{"data":{"skill":{"slug":"sickn33-backend-dev-guidelines","name":"backend-dev-guidelines","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/backend-dev-guidelines","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"9441c325-d9d7-45a2-a610-6a3f8ed1897e","skill_id":"da49f31a-6eb2-4934-8b35-d57ec93c1746","version":5,"content_hash":"v3:5a26d1d61d694db29af9b138c661c1981076d9df:aa2e8fc9ab3d641cb41b7b320a130a4dc27b32251a1db8c5a4bbd5d80bf13dd2:e616484cdf674a4f98429b9f853e47c34a8511064f1e512e2f43f21f4f6cd81d:736b696c6c732f7369636b6e33332f6261636b656e642d6465762d67756964656c696e6573:9c62b28104521a9a978c764e5a5c8917","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 219 static alerts are false positives caused by Markdown examples, relative imports, placeholders, and TypeScript syntax. Semantic review found overbroad Sentry collection, plaintext development secrets, and direct client exposure of internal error messages.","remediation":[{"issue":"Sentry captures broad request and local-variable data with limited redaction.","severity":"high","suggestion":"Disable local-variable capture and default request-body collection. Allowlist required fields, redact secrets recursively, and document retention and consent requirements."},{"issue":"Development guidance stores several secrets in plaintext config.ini.","severity":"medium","suggestion":"Use a secret manager or injected environment values. Keep only non-secret settings in INI files and reject placeholder secrets during startup."},{"issue":"The controller example sends arbitrary exception messages to clients.","severity":"medium","suggestion":"Map approved domain errors to public messages. Return a generic message for unexpected errors and retain detailed context only in protected logs."}],"risk_factor_evidence":[{"factor":"env_access","evidence":[{"file":"resources/architecture-overview.md","line_end":185,"line_start":185},{"file":"resources/architecture-overview.md","line_end":207,"line_start":207},{"file":"resources/configuration.md","line_end":44,"line_start":44},{"file":"resources/configuration.md","line_end":45,"line_start":45},{"file":"resources/configuration.md","line_end":58,"line_start":58},{"file":"resources/configuration.md","line_end":61,"line_start":61},{"file":"resources/configuration.md","line_end":62,"line_start":62},{"file":"resources/configuration.md","line_end":130,"line_start":130},{"file":"resources/configuration.md","line_end":131,"line_start":131},{"file":"resources/configuration.md","line_end":132,"line_start":132},{"file":"resources/configuration.md","line_end":133,"line_start":133},{"file":"resources/configuration.md","line_end":134,"line_start":134},{"file":"resources/configuration.md","line_end":137,"line_start":137},{"file":"resources/configuration.md","line_end":138,"line_start":138},{"file":"resources/configuration.md","line_end":228,"line_start":228},{"file":"resources/configuration.md","line_end":231,"line_start":231},{"file":"resources/configuration.md","line_end":251,"line_start":251},{"file":"resources/configuration.md","line_end":252,"line_start":252},{"file":"resources/configuration.md","line_end":253,"line_start":253},{"file":"resources/configuration.md","line_end":8,"line_start":8},{"file":"resources/configuration.md","line_end":20,"line_start":20},{"file":"resources/configuration.md","line_end":38,"line_start":38},{"file":"resources/configuration.md","line_end":44,"line_start":44},{"file":"resources/configuration.md","line_end":45,"line_start":45},{"file":"resources/configuration.md","line_end":58,"line_start":58},{"file":"resources/configuration.md","line_end":61,"line_start":61},{"file":"resources/configuration.md","line_end":62,"line_start":62},{"file":"resources/configuration.md","line_end":130,"line_start":130},{"file":"resources/configuration.md","line_end":131,"line_start":131},{"file":"resources/configuration.md","line_end":132,"line_start":132},{"file":"resources/configuration.md","line_end":133,"line_start":133},{"file":"resources/configuration.md","line_end":134,"line_start":134},{"file":"resources/configuration.md","line_end":137,"line_start":137},{"file":"resources/configuration.md","line_end":138,"line_start":138},{"file":"resources/configuration.md","line_end":151,"line_start":151},{"file":"resources/configuration.md","line_end":202,"line_start":202},{"file":"resources/configuration.md","line_end":228,"line_start":228},{"file":"resources/configuration.md","line_end":231,"line_start":231},{"file":"resources/configuration.md","line_end":240,"line_start":240},{"file":"resources/configuration.md","line_end":243,"line_start":243},{"file":"resources/configuration.md","line_end":251,"line_start":251},{"file":"resources/configuration.md","line_end":252,"line_start":252},{"file":"resources/configuration.md","line_end":253,"line_start":253},{"file":"resources/configuration.md","line_end":133,"line_start":133},{"file":"resources/configuration.md","line_end":196,"line_start":196},{"file":"resources/configuration.md","line_end":228,"line_start":228},{"file":"resources/sentry-and-monitoring.md","line_end":44,"line_start":44},{"file":"resources/sentry-and-monitoring.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":161,"line_start":161},{"file":"SKILL.md","line_end":161,"line_start":161}]},{"factor":"filesystem","evidence":[{"file":"resources/complete-examples.md","line_end":24,"line_start":24},{"file":"resources/complete-examples.md","line_end":25,"line_start":25},{"file":"resources/complete-examples.md","line_end":130,"line_start":130},{"file":"resources/complete-examples.md","line_end":131,"line_start":131},{"file":"resources/complete-examples.md","line_end":132,"line_start":132},{"file":"resources/complete-examples.md","line_end":212,"line_start":212},{"file":"resources/complete-examples.md","line_end":213,"line_start":213},{"file":"resources/complete-examples.md","line_end":214,"line_start":214},{"file":"resources/complete-examples.md","line_end":366,"line_start":366},{"file":"resources/configuration.md","line_end":126,"line_start":126},{"file":"resources/configuration.md","line_end":126,"line_start":126},{"file":"resources/configuration.md","line_end":125,"line_start":125},{"file":"resources/configuration.md","line_end":125,"line_start":125},{"file":"resources/middleware-guide.md","line_end":93,"line_start":93},{"file":"resources/routing-and-controllers.md","line_end":38,"line_start":38},{"file":"resources/routing-and-controllers.md","line_end":39,"line_start":39},{"file":"resources/routing-and-controllers.md","line_end":40,"line_start":40},{"file":"resources/routing-and-controllers.md","line_end":234,"line_start":234},{"file":"resources/routing-and-controllers.md","line_end":235,"line_start":235},{"file":"resources/routing-and-controllers.md","line_end":313,"line_start":313},{"file":"resources/routing-and-controllers.md","line_end":314,"line_start":314},{"file":"resources/routing-and-controllers.md","line_end":406,"line_start":406},{"file":"resources/routing-and-controllers.md","line_end":531,"line_start":531},{"file":"resources/sentry-and-monitoring.md","line_end":40,"line_start":40},{"file":"resources/sentry-and-monitoring.md","line_end":40,"line_start":40},{"file":"resources/sentry-and-monitoring.md","line_end":39,"line_start":39},{"file":"resources/sentry-and-monitoring.md","line_end":39,"line_start":39},{"file":"resources/sentry-and-monitoring.md","line_end":140,"line_start":140},{"file":"resources/sentry-and-monitoring.md","line_end":182,"line_start":182},{"file":"resources/sentry-and-monitoring.md","line_end":219,"line_start":219},{"file":"resources/services-and-repositories.md","line_end":338,"line_start":338},{"file":"resources/services-and-repositories.md","line_end":505,"line_start":505},{"file":"resources/services-and-repositories.md","line_end":506,"line_start":506},{"file":"resources/services-and-repositories.md","line_end":725,"line_start":725},{"file":"resources/services-and-repositories.md","line_end":726,"line_start":726},{"file":"resources/services-and-repositories.md","line_end":727,"line_start":727},{"file":"resources/services-and-repositories.md","line_end":730,"line_start":730},{"file":"resources/testing-guide.md","line_end":23,"line_start":23},{"file":"resources/testing-guide.md","line_end":25,"line_start":25},{"file":"resources/testing-guide.md","line_end":201,"line_start":201},{"file":"resources/validation-patterns.md","line_end":378,"line_start":378},{"file":"resources/validation-patterns.md","line_end":379,"line_start":379}]},{"factor":"network","evidence":[{"file":"resources/configuration.md","line_end":182,"line_start":182},{"file":"resources/configuration.md","line_end":186,"line_start":186},{"file":"resources/testing-guide.md","line_end":191,"line_start":191},{"file":"resources/testing-guide.md","line_end":194,"line_start":194}]},{"factor":"external_commands","evidence":[{"file":"resources/routing-and-controllers.md","line_end":226,"line_start":171},{"file":"resources/services-and-repositories.md","line_end":317,"line_start":270},{"file":"resources/services-and-repositories.md","line_end":333,"line_start":317},{"file":"resources/services-and-repositories.md","line_end":435,"line_start":400},{"file":"resources/services-and-repositories.md","line_end":462,"line_start":435},{"file":"resources/services-and-repositories.md","line_end":477,"line_start":462},{"file":"resources/services-and-repositories.md","line_end":499,"line_start":477},{"file":"resources/services-and-repositories.md","line_end":542,"line_start":523},{"file":"resources/services-and-repositories.md","line_end":548,"line_start":542},{"file":"resources/services-and-repositories.md","line_end":630,"line_start":619},{"file":"SKILL.md","line_end":45,"line_start":43},{"file":"SKILL.md","line_end":47,"line_start":45},{"file":"SKILL.md","line_end":77,"line_start":47},{"file":"SKILL.md","line_end":79,"line_start":77},{"file":"SKILL.md","line_end":89,"line_start":79},{"file":"SKILL.md","line_end":99,"line_start":89},{"file":"SKILL.md","line_end":123,"line_start":99},{"file":"SKILL.md","line_end":125,"line_start":123},{"file":"SKILL.md","line_end":136,"line_start":125},{"file":"SKILL.md","line_end":138,"line_start":136},{"file":"SKILL.md","line_end":144,"line_start":138},{"file":"SKILL.md","line_end":149,"line_start":144},{"file":"SKILL.md","line_end":151,"line_start":149},{"file":"SKILL.md","line_end":159,"line_start":151},{"file":"SKILL.md","line_end":166,"line_start":159},{"file":"SKILL.md","line_end":177,"line_start":166},{"file":"SKILL.md","line_end":183,"line_start":177},{"file":"SKILL.md","line_end":191,"line_start":183},{"file":"SKILL.md","line_end":206,"line_start":191},{"file":"SKILL.md","line_end":214,"line_start":206},{"file":"SKILL.md","line_end":215,"line_start":214},{"file":"SKILL.md","line_end":216,"line_start":215},{"file":"SKILL.md","line_end":217,"line_start":216},{"file":"SKILL.md","line_end":218,"line_start":217},{"file":"SKILL.md","line_end":228,"line_start":218},{"file":"SKILL.md","line_end":234,"line_start":228},{"file":"SKILL.md","line_end":247,"line_start":234},{"file":"SKILL.md","line_end":249,"line_start":247},{"file":"SKILL.md","line_end":259,"line_start":249},{"file":"SKILL.md","line_end":266,"line_start":259},{"file":"SKILL.md","line_end":292,"line_start":266},{"file":"SKILL.md","line_end":298,"line_start":292}]}],"critical_findings":[],"high_findings":[{"title":"Overbroad Sentry Data Collection","locations":[{"file":"resources/sentry-and-monitoring.md","line_end":85,"line_start":49}],"confidence":0.96,"description":"The recommended setup captures local variables, request bodies, headers, query strings, IP addresses, and user identifiers. Its scrubber removes only two headers and masks one email field.