📦
Historial de auditorías
stageshow - 1 auditoría
Versión de auditoría 1 Más reciente
1 nov 2026, 14:40
All 400 presented static findings are false positives involving illustration code, assets, dependency metadata, or expected local tooling. One additional finding identifies unescaped scene labels that can inject HTML into contact sheets; no evidence found of keylogging, credential theft, or audit manipulation. The analyzer capped review at 400 of 2,018 matches; the remaining 1,618 are unconfirmed and require manual review before automatic publishing. Static review was capped at 400/2018 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
356
Archivos escaneados
52,755
Líneas analizadas
6
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (1)
Medio
Unescaped Scene Labels Can Alter Capture Evidence
State capture reads page-controlled data-mark values and inserts them unescaped into contact-sheet HTML. Crafted labels can inject styles or scripts, falsifying review images or initiating browser requests.
The source directly connects data-mark attributes to shot labels and interpolates those labels into setContent without escaping. Exploitation requires control of a captured label; no malicious payload was observed.
Factores de riesgo
⚙️ Comandos externos (50)
examples/ai-cards/index.tsx:88 examples/ai-cards/index.tsx:106 examples/annotations/composed.tsx:20 examples/annotations/composed.tsx:47 examples/annotations/composed.tsx:52 examples/annotations/composed.tsx:65 examples/annotations/composed.tsx:68 examples/annotations/index.tsx:35 examples/annotations/index.tsx:79 examples/annotations/index.tsx:105 examples/annotations/index.tsx:180 examples/annotations/index.tsx:192 examples/annotations/index.tsx:193 examples/annotations/index.tsx:199 examples/annotations/index.tsx:200 examples/annotations/index.tsx:221 examples/annotations/index.tsx:222 examples/annotations/index.tsx:227 examples/annotations/index.tsx:228 examples/annotations/index.tsx:243 examples/annotations/index.tsx:246 examples/annotations/index.tsx:276 examples/backgrounds/index.tsx:67 examples/bento/index.tsx:38 examples/bento/index.tsx:263 examples/bento/index.tsx:360 examples/bento/index.tsx:372 examples/bento/index.tsx:373 examples/brand-marks/index.tsx:34 examples/calendar/index.tsx:21 examples/calendar/index.tsx:39 examples/calendar/index.tsx:43 examples/calendar/index.tsx:58 examples/calendar/index.tsx:182 examples/calendar/index.tsx:189 examples/chart-scrub/index.tsx:35 examples/choreography/index.tsx:68 examples/choreography/index.tsx:83 examples/controls/index.tsx:182 examples/cursor-morph/cursor-morph.tsx:67 examples/cursor-morph/cursor-morph.tsx:68 examples/cursor-morph/cursor-morph.tsx:123 examples/cursor-morph/index.tsx:23 examples/cursor-morph/index.tsx:47 examples/cursors/index.tsx:103 examples/cursors/index.tsx:113 examples/cursors/index.tsx:114 examples/dark-bento/index.tsx:59 examples/dark-bento/index.tsx:69 examples/dark-hero/index.tsx:84
📁 Acceso al sistema de archivos (50)
examples/ai-cards/index.tsx:1 examples/ai-chat/index.tsx:11 examples/annotations/composed.tsx:2 examples/annotations/index.tsx:2 examples/annotations/index.tsx:6 examples/backgrounds/index.tsx:2 examples/bento/index.tsx:2 examples/bento/index.tsx:3 examples/bento/index.tsx:4 examples/brand-marks/index.tsx:2 examples/calendar/index.tsx:1 examples/chart-scrub/index.tsx:2 examples/choreography/index.tsx:2 examples/chrome/index.tsx:2 examples/close-up/index.tsx:1 examples/controls/index.tsx:1 examples/corner-chip/index.tsx:1 examples/cursor-morph/cursor-morph.tsx:5 examples/cursor-morph/index.tsx:4 examples/cursor-resize/index.tsx:1 examples/cursors/index.tsx:1 examples/dark-bento/index.tsx:1 examples/dark-hero/index.tsx:3 examples/device-pair/index.tsx:1 examples/dynamic-island/index.tsx:2 examples/excel/index.tsx:1 examples/fade-crop/index.tsx:1 examples/figma/index.tsx:2 examples/finder-glass/index.tsx:27 examples/finder-glass/index.tsx:345 examples/finder-glass/index.tsx:346 examples/finder/index.tsx:21 examples/finder/index.tsx:293 examples/finder/index.tsx:294 examples/form-error/index.tsx:1 examples/freeform-drag/index.tsx:1 examples/glass/index.tsx:1 examples/gmail/index.tsx:1 examples/google-calendar/index.tsx:1 examples/google-docs/index.tsx:2 examples/google-docs/index.tsx:122 examples/hero-demo/HeroDemo.tsx:1 examples/hero-grid/index.tsx:2 examples/imessage/index.tsx:2 examples/kit-extras/index.tsx:1 examples/kit-extras/index.tsx:3 examples/linear/index.tsx:3 examples/loading/index.tsx:2 examples/looks/index.tsx:1 examples/looks/studies.tsx:1
🌐 Acceso a red (50)
examples/controls/index.tsx:13 examples/wikipedia/index.tsx:410 kit/brands/1password-dark.svg:1 kit/brands/1password.svg:1 kit/brands/amex.svg:1 kit/brands/bankofamerica-dark.svg:1 kit/brands/bankofamerica.svg:1 kit/brands/barclays.svg:1 kit/brands/bitcoin.svg:1 kit/brands/chase.svg:1 kit/brands/monzo-dark.svg:1 kit/brands/monzo.svg:1 kit/brands/revolut-dark.svg:1 kit/brands/revolut.svg:1 kit/brands/solana.svg:1 kit/brands/wellsfargo.svg:1 kit/cursors.tsx:56 kit/cursors.tsx:58 kit/cursors.tsx:73 package-lock.json:34 package-lock.json:49 package-lock.json:59 package-lock.json:85 package-lock.json:90 package-lock.json:107 package-lock.json:124 package-lock.json:134 package-lock.json:148 package-lock.json:166 package-lock.json:176 package-lock.json:186 package-lock.json:196 package-lock.json:206 package-lock.json:220 package-lock.json:236 package-lock.json:252 package-lock.json:268 package-lock.json:283 package-lock.json:302 package-lock.json:316 package-lock.json:333 package-lock.json:350 package-lock.json:367 package-lock.json:384 package-lock.json:401 package-lock.json:418 package-lock.json:435 package-lock.json:452 package-lock.json:469 package-lock.json:486
🔑 Variables de entorno (10)
Auditado por: codex