Compétences playwright-best-practices Historique des audits

📦

Historique des audits

playwright-best-practices - 1 audit

29 oct. 2026, 14:53

Most presented alerts are benign Playwright examples; no evidence found of keylogging, prompt injection, or malicious exfiltration in reviewed context. Confirmed risks involve unguarded database operations, predictable temporary files, and indiscriminate process termination; HAR commit guidance adds a data-disclosure concern. All 400 presented findings were adjudicated; 888 omitted matches still require manual review before automatic publication. Static review was capped at 400/1288 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Fichiers analysés

26,413

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (1)

Moyen

architecture/when-to-mock.md:160-169 architecture/when-to-mock.md:187-192

HAR Commit Guidance Omits Secret Redaction

The guide says 'Commit `.har` files to version control' after recording staging admin API traffic. Without redaction, recordings can disclose authorization headers, cookies, or sensitive response bodies through repository history.

The recording and commit recommendation are explicit, but no captured HAR was supplied. This confirms unsafe guidance, not an observed credential leak.

Éléments d’évaluation des capacités (7)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Élevé

core/global-setup.md:163

Database connection strings

execSync(`psql $DATABASE_URL < ${SNAPSHOT_PATH}`, { stdio: "inherit" });

core/global-setup.md:163: The snapshot restore executes SQL against DATABASE_URL without verifying a disposable test database. A misconfigured connection can modify a non-test database.

Élevé

core/configuration.md:266

Synchronous process execution

execSync('npx prisma db push --force-reset', { stdio: 'inherit' });

core/configuration.md:266: Teardown invokes Prisma with --force-reset without validating the database target. An inherited production connection could cause irreversible data loss.

Élevé

core/global-setup.md:163

Synchronous process execution

execSync(`psql $DATABASE_URL < ${SNAPSHOT_PATH}`, { stdio: "inherit" });

core/global-setup.md:163: The snapshot restore executes SQL against DATABASE_URL without verifying a disposable test database. A misconfigured connection can modify a non-test database.

Moyen

debugging/flaky-tests.md:306

Node.js fs operations

fs.writeFileSync(file, "{}");

debugging/flaky-tests.md:306: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

Moyen

debugging/flaky-tests.md:306

Synchronous file operations

fs.writeFileSync(file, "{}");

debugging/flaky-tests.md:306: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

Moyen

debugging/flaky-tests.md:305

Temp directory access

const file = `/tmp/test-${Date.now()}.json`;

debugging/flaky-tests.md:305: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

Moyen

infrastructure-ci-cd/github-actions.md:519

xargs command (can execute arbitrary commands)

run: lsof -ti:3000 | xargs kill -9 2>/dev/null || true

infrastructure-ci-cd/github-actions.md:519: The command force-kills every process returned for port 3000 without checking ownership by this test run. Shared runners could lose unrelated services.

Facteurs de risque

⚙️ Commandes externes (50)

🌐 Accès réseau (50)

📁 Accès au système de fichiers (50)

⚡ Contient des scripts (4)

advanced/authentication.md:467 architecture/pom-vs-fixtures.md:141 core/configuration.md:254 core/configuration.md:265

🔑 Variables d’environnement (50)

advanced/authentication.md:108 advanced/authentication.md:109 advanced/authentication.md:201 advanced/authentