes and do not record user keyboard input.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/keys.css:1:keylogger-keywords","reason":"The matched comment describes scripted keycap or caret animation. These components display authored keystrokes and do not record user keyboard input.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/keys.tsx:3:keylogger-keywords","reason":"The matched comment describes scripted keycap or caret animation. These components display authored keystrokes and do not record user keyboard input.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/keys.tsx:9:keylogger-keywords","reason":"The matched comment describes scripted keycap or caret animation. These components display authored keystrokes and do not record user keyboard input.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/brands/index.ts:76:1password-data","reason":"The string names the 1Password brand in the logo catalog. It does not access a password vault or credential store.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/layout.mjs:14:screen-capture-upload","reason":"The match is CLI help for an optional local screenshot. The implementation writes the image to the requested path without uploading it.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/brand-marks/index.tsx:5:certificate-key-files","reason":"Object.keys enumerates in-memory object properties for rendering or verification. It performs no certificate or private-key file access.","verdict":"false_positive","confidence":1},{"id":"sensitive:examples/calendar/index.tsx:112:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/excel/index.tsx:74:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/figma/index.tsx:97:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/finder-glass/index.tsx:115:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/finder-glass/index.tsx:121:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/finder/index.tsx:85:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/finder/index.tsx:91:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/finder/index.tsx:117:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/hero-demo/HeroDemo.tsx:134:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/act.ts:647:certificate-key-files","reason":"Object.keys enumerates in-memory object properties for rendering or verification. It performs no certificate or private-key file access.","verdict":"false_positive","confidence":1},{"id":"sensitive:kit/act.ts:664:certificate-key-files","reason":"Object.keys enumerates in-memory object properties for rendering or verification. It performs no certificate or private-key file access.","verdict":"false_positive","confidence":1},{"id":"sensitive:kit/cursor.tsx:71:certificate-key-files","reason":"Object.keys enumerates in-memory object properties for rendering or verification. It performs no certificate or private-key file access.","verdict":"false_positive","confidence":1},{"id":"sensitive:kit/keys.css:1:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/keys.tsx:3:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/measure.ts:103:certificate-key-files","reason":"Object.keys enumerates in-memory object properties for rendering or verification. It performs no certificate or private-key file access.","verdict":"false_positive","confidence":1},{"id":"sensitive:kit/measure.ts:104:certificate-key-files","reason":"Object.keys enumerates in-memory object properties for rendering or verification. It performs no certificate or private-key file access.","verdict":"false_positive","confidence":1},{"id":"sensitive:kit/motion/Expand.tsx:51:certificate-key-files","reason":"The key property identifies animation state or a verification stage. It is not a cryptographic key or a sensitive file reference.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/motion/Roll.tsx:112:certificate-key-files","reason":"The key property identifies animation state or a verification stage. It is not a cryptographic key or a sensitive file reference.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/motion/Roll.tsx:117:certificate-key-files","reason":"The key property identifies animation state or a verification stage. It is not a cryptographic key or a sensitive file reference.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:playground/catalog.ts:86:certificate-key-files","reason":"Object.keys enumerates in-memory object properties for rendering or verification. It performs no certificate or private-key file access.","verdict":"false_positive","confidence":1},{"id":"sensitive:references/motion.md:126:certificate-key-files","reason":"The key reference describes simulated keyboard keycaps for a scene. It does not identify or read a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/film-checks.mjs:1307:certificate-key-files","reason":"Object.keys enumerates in-memory object properties for rendering or verification. It performs no certificate or private-key file access.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/film.mjs:511:certificate-key-files","reason":"The key property identifies animation state or a verification stage. It is not a cryptographic key or a sensitive file reference.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/film.mjs:515:certificate-key-files","reason":"The key property identifies animation state or a verification stage. It is not a cryptographic key or a sensitive file reference.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/film.mjs:516:certificate-key-files","reason":"The key property identifies animation state or a verification stage. It is not a cryptographic key or a sensitive file reference.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/film.mjs:517:certificate-key-files","reason":"The key property identifies animation state or a verification stage. It is not a cryptographic key or a sensitive file reference.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/jumps.mjs:39:certificate-key-files","reason":"Object.keys enumerates in-memory object properties for rendering or verification. It performs no certificate or private-key file access.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/jumps.mjs:57:certificate-key-files","reason":"The key property identifies animation state or a verification stage. It is not a cryptographic key or a sensitive file reference.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/jumps.mjs:58:certificate-key-files","reason":"The key property identifies animation state or a verification stage. It is not a cryptographic key or a sensitive file reference.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/jumps.mjs:59:certificate-key-files","reason":"The key property identifies animation state or a verification stage. It is not a cryptographic key or a sensitive file reference.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/layout-core.mjs:17:certificate-key-files","reason":"Object.keys enumerates in-memory object properties for rendering or verification. It performs no certificate or private-key file access.","verdict":"false_positive","confidence":1},{"id":"sensitive:kit/util.ts:4:environment-file-access","reason":"NODE_ENV controls development warnings; one match is only a comment. No environment file or secret value is read at this location.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/util.ts:8:environment-file-access","reason":"NODE_ENV controls development warnings; one match is only a comment. No environment file or secret value is read at this location.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/browser.mjs:13:environment-file-access","reason":"CHROME_PATH selects the operator-configured browser executable for local captures. It does not read an environment file or transmit credentials.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:scripts/film.mjs:131:environment-file-access","reason":"FILM_CHILD is a local recursion guard for capture retries. The code does not read environment files or collect secret variables.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:scripts/film.mjs:136:environment-file-access","reason":"The retry launches the same Node script with inherited environment and a FILM_CHILD marker. No environment content is sent to a network destination.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:assets/app-icons.ts:7:heuristic-extremely-long-line-11148-chars-likely","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:assets/app-icons.ts:11:heuristic-extremely-long-line-12089-chars-likely","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:assets/app-icons.ts:5:heuristic-extremely-long-line-14276-chars-likely","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:assets/app-icons.ts:13:heuristic-extremely-long-line-14749-chars-likely","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/brands/discover.svg:1:heuristic-extremely-long-line-2077-chars-likely-","reason":"The long line contains SVG brand drawing data. This is vector artwork, not concealed executable code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:assets/app-icons.ts:9:heuristic-extremely-long-line-22018-chars-likely","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/brands/barclays.svg:1:heuristic-extremely-long-line-2331-chars-likely-","reason":"The long line contains SVG brand drawing data. This is vector artwork, not concealed executable code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/brands/amex.svg:1:heuristic-extremely-long-line-2402-chars-likely-","reason":"The long line contains SVG brand drawing data. This is vector artwork, not concealed executable code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/brands/wellsfargo.svg:1:heuristic-extremely-long-line-2446-chars-likely-","reason":"The long line contains SVG brand drawing data. This is vector artwork, not concealed executable code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/cursors.tsx:72:heuristic-extremely-long-line-2788-chars-likely-","reason":"The long line defines an SVG cursor path with detailed coordinates. It is drawing data rather than executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/telegram/telegram.css:47:heuristic-extremely-long-line-3465-chars-likely-","reason":"The long CSS line embeds URL-encoded SVG wallpaper artwork. It supplies a local background image, not an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/cursors.tsx:73:heuristic-extremely-long-line-4823-chars-likely-","reason":"The long line defines an SVG cursor path with detailed coordinates. It is drawing data rather than executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:assets/app-icons.ts:15:heuristic-extremely-long-line-9934-chars-likely-","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:assets/app-icons.ts:1:heuristic-high-file-entropy-6-01-bits-possible-b","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/film.mjs:1:heuristic-multiple-bracket-chains-11-jsfuck-obfu","reason":"The source uses readable arrays, callbacks, and nested expressions for visual verification. The bracket heuristic does not establish JSFuck or concealed execution.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:scripts/film-checks.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The source uses readable arrays, callbacks, and nested expressions for visual verification. The bracket heuristic does not establish JSFuck or concealed execution.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:package-lock.json:487:heuristic-very-high-entropy-string-5-50-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:903:heuristic-very-high-entropy-string-5-50-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1085:heuristic-very-high-entropy-string-5-50-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1253:heuristic-very-high-entropy-string-5-50-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:521:heuristic-very-high-entropy-string-5-51-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:691:heuristic-very-high-entropy-string-5-51-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:931:heuristic-very-high-entropy-string-5-51-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1057:heuristic-very-high-entropy-string-5-51-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1821:heuristic-very-high-entropy-string-5-51-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:50:heuristic-very-high-entropy-string-5-52-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:108:heuristic-very-high-entropy-string-5-52-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:237:heuristic-very-high-entropy-string-5-52-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:269:heuristic-very-high-entropy-string-5-52-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:770:heuristic-very-high-entropy-string-5-52-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:917:heuristic-very-high-entropy-string-5-52-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1155:heuristic-very-high-entropy-string-5-52-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1183:heuristic-very-high-entropy-string-5-52-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1197:heuristic-very-high-entropy-string-5-52-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1474:heuristic-very-high-entropy-string-5-52-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:538:heuristic-very-high-entropy-string-5-53-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:589:heuristic-very-high-entropy-string-5-53-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:674:heuristic-very-high-entropy-string-5-53-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1284:heuristic-very-high-entropy-string-5-53-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:187:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:385:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:402:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:453:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:781:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1029:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1263:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1715:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1761:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:135:heuristic-very-high-entropy-string-5-55-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:317:heuristic-very-high-entropy-string-5-55-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:470:heuristic-very-high-entropy-string-5-55-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:759:heuristic-very-high-entropy-string-5-55-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:826:heuristic-very-high-entropy-string-5-55-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1331:heuristic-very-high-entropy-string-5-55-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1456:heuristic-very-high-entropy-string-5-55-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:708:heuristic-very-high-entropy-string-5-56-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:959:heuristic-very-high-entropy-string-5-56-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1379:heuristic-very-high-entropy-string-5-56-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1770:heuristic-very-high-entropy-string-5-56-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:657:heuristic-very-high-entropy-string-5-57-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1651:heuristic-very-high-entropy-string-5-57-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1790:heuristic-very-high-entropy-string-5-57-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:303:heuristic-very-high-entropy-string-5-58-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:555:heuristic-very-high-entropy-string-5-58-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1043:heuristic-very-high-entropy-string-5-58-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:606:heuristic-very-high-entropy-string-5-59-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1807:heuristic-very-high-entropy-string-5-59-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1297:heuristic-very-high-entropy-string-5-60-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:35:heuristic-very-high-entropy-string-5-61-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1705:heuristic-very-high-entropy-string-5-61-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:623:heuristic-very-high-entropy-string-5-62-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1218:heuristic-very-high-entropy-string-5-62-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1228:heuristic-very-high-entropy-string-5-62-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:149:heuristic-very-high-entropy-string-5-63-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1553:heuristic-very-high-entropy-string-5-63-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1372:heuristic-very-high-entropy-string-5-64-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1543:heuristic-very-high-entropy-string-5-64-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:351:heuristic-very-high-entropy-string-5-65-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:889:heuristic-very-high-entropy-string-5-65-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1127:heuristic-very-high-entropy-string-5-66-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:package-lock.json:1531:heuristic-very-high-entropy-string-5-66-bits-lik","reason":"The matched value is an npm SHA-512 integrity checksum. Its expected entropy does not indicate executable or encrypted payload code.","verdict":"false_positive","confidence":1},{"id":"obfuscation:assets/app-icons.ts:5:heuristic-very-high-entropy-string-6-00-bits-lik","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:assets/app-icons.ts:7:heuristic-very-high-entropy-string-6-00-bits-lik","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:assets/app-icons.ts:9:heuristic-very-high-entropy-string-6-00-bits-lik","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:assets/app-icons.ts:11:heuristic-very-high-entropy-string-6-00-bits-lik","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:assets/app-icons.ts:13:heuristic-very-high-entropy-string-6-00-bits-lik","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:assets/app-icons.ts:15:heuristic-very-high-entropy-string-6-00-bits-lik","reason":"The file exports embedded PNG app icons for demo artwork. Long lines and high entropy come from image data, not executable obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"env_access:examples/ruled-bento/index.tsx:96:database-connection-strings","reason":"DATABASE_URL is literal text displayed in a simulated terminal. The scene does not read a database credential or establish a connection.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/dev.mjs:2:node-js-child-process-module","reason":"The launcher runs locally installed development tools through Node with shell disabled. Arguments are passed as an array, not interpolated into a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/film.mjs:125:node-js-child-process-module","reason":"The capture wrapper retries the same Node script with argument arrays and a child marker. It does not construct or execute shell commands.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/ai-cards/index.tsx:1:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/ai-chat/index.tsx:11:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/annotations/composed.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/annotations/index.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/annotations/index.tsx:6:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/backgrounds/index.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/bento/index.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/bento/index.tsx:3:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/bento/index.tsx:4:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/brand-marks/index.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/controls/Field.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/controls/Segmented.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Camera.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Camera.tsx:3:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Camera.tsx:4:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Connector.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Count.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Expand.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Expand.tsx:3:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Fly.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:playground/catalog.ts:86:path-traversal-sequence","reason":"The relative glob lists bundled local example modules. It does not concatenate untrusted input into a filesystem read.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:playground/main.tsx:1:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:playground/preview.tsx:3:path-traversal-sequence","reason":"The relative path is a fixed import or a lookup in the build-generated example module map. It cannot load arbitrary filesystem paths.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:playground/preview.tsx:6:path-traversal-sequence","reason":"The relative path is a fixed import or a lookup in the build-generated example module map. It cannot load arbitrary filesystem paths.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:playground/preview.tsx:14:path-traversal-sequence","reason":"The relative path is a fixed import or a lookup in the build-generated example module map. It cannot load arbitrary filesystem paths.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:playground/tsconfig.json:3:path-traversal-sequence","reason":"These relative include paths configure TypeScript project sources. They do not traverse paths supplied by an attacker.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:teaching/composition.tsx:1:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:teaching/continuity.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:teaching/continuity.tsx:3:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:teaching/continuity.tsx:4:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:teaching/contrasts.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:teaching/contrasts.tsx:3:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:teaching/contrasts.tsx:13:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:teaching/details.tsx:3:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:teaching/edges.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:teaching/relationships.tsx:2:path-traversal-sequence","reason":"The parent-directory reference is a fixed local module or asset path. It is not an attacker-controlled filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:kit/code.tsx:24:process-exec","reason":"This is JavaScript RegExp.exec used to parse display text. It neither invokes a process nor evaluates Python or JavaScript code.","verdict":"false_positive","confidence":1},{"id":"external_commands:kit/motion/Count.tsx:25:process-exec","reason":"This is JavaScript RegExp.exec used to parse display text. It neither invokes a process nor evaluates Python or JavaScript code.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/dev.mjs:46:process-spawn","reason":"The launcher runs locally installed development tools through Node with shell disabled. Arguments are passed as an array, not interpolated into a shell.","verdict":"false_positive","confidence":0.97},{"id":"scripts:kit/code.tsx:24:python-exec-function","reason":"This is JavaScript RegExp.exec used to parse display text. It neither invokes a process nor evaluates Python or JavaScript code.","verdict":"false_positive","confidence":1},{"id":"scripts:kit/motion/Count.tsx:25:python-exec-function","reason":"This is JavaScript RegExp.exec used to parse display text. It neither invokes a process nor evaluates Python or JavaScript code.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/film.mjs:136:synchronous-spawn","reason":"The capture wrapper retries the same Node script with argument arrays and a child marker. It does not construct or execute shell commands.","verdict":"false_positive","confidence":0.97},{"id":"blocker:examples/backgrounds/index.tsx:32:at-command-scheduling","reason":"The match is illustration prose, scale notation, or a displayed time. No operating-system at command is invoked or scheduled.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/bento/bento.css:5:at-command-scheduling","reason":"The match is illustration prose, scale notation, or a displayed time. No operating-system at command is invoked or scheduled.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/bento/index.tsx:20:at-command-scheduling","reason":"The match is illustration prose, scale notation, or a displayed time. No operating-system at command is invoked or scheduled.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/ruled-bento/grid.css:6:at-command-scheduling","reason":"The match is illustration prose, scale notation, or a displayed time. No operating-system at command is invoked or scheduled.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/ruled-bento/index.tsx:19:at-command-scheduling","reason":"The match is illustration prose, scale notation, or a displayed time. No operating-system at command is invoked or scheduled.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/ruled-bento/index.tsx:243:at-command-scheduling","reason":"The match is illustration prose, scale notation, or a displayed time. No operating-system at command is invoked or scheduled.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/staggered-bento/grid.css:6:at-command-scheduling","reason":"The match is illustration prose, scale notation, or a displayed time. No operating-system at command is invoked or scheduled.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/staggered-bento/index.tsx:20:at-command-scheduling","reason":"The match is illustration prose, scale notation, or a displayed time. No operating-system at command is invoked or scheduled.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/bento.md:20:at-command-scheduling","reason":"The match is illustration prose, scale notation, or a displayed time. No operating-system at command is invoked or scheduled.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/framing.md:38:at-command-scheduling","reason":"The match is illustration prose, scale notation, or a displayed time. No operating-system at command is invoked or scheduled.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:34:at-command-scheduling","reason":"The match is illustration prose, scale notation, or a displayed time. No operating-system at command is invoked or scheduled.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/phones/index.tsx:16:template-injection-targeting-system-prompt","reason":"system-ui is a CSS font family in a React style object. It is not an instruction targeting an AI system prompt.","verdict":"false_positive","confidence":1},{"id":"blocker:examples/phones/index.tsx:47:template-injection-targeting-system-prompt","reason":"system-ui is a CSS font family in a React style object. It is not an instruction targeting an AI system prompt.","verdict":"false_positive","confidence":1},{"id":"sensitive:examples/dark-bento/bento.css:2:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:examples/dark-bento/bento.css:22:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:examples/dark-bento/bento.css:33:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:examples/dark-bento/bento.css:37:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:examples/dark-bento/bento.css:48:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:examples/dark-bento/bento.css:56:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:examples/dark-bento/bento.css:62:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:examples/dark-bento/bento.css:69:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:examples/dark-bento/bento.css:76:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:examples/dark-bento/bento.css:88:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:teaching/details.css:62:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:teaching/details.css:63:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:teaching/details.css:64:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"sensitive:teaching/details.css:65:sqlite-database-file","reason":"The .db- prefix names CSS classes for a demo layout. There is no SQLite filename, database read, or database connection.","verdict":"false_positive","confidence":1},{"id":"scripts:playground/main.tsx:17:dynamic-import-expression","reason":"The dynamic import names a fixed local preview module or installed dependency. It does not execute modules from untrusted URLs or paths.","verdict":"false_positive","confidence":0.99},{"id":"scripts:playground/main.tsx:22:dynamic-import-expression","reason":"The dynamic import names a fixed local preview module or installed dependency. It does not execute modules from untrusted URLs or paths.","verdict":"false_positive","confidence":0.99},{"id":"scripts:playground/main.tsx:83:dynamic-import-expression","reason":"The dynamic import names a fixed local preview module or installed dependency. It does not execute modules from untrusted URLs or paths.","verdict":"false_positive","confidence":0.99},{"id":"scripts:playground/preview.tsx:14:dynamic-import-expression","reason":"The import selects a fixed teaching module or an entry from the bundled example map. Arbitrary external modules cannot be selected.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/browser.mjs:8:dynamic-import-expression","reason":"The dynamic import names a fixed local preview module or installed dependency. It does not execute modules from untrusted URLs or paths.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/class-clash.mjs:36:dynamic-import-expression","reason":"The dynamic import names a fixed local preview module or installed dependency. It does not execute modules from untrusted URLs or paths.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/film.mjs:176:dynamic-import-expression","reason":"A fixed node:fs import reads this script header to print help. No user-controlled module is imported.","verdict":"false_positive","confidence":0.99},{"id":"network:examples/wikipedia/index.tsx:410:hardcoded-ip-address","reason":"The apparent IP address consists of SVG path coordinates in a displayed icon. No network connection is made by this drawing.","verdict":"false_positive","confidence":0.99},{"id":"network:kit/brands/1password-dark.svg:1:hardcoded-ip-address","reason":"The numeric match is SVG drawing geometry in a brand asset, not an IP destination or network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:kit/brands/1password.svg:1:hardcoded-ip-address","reason":"The numeric match is SVG drawing geometry in a brand asset, not an IP destination or network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:kit/brands/amex.svg:1:hardcoded-ip-address","reason":"The numeric match is SVG drawing geometry in a brand asset, not an IP destination or network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:kit/brands/bankofamerica-dark.svg:1:hardcoded-ip-address","reason":"The numeric match is SVG drawing geometry in a brand asset, not an IP destination or network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:kit/brands/bankofamerica.svg:1:hardcoded-ip-address","reason":"The numeric match is SVG drawing geometry in a brand asset, not an IP destination or network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:kit/brands/barclays.svg:1:hardcoded-ip-address","reason":"The numeric match is SVG drawing geometry in a brand asset, not an IP destination or network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:kit/brands/bitcoin.svg:1:hardcoded-ip-address","reason":"The numeric match is SVG drawing geometry in a brand asset, not an IP destination or network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:kit/brands/chase.svg:1:hardcoded-ip-address","reason":"The numeric match is SVG drawing geometry in a brand asset, not an IP destination or network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:kit/brands/monzo-dark.svg:1:hardcoded-ip-address","reason":"The numeric match is SVG drawing geometry in a brand asset, not an IP destination or network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:kit/brands/monzo.svg:1:hardcoded-ip-address","reason":"The numeric match is SVG drawing geometry in a brand asset, not an IP destination or network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:playground/vite.config.ts:3:hardcoded-ip-address","reason":"127.0.0.1 binds the preview server to loopback. This is local development configuration, not a remote collection endpoint.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/ios.tsx:88:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Count.tsx:25:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Roll.tsx:76:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Roll.tsx:88:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Roll.tsx:89:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Roll.tsx:106:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/motion/Roll.tsx:108:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/class-clash-core.mjs:90:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/class-clash-core.mjs:91:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/film-checks.mjs:62:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/film-checks.mjs:179:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/film-checks.mjs:318:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/film-checks.mjs:426:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/film-checks.mjs:488:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/film-checks.mjs:520:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/film-checks.mjs:521:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/film-checks.mjs:553:hidden-file-access","reason":"The match is a regular expression checking text, CSS properties, or element types. No hidden file is opened or enumerated.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:examples/ai-cards/index.tsx:88:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:examples/ai-cards/index.tsx:106:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:examples/annotations/composed.tsx:20:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:examples/annotations/composed.tsx:47:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:examples/annotations/composed.tsx:52:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:examples/annotations/composed.tsx:65:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:examples/annotations/composed.tsx:68:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:examples/annotations/index.tsx:35:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:examples/annotations/index.tsx:79:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:examples/annotations/index.tsx:105:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:kit/act.ts:24:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:kit/act.ts:30:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:kit/act.ts:34:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:kit/act.ts:40:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:kit/act.ts:42:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:kit/act.ts:47:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:kit/act.ts:48:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:kit/act.ts:55:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:kit/act.ts:57:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:playground/main.tsx:9:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:playground/preview.tsx:14:ruby-shell-backtick-execution","reason":"The template string forms a bundled module-map key or an error message. It is not interpreted by a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:playground/preview.tsx:15:ruby-shell-backtick-execution","reason":"The template string forms a bundled module-map key or an error message. It is not interpreted by a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:playground/viewer.tsx:26:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:playground/viewer.tsx:72:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:playground/viewer.tsx:85:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/browser.mjs:10:ruby-shell-backtick-execution","reason":"The string formats a browser-launch diagnostic or installation guidance. Backticks in this JavaScript file do not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/browser.mjs:17:ruby-shell-backtick-execution","reason":"The string formats a browser-launch diagnostic or installation guidance. Backticks in this JavaScript file do not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/class-clash-core.mjs:74:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/class-clash-core.mjs:78:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/class-clash-core.mjs:79:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/class-clash-core.mjs:91:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/class-clash-core.mjs:100:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/class-clash-core.mjs:125:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/class-clash.mjs:33:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backticks mark documentation examples for illustration APIs. They are not Ruby execution or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:teaching/composition.tsx:88:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:teaching/composition.tsx:127:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:teaching/continuity.tsx:64:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:teaching/contrasts.tsx:85:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:teaching/contrasts.tsx:104:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:teaching/contrasts.tsx:130:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:teaching/contrasts.tsx:138:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:teaching/contrasts.tsx:172:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:teaching/details.tsx:87:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template strings for UI identifiers, drawing geometry, or diagnostics. No shell execution consumes these strings.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/film.mjs:142:sharedarraybuffer-spectre-risk","reason":"A four-byte SharedArrayBuffer provides a bounded Node retry delay through Atomics.wait. It is not shared with browser content or used for speculative-execution attacks.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:scripts/film.mjs:374:shell-command-substitution","reason":"The dollar-sign method is a Playwright CSS-selector query. This JavaScript expression is not shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/film.mjs:380:shell-command-substitution","reason":"The dollar-sign method is a Playwright CSS-selector query. This JavaScript expression is not shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/film.mjs:432:shell-command-substitution","reason":"The dollar-sign method is a Playwright CSS-selector query. This JavaScript expression is not shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/film.mjs:600:shell-command-substitution","reason":"The dollar-sign method is a Playwright CSS-selector query. This JavaScript expression is not shell command substitution.","verdict":"false_positive","confidence":1},{"id":"filesystem:scripts/class-clash.mjs:9:synchronous-file-operations","reason":"The CLI reads operator-selected CSS files for namespace analysis and skips nested symbolic links. Synchronous reads do not imply secret collection or exfiltration.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/class-clash.mjs:42:synchronous-file-operations","reason":"The CLI reads operator-selected CSS files for namespace analysis and skips nested symbolic links. Synchronous reads do not imply secret collection or exfiltration.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/dev.mjs:3:synchronous-file-operations","reason":"The launcher reads installed package metadata to resolve local development executables. It does not target credentials or unrelated private files.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/dev.mjs:12:synchronous-file-operations","reason":"The launcher reads installed package metadata to resolve local development executables. It does not target credentials or unrelated private files.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/film.mjs:123:synchronous-file-operations","reason":"The capture CLI writes requested local output and verification reports. These synchronous operations are expected tooling, not unauthorized file access.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/film.mjs:176:synchronous-file-operations","reason":"The help branch reads its own source header to print CLI documentation. It does not access unrelated private files.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/film.mjs:530:synchronous-file-operations","reason":"The capture CLI writes requested local output and verification reports. These synchronous operations are expected tooling, not unauthorized file access.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/jumps.mjs:7:synchronous-file-operations","reason":"The verification CLI writes its report to an operator-selected local path. There is no unsolicited file modification or upload.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/jumps.mjs:66:synchronous-file-operations","reason":"The verification CLI writes its report to an operator-selected local path. There is no unsolicited file modification or upload.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/film.mjs:362:template-literal-with-command-substitution","reason":"This template literal formats a diagnostic or capture status message. Interpolation is ordinary JavaScript and is not passed to a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/film.mjs:410:template-literal-with-command-substitution","reason":"This template literal formats a diagnostic or capture status message. Interpolation is ordinary JavaScript and is not passed to a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/film.mjs:590:template-literal-with-command-substitution","reason":"This template literal formats a diagnostic or capture status message. Interpolation is ordinary JavaScript and is not passed to a shell.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/ai-chat/index.tsx:20:system-reconnaissance","reason":"The match describes or renders demo content and local playback behavior. It does not perform host discovery or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/ai-chat/index.tsx:30:system-reconnaissance","reason":"The match describes or renders demo content and local playback behavior. It does not perform host discovery or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/annotations/annotations.css:4:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/annotations/annotations.css:6:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/annotations/annotations.css:7:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/annotations/annotations.css:9:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/annotations/annotations.css:14:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/annotations/annotations.css:17:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/annotations/annotations.css:20:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/act.ts:21:system-reconnaissance","reason":"The match is a scene-animation API, type signature, or local scheduling comment. It does not inspect host identity or operating-system data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/act.ts:45:system-reconnaissance","reason":"The match is a scene-animation API, type signature, or local scheduling comment. It does not inspect host identity or operating-system data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/act.ts:80:system-reconnaissance","reason":"The match is a scene-animation API, type signature, or local scheduling comment. It does not inspect host identity or operating-system data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/act.ts:94:system-reconnaissance","reason":"The match is a scene-animation API, type signature, or local scheduling comment. It does not inspect host identity or operating-system data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/act.ts:128:system-reconnaissance","reason":"The match is a scene-animation API, type signature, or local scheduling comment. It does not inspect host identity or operating-system data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/act.ts:129:system-reconnaissance","reason":"The match is a scene-animation API, type signature, or local scheduling comment. It does not inspect host identity or operating-system data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/act.ts:130:system-reconnaissance","reason":"The match is a scene-animation API, type signature, or local scheduling comment. It does not inspect host identity or operating-system data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/act.ts:155:system-reconnaissance","reason":"The match is a scene-animation API, type signature, or local scheduling comment. It does not inspect host identity or operating-system data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/act.ts:204:system-reconnaissance","reason":"The match is a scene-animation API, type signature, or local scheduling comment. It does not inspect host identity or operating-system data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:playground/catalog.ts:6:system-reconnaissance","reason":"The match describes or renders demo content and local playback behavior. It does not perform host discovery or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:playground/catalog.ts:21:system-reconnaissance","reason":"The match describes or renders demo content and local playback behavior. It does not perform host discovery or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:playground/catalog.ts:79:system-reconnaissance","reason":"The match describes or renders demo content and local playback behavior. It does not perform host discovery or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:playground/catalog.ts:88:system-reconnaissance","reason":"The match describes or renders demo content and local playback behavior. It does not perform host discovery or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:playground/catalog.ts:90:system-reconnaissance","reason":"The match describes or renders demo content and local playback behavior. It does not perform host discovery or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:playground/catalog.ts:91:system-reconnaissance","reason":"The match describes or renders demo content and local playback behavior. It does not perform host discovery or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:playground/main.tsx:78:system-reconnaissance","reason":"The match describes or renders demo content and local playback behavior. It does not perform host discovery or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:playground/main.tsx:87:system-reconnaissance","reason":"The match describes or renders demo content and local playback behavior. It does not perform host discovery or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:playground/main.tsx:111:system-reconnaissance","reason":"The match describes or renders demo content and local playback behavior. It does not perform host discovery or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/annotations.md:11:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/annotations.md:12:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/annotations.md:15:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/annotations.md:28:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/annotations.md:59:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/backgrounds.md:7:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/backgrounds.md:9:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/backgrounds.md:14:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/backgrounds.md:20:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/film-checks.mjs:184:system-reconnaissance","reason":"The checker inspects DOM layout, styles, and visibility on the requested page. This is visual verification, not operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/film-checks.mjs:279:system-reconnaissance","reason":"The checker inspects DOM layout, styles, and visibility on the requested page. This is visual verification, not operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/film-checks.mjs:420:system-reconnaissance","reason":"The checker inspects DOM layout, styles, and visibility on the requested page. This is visual verification, not operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/film-checks.mjs:489:system-reconnaissance","reason":"The checker inspects DOM layout, styles, and visibility on the requested page. This is visual verification, not operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/film-checks.mjs:736:system-reconnaissance","reason":"The checker inspects DOM layout, styles, and visibility on the requested page. This is visual verification, not operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/film-checks.mjs:744:system-reconnaissance","reason":"The checker inspects DOM layout, styles, and visibility on the requested page. This is visual verification, not operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/film-checks.mjs:895:system-reconnaissance","reason":"The checker inspects DOM layout, styles, and visibility on the requested page. This is visual verification, not operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/film-checks.mjs:1005:system-reconnaissance","reason":"The checker inspects DOM layout, styles, and visibility on the requested page. This is visual verification, not operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/film-checks.mjs:1006:system-reconnaissance","reason":"The checker inspects DOM layout, styles, and visibility on the requested page. This is visual verification, not operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:22:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:34:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:40:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:64:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:79:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:98:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:99:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:100:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:101:system-reconnaissance","reason":"The matched prose describes illustration composition or interface storytelling. It does not direct host discovery or collection of system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:teaching/composition.css:11:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:teaching/composition.css:12:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:teaching/composition.css:18:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:teaching/composition.css:27:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:teaching/composition.css:42:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:teaching/composition.css:44:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:teaching/composition.css:45:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:teaching/composition.css:48:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:teaching/composition.css:51:system-reconnaissance","reason":"The match is a CSS declaration for borders, layout, or appearance. It performs no host discovery or operating-system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/figma/index.tsx:30:array-join-empty-string","reason":"Joining formatted hexadecimal color channels creates a display color. It does not reconstruct executable code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/film.mjs:654:array-join-empty-string","reason":"The join assembles contact-sheet HTML, not an encoded executable payload. Unescaped page-derived labels are assessed separately as an HTML injection finding.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/jumps-core.mjs:73:array-join-empty-string","reason":"The join combines DOM text nodes for visual-change comparison. No reconstructed text is evaluated as code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/motion-watch.mjs:196:array-join-empty-string","reason":"The join combines visible text for motion comparison. The result is a short label, not executable code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/film-checks.mjs:688:unicode-code-point-escape","reason":"The Unicode escapes belong to an emoji-detection regular expression used by visual checks. They do not conceal executable instructions.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/film-checks.mjs:688:unicode-escape-sequence","reason":"The Unicode escapes belong to an emoji-detection regular expression used by visual checks. They do not conceal executable instructions.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/film.mjs:195:url-decode","reason":"decodeURIComponent converts an example query value into a CSS selector. The decoded value is not evaluated as JavaScript or executed as a command.","verdict":"false_positive","confidence":0.97},{"id":"env_access:kit/util.ts:4:environment-variable-access-dot-notation","reason":"NODE_ENV controls development warnings; one match is only a comment. No environment file or secret value is read at this location.","verdict":"false_positive","confidence":0.99},{"id":"env_access:kit/util.ts:8:environment-variable-access-dot-notation","reason":"NODE_ENV controls development warnings; one match is only a comment. No environment file or secret value is read at this location.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/browser.mjs:13:environment-variable-access-dot-notation","reason":"CHROME_PATH selects the operator-configured browser executable for local captures. It does not read an environment file or transmit credentials.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/film.mjs:131:environment-variable-access-dot-notation","reason":"FILM_CHILD is a local recursion guard for capture retries. The code does not read environment files or collect secret variables.","verdict":"false_positive","confidence":0.98},{"id":"env_access:kit/util.ts:4:environment-variable-object","reason":"NODE_ENV controls development warnings; one match is only a comment. No environment file or secret value is read at this location.","verdict":"false_positive","confidence":0.99},{"id":"env_access:kit/util.ts:8:environment-variable-object","reason":"NODE_ENV controls development warnings; one match is only a comment. No environment file or secret value is read at this location.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/browser.mjs:13:environment-variable-object","reason":"CHROME_PATH selects the operator-configured browser executable for local captures. It does not read an environment file or transmit credentials.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/film.mjs:131:environment-variable-object","reason":"FILM_CHILD is a local recursion guard for capture retries. The code does not read environment files or collect secret variables.","verdict":"false_positive","confidence":0.98},{"id":"env_access:scripts/film.mjs:136:environment-variable-object","reason":"The retry launches the same Node script with inherited environment and a FILM_CHILD marker. No environment content is sent to a network destination.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/controls/index.tsx:13:fetch-api-call","reason":"fetch(id) appears inside a literal code sample rendered by the controls demo. The sample is displayed as text and is not executed.","verdict":"false_positive","confidence":1},{"id":"network:package-lock.json:34:hardcoded-url","reason":"The URL identifies an npm dependency archive in lockfile metadata. No upload or credential transmission occurs at this location.","verdict":"false_positive","confidence":1},{"id":"network:package-lock.json:49:hardcoded-url","reason":"The URL identifies an npm dependency archive in lockfile metadata. No upload or credential transmission occurs at this location.","verdict":"false_positive","confidence":1},{"id":"network:package-lock.json:59:hardcoded-url","reason":"The URL identifies an npm dependency archive in lockfile metadata. No upload or credential transmission occurs at this location.","verdict":"false_positive","confidence":1},{"id":"network:package-lock.json:85:hardcoded-url","reason":"The URL is Babel funding metadata, not a request or data destination used by this skill.","verdict":"false_positive","confidence":1},{"id":"network:package-lock.json:90:hardcoded-url","reason":"The URL identifies an npm dependency archive in lockfile metadata. No upload or credential transmission occurs at this location.","verdict":"false_positive","confidence":1},{"id":"network:package-lock.json:107:hardcoded-url","reason":"The URL identifies an npm dependency archive in lockfile metadata. No upload or credential transmission occurs at this location.","verdict":"false_positive","confidence":1},{"id":"network:package-lock.json:124:hardcoded-url","reason":"The URL identifies an npm dependency archive in lockfile metadata. No upload or credential transmission occurs at this location.","verdict":"false_positive","confidence":1},{"id":"network:package-lock.json:134:hardcoded-url","reason":"The URL identifies an npm dependency archive in lockfile metadata. No upload or credential transmission occurs at this location.","verdict":"false_positive","confidence":1},{"id":"network:package-lock.json:148:hardcoded-url","reason":"The URL identifies an npm dependency archive in lockfile metadata. No upload or credential transmission occurs at this location.","verdict":"false_positive","confidence":1},{"id":"network:playground/playback.ts:98:http-client-library","reason":"request is an injected animation-frame scheduling callback, not an HTTP client. It advances local playback and makes no network request.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"Unescaped Scene Labels Can Alter Capture Evidence","severity":"medium","locations":[{"file":"scripts/film.mjs","line_end":609,"line_start":602},{"file":"scripts/film.mjs","line_end":655,"line_start":644}],"confidence":0.94,"description":"State capture reads page-controlled data-mark values and inserts them unescaped into contact-sheet HTML. Crafted labels can inject styles or scripts, falsifying review images or initiating browser requests.","confidence_reasoning":"The source directly connects data-mark attributes to shot labels and interpolates those labels into setContent without escaping. Exploitation requires control of a captured label; no malicious payload was observed."}],"subject_marketplace_commit_sha":"2248333d85aa37e3eccaa477a113c86a0285b02e","subject_content_hash":"a9b790ab20631961dcc71ae5955710d5bda10d62469f43767a6a38c650e5e9d7","subject_tree_hash":"a31b7ae96d97f0f456b72ac7c79acce3ec78904175ce88d68e95bbaea76f3869","subject_plugin_path":"skills/benjitaylor/stageshow","audit_payload_hash":"7bded508c20892d4069e3e23407f883c","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"2248333d85aa37e3eccaa477a113c86a0285b02e","contentHash":"a9b790ab20631961dcc71ae5955710d5bda10d62469f43767a6a38c650e5e9d7","treeHash":"a31b7ae96d97f0f456b72ac7c79acce3ec78904175ce88d68e95bbaea76f3869","pluginPath":"skills/benjitaylor/stageshow","auditPayloadHash":"7bded508c20892d4069e3e23407f883c"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"unavailable","url":null,"status":null},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"unavailable","verificationState":"not_verified"},"isLatest":true}}