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The enabled integrations and included fields are explicit. Passwords, tokens, and personal data outside the narrow scrubber could reach Sentry."}],"medium_findings":[{"title":"Plaintext Secret Configuration Guidance","locations":[{"file":"resources/configuration.md","line_end":234,"line_start":160}],"confidence":0.93,"description":"The guide places database, JWT, internal API, and client secrets in config.ini and gives that file highest precedence. Gitignore guidance reduces accidental commits but not plaintext exposure.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The configuration examples and precedence rules are explicit. Production uses environment variables, but the recommended development file still stores secrets unencrypted."},{"title":"Internal Error Messages Returned to Clients","locations":[{"file":"resources/sentry-and-monitoring.md","line_end":134,"line_start":120}],"confidence":0.91,"description":"The BaseController example returns error.message directly in HTTP responses. Unexpected exceptions can reveal database details, identifiers, or internal implementation information.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The response assignment is direct and lacks an allowlist of public error types. The exposure depends on which exceptions reach this handler."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":12,"total_lines":5342,"audit_model":"codex","audited_at":"2026-08-14T09:39:22.747+00:00","created_at":"2026-08-15T04:54:28.201968+00:00","static_findings":[{"id":"env_access:resources/architecture-overview.md:185:environment-variable-object","file":"resources/architecture-overview.md","pattern":"Environment variable object","snippet":"- Direct process.env usage (60+ occurrences)","category":"env_access","line_end":185,"severity":"low","line_start":185},{"id":"env_access:resources/architecture-overview.md:207:environment-variable-object","file":"resources/architecture-overview.md","pattern":"Environment variable object","snippet":"**Avoid:** responseRoutes.ts, direct process.env","category":"env_access","line_end":207,"severity":"low","line_start":207},{"id":"sensitive:resources/architecture-overview.md:185:environment-file-access","file":"resources/architecture-overview.md","pattern":"Environment file access","snippet":"- Direct process.env usage (60+ occurrences)","category":"sensitive","line_end":185,"severity":"high","line_start":185},{"id":"sensitive:resources/architecture-overview.md:207:environment-file-access","file":"resources/architecture-overview.md","pattern":"Environment file access","snippet":"**Avoid:** responseRoutes.ts, direct process.env","category":"sensitive","line_end":207,"severity":"high","line_start":207},{"id":"blocker:resources/architecture-overview.md:275:network-reconnaissance","file":"resources/architecture-overview.md","pattern":"Network reconnaissance","snippet":"- Register routes with Express","category":"blocker","line_end":276,"severity":"low","line_start":275},{"id":"blocker:resources/async-and-errors.md:39:system-reconnaissance","file":"resources/async-and-errors.md","pattern":"System reconnaissance","snippet":"### Avoid .then() Chains","category":"blocker","line_end":39,"severity":"low","line_start":39},{"id":"filesystem:resources/complete-examples.md:24:path-traversal-sequence","file":"resources/complete-examples.md","pattern":"Path traversal sequence","snippet":"import { UserService } from '../services/userService';","category":"filesystem","line_end":24,"severity":"high","line_start":24},{"id":"filesystem:resources/complete-examples.md:25:path-traversal-sequence","file":"resources/complete-examples.md","pattern":"Path traversal sequence","snippet":"import { createUserSchema, updateUserSchema } from '../validators/userSchemas';","category":"filesystem","line_end":25,"severity":"high","line_start":25},{"id":"filesystem:resources/complete-examples.md:130:path-traversal-sequence","file":"resources/complete-examples.md","pattern":"Path traversal sequence","snippet":"import { UserRepository } from '../repositories/UserRepository';","category":"filesystem","line_end":130,"severity":"high","line_start":130},{"id":"filesystem:resources/complete-examples.md:131:path-traversal-sequence","file":"resources/complete-examples.md","pattern":"Path traversal sequence","snippet":"import { ConflictError, NotFoundError, ValidationError } from '../types/errors';","category":"filesystem","line_end":131,"severity":"high","line_start":131},{"id":"filesystem:resources/complete-examples.md:132:path-traversal-sequence","file":"resources/complete-examples.md","pattern":"Path traversal sequence","snippet":"import type { CreateUserDTO, UpdateUserDTO, User } from '../types/user.types';","category":"filesystem","line_end":132,"severity":"high","line_start":132},{"id":"filesystem:resources/complete-examples.md:212:path-traversal-sequence","file":"resources/complete-examples.md","pattern":"Path traversal sequence","snippet":"import { UserController } from '../controllers/UserController';","category":"filesystem","line_end":212,"severity":"high","line_start":212},{"id":"filesystem:resources/complete-examples.md:213:path-traversal-sequence","file":"resources/complete-examples.md","pattern":"Path traversal sequence","snippet":"import { SSOMiddlewareClient } from '../middleware/SSOMiddleware';","category":"filesystem","line_end":213,"severity":"high","line_start":213},{"id":"filesystem:resources/complete-examples.md:214:path-traversal-sequence","file":"resources/complete-examples.md","pattern":"Path traversal sequence","snippet":"import { auditMiddleware } from '../middleware/auditMiddleware';","category":"filesystem","line_end":214,"severity":"high","line_start":214},{"id":"filesystem:resources/complete-examples.md:366:path-traversal-sequence","file":"resources/complete-examples.md","pattern":"Path traversal sequence","snippet":"import { PostController } from '../controllers/PostController';","category":"filesystem","line_end":366,"severity":"high","line_start":366},{"id":"blocker:resources/complete-examples.md:226:system-reconnaissance","file":"resources/complete-examples.md","pattern":"System reconnaissance","snippet":"// GET /users/:id - Get single user","category":"blocker","line_end":226,"severity":"low","line_start":226},{"id":"blocker:resources/complete-examples.md:240:system-reconnaissance","file":"resources/complete-examples.md","pattern":"System reconnaissance","snippet":"// PUT /users/:id - Update user","category":"blocker","line_end":240,"severity":"low","line_start":240},{"id":"blocker:resources/complete-examples.md:247:system-reconnaissance","file":"resources/complete-examples.md","pattern":"System reconnaissance","snippet":"// DELETE /users/:id - Delete user","category":"blocker","line_end":247,"severity":"low","line_start":247},{"id":"blocker:resources/complete-examples.md:271:system-reconnaissance","file":"resources/complete-examples.md","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":271,"severity":"low","line_start":271},{"id":"blocker:resources/complete-examples.md:300:system-reconnaissance","file":"resources/complete-examples.md","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":300,"severity":"low","line_start":300},{"id":"blocker:resources/complete-examples.md:309:system-reconnaissance","file":"resources/complete-examples.md","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":309,"severity":"low","line_start":309},{"id":"blocker:resources/complete-examples.md:516:system-reconnaissance","file":"resources/complete-examples.md","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":516,"severity":"low","line_start":516},{"id":"network:resources/configuration.md:182:hardcoded-url","file":"resources/configuration.md","pattern":"Hardcoded URL","snippet":"baseUrl = http://localhost:8080","category":"network","line_end":182,"severity":"low","line_start":182},{"id":"network:resources/configuration.md:186:hardcoded-url","file":"resources/configuration.md","pattern":"Hardcoded URL","snippet":"dsn = https://your-sentry-dsn","category":"network","line_end":186,"severity":"low","line_start":186},{"id":"filesystem:resources/configuration.md:126:node-js-fs-operations","file":"resources/configuration.md","pattern":"Node.js fs operations","snippet":"const iniConfig = ini.parse(fs.readFileSync(configPath, 'utf-8'));","category":"filesystem","line_end":126,"severity":"medium","line_start":126},{"id":"filesystem:resources/configuration.md:126:synchronous-file-operations","file":"resources/configuration.md","pattern":"Synchronous file operations","snippet":"const iniConfig = ini.parse(fs.readFileSync(configPath, 'utf-8'));","category":"filesystem","line_end":126,"severity":"medium","line_start":126},{"id":"filesystem:resources/configuration.md:125:path-traversal-with","file":"resources/configuration.md","pattern":"Path traversal with ..","snippet":"const configPath = path.join(__dirname, '../../config.ini');","category":"filesystem","line_end":125,"severity":"high","line_start":125},{"id":"filesystem:resources/configuration.md:125:path-traversal-sequence","file":"resources/configuration.md","pattern":"Path traversal sequence","snippet":"const configPath = path.join(__dirname, '../../config.ini');","category":"filesystem","line_end":125,"severity":"high","line_start":125},{"id":"env_access:resources/configuration.md:44:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"const timeout = parseInt(process.env.TIMEOUT_MS || '5000');","category":"env_access","line_end":44,"severity":"low","line_start":44},{"id":"env_access:resources/configuration.md:45:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"const dbHost = process.env.DB_HOST || 'localhost';","category":"env_access","line_end":45,"severity":"low","line_start":45},{"id":"env_access:resources/configuration.md:58:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"const host = process.env.DB_HSOT; // undefined! No