{"data":{"skill":{"slug":"sickn33-nodejs-backend-patterns","name":"nodejs-backend-patterns","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/nodejs-backend-patterns","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"da6c2467-2101-45f5-98af-02e59e903dd2","skill_id":"03a2afe2-722b-4954-a79d-944fc332b1b2","version":5,"content_hash":"v3:81e05e636292629114b76cbb3922fbe57672fc02:ec798e95704e9789efc5a11561c65e3cf10231a881da4fc467ace1bd4e71e3e2:b7ad7d87906844ee6d358ed8101290cba6c58fef9d5ac07c0e8de5953d3268b5:736b696c6c732f7369636b6e33332f6e6f64656a732d6261636b656e642d7061747465726e73:09e923b64500803d39cf459a14c5f08f","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most static alerts are false positives caused by Markdown, TypeScript imports, template literals, environment configuration, and database examples. The all-interface network bind is a contextual exposure, and the playbook also contains unsafe SQL identifier interpolation, permissive CORS, and blocking Redis invalidation guidance.","remediation":[{"issue":"Update fields are interpolated into SQL without a runtime allowlist.","severity":"high","suggestion":"Map accepted update properties to fixed column names, reject unknown keys, and keep all values parameterized."},{"issue":"The Fastify example enables CORS for every reflected origin.","severity":"medium","suggestion":"Use an explicit production origin allowlist and document separate development settings."},{"issue":"The Redis invalidation example uses KEYS and unrestricted patterns.","severity":"medium","suggestion":"Use cursor-based SCAN, namespace every cache key, restrict patterns, and delete matches in bounded batches."},{"issue":"The Fastify server binds to every network interface.","severity":"medium","suggestion":"Explain when 0.0.0.0 is required and require firewall, proxy, or container network controls for production."}],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"resources/implementation-playbook.md","line_end":563,"line_start":563}]},{"factor":"external_commands","evidence":[{"file":"resources/implementation-playbook.md","line_end":50,"line_start":44},{"file":"resources/implementation-playbook.md","line_end":52,"line_start":50},{"file":"resources/implementation-playbook.md","line_end":271,"line_start":245},{"file":"resources/implementation-playbook.md","line_end":274,"line_start":271},{"file":"resources/implementation-playbook.md","line_end":291,"line_start":279},{"file":"resources/implementation-playbook.md","line_end":359,"line_start":314},{"file":"resources/implementation-playbook.md","line_end":548,"line_start":538},{"file":"resources/implementation-playbook.md","line_end":946,"line_start":930},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":38,"line_start":38}]},{"factor":"network","evidence":[{"file":"resources/implementation-playbook.md","line_end":98,"line_start":98}]},{"factor":"filesystem","evidence":[{"file":"resources/implementation-playbook.md","line_end":123,"line_start":123},{"file":"resources/implementation-playbook.md","line_end":124,"line_start":124},{"file":"resources/implementation-playbook.md","line_end":175,"line_start":175},{"file":"resources/implementation-playbook.md","line_end":176,"line_start":176},{"file":"resources/implementation-playbook.md","line_end":177,"line_start":177},{"file":"resources/implementation-playbook.md","line_end":235,"line_start":235},{"file":"resources/implementation-playbook.md","line_end":369,"line_start":369},{"file":"resources/implementation-playbook.md","line_end":434,"line_start":434},{"file":"resources/implementation-playbook.md","line_end":604,"line_start":604},{"file":"resources/implementation-playbook.md","line_end":800,"line_start":800},{"file":"resources/implementation-playbook.md","line_end":801,"line_start":801}]},{"factor":"env_access","evidence":[{"file":"resources/implementation-playbook.md","line_end":35,"line_start":35},{"file":"resources/implementation-playbook.md","line_end":48,"line_start":48},{"file":"resources/implementation-playbook.md","line_end":65,"line_start":65},{"file":"resources/implementation-playbook.md","line_end":334,"line_start":334},{"file":"resources/implementation-playbook.md","line_end":335,"line_start":335},{"file":"resources/implementation-playbook.md","line_end":336,"line_start":336},{"file":"resources/implementation-playbook.md","line_end":337,"line_start":337},{"file":"resources/implementation-playbook.md","line_end":338,"line_start":338},{"file":"resources/implementation-playbook.md","line_end":398,"line_start":398},{"file":"resources/implementation-playbook.md","line_end":482,"line_start":482},{"file":"resources/implementation-playbook.md","line_end":483,"line_start":483},{"file":"resources/implementation-playbook.md","line_end":517,"line_start":517},{"file":"resources/implementation-playbook.md","line_end":630,"line_start":630},{"file":"resources/implementation-playbook.md","line_end":659,"line_start":659},{"file":"resources/implementation-playbook.md","line_end":660,"line_start":660},{"file":"resources/implementation-playbook.md","line_end":661,"line_start":661},{"file":"resources/implementation-playbook.md","line_end":662,"line_start":662},{"file":"resources/implementation-playbook.md","line_end":663,"line_start":663},{"file":"resources/implementation-playbook.md","line_end":696,"line_start":696},{"file":"resources/implementation-playbook.md","line_end":843,"line_start":843},{"file":"resources/implementation-playbook.md","line_end":864,"line_start":864},{"file":"resources/implementation-playbook.md","line_end":870,"line_start":870},{"file":"resources/implementation-playbook.md","line_end":884,"line_start":884},{"file":"resources/implementation-playbook.md","line_end":885,"line_start":885},{"file":"resources/implementation-playbook.md","line_end":35,"line_start":35},{"file":"resources/implementation-playbook.md","line_end":48,"line_start":48},{"file":"resources/implementation-playbook.md","line_end":65,"line_start":65},{"file":"resources/implementation-playbook.md","line_end":334,"line_start":334},{"file":"resources/implementation-playbook.md","line_end":335,"line_start":335},{"file":"resources/implementation-playbook.md","line_end":336,"line_start":336},{"file":"resources/implementation-playbook.md","line_end":337,"line_start":337},{"file":"resources/implementation-playbook.md","line_end":338,"line_start":338},{"file":"resources/implementation-playbook.md","line_end":398,"line_start":398},{"file":"resources/implementation-playbook.md","line_end":482,"line_start":482},{"file":"resources/implementation-playbook.md","line_end":483,"line_start":483},{"file":"resources/implementation-playbook.md","line_end":517,"line_start":517},{"file":"resources/implementation-playbook.md","line_end":630,"line_start":630},{"file":"resources/implementation-playbook.md","line_end":659,"line_start":659},{"file":"resources/implementation-playbook.md","line_end":660,"line_start":660},{"file":"resources/implementation-playbook.md","line_end":661,"line_start":661},{"file":"resources/implementation-playbook.md","line_end":662,"line_start":662},{"file":"resources/implementation-playbook.md","line_end":663,"line_start":663},{"file":"resources/implementation-playbook.md","line_end":696,"line_start":696},{"file":"resources/implementation-playbook.md","line_end":843,"line_start":843},{"file":"resources/implementation-playbook.md","line_end":864,"line_start":864},{"file":"resources/implementation-playbook.md","line_end":870,"line_start":870},{"file":"resources/implementation-playbook.md","line_end":884,"line_start":884},{"file":"resources/implementation-playbook.md","line_end":885,"line_start":885},{"file":"resources/implementation-playbook.md","line_end":338,"line_start":338},{"file":"resources/implementation-playbook.md","line_end":663,"line_start":663}]}],"critical_findings":[],"high_findings":[{"title":"Unvalidated SQL Identifier Interpolation","locations":[{"file":"resources/implementation-playbook.md","line_end":281,"line_start":266}],"confidence":0.97,"description":"The update example builds SQL column assignments from Object.keys(updates). Parameterized values do not protect interpolated identifiers, so unexpected request keys can alter the query.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The field names are directly interpolated into SQL while only values use placeholders. The example shows no runtime allowlist for accepted update keys."}],"medium_findings":[{"title":"Hardcoded IP address","locations":[{"file":"resources/implementation-playbook.md","line_end":98,"line_start":98}],"confidence":0.86,"description":"await fastify.listen({ port: 3000, host: '0.0.0.0' });","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The example binds Fastify to 0.0.0.0, exposing the service on every available interface. This is valid for containers but requires explicit network controls."},{"title":"Permissive Fastify CORS Configuration","locations":[{"file":"resources/implementation-playbook.md","line_end":76,"line_start":73}],"confidence":0.94,"description":"The Fastify example reflects any request origin through origin: true. Production use can grant untrusted websites cross-origin access unless routes are strictly public.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The configuration explicitly enables dynamic origin reflection. The same playbook later warns against unrestricted production CORS, confirming this example needs qualification."},{"title":"Blocking Redis Pattern Invalidation","locations":[{"file":"resources/implementation-playbook.md","line_end":915,"line_start":911}],"confidence":0.9,"description":"The cache example uses Redis KEYS with an arbitrary pattern, then deletes every match. Large keyspaces or broad patterns can block Redis and remove unrelated cache entries.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The method accepts any pattern and directly calls KEYS followed by bulk deletion. Redis KEYS is synchronously expensive across large keyspaces."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":1064,"audit_model":"codex","audited_at":"2026-08-04T16:06:42.011+00:00","created_at":"2026-08-05T01:36:43.733809+00:00","static_findings":[{"id":"scripts:resources/implementation-playbook.md:563:prototype-manipulation","file":"resources/implementation-playbook.md","pattern":"Prototype manipulation","snippet":"Object.setPrototypeOf(this, AppError.prototype);","category":"scripts","line_end":563,"severity":"medium","line_start":563},{"id":"external_commands:resources/implementation-playbook.md:44:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`${req.method} ${req.path}`);","category":"external_commands","line_end":50,"severity":"medium","line_start":44},{"id":"external_commands:resources/implementation-playbook.md:50:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Server running on port ${PORT}`);","category":"external_commands","line_end":52,"severity":"medium","line_start":50},{"id":"external_commands:resources/implementation-playbook.md:245:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"`;","category":"external_commands","line_end":271,"severity":"medium","line_start":245},{"id":"external_commands:resources/implementation-playbook.md:271:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":".map((field, idx) => `${field} = $${idx + 2}`)","category":"external_commands","line_end":274,"severity":"medium","line_start":271},{"id":"external_commands:resources/implementation-playbook.md:279:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"`;","category":"external_commands","line_end":291,"severity":"medium","line_start":279},{"id":"external_commands:resources/implementation-playbook.md:314:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`No factory registered for ${key}`);","category":"external_commands","line_end":359,"severity":"medium","line_start":314},{"id":"external_commands:resources/implementation-playbook.md:538:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"duration: `${duration}ms`,","category":"external_commands","line_end":548,"severity":"medium","line_start":538},{"id":"external_commands:resources/implementation-playbook.md:930:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"const cacheKey = `${propertyKey}:${JSON.stringify(args)}`;","category":"external_commands","line_end":946,"severity":"medium","line_start":930},{"id":"network:resources/implementation-playbook.md:98:hardcoded-ip-address","file":"resources/implementation-playbook.md","pattern":"Hardcoded IP address","snippet":"await fastify.listen({ port: 3000, host: '0.0.0.0' });","category":"network","line_end":98,"severity":"medium","line_start":98},{"id":"filesystem:resources/implementation-playbook.md:123:path-traversal-sequence","file":"resources/implementation-playbook.md","pattern":"Path traversal sequence","snippet":"import { UserService } from '../services/user.service';","category":"filesystem","line_end":123,"severity":"high","line_start":123},{"id":"filesystem:resources/implementation-playbook.md:124:path-traversal-sequence","file":"resources/implementation-playbook.md","pattern":"Path traversal sequence","snippet":"import { CreateUserDTO, UpdateUserDTO } from '../types/user.types';","category":"filesystem","line_end":124,"severity":"high","line_start":124},{"id":"filesystem:resources/implementation-playbook.md:175:path-traversal-sequence","file":"resources/implementation-playbook.md","pattern":"Path traversal sequence","snippet":"import { UserRepository } from '../repositories/user.repository';","category":"filesystem","line_end":175,"severity":"high","line_start":175},{"id":"filesystem:resources/implementation-playbook.md:176:path-traversal-sequence","file":"resources/implementation-playbook.md","pattern":"Path traversal sequence","snippet":"import { CreateUserDTO, UpdateUserDTO, User } from '../types/user.types';","category":"filesystem","line_end":176,"severity":"high","line_start":176},{"id":"filesystem:resources/implementation-playbook.md:177:path-traversal-sequence","file":"resources/implementation-playbook.md","pattern":"Path traversal sequence","snippet":"import { NotFoundError, ValidationError } from '../utils/errors';","category":"filesystem","line_end":177,"severity":"high","line_start":177},{"id":"filesystem:resources/implementation-playbook.md:235:path-traversal-sequence","file":"resources/implementation-playbook.md","pattern":"Path traversal sequence","snippet":"import { CreateUserDTO, UpdateUserDTO, UserEntity } from '../types/user.types';","category":"filesystem","line_end":235,"severity":"high","line_start":235},{"id":"filesystem:resources/implementation-playbook.md:369:path-traversal-sequence","file":"resources/implementation-playbook.md","pattern":"Path traversal sequence","snippet":"import { UnauthorizedError } from '../utils/errors';","category":"filesystem","line_end":369,"severity":"high","line_start":369},{"id":"filesystem:resources/implementation-playbook.md:434:path-traversal-sequence","file":"resources/implementation-playbook.md","pattern":"Path traversal sequence","snippet":"import { ValidationError } from '../utils/errors';","category":"filesystem","line_end":434,"severity":"high","line_start":434},{"id":"filesystem:resources/implementation-playbook.md:604:path-traversal-sequence","file":"resources/implementation-playbook.md","pattern":"Path traversal sequence","snippet":"import { AppError } from '../utils/errors';","category":"filesystem","line_end":604,"severity":"high","line_start":604},{"id":"filesystem:resources/implementation-playbook.md:800:path-traversal-sequence","file":"resources/implementation-playbook.md","pattern":"Path traversal sequence","snippet":"import { UserRepository } from '../repositories/user.repository';","category":"filesystem","line_end":800,"severity":"high","line_start":800},{"id":"filesystem:resources/implementation-playbook.md:801:path-traversal-sequence","file":"resources/implementation-playbook.md","pattern":"Path traversal sequence","snippet":"import { UnauthorizedError } from '../utils/errors';","category":"filesystem","line_end":801,"severity":"high","line_start":801},{"id":"env_access:resources/implementation-playbook.md:35:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"app.use(cors({ origin: process.env.ALLOWED_ORIGINS?.split(',') }));","category":"env_access","line_end":35,"severity":"low","line_start":35},{"id":"env_access:resources/implementation-playbook.md:48:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"const PORT = process.env.PORT || 3000;","category":"env_access","line_end":48,"severity":"low","line_start":48},{"id":"env_access:resources/implementation-playbook.md:65:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"level: process.env.LOG_LEVEL || 'info',","category":"env_access","line_end":65,"severity":"low","line_start":65},{"id":"env_access:resources/implementation-playbook.md:334:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"host: process.env.DB_HOST,","category":"env_access","line_end":334,"severity":"low","line_start":334},{"id":"env_access:resources/implementation-playbook.md:335:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"port: parseInt(process.env.DB_PORT || '5432'),","category":"env_access","line_end":335,"severity":"low","line_start":335},{"id":"env_access:resources/implementation-playbook.md:336:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"database: process.env.DB_NAME,","category":"env_access","line_end":336,"severity":"low","line_start":336},{"id":"env_access:resources/implementation-playbook.md:337:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"user: process.env.DB_USER,","category":"env_access","line_end":337,"severity":"low","line_start":337},{"id":"env_access:resources/implementation-playbook.md:338:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"password: process.env.DB_PASSWORD,","category":"env_access","line_end":338,"severity":"low","line_start":338},{"id":"env_access:resources/implementation-playbook.md:398:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.JWT_SECRET!","category":"env_access","line_end":398,"severity":"low","line_start":398},{"id":"env_access:resources/implementation-playbook.md:482:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"host: process.env.REDIS_HOST,","category":"env_access","line_end":482,"severity":"low","line_start":482},{"id":"env_access:resources/implementation-playbook.md:483:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"port: parseInt(process.env.REDIS_PORT || '6379')","category":"env_access","line_end":483,"severity":"low","line_start":483},{"id":"env_access:resources/implementation-playbook.md:517:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"level: process.env.LOG_LEVEL || 'info',","category":"env_access","line_end":517,"severity":"low","line_start":517},{"id":"env_access:resources/implementation-playbook.md:630:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"const message = process.env.NODE_ENV === 'production'","category":"env_access","line_end":630,"severity":"low","line_start":630},{"id":"env_access:resources/implementation-playbook.md:659:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"host: process.env.DB_HOST,","category":"env_access","line_end":659,"severity":"low","line_start":659},{"id":"env_access:resources/implementation-playbook.md:660:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"port: parseInt(process.env.DB_PORT || '5432'),","category":"env_access","line_end":660,"severity":"low","line_start":660},{"id":"env_access:resources/implementation-playbook.md:661:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"database: process.env.DB_NAME,","category":"env_access","line_end":661,"severity":"low","line_start":661},{"id":"env_access:resources/implementation-playbook.md:662:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"user: process.env.DB_USER,","category":"env_access","line_end":662,"severity":"low","line_start":662},{"id":"env_access:resources/implementation-playbook.md:663:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"password: process.env.DB_PASSWORD,","category":"env_access","line_end":663,"severity":"low","line_start":663},{"id":"env_access:resources/implementation-playbook.md:696:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"await mongoose.connect(process.env.MONGODB_URI!, {","category":"env_access","line_end":696,"severity":"low","line_start":696},{"id":"env_access:resources/implementation-playbook.md:843:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.REFRESH_TOKEN_SECRET!","category":"env_access","line_end":843,"severity":"low","line_start":843},{"id":"env_access:resources/implementation-playbook.md:864:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"return jwt.sign(payload, process.env.JWT_SECRET!, {","category":"env_access","line_end":864,"severity":"low","line_start":864},{"id":"env_access:resources/implementation-playbook.md:870:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"return jwt.sign(payload, process.env.REFRESH_TOKEN_SECRET!, {","category":"env_access","line_end":870,"severity":"low","line_start":870},{"id":"env_access:resources/implementation-playbook.md:884:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"host: process.env.REDIS_HOST,","category":"env_access","line_end":884,"severity":"low","line_start":884},{"id":"env_access:resources/implementation-playbook.md:885:environment-variable-access-dot-notation","file":"resources/implementation-playbook.md","pattern":"Environment variable access (dot notation)","snippet":"port: parseInt(process.env.REDIS_PORT || '6379'),","category":"env_access","line_end":885,"severity":"low","line_start":885},{"id":"env_access:resources/implementation-playbook.md:35:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"app.use(cors({ origin: process.env.ALLOWED_ORIGINS?.split(',') }));","category":"env_access","line_end":35,"severity":"low","line_start":35},{"id":"env_access:resources/implementation-playbook.md:48:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"const PORT = process.env.PORT || 3000;","category":"env_access","line_end":48,"severity":"low","line_start":48},{"id":"env_access:resources/implementation-playbook.md:65:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"level: process.env.LOG_LEVEL || 'info',","category":"env_access","line_end":65,"severity":"low","line_start":65},{"id":"env_access:resources/implementation-playbook.md:334:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"host: process.env.DB_HOST,","category":"env_access","line_end":334,"severity":"low","line_start":334},{"id":"env_access:resources/implementation-playbook.md:335:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"port: parseInt(process.env.DB_PORT || '5432'),","category":"env_access","line_end":335,"severity":"low","line_start":335},{"id":"env_access:resources/implementation-playbook.md:336:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"database: process.env.DB_NAME,","category":"env_access","line_end":336,"severity":"low","line_start":336},{"id":"env_access:resources/implementation-playbook.md:337:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"user: process.env.DB_USER,","category":"env_access","line_end":337,"severity":"low","line_start":337},{"id":"env_access:resources/implementation-playbook.md:338:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"password: process.env.DB_PASSWORD,","category":"env_access","line_end":338,"severity":"low","line_start":338},{"id":"env_access:resources/implementation-playbook.md:398:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"process.env.JWT_SECRET!","category":"env_access","line_end":398,"severity":"low","line_start":398},{"id":"env_access:resources/implementation-playbook.md:482:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"host: process.env.REDIS_HOST,","category":"env_access","line_end":482,"severity":"low","line_start":482},{"id":"env_access:resources/implementation-playbook.md:483:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"port: parseInt(process.env.REDIS_PORT || '6379')","category":"env_access","line_end":483,"severity":"low","line_start":483},{"id":"env_access:resources/implementation-playbook.md:517:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"level: process.env.LOG_LEVEL || 'info',","category":"env_access","line_end":517,"severity":"low","line_start":517},{"id":"env_access:resources/implementation-playbook.md:630:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"const message = process.env.NODE_ENV === 'production'","category":"env_access","line_end":630,"severity":"low","line_start":630},{"id":"env_access:resources/implementation-playbook.md:659:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"host: process.env.DB_HOST,","category":"env_access","line_end":659,"severity":"low","line_start":659},{"id":"env_access:resources/implementation-playbook.md:660:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"port: parseInt(process.env.DB_PORT || '5432'),","category":"env_access","line_end":660,"severity":"low","line_start":660},{"id":"env_access:resources/implementation-playbook.md:661:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"database: process.env.DB_NAME,","category":"env_access","line_end":661,"severity":"low","line_start":661},{"id":"env_access:resources/implementation-playbook.md:662:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"user: process.env.DB_USER,","category":"env_access","line_end":662,"severity":"low","line_start":662},{"id":"env_access:resources/implementation-playbook.md:663:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"password: process.env.DB_PASSWORD,","category":"env_access","line_end":663,"severity":"low","line_start":663},{"id":"env_access:resources/implementation-playbook.md:696:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"await mongoose.connect(process.env.MONGODB_URI!, {","category":"env_access","line_end":696,"severity":"low","line_start":696},{"id":"env_access:resources/implementation-playbook.md:843:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"process.env.REFRESH_TOKEN_SECRET!","category":"env_access","line_end":843,"severity":"low","line_start":843},{"id":"env_access:resources/implementation-playbook.md:864:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"return jwt.sign(payload, process.env.JWT_SECRET!, {","category":"env_access","line_end":864,"severity":"low","line_start":864},{"id":"env_access:resources/implementation-playbook.md:870:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"return jwt.sign(payload, process.env.REFRESH_TOKEN_SECRET!, {","category":"env_access","line_end":870,"severity":"low","line_start":870},{"id":"env_access:resources/implementation-playbook.md:884:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"host: process.env.REDIS_HOST,","category":"env_access","line_end":884,"severity":"low","line_start":884},{"id":"env_access:resources/implementation-playbook.md:885:environment-variable-object","file":"resources/implementation-playbook.md","pattern":"Environment variable object","snippet":"port: parseInt(process.env.REDIS_PORT || '6379'),","category":"env_access","line_end":885,"severity":"low","line_start":885},{"id":"env_access:resources/implementation-playbook.md:338:database-connection-strings","file":"resources/implementation-playbook.md","pattern":"Database connection strings","snippet":"password: process.env.DB_PASSWORD,","category":"env_access","line_end":338,"severity":"high","line_start":338},{"id":"env_access:resources/implementation-playbook.md:663:database-connection-strings","file":"resources/implementation-playbook.md","pattern":"Database connection strings","snippet":"password: process.env.DB_PASSWORD,","category":"env_access","line_end":663,"severity":"high","line_start":663},{"id":"sensitive:resources/implementation-playbook.md:35:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"app.use(cors({ origin: process.env.ALLOWED_ORIGINS?.split(',') }));","category":"sensitive","line_end":35,"severity":"high","line_start":35},{"id":"sensitive:resources/implementation-playbook.md:48:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"const PORT = process.env.PORT || 3000;","category":"sensitive","line_end":48,"severity":"high","line_start":48},{"id":"sensitive:resources/implementation-playbook.md:65:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"level: process.env.LOG_LEVEL || 'info',","category":"sensitive","line_end":65,"severity":"high","line_start":65},{"id":"sensitive:resources/implementation-playbook.md:334:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"host: process.env.DB_HOST,","category":"sensitive","line_end":334,"severity":"high","line_start":334},{"id":"sensitive:resources/implementation-playbook.md:335:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"port: parseInt(process.env.DB_PORT || '5432'),","category":"sensitive","line_end":335,"severity":"high","line_start":335},{"id":"sensitive:resources/implementation-playbook.md:336:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"database: process.env.DB_NAME,","category":"sensitive","line_end":336,"severity":"high","line_start":336},{"id":"sensitive:resources/implementation-playbook.md:337:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"user: process.env.DB_USER,","category":"sensitive","line_end":337,"severity":"high","line_start":337},{"id":"sensitive:resources/implementation-playbook.md:338:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"password: process.env.DB_PASSWORD,","category":"sensitive","line_end":338,"severity":"high","line_start":338},{"id":"sensitive:resources/implementation-playbook.md:398:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"process.env.JWT_SECRET!","category":"sensitive","line_end":398,"severity":"high","line_start":398},{"id":"sensitive:resources/implementation-playbook.md:482:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"host: process.env.REDIS_HOST,","category":"sensitive","line_end":482,"severity":"high","line_start":482},{"id":"sensitive:resources/implementation-playbook.md:483:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"port: parseInt(process.env.REDIS_PORT || '6379')","category":"sensitive","line_end":483,"severity":"high","line_start":483},{"id":"sensitive:resources/implementation-playbook.md:517:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"level: process.env.LOG_LEVEL || 'info',","category":"sensitive","line_end":517,"severity":"high","line_start":517},{"id":"sensitive:resources/implementation-playbook.md:630:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"const message = process.env.NODE_ENV === 'production'","category":"sensitive","line_end":630,"severity":"high","line_start":630},{"id":"sensitive:resources/implementation-playbook.md:659:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"host: process.env.DB_HOST,","category":"sensitive","line_end":659,"severity":"high","line_start":659},{"id":"sensitive:resources/implementation-playbook.md:660:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"port: parseInt(process.env.DB_PORT || '5432'),","category":"sensitive","line_end":660,"severity":"high","line_start":660},{"id":"sensitive:resources/implementation-playbook.md:661:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"database: process.env.DB_NAME,","category":"sensitive","line_end":661,"severity":"high","line_start":661},{"id":"sensitive:resources/implementation-playbook.md:662:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"user: process.env.DB_USER,","category":"sensitive","line_end":662,"severity":"high","line_start":662},{"id":"sensitive:resources/implementation-playbook.md:663:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"password: process.env.DB_PASSWORD,","category":"sensitive","line_end":663,"severity":"high","line_start":663},{"id":"sensitive:resources/implementation-playbook.md:696:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"await mongoose.connect(process.env.MONGODB_URI!, {","category":"sensitive","line_end":696,"severity":"high","line_start":696},{"id":"sensitive:resources/implementation-playbook.md:843:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"process.env.REFRESH_TOKEN_SECRET!","category":"sensitive","line_end":843,"severity":"high","line_start":843},{"id":"sensitive:resources/implementation-playbook.md:864:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"return jwt.sign(payload, process.env.JWT_SECRET!, {","category":"sensitive","line_end":864,"severity":"high","line_start":864},{"id":"sensitive:resources/implementation-playbook.md:870:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"return jwt.sign(payload, process.env.REFRESH_TOKEN_SECRET!, {","category":"sensitive","line_end":870,"severity":"high","line_start":870},{"id":"sensitive:resources/implementation-playbook.md:884:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"host: process.env.REDIS_HOST,","category":"sensitive","line_end":884,"severity":"high","line_start":884},{"id":"sensitive:resources/implementation-playbook.md:885:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"port: parseInt(process.env.REDIS_PORT || '6379'),","category":"sensitive","line_end":885,"severity":"high","line_start":885},{"id":"sensitive:resources/implementation-playbook.md:267:certificate-key-files","file":"resources/implementation-playbook.md","pattern":"Certificate/key files","snippet":"const fields = Object.keys(updates);","category":"sensitive","line_end":267,"severity":"high","line_start":267},{"id":"sensitive:resources/implementation-playbook.md:912:certificate-key-files","file":"resources/implementation-playbook.md","pattern":"Certificate/key files","snippet":"const keys = await redis.keys(pattern);","category":"sensitive","line_end":912,"severity":"high","line_start":912},{"id":"sensitive:resources/implementation-playbook.md:914:certificate-key-files","file":"resources/implementation-playbook.md","pattern":"Certificate/key files","snippet":"await redis.del(...keys);","category":"sensitive","line_end":914,"severity":"high","line_start":914},{"id":"sensitive:resources/implementation-playbook.md:246:sqlite-database-file","file":"resources/implementation-playbook.md","pattern":"SQLite database file","snippet":"const { rows } = await this.db.query(query, [","category":"sensitive","line_end":246,"severity":"medium","line_start":246},{"id":"sensitive:resources/implementation-playbook.md:256:sqlite-database-file","file":"resources/implementation-playbook.md","pattern":"SQLite database file","snippet":"const { rows } = await this.db.query(query, [id]);","category":"sensitive","line_end":256,"severity":"medium","line_start":256},{"id":"sensitive:resources/implementation-playbook.md:262:sqlite-database-file","file":"resources/implementation-playbook.md","pattern":"SQLite database file","snippet":"const { rows } = await this.db.query(query, [email]);","category":"sensitive","line_end":262,"severity":"medium","line_start":262},{"id":"sensitive:resources/implementation-playbook.md:281:sqlite-database-file","file":"resources/implementation-playbook.md","pattern":"SQLite database file","snippet":"const { rows } = await this.db.query(query, [id, ...values]);","category":"sensitive","line_end":281,"severity":"medium","line_start":281},{"id":"sensitive:resources/implementation-playbook.md:287:sqlite-database-file","file":"resources/implementation-playbook.md","pattern":"SQLite database file","snippet":"const { rowCount } = await this.db.query(query, [id]);","category":"sensitive","line_end":287,"severity":"medium","line_start":287},{"id":"sensitive:resources/implementation-playbook.md:754:sqlite-database-file","file":"resources/implementation-playbook.md","pattern":"SQLite database file","snippet":"const client = await this.db.connect();","category":"sensitive","line_end":754,"severity":"medium","line_start":754},{"id":"blocker:resources/implementation-playbook.md:141:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"const { id } = req.params;","category":"blocker","line_end":141,"severity":"low","line_start":141},{"id":"blocker:resources/implementation-playbook.md:151:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"const { id } = req.params;","category":"blocker","line_end":151,"severity":"low","line_start":151},{"id":"blocker:resources/implementation-playbook.md:162:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"const { id } = req.params;","category":"blocker","line_end":162,"severity":"low","line_start":162},{"id":"blocker:resources/implementation-playbook.md:255:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"const query = 'SELECT * FROM users WHERE id = $1';","category":"blocker","line_end":255,"severity":"low","line_start":255},{"id":"blocker:resources/implementation-playbook.md:277:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"WHERE id = $1","category":"blocker","line_end":277,"severity":"low","line_start":277},{"id":"blocker:resources/implementation-playbook.md:286:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"const query = 'DELETE FROM users WHERE id = $1';","category":"blocker","line_end":286,"severity":"low","line_start":286},{"id":"blocker:resources/implementation-playbook.md:307:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"register<T>(key: string, factory: () => T): void {","category":"blocker","line_end":307,"severity":"low","line_start":307},{"id":"blocker:resources/implementation-playbook.md:319:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"singleton<T>(key: string, factory: () => T): void {","category":"blocker","line_end":319,"severity":"low","line_start":319},{"id":"blocker:resources/implementation-playbook.md:404:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"next(new UnauthorizedError('Invalid token'));","category":"blocker","line_end":404,"severity":"low","line_start":404},{"id":"blocker:resources/implementation-playbook.md:775:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"'UPDATE products SET stock = stock - $1 WHERE id = $2',","category":"blocker","line_end":775,"severity":"low","line_start":775},{"id":"blocker:resources/implementation-playbook.md:810:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"throw new UnauthorizedError('Invalid credentials');","category":"blocker","line_end":810,"severity":"low","line_start":810},{"id":"blocker:resources/implementation-playbook.md:813:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"const isValid = await bcrypt.compare(password, user.password);","category":"blocker","line_end":813,"severity":"low","line_start":813},{"id":"blocker:resources/implementation-playbook.md:816:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"throw new UnauthorizedError('Invalid credentials');","category":"blocker","line_end":816,"severity":"low","line_start":816},{"id":"blocker:resources/implementation-playbook.md:825:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"userId: user.id","category":"blocker","line_end":826,"severity":"low","line_start":825},{"id":"blocker:resources/implementation-playbook.md:859:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"throw new UnauthorizedError('Invalid refresh token');","category":"blocker","line_end":859,"severity":"low","line_start":859},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `resources/implementation-playbook.md` for detailed patterns and examples.","category":"external_commands","line_end":38,"severity":"medium","line_start":38}],"finding_verdicts":[{"id":"scripts:resources/implementation-playbook.md:563:prototype-manipulation","reason":"Object.setPrototypeOf restores the prototype chain for a custom Error subclass. It does not modify a shared prototype or accept attacker-controlled properties.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:44:ruby-shell-backtick-execution","reason":"The flagged backticks are JavaScript template-literal syntax inside a TypeScript documentation example. No shell, subprocess, or command execution API is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:50:ruby-shell-backtick-execution","reason":"The flagged backticks are JavaScript template-literal syntax inside a TypeScript documentation example. No shell, subprocess, or command execution API is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:245:ruby-shell-backtick-execution","reason":"This backtick delimits a multiline JavaScript SQL string in a documentation example. It does not invoke a shell or external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:271:ruby-shell-backtick-execution","reason":"This is JavaScript string interpolation used to construct SQL text, not shell execution. The separate risk from interpolated SQL identifiers is recorded as a semantic finding.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:279:ruby-shell-backtick-execution","reason":"This backtick delimits a multiline JavaScript SQL string in a documentation example. It does not invoke a shell or external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:314:ruby-shell-backtick-execution","reason":"The flagged backticks are JavaScript template-literal syntax inside a TypeScript documentation example. No shell, subprocess, or command execution API is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:538:ruby-shell-backtick-execution","reason":"The flagged backticks are JavaScript template-literal syntax inside a TypeScript documentation example. No shell, subprocess, or command execution API is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:930:ruby-shell-backtick-execution","reason":"The template literal builds an in-memory Redis cache key from method metadata. It does not invoke a shell or external process.","verdict":"false_positive","confidence":0.99},{"id":"network:resources/implementation-playbook.md:98:hardcoded-ip-address","reason":"The example binds Fastify to 0.0.0.0, exposing the service on every available interface. This is valid for containers but requires explicit network controls.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"filesystem:resources/implementation-playbook.md:123:path-traversal-sequence","reason":"The ../ sequence is a static TypeScript module import path in a documentation example. No user-controlled path is resolved or used for filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:124:path-traversal-sequence","reason":"The ../ sequence is a static TypeScript module import path in a documentation example. No user-controlled path is resolved or used for filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:175:path-traversal-sequence","reason":"The ../ sequence is a static TypeScript module import path in a documentation example. No user-controlled path is resolved or used for filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:176:path-traversal-sequence","reason":"The ../ sequence is a static TypeScript module import path in a documentation example. No user-controlled path is resolved or used for filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:177:path-traversal-sequence","reason":"The ../ sequence is a static TypeScript module import path in a documentation example. No user-controlled path is resolved or used for filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:235:path-traversal-sequence","reason":"The ../ sequence is a static TypeScript module import path in a documentation example. No user-controlled path is resolved or used for filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:369:path-traversal-sequence","reason":"The ../ sequence is a static TypeScript module import path in a documentation example. No user-controlled path is resolved or used for filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:434:path-traversal-sequence","reason":"The ../ sequence is a static TypeScript module import path in a documentation example. No user-controlled path is resolved or used for filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:604:path-traversal-sequence","reason":"The ../ sequence is a static TypeScript module import path in a documentation example. No user-controlled path is resolved or used for filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:800:path-traversal-sequence","reason":"The ../ sequence is a static TypeScript module import path in a documentation example. No user-controlled path is resolved or used for filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:801:path-traversal-sequence","reason":"The ../ sequence is a static TypeScript module import path in a documentation example. No user-controlled path is resolved or used for filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"env_access:resources/implementation-playbook.md:35:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:48:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:65:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:334:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:335:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:336:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:337:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:338:environment-variable-access-dot-notation","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:398:environment-variable-access-dot-notation","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:482:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:483:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:517:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:630:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:659:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:660:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:661:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:662:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:663:environment-variable-access-dot-notation","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:696:environment-variable-access-dot-notation","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:843:environment-variable-access-dot-notation","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:864:environment-variable-access-dot-notation","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:870:environment-variable-access-dot-notation","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:884:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:885:environment-variable-access-dot-notation","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:35:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:48:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:65:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:334:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:335:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:336:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:337:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:338:environment-variable-object","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:398:environment-variable-object","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:482:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:483:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:517:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:630:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:659:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:660:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:661:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:662:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:663:environment-variable-object","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:696:environment-variable-object","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:843:environment-variable-object","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:864:environment-variable-object","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:870:environment-variable-object","reason":"The example reads a specifically named secret from the process environment for its intended database or token operation. No secret value is logged, embedded, or transmitted elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:884:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:885:environment-variable-object","reason":"The example reads a named environment variable for application configuration. It does not enumerate, transmit, log, or expose the environment object.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:338:database-connection-strings","reason":"The snippet references the DB_PASSWORD environment variable but contains no connection string or credential value. Using environment configuration avoids hardcoded database secrets.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:663:database-connection-strings","reason":"The snippet references the DB_PASSWORD environment variable but contains no connection string or credential value. Using environment configuration avoids hardcoded database secrets.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:resources/implementation-playbook.md:35:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:48:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:65:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:334:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:335:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:336:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:337:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:338:environment-file-access","reason":"The snippet consumes a named environment secret for its intended authentication or database operation. It does not access an environment file or disclose the value.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:398:environment-file-access","reason":"The snippet consumes a named environment secret for its intended authentication or database operation. It does not access an environment file or disclose the value.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:482:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:483:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:517:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:630:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:659:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:660:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:661:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:662:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:663:environment-file-access","reason":"The snippet consumes a named environment secret for its intended authentication or database operation. It does not access an environment file or disclose the value.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:696:environment-file-access","reason":"The snippet consumes a named environment secret for its intended authentication or database operation. It does not access an environment file or disclose the value.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:843:environment-file-access","reason":"The snippet consumes a named environment secret for its intended authentication or database operation. It does not access an environment file or disclose the value.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:864:environment-file-access","reason":"The snippet consumes a named environment secret for its intended authentication or database operation. It does not access an environment file or disclose the value.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:870:environment-file-access","reason":"The snippet consumes a named environment secret for its intended authentication or database operation. It does not access an environment file or disclose the value.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:884:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:885:environment-file-access","reason":"The snippet reads process.env configuration and does not open or parse an environment file. No filesystem access or secret disclosure occurs.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:267:certificate-key-files","reason":"The identifier keys refers to object fields or Redis cache keys, not cryptographic key material. No certificate or private-key file is read.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:912:certificate-key-files","reason":"The identifier keys refers to object fields or Redis cache keys, not cryptographic key material. No certificate or private-key file is read.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:914:certificate-key-files","reason":"The identifier keys refers to object fields or Redis cache keys, not cryptographic key material. No certificate or private-key file is read.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:246:sqlite-database-file","reason":"The code uses a PostgreSQL Pool client and parameterized queries. It does not reference, read, or write a SQLite database file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:256:sqlite-database-file","reason":"The code uses a PostgreSQL Pool client and parameterized queries. It does not reference, read, or write a SQLite database file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:262:sqlite-database-file","reason":"The code uses a PostgreSQL Pool client and parameterized queries. It does not reference, read, or write a SQLite database file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:281:sqlite-database-file","reason":"The code uses a PostgreSQL Pool client and parameterized queries. It does not reference, read, or write a SQLite database file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:287:sqlite-database-file","reason":"The code uses a PostgreSQL Pool client and parameterized queries. It does not reference, read, or write a SQLite database file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:754:sqlite-database-file","reason":"The code uses a PostgreSQL Pool client and parameterized queries. It does not reference, read, or write a SQLite database file.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:141:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:151:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:162:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:255:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:277:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:286:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:307:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:319:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:404:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:775:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:810:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:813:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:816:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:825:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:859:system-reconnaissance","reason":"The snippet is ordinary TypeScript application logic in a backend example. It does not query host, network, account, process, or system metadata.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks format a relative Markdown file reference. The text neither executes the file nor invokes an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The backticks format a relative Markdown file reference. The text neither executes the file nor invokes an external command.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Unvalidated SQL Identifier Interpolation","severity":"high","locations":[{"file":"resources/implementation-playbook.md","line_end":281,"line_start":266}],"confidence":0.97,"description":"The update example builds SQL column assignments from Object.keys(updates). Parameterized values do not protect interpolated identifiers, so unexpected request keys can alter the query.","confidence_reasoning":"The field names are directly interpolated into SQL while only values use placeholders. The example shows no runtime allowlist for accepted update keys."},{"title":"Permissive Fastify CORS Configuration","severity":"medium","locations":[{"file":"resources/implementation-playbook.md","line_end":76,"line_start":73}],"confidence":0.94,"description":"The Fastify example reflects any request origin through origin: true. Production use can grant untrusted websites cross-origin access unless routes are strictly public.","confidence_reasoning":"The configuration explicitly enables dynamic origin reflection. The same playbook later warns against unrestricted production CORS, confirming this example needs qualification."},{"title":"Blocking Redis Pattern Invalidation","severity":"medium","locations":[{"file":"resources/implementation-playbook.md","line_end":915,"line_start":911}],"confidence":0.9,"description":"The cache example uses Redis KEYS with an arbitrary pattern, then deletes every match. Large keyspaces or broad patterns can block Redis and remove unrelated cache entries.","confidence_reasoning":"The method accepts any pattern and directly calls KEYS followed by bulk deletion. Redis KEYS is synchronously expensive across large keyspaces."}],"subject_marketplace_commit_sha":"81e05e636292629114b76cbb3922fbe57672fc02","subject_content_hash":"ec798e95704e9789efc5a11561c65e3cf10231a881da4fc467ace1bd4e71e3e2","subject_tree_hash":"b7ad7d87906844ee6d358ed8101290cba6c58fef9d5ac07c0e8de5953d3268b5","subject_plugin_path":"skills/sickn33/nodejs-backend-patterns","audit_payload_hash":"09e923b64500803d39cf459a14c5f08f","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"81e05e636292629114b76cbb3922fbe57672fc02","contentHash":"ec798e95704e9789efc5a11561c65e3cf10231a881da4fc467ace1bd4e71e3e2","treeHash":"b7ad7d87906844ee6d358ed8101290cba6c58fef9d5ac07c0e8de5953d3268b5","pluginPath":"skills/sickn33/nodejs-backend-patterns","auditPayloadHash":"09e923b64500803d39cf459a14c5f08f"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-nodejs-backend-patterns/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}