error!","category":"env_access","line_end":58,"severity":"low","line_start":58},{"id":"env_access:resources/configuration.md:61:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"const port = process.env.PORT; // string! Need parseInt","category":"env_access","line_end":61,"severity":"low","line_start":61},{"id":"env_access:resources/configuration.md:62:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"const timeout = parseInt(process.env.TIMEOUT); // NaN if not set!","category":"env_access","line_end":62,"severity":"low","line_start":62},{"id":"env_access:resources/configuration.md:130:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"host: iniConfig.database?.host || process.env.DB_HOST || 'localhost',","category":"env_access","line_end":130,"severity":"low","line_start":130},{"id":"env_access:resources/configuration.md:131:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"port: parseInt(iniConfig.database?.port || process.env.DB_PORT || '3306'),","category":"env_access","line_end":131,"severity":"low","line_start":131},{"id":"env_access:resources/configuration.md:132:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"username: iniConfig.database?.username || process.env.DB_USER || 'root',","category":"env_access","line_end":132,"severity":"low","line_start":132},{"id":"env_access:resources/configuration.md:133:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"password: iniConfig.database?.password || process.env.DB_PASSWORD || '',","category":"env_access","line_end":133,"severity":"low","line_start":133},{"id":"env_access:resources/configuration.md:134:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"database: iniConfig.database?.database || process.env.DB_NAME || 'blog_dev',","category":"env_access","line_end":134,"severity":"low","line_start":134},{"id":"env_access:resources/configuration.md:137:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"port: parseInt(iniConfig.server?.port || process.env.PORT || '3002'),","category":"env_access","line_end":137,"severity":"low","line_start":137},{"id":"env_access:resources/configuration.md:138:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"sessionSecret: iniConfig.server?.sessionSecret || process.env.SESSION_SECRET || 'dev-secret',","category":"env_access","line_end":138,"severity":"low","line_start":138},{"id":"env_access:resources/configuration.md:228:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"password: process.env.DB_PASSWORD || iniConfig.database?.password || '',","category":"env_access","line_end":228,"severity":"low","line_start":228},{"id":"env_access:resources/configuration.md:231:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"jwt: process.env.JWT_SECRET || iniConfig.tokens?.jwt || '',","category":"env_access","line_end":231,"severity":"low","line_start":231},{"id":"env_access:resources/configuration.md:251:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"const timeout = parseInt(process.env.OPENID_HTTP_TIMEOUT_MS || '15000');","category":"env_access","line_end":251,"severity":"low","line_start":251},{"id":"env_access:resources/configuration.md:252:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"const keycloakUrl = process.env.KEYCLOAK_BASE_URL;","category":"env_access","line_end":252,"severity":"low","line_start":252},{"id":"env_access:resources/configuration.md:253:environment-variable-access-dot-notation","file":"resources/configuration.md","pattern":"Environment variable access (dot notation)","snippet":"const jwtSecret = process.env.JWT_SECRET;","category":"env_access","line_end":253,"severity":"low","line_start":253},{"id":"env_access:resources/configuration.md:8:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"- [NEVER Use process.env Directly](#never-use-processenv-directly)","category":"env_access","line_end":8,"severity":"low","line_start":8},{"id":"env_access:resources/configuration.md:20:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"**Problems with process.env:**","category":"env_access","line_end":20,"severity":"low","line_start":20},{"id":"env_access:resources/configuration.md:38:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"## NEVER Use process.env Directly","category":"env_access","line_end":38,"severity":"low","line_start":38},{"id":"env_access:resources/configuration.md:44:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"const timeout = parseInt(process.env.TIMEOUT_MS || '5000');","category":"env_access","line_end":44,"severity":"low","line_start":44},{"id":"env_access:resources/configuration.md:45:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"const dbHost = process.env.DB_HOST || 'localhost';","category":"env_access","line_end":45,"severity":"low","line_start":45},{"id":"env_access:resources/configuration.md:58:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"const host = process.env.DB_HSOT; // undefined! No error!","category":"env_access","line_end":58,"severity":"low","line_start":58},{"id":"env_access:resources/configuration.md:61:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"const port = process.env.PORT; // string! Need parseInt","category":"env_access","line_end":61,"severity":"low","line_start":61},{"id":"env_access:resources/configuration.md:62:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"const timeout = parseInt(process.env.TIMEOUT); // NaN if not set!","category":"env_access","line_end":62,"severity":"low","line_start":62},{"id":"env_access:resources/configuration.md:130:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"host: iniConfig.database?.host || process.env.DB_HOST || 'localhost',","category":"env_access","line_end":130,"severity":"low","line_start":130},{"id":"env_access:resources/configuration.md:131:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"port: parseInt(iniConfig.database?.port || process.env.DB_PORT || '3306'),","category":"env_access","line_end":131,"severity":"low","line_start":131},{"id":"env_access:resources/configuration.md:132:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"username: iniConfig.database?.username || process.env.DB_USER || 'root',","category":"env_access","line_end":132,"severity":"low","line_start":132},{"id":"env_access:resources/configuration.md:133:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"password: iniConfig.database?.password || process.env.DB_PASSWORD || '',","category":"env_access","line_end":133,"severity":"low","line_start":133},{"id":"env_access:resources/configuration.md:134:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"database: iniConfig.database?.database || process.env.DB_NAME || 'blog_dev',","category":"env_access","line_end":134,"severity":"low","line_start":134},{"id":"env_access:resources/configuration.md:137:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"port: parseInt(iniConfig.server?.port || process.env.PORT || '3002'),","category":"env_access","line_end":137,"severity":"low","line_start":137},{"id":"env_access:resources/configuration.md:138:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"sessionSecret: iniConfig.server?.sessionSecret || process.env.SESSION_SECRET || 'dev-secret',","category":"env_access","line_end":138,"severity":"low","line_start":138},{"id":"env_access:resources/configuration.md:151:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"- Fallback to process.env","category":"env_access","line_end":151,"severity":"low","line_start":151},{"id":"env_access:resources/configuration.md:202:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"2. process.env variables","category":"env_access","line_end":202,"severity":"low","line_start":202},{"id":"env_access:resources/configuration.md:228:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"password: process.env.DB_PASSWORD || iniConfig.database?.password || '',","category":"env_access","line_end":228,"severity":"low","line_start":228},{"id":"env_access:resources/configuration.md:231:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"jwt: process.env.JWT_SECRET || iniConfig.tokens?.jwt || '',","category":"env_access","line_end":231,"severity":"low","line_start":231},{"id":"env_access:resources/configuration.md:240:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"### Find All process.env Usage","category":"env_access","line_end":240,"severity":"low","line_start":240},{"id":"env_access:resources/configuration.md:243:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"grep -r \"process.env\" blog-api/src/ --include=\"*.ts\" | wc -l","category":"env_access","line_end":243,"severity":"low","line_start":243},{"id":"env_access:resources/configuration.md:251:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"const timeout = parseInt(process.env.OPENID_HTTP_TIMEOUT_MS || '15000');","category":"env_access","line_end":251,"severity":"low","line_start":251},{"id":"env_access:resources/configuration.md:252:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"const keycloakUrl = process.env.KEYCLOAK_BASE_URL;","category":"env_access","line_end":252,"severity":"low","line_start":252},{"id":"env_access:resources/configuration.md:253:environment-variable-object","file":"resources/configuration.md","pattern":"Environment variable object","snippet":"const jwtSecret = process.env.JWT_SECRET;","category":"env_access","line_end":253,"severity":"low","line_start":253},{"id":"env_access:resources/configuration.md:133:database-connection-strings","file":"resources/configuration.md","pattern":"Database connection strings","snippet":"password: iniConfig.database?.password || process.env.DB_PASSWORD || '',","category":"env_access","line_end":133,"severity":"high","line_start":133},{"id":"env_access:resources/configuration.md:196:database-connection-strings","file":"resources/configuration.md","pattern":"Database connection strings","snippet":"DB_PASSWORD=secure-password","category":"env_access","line_end":196,"severity":"high","line_start":196},{"id":"env_access:resources/configuration.md:228:database-connection-strings","file":"resources/configuration.md","pattern":"Database connection strings","snippet":"password: process.env.DB_PASSWORD || iniConfig.database?.password || '',","category":"env_access","line_end":228,"severity":"high","line_start":228},{"id":"sensitive:resources/configuration.md:8:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"- [NEVER Use process.env Directly](#never-use-processenv-directly)","category":"sensitive","line_end":8,"severity":"high","line_start":8},{"id":"sensitive:resources/configuration.md:20:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"**Problems with process.env:**","category":"sensitive","line_end":20,"severity":"high","line_start":20},{"id":"sensitive:resources/configuration.md:38:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"## NEVER Use process.env Directly","category":"sensitive","line_end":38,"severity":"high","line_start":38},{"id":"sensitive:resources/configuration.md:44:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"const timeout = parseInt(process.env.TIMEOUT_MS || '5000');","category":"sensitive","line_end":44,"severity":"high","line_start":44},{"id":"sensitive:resources/configuration.md:45:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"const dbHost = process.env.DB_HOST || 'localhost';","category":"sensitive","line_end":45,"severity":"high","line_start":45},{"id":"sensitive:resources/configuration.md:58:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"const host = process.env.DB_HSOT; // undefined! No error!","category":"sensitive","line_end":58,"severity":"high","line_start":58},{"id":"sensitive:resources/configuration.md:61:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"const port = process.env.PORT; // string! Need parseInt","category":"sensitive","line_end":61,"severity":"high","line_start":61},{"id":"sensitive:resources/configuration.md:62:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"const timeout = parseInt(process.env.TIMEOUT); // NaN if not set!","category":"sensitive","line_end":62,"severity":"high","line_start":62},{"id":"sensitive:resources/configuration.md:130:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"host: iniConfig.database?.host || process.env.DB_HOST || 'localhost',","category":"sensitive","line_end":130,"severity":"high","line_start":130},{"id":"sensitive:resources/configuration.md:131:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"port: parseInt(iniConfig.database?.port || process.env.DB_PORT || '3306'),","category":"sensitive","line_end":131,"severity":"high","line_start":131},{"id":"sensitive:resources/configuration.md:132:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"username: iniConfig.database?.username || process.env.DB_USER || 'root',","category":"sensitive","line_end":132,"severity":"high","line_start":132},{"id":"sensitive:resources/configuration.md:133:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"password: iniConfig.database?.password || process.env.DB_PASSWORD || '',","category":"sensitive","line_end":133,"severity":"high","line_start":133},{"id":"sensitive:resources/configuration.md:134:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"database: iniConfig.database?.database || process.env.DB_NAME || 'blog_dev',","category":"sensitive","line_end":134,"severity":"high","line_start":134},{"id":"sensitive:resources/configuration.md:137:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"port: parseInt(iniConfig.server?.port || process.env.PORT || '3002'),","category":"sensitive","line_end":137,"severity":"high","line_start":137},{"id":"sensitive:resources/configuration.md:138:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"sessionSecret: iniConfig.server?.sessionSecret || process.env.SESSION_SECRET || 'dev-secret',","category":"sensitive","line_end":138,"severity":"high","line_start":138},{"id":"sensitive:resources/configuration.md:151:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"- Fallback to process.env","category":"sensitive","line_end":151,"severity":"high","line_start":151},{"id":"sensitive:resources/configuration.md:194:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"# .env file (optional overrides)","category":"sensitive","line_end":194,"severity":"high","line_start":194},{"id":"sensitive:resources/configuration.md:202:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"2. process.env variables","category":"sensitive","line_end":202,"severity":"high","line_start":202},{"id":"sensitive:resources/configuration.md:214:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":".env","category":"sensitive","line_end":214,"severity":"high","line_start":214},{"id":"sensitive:resources/configuration.md:228:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"password: process.env.DB_PASSWORD || iniConfig.database?.password || '',","category":"sensitive","line_end":228,"severity":"high","line_start":228},{"id":"sensitive:resources/configuration.md:231:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"jwt: process.env.JWT_SECRET || iniConfig.tokens?.jwt || '',","category":"sensitive","line_end":231,"severity":"high","line_start":231},{"id":"sensitive:resources/configuration.md:240:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"### Find All process.env Usage","category":"sensitive","line_end":240,"severity":"high","line_start":240},{"id":"sensitive:resources/configuration.md:243:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"grep -r \"process.env\" blog-api/src/ --include=\"*.ts\" | wc -l","category":"sensitive","line_end":243,"severity":"high","line_start":243},{"id":"sensitive:resources/configuration.md:251:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"const timeout = parseInt(process.env.OPENID_HTTP_TIMEOUT_MS || '15000');","category":"sensitive","line_end":251,"severity":"high","line_start":251},{"id":"sensitive:resources/configuration.md:252:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"const keycloakUrl = process.env.KEYCLOAK_BASE_URL;","category":"sensitive","line_end":252,"severity":"high","line_start":252},{"id":"sensitive:resources/configuration.md:253:environment-file-access","file":"resources/configuration.md","pattern":"Environment file access","snippet":"const jwtSecret = process.env.JWT_SECRET;","category":"sensitive","line_end":253,"severity":"high","line_start":253},{"id":"sensitive:resources/configuration.md:216:certificate-key-files","file":"resources/configuration.md","pattern":"Certificate/key files","snippet":"*.pem","category":"sensitive","line_end":216,"severity":"high","line_start":216},{"id":"sensitive:resources/configuration.md:217:certificate-key-files","file":"resources/configuration.md","pattern":"Certificate/key files","snippet":"*.key","category":"sensitive","line_end":217,"severity":"high","line_start":217},{"id":"sensitive:resources/configuration.md:260:certificate-key-files","file":"resources/configuration.md","pattern":"Certificate/key files","snippet":"const timeout = config.keycloak.timeout;","category":"sensitive","line_end":260,"severity":"high","line_start":260},{"id":"sensitive:resources/configuration.md:261:certificate-key-files","file":"resources/configuration.md","pattern":"Certificate/key files","snippet":"const keycloakUrl = config.keycloak.baseUrl;","category":"sensitive","line_end":261,"severity":"high","line_start":261},{"id":"blocker:resources/configuration.md:154:network-reconnaissance","file":"resources/configuration.md","pattern":"Network reconnaissance","snippet":"- Type-safe access","category":"blocker","line_end":156,"severity":"low","line_start":154},{"id":"blocker:resources/database-patterns.md:34:system-reconnaissance","file":"resources/database-patterns.md","pattern":"System reconnaissance","snippet":"const user = await PrismaService.main.user.findUnique({ where: { id } });","category":"blocker","line_end":34,"severity":"low","line_start":34},{"id":"blocker:resources/database-patterns.md:59:system-reconnaissance","file":"resources/database-patterns.md","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":59,"severity":"low","line_start":59},{"id":"blocker:resources/database-patterns.md:86:system-reconnaissance","file":"resources/database-patterns.md","pattern":"System reconnaissance","snippet":"const profile = await tx.userProfile.create({ data: { userId: user.id } });","category":"blocker","line_end":86,"severity":"low","line_start":86},{"id":"blocker:resources/database-patterns.md:96:system-reconnaissance","file":"resources/database-patterns.md","pattern":"System reconnaissance","snippet":"const user = await tx.user.findUnique({ where: { id } });","category":"blocker","line_end":96,"severity":"low","line_start":96},{"id":"blocker:resources/database-patterns.md:100:system-reconnaissance","file":"resources/database-patterns.md","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":100,"severity":"low","line_start":100},{"id":"blocker:resources/database-patterns.md:136:system-reconnaissance","file":"resources/database-patterns.md","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":136,"severity":"low","line_start":136},{"id":"blocker:resources/database-patterns.md:146:system-reconnaissance","file":"resources/database-patterns.md","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":146,"severity":"low","line_start":146},{"id":"blocker:resources/database-patterns.md:164:system-reconnaissance","file":"resources/database-patterns.md","pattern":"System reconnaissance","snippet":"where: { userId: user.id },","category":"blocker","line_end":164,"severity":"low","line_start":164},{"id":"blocker:resources/database-patterns.md:204:system-reconnaissance","file":"resources/database-patterns.md","pattern":"System reconnaissance","snippet":"throw new ValidationError('Invalid reference');","category":"blocker","line_end":204,"severity":"low","line_start":204},{"id":"filesystem:resources/middleware-guide.md:93:path-traversal-sequence","file":"resources/middleware-guide.md","pattern":"Path traversal sequence","snippet":"import { getAuditContext } from '../middleware/auditMiddleware';","category":"filesystem","line_end":93,"severity":"high","line_start":93},{"id":"blocker:resources/middleware-guide.md:24:system-reconnaissance","file":"resources/middleware-guide.md","pattern":"System reconnaissance","snippet":"static verifyLoginStatus(req: Request, res: Response, next: NextFunction): void {","category":"blocker","line_end":24,"severity":"low","line_start":24},{"id":"blocker:resources/middleware-guide.md:37:system-reconnaissance","file":"resources/middleware-guide.md","pattern":"System reconnaissance","snippet":"res.status(401).json({ error: 'Invalid token' });","category":"blocker","line_end":37,"severity":"low","line_start":37},{"id":"blocker:resources/middleware-guide.md:65:system-reconnaissance","file":"resources/middleware-guide.md","pattern":"System reconnaissance","snippet":"export function auditMiddleware(req: Request, res: Response, next: NextFunction): void {","category":"blocker","line_end":65,"severity":"low","line_start":65},{"id":"blocker:resources/middleware-guide.md:71:system-reconnaissance","file":"resources/middleware-guide.md","pattern":"System reconnaissance","snippet":"requestId: req.id || uuidv4(),","category":"blocker","line_end":71,"severity":"low","line_start":71},{"id":"blocker:resources/middleware-guide.md:115:system-reconnaissance","file":"resources/middleware-guide.md","pattern":"System reconnaissance","snippet":"): void {","category":"blocker","line_end":115,"severity":"low","line_start":115},{"id":"external_commands:resources/routing-and-controllers.md:171:ruby-shell-backtick-execution","file":"resources/routing-and-controllers.md","pattern":"Ruby/shell backtick execution","snippet":"`Missing required fields: ${missing.join(', ')}`,","category":"external_commands","line_end":226,"severity":"medium","line_start":171},{"id":"filesystem:resources/routing-and-controllers.md:38:path-traversal-sequence","file":"resources/routing-and-controllers.md","pattern":"Path traversal sequence","snippet":"import { UserController } from '../controllers/UserController';","category":"filesystem","line_end":38,"severity":"high","line_start":38},{"id":"filesystem:resources/routing-and-controllers.md:39:path-traversal-sequence","file":"resources/routing-and-controllers.md","pattern":"Path traversal sequence","snippet":"import { SSOMiddlewareClient } from '../middleware/SSOMiddleware';","category":"filesystem","line_end":39,"severity":"high","line_start":39},{"id":"filesystem:resources/routing-and-controllers.md:40:path-traversal-sequence","file":"resources/routing-and-controllers.md","pattern":"Path traversal sequence","snippet":"import { auditMiddleware } from '../middleware/auditMiddleware';","category":"filesystem","line_end":40,"severity":"high","line_start":40},{"id":"filesystem:resources/routing-and-controllers.md:234:path-traversal-sequence","file":"resources/routing-and-controllers.md","pattern":"Path traversal sequence","snippet":"import { UserService } from '../services/userService';","category":"filesystem","line_end":234,"severity":"high","line_start":234},{"id":"filesystem:resources/routing-and-controllers.md:235:path-traversal-sequence","file":"resources/routing-and-controllers.md","pattern":"Path traversal sequence","snippet":"import { createUserSchema } from '../validators/userSchemas';","category":"filesystem","line_end":235,"severity":"high","line_start":235},{"id":"filesystem:resources/routing-and-controllers.md:313:path-traversal-sequence","file":"resources/routing-and-controllers.md","pattern":"Path traversal sequence","snippet":"import { NotificationController } from '../controllers/NotificationController';","category":"filesystem","line_end":313,"severity":"high","line_start":313},{"id":"filesystem:resources/routing-and-controllers.md:314:path-traversal-sequence","file":"resources/routing-and-controllers.md","pattern":"Path traversal sequence","snippet":"import { SSOMiddlewareClient } from '../middleware/SSOMiddleware';","category":"filesystem","line_end":314,"severity":"high","line_start":314},{"id":"filesystem:resources/routing-and-controllers.md:406:path-traversal-sequence","file":"resources/routing-and-controllers.md","pattern":"Path traversal sequence","snippet":"const { createWorkflowEngine, CompleteStepCommand } = require('../workflow/core/WorkflowEngineV3');","category":"filesystem","line_end":406,"severity":"high","line_start":406},{"id":"filesystem:resources/routing-and-controllers.md:531:path-traversal-sequence","file":"resources/routing-and-controllers.md","pattern":"Path traversal sequence","snippet":"import { PostController } from '../controllers/PostController';","category":"filesystem","line_end":531,"severity":"high","line_start":531},{"id":"blocker:resources/routing-and-controllers.md:104:system-reconnaissance","file":"resources/routing-and-controllers.md","pattern":"System reconnaissance","snippet":"): void {","category":"blocker","line_end":104,"severity":"low","line_start":104},{"id":"blocker:resources/routing-and-controllers.md:137:system-reconnaissance","file":"resources/routing-and-controllers.md","pattern":"System reconnaissance","snippet":"): void {","category":"blocker","line_end":137,"severity":"low","line_start":137},{"id":"blocker:resources/routing-and-controllers.md:191:system-reconnaissance","file":"resources/routing-and-controllers.md","pattern":"System reconnaissance","snippet":"protected logInfo(message: string, context?: Record<string, any>): void {","category":"blocker","line_end":191,"severity":"low","line_start":191},{"id":"blocker:resources/routing-and-controllers.md:200:system-reconnaissance","file":"resources/routing-and-controllers.md","pattern":"System reconnaissance","snippet":"protected logWarning(message: string, context?: Record<string, any>): void {","category":"blocker","line_end":200,"severity":"low","line_start":200},{"id":"blocker:resources/routing-and-controllers.md:215:system-reconnaissance","file":"resources/routing-and-controllers.md","pattern":"System reconnaissance","snippet":"): void {","category":"blocker","line_end":215,"severity":"low","line_start":215},{"id":"blocker:resources/routing-and-controllers.md:222:system-reconnaissance","file":"resources/routing-and-controllers.md","pattern":"System reconnaissance","snippet":"protected captureMetric(name: string, value: number, unit: string): void {","category":"blocker","line_end":222,"severity":"low","line_start":222},{"id":"blocker:resources/routing-and-controllers.md:247:system-reconnaissance","file":"resources/routing-and-controllers.md","pattern":"System reconnaissance","snippet":"this.addBreadcrumb('Fetching user', 'user_controller', { userId: req.params.id });","category":"blocker","line_end":247,"severity":"low","line_start":247},{"id":"blocker:resources/routing-and-controllers.md:426:system-reconnaissance","file":"resources/routing-and-controllers.md","pattern":"System reconnaissance","snippet":"where: { id: postData.id },","category":"blocker","line_end":426,"severity":"low","line_start":426},{"id":"blocker:resources/routing-and-controllers.md:624:system-reconnaissance","file":"resources/routing-and-controllers.md","pattern":"System reconnaissance","snippet":"| 400 | Bad Request | Invalid input data |","category":"blocker","line_end":624,"severity":"low","line_start":624},{"id":"blocker:resources/routing-and-controllers.md:742:system-reconnaissance","file":"resources/routing-and-controllers.md","pattern":"System reconnaissance","snippet":"return PrismaService.main.entity.findUnique({ where: { id } });","category":"blocker","line_end":742,"severity":"low","line_start":742},{"id":"blocker:resources/routing-and-controllers.md:746:system-reconnaissance","file":"resources/routing-and-controllers.md","pattern":"System reconnaissance","snippet":"return PrismaService.main.entity.update({ where: { id }, data });","category":"blocker","line_end":746,"severity":"low","line_start":746},{"id":"filesystem:resources/sentry-and-monitoring.md:40:node-js-fs-operations","file":"resources/sentry-and-monitoring.md","pattern":"Node.js fs operations","snippet":"const sentryConfig = ini.parse(fs.readFileSync(sentryConfigPath, 'utf-8'));","category":"filesystem","line_end":40,"severity":"medium","line_start":40},{"id":"filesystem:resources/sentry-and-monitoring.md:40:synchronous-file-operations","file":"resources/sentry-and-monitoring.md","pattern":"Synchronous file operations","snippet":"const sentryConfig = ini.parse(fs.readFileSync(sentryConfigPath, 'utf-8'));","category":"filesystem","line_end":40,"severity":"medium","line_start":40},{"id":"filesystem:resources/sentry-and-monitoring.md:39:path-traversal-with","file":"resources/sentry-and-monitoring.md","pattern":"Path traversal with ..","snippet":"const sentryConfigPath = path.join(__dirname, '../sentry.ini');","category":"filesystem","line_end":39,"severity":"high","line_start":39},{"id":"filesystem:resources/sentry-and-monitoring.md:39:path-traversal-sequence","file":"resources/sentry-and-monitoring.md","pattern":"Path traversal sequence","snippet":"const sentryConfigPath = path.join(__dirname, '../sentry.ini');","category":"filesystem","line_end":39,"severity":"high","line_start":39},{"id":"filesystem:resources/sentry-and-monitoring.md:140:path-traversal-sequence","file":"resources/sentry-and-monitoring.md","pattern":"Path traversal sequence","snippet":"import { SentryHelper } from '../utils/sentryHelper';","category":"filesystem","line_end":140,"severity":"high","line_start":140},{"id":"filesystem:resources/sentry-and-monitoring.md:182:path-traversal-sequence","file":"resources/sentry-and-monitoring.md","pattern":"Path traversal sequence","snippet":"import { DatabasePerformanceMonitor } from '../utils/databasePerformance';","category":"filesystem","line_end":182,"severity":"high","line_start":182},{"id":"filesystem:resources/sentry-and-monitoring.md:219:path-traversal-sequence","file":"resources/sentry-and-monitoring.md","pattern":"Path traversal sequence","snippet":"import '../instrument'; // FIRST LINE after shebang","category":"filesystem","line_end":219,"severity":"high","line_start":219},{"id":"env_access:resources/sentry-and-monitoring.md:44:environment-variable-access-dot-notation","file":"resources/sentry-and-monitoring.md","pattern":"Environment variable access (dot notation)","snippet":"environment: process.env.NODE_ENV || 'development',","category":"env_access","line_end":44,"severity":"low","line_start":44},{"id":"env_access:resources/sentry-and-monitoring.md:44:environment-variable-object","file":"resources/sentry-and-monitoring.md","pattern":"Environment variable object","snippet":"environment: process.env.NODE_ENV || 'development',","category":"env_access","line_end":44,"severity":"low","line_start":44},{"id":"sensitive:resources/sentry-and-monitoring.md:44:environment-file-access","file":"resources/sentry-and-monitoring.md","pattern":"Environment file access","snippet":"environment: process.env.NODE_ENV || 'development',","category":"sensitive","line_end":44,"severity":"high","line_start":44},{"id":"blocker:resources/sentry-and-monitoring.md:89:system-reconnaissance","file":"resources/sentry-and-monitoring.md","pattern":"System reconnaissance","snippet":"/^Invalid JWT/,","category":"blocker","line_end":89,"severity":"low","line_start":89},{"id":"blocker:resources/sentry-and-monitoring.md:122:system-reconnaissance","file":"resources/sentry-and-monitoring.md","pattern":"System reconnaissance","snippet":"protected handleError(error: unknown, res: Response, context: string, statusCode = 500): void {","category":"blocker","line_end":122,"severity":"low","line_start":122},{"id":"external_commands:resources/services-and-repositories.md:270:ruby-shell-backtick-execution","file":"resources/services-and-repositories.md","pattern":"Ruby/shell backtick execution","snippet":"const cacheKey = `${userId}:${stepInstanceId}`;","category":"external_commands","line_end":317,"severity":"medium","line_start":270},{"id":"external_commands:resources/services-and-repositories.md:317:ruby-shell-backtick-execution","file":"resources/services-and-repositories.md","pattern":"Ruby/shell backtick execution","snippet":"if (key.startsWith(`${userId}:`)) {","category":"external_commands","line_end":333,"severity":"medium","line_start":317},{"id":"external_commands:resources/services-and-repositories.md:400:ruby-shell-backtick-execution","file":"resources/services-and-repositories.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`Failed to find user: ${userId}`);","category":"external_commands","line_end":435,"severity":"medium","line_start":400},{"id":"external_commands:resources/services-and-repositories.md:435:ruby-shell-backtick-execution","file":"resources/services-and-repositories.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`Failed to find user with email: ${email}`);","category":"external_commands","line_end":462,"severity":"medium","line_start":435},{"id":"external_commands:resources/services-and-repositories.md:462:ruby-shell-backtick-execution","file":"resources/services-and-repositories.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`Failed to update user: ${userId}`);","category":"external_commands","line_end":477,"severity":"medium","line_start":462},{"id":"external_commands:resources/services-and-repositories.md:477:ruby-shell-backtick-execution","file":"resources/services-and-repositories.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`Failed to delete user: ${userId}`);","category":"external_commands","line_end":499,"severity":"medium","line_start":477},{"id":"external_commands:resources/services-and-repositories.md:523:ruby-shell-backtick-execution","file":"resources/services-and-repositories.md","pattern":"Ruby/shell backtick execution","snippet":"throw new ValidationError(`Invalid roles: ${invalidRoles.join(', ')}`);","category":"external_commands","line_end":542,"severity":"medium","line_start":523},{"id":"external_commands:resources/services-and-repositories.md:542:ruby-shell-backtick-execution","file":"resources/services-and-repositories.md","pattern":"Ruby/shell backtick execution","snippet":"throw new NotFoundError(`User not found: ${userId}`);","category":"external_commands","line_end":548,"severity":"medium","line_start":542},{"id":"external_commands:resources/services-and-repositories.md:619:ruby-shell-backtick-execution","file":"resources/services-and-repositories.md","pattern":"Ruby/shell backtick execution","snippet":"throw new NotFoundError(`User not found: ${userId}`);","category":"external_commands","line_end":630,"severity":"medium","line_start":619},{"id":"filesystem:resources/services-and-repositories.md:338:path-traversal-sequence","file":"resources/services-and-repositories.md","pattern":"Path traversal sequence","snippet":"import { permissionService } from '../services/permissionService';","category":"filesystem","line_end":338,"severity":"high","line_start":338},{"id":"filesystem:resources/services-and-repositories.md:505:path-traversal-sequence","file":"resources/services-and-repositories.md","pattern":"Path traversal sequence","snippet":"import { userRepository } from '../repositories/UserRepository';","category":"filesystem","line_end":505,"severity":"high","line_start":505},{"id":"filesystem:resources/services-and-repositories.md:506:path-traversal-sequence","file":"resources/services-and-repositories.md","pattern":"Path traversal sequence","snippet":"import { ConflictError, NotFoundError } from '../utils/errors';","category":"filesystem","line_end":506,"severity":"high","line_start":506},{"id":"filesystem:resources/services-and-repositories.md:725:path-traversal-sequence","file":"resources/services-and-repositories.md","pattern":"Path traversal sequence","snippet":"import { UserService } from '../services/userService';","category":"filesystem","line_end":725,"severity":"high","line_start":725},{"id":"filesystem:resources/services-and-repositories.md:726:path-traversal-sequence","file":"resources/services-and-repositories.md","pattern":"Path traversal sequence","snippet":"import { userRepository } from '../repositories/UserRepository';","category":"filesystem","line_end":726,"severity":"high","line_start":726},{"id":"filesystem:resources/services-and-repositories.md:727:path-traversal-sequence","file":"resources/services-and-repositories.md","pattern":"Path traversal sequence","snippet":"import { ConflictError } from '../utils/errors';","category":"filesystem","line_end":727,"severity":"high","line_start":727},{"id":"filesystem:resources/services-and-repositories.md:730:path-traversal-sequence","file":"resources/services-and-repositories.md","pattern":"Path traversal sequence","snippet":"jest.mock('../repositories/UserRepository');","category":"filesystem","line_end":730,"severity":"high","line_start":730},{"id":"blocker:resources/services-and-repositories.md:315:system-reconnaissance","file":"resources/services-and-repositories.md","pattern":"System reconnaissance","snippet":"clearUserCache(userId: string): void {","category":"blocker","line_end":315,"severity":"low","line_start":315},{"id":"blocker:resources/services-and-repositories.md:326:system-reconnaissance","file":"resources/services-and-repositories.md","pattern":"System reconnaissance","snippet":"clearCache(): void {","category":"blocker","line_end":326,"severity":"low","line_start":326},{"id":"blocker:resources/services-and-repositories.md:523:system-reconnaissance","file":"resources/services-and-repositories.md","pattern":"System reconnaissance","snippet":"throw new ValidationError(`Invalid roles: ${invalidRoles.join(', ')}`);","category":"blocker","line_end":523,"severity":"low","line_start":523},{"id":"blocker:resources/services-and-repositories.md:632:system-reconnaissance","file":"resources/services-and-repositories.md","pattern":"System reconnaissance","snippet":"### 5. Avoid God Services","category":"blocker","line_end":632,"severity":"low","line_start":632},{"id":"blocker:resources/services-and-repositories.md:695:system-reconnaissance","file":"resources/services-and-repositories.md","pattern":"System reconnaissance","snippet":"clearUserCache(userId: string): void {","category":"blocker","line_end":695,"severity":"low","line_start":695},{"id":"network:resources/testing-guide.md:191:hardcoded-url","file":"resources/testing-guide.md","pattern":"Hardcoded URL","snippet":"node scripts/test-auth-route.js http://localhost:3002/form/api/users","category":"network","line_end":191,"severity":"low","line_start":191},{"id":"network:resources/testing-guide.md:194:hardcoded-url","file":"resources/testing-guide.md","pattern":"Hardcoded URL","snippet":"node scripts/test-auth-route.js http://localhost:3002/form/api/users POST '{\"email\":\"test@test.com\"}","category":"network","line_end":194,"severity":"low","line_start":194},{"id":"filesystem:resources/testing-guide.md:23:path-traversal-sequence","file":"resources/testing-guide.md","pattern":"Path traversal sequence","snippet":"import { UserRepository } from '../repositories/UserRepository';","category":"filesystem","line_end":23,"severity":"high","line_start":23},{"id":"filesystem:resources/testing-guide.md:25:path-traversal-sequence","file":"resources/testing-guide.md","pattern":"Path traversal sequence","snippet":"jest.mock('../repositories/UserRepository');","category":"filesystem","line_end":25,"severity":"high","line_start":25},{"id":"filesystem:resources/testing-guide.md:201:path-traversal-sequence","file":"resources/testing-guide.md","pattern":"Path traversal sequence","snippet":"jest.mock('../middleware/SSOMiddleware', () => ({","category":"filesystem","line_end":201,"severity":"high","line_start":201},{"id":"blocker:resources/testing-guide.md:99:system-reconnaissance","file":"resources/testing-guide.md","pattern":"System reconnaissance","snippet":"await PrismaService.main.user.delete({ where: { id: testUser.id } });","category":"blocker","line_end":99,"severity":"low","line_start":99},{"id":"filesystem:resources/validation-patterns.md:378:path-traversal-sequence","file":"resources/validation-patterns.md","pattern":"Path traversal sequence","snippet":"import { UserService } from '../services/userService';","category":"filesystem","line_end":378,"severity":"high","line_start":378},{"id":"filesystem:resources/validation-patterns.md:379:path-traversal-sequence","file":"resources/validation-patterns.md","pattern":"Path traversal sequence","snippet":"import { createUserSchema, updateUserSchema } from '../validators/userSchemas';","category":"filesystem","line_end":379,"severity":"high","line_start":379},{"id":"blocker:resources/validation-patterns.md:524:system-reconnaissance","file":"resources/validation-patterns.md","pattern":"System reconnaissance","snippet":"email: z.string().email({ message: 'Please provide a valid email address' }),","category":"blocker","line_end":524,"severity":"low","line_start":524},{"id":"blocker:resources/validation-patterns.md:563:system-reconnaissance","file":"resources/validation-patterns.md","pattern":"System reconnaissance","snippet":"//         \"message\": \"Invalid email\",","category":"blocker","line_end":563,"severity":"low","line_start":563},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":45,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":47,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Range:** `-10 → +10`","category":"external_commands","line_end":77,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":79,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":99,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":123,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### 4. All Controllers Extend `BaseController`","category":"external_commands","line_end":125,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":136,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":138,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"No raw `res.json` calls outside BaseController helpers.","category":"external_commands","line_end":144,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":149,"severity":"medium","line_start":144},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":151,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"❌ `console.log`","category":"external_commands","line_end":159,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":166,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":177,"severity":"medium","line_start":166},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":183,"severity":"medium","line_start":177},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":191,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":206,"severity":"medium","line_start":191},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":214,"severity":"medium","line_start":206},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Controller | `PascalCaseController.ts` |","category":"external_commands","line_end":215,"severity":"medium","line_start":214},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Service    | `camelCaseService.ts`     |","category":"external_commands","line_end":216,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Repository | `PascalCaseRepository.ts` |","category":"external_commands","line_end":217,"severity":"medium","line_start":216},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Routes     | `camelCaseRoutes.ts`      |","category":"external_commands","line_end":218,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:218:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Validators | `camelCase.schema.ts`     |","category":"external_commands","line_end":228,"severity":"medium","line_start":218},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":234,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":247,"severity":"medium","line_start":234},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":249,"severity":"medium","line_start":247},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":259,"severity":"medium","line_start":249},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":266,"severity":"medium","line_start":259},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":292,"severity":"medium","line_start":266},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":298,"severity":"medium","line_start":292},{"id":"env_access:SKILL.md:161:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.JWT_SECRET;","category":"env_access","line_end":161,"severity":"low","line_start":161},{"id":"env_access:SKILL.md:161:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"process.env.JWT_SECRET;","category":"env_access","line_end":161,"severity":"low","line_start":161},{"id":"env_access:SKILL.md:310:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"❌ process.env usage","category":"env_access","line_end":310,"severity":"low","line_start":310},{"id":"sensitive:SKILL.md:161:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"process.env.JWT_SECRET;","category":"sensitive","line_end":161,"severity":"high","line_start":161},{"id":"sensitive:SKILL.md:310:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"❌ process.env usage","category":"sensitive","line_end":310,"severity":"high","line_start":310}],"finding_verdicts":[{"id":"env_access:resources/architecture-overview.md:185:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/architecture-overview.md:207:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/architecture-overview.md:185:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/architecture-overview.md:207:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/architecture-overview.md:275:network-reconnaissance","reason":"The Markdown snippet describes routing or type safety. It performs no network discovery, probing, or host enumeration.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/async-and-errors.md:39:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/complete-examples.md:24:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/complete-examples.md:25:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/complete-examples.md:130:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/complete-examples.md:131:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/complete-examples.md:132:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/complete-examples.md:212:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/complete-examples.md:213:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/complete-examples.md:214:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/complete-examples.md:366:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/complete-examples.md:226:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/complete-examples.md:240:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/complete-examples.md:247:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/complete-examples.md:271:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/complete-examples.md:300:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/complete-examples.md:309:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/complete-examples.md:516:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"network:resources/configuration.md:182:hardcoded-url","reason":"The URL is localhost or an explicit placeholder used in configuration and testing documentation. The skill makes no outbound request.","verdict":"false_positive","confidence":0.98},{"id":"network:resources/configuration.md:186:hardcoded-url","reason":"The URL is localhost or an explicit placeholder used in configuration and testing documentation. The skill makes no outbound request.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/configuration.md:126:node-js-fs-operations","reason":"This is a documented TypeScript example that reads a fixed INI configuration path. The skill itself does not execute filesystem operations.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/configuration.md:126:synchronous-file-operations","reason":"This is a documented TypeScript example that reads a fixed INI configuration path. The skill itself does not execute filesystem operations.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/configuration.md:125:path-traversal-with","reason":"The parent segment builds a fixed application configuration path in a documented example. No untrusted input controls the path.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/configuration.md:125:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:44:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:45:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:58:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:61:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:62:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:130:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:131:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:132:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:133:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:134:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:137:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:138:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:228:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:231:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:251:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:252:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:253:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:8:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:20:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:38:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:44:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:45:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:58:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:61:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:62:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:130:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:131:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:132:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:133:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:134:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:137:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:138:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:151:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:202:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:228:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:231:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:240:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:243:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:251:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:252:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:253:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:133:database-connection-strings","reason":"This is a placeholder configuration example in documentation, not a real connection string. No credential is accessed or transmitted by the skill.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:196:database-connection-strings","reason":"This is a placeholder configuration example in documentation, not a real connection string. No credential is accessed or transmitted by the skill.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/configuration.md:228:database-connection-strings","reason":"This is a placeholder configuration example in documentation, not a real connection string. No credential is accessed or transmitted by the skill.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:8:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:20:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:38:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:44:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:45:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:58:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:61:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:62:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:130:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:131:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:132:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:133:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:134:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:137:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:138:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:151:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:194:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:202:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:214:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:228:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:231:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:240:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:243:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:251:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:252:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:253:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:216:certificate-key-files","reason":"The match is a gitignore pattern or a Keycloak property name. It does not read, expose, or modify certificate or private-key files.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:217:certificate-key-files","reason":"The match is a gitignore pattern or a Keycloak property name. It does not read, expose, or modify certificate or private-key files.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:260:certificate-key-files","reason":"The match is a gitignore pattern or a Keycloak property name. It does not read, expose, or modify certificate or private-key files.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/configuration.md:261:certificate-key-files","reason":"The match is a gitignore pattern or a Keycloak property name. It does not read, expose, or modify certificate or private-key files.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/configuration.md:154:network-reconnaissance","reason":"The Markdown snippet describes routing or type safety. It performs no network discovery, probing, or host enumeration.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/database-patterns.md:34:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/database-patterns.md:59:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/database-patterns.md:86:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/database-patterns.md:96:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/database-patterns.md:100:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/database-patterns.md:136:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/database-patterns.md:146:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/database-patterns.md:164:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/database-patterns.md:204:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/middleware-guide.md:93:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/middleware-guide.md:24:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/middleware-guide.md:37:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/middleware-guide.md:65:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/middleware-guide.md:71:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/middleware-guide.md:115:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/routing-and-controllers.md:171:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/routing-and-controllers.md:38:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/routing-and-controllers.md:39:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/routing-and-controllers.md:40:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/routing-and-controllers.md:234:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/routing-and-controllers.md:235:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/routing-and-controllers.md:313:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/routing-and-controllers.md:314:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/routing-and-controllers.md:406:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/routing-and-controllers.md:531:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/routing-and-controllers.md:104:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/routing-and-controllers.md:137:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/routing-and-controllers.md:191:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/routing-and-controllers.md:200:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/routing-and-controllers.md:215:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/routing-and-controllers.md:222:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/routing-and-controllers.md:247:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/routing-and-controllers.md:426:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/routing-and-controllers.md:624:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/routing-and-controllers.md:742:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/routing-and-controllers.md:746:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/sentry-and-monitoring.md:40:node-js-fs-operations","reason":"This is a documented TypeScript example that reads a fixed INI configuration path. The skill itself does not execute filesystem operations.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/sentry-and-monitoring.md:40:synchronous-file-operations","reason":"This is a documented TypeScript example that reads a fixed INI configuration path. The skill itself does not execute filesystem operations.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/sentry-and-monitoring.md:39:path-traversal-with","reason":"The parent segment builds a fixed application configuration path in a documented example. No untrusted input controls the path.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/sentry-and-monitoring.md:39:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/sentry-and-monitoring.md:140:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/sentry-and-monitoring.md:182:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/sentry-and-monitoring.md:219:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/sentry-and-monitoring.md:44:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/sentry-and-monitoring.md:44:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/sentry-and-monitoring.md:44:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/sentry-and-monitoring.md:89:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/sentry-and-monitoring.md:122:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/services-and-repositories.md:270:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/services-and-repositories.md:317:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/services-and-repositories.md:400:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/services-and-repositories.md:435:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/services-and-repositories.md:462:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/services-and-repositories.md:477:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/services-and-repositories.md:523:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/services-and-repositories.md:542:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/services-and-repositories.md:619:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/services-and-repositories.md:338:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/services-and-repositories.md:505:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/services-and-repositories.md:506:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/services-and-repositories.md:725:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/services-and-repositories.md:726:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/services-and-repositories.md:727:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/services-and-repositories.md:730:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/services-and-repositories.md:315:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/services-and-repositories.md:326:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/services-and-repositories.md:523:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/services-and-repositories.md:632:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/services-and-repositories.md:695:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"network:resources/testing-guide.md:191:hardcoded-url","reason":"The URL is localhost or an explicit placeholder used in configuration and testing documentation. The skill makes no outbound request.","verdict":"false_positive","confidence":0.98},{"id":"network:resources/testing-guide.md:194:hardcoded-url","reason":"The URL is localhost or an explicit placeholder used in configuration and testing documentation. The skill makes no outbound request.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/testing-guide.md:23:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/testing-guide.md:25:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/testing-guide.md:201:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/testing-guide.md:99:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/validation-patterns.md:378:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/validation-patterns.md:379:path-traversal-sequence","reason":"The sequence is a relative module import or fixed configuration path inside documentation. It is not user-controlled filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/validation-patterns.md:524:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/validation-patterns.md:563:system-reconnaissance","reason":"The Markdown snippet contains ordinary TypeScript, API documentation, or prose. It performs no system discovery or host inspection.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:218:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","reason":"The analyzer matched Markdown fences, inline code, or TypeScript template literals. No shell execution API or executable command is present.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:161:environment-variable-access-dot-notation","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:161:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:310:environment-variable-object","reason":"The documentation discusses environment-backed application configuration. The skill contains no executable code that reads the installer or agent environment.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:161:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:310:environment-file-access","reason":"The Markdown mentions process.env or .env configuration, often as an anti-pattern. It does not access an environment file or disclose secret values.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Overbroad Sentry Data Collection","severity":"high","locations":[{"file":"resources/sentry-and-monitoring.md","line_end":85,"line_start":49}],"confidence":0.96,"description":"The recommended setup captures local variables, request bodies, headers, query strings, IP addresses, and user identifiers. Its scrubber removes only two headers and masks one email field.","confidence_reasoning":"The enabled integrations and included fields are explicit. Passwords, tokens, and personal data outside the narrow scrubber could reach Sentry."},{"title":"Plaintext Secret Configuration Guidance","severity":"medium","locations":[{"file":"resources/configuration.md","line_end":234,"line_start":160}],"confidence":0.93,"description":"The guide places database, JWT, internal API, and client secrets in config.ini and gives that file highest precedence. Gitignore guidance reduces accidental commits but not plaintext exposure.","confidence_reasoning":"The configuration examples and precedence rules are explicit. Production uses environment variables, but the recommended development file still stores secrets unencrypted."},{"title":"Internal Error Messages Returned to Clients","severity":"medium","locations":[{"file":"resources/sentry-and-monitoring.md","line_end":134,"line_start":120}],"confidence":0.91,"description":"The BaseController example returns error.message directly in HTTP responses. Unexpected exceptions can reveal database details, identifiers, or internal implementation information.","confidence_reasoning":"The response assignment is direct and lacks an allowlist of public error types. The exposure depends on which exceptions reach this handler."}],"subject_marketplace_commit_sha":"5a26d1d61d694db29af9b138c661c1981076d9df","subject_content_hash":"aa2e8fc9ab3d641cb41b7b320a130a4dc27b32251a1db8c5a4bbd5d80bf13dd2","subject_tree_hash":"e616484cdf674a4f98429b9f853e47c34a8511064f1e512e2f43f21f4f6cd81d","subject_plugin_path":"skills/sickn33/backend-dev-guidelines","audit_payload_hash":"9c62b28104521a9a978c764e5a5c8917","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5a26d1d61d694db29af9b138c661c1981076d9df","contentHash":"aa2e8fc9ab3d641cb41b7b320a130a4dc27b32251a1db8c5a4bbd5d80bf13dd2","treeHash":"e616484cdf674a4f98429b9f853e47c34a8511064f1e512e2f43f21f4f6cd81d","pluginPath":"skills/sickn33/backend-dev-guidelines","auditPayloadHash":"9c62b28104521a9a978c764e5a5c8917"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-backend-dev-guidelines/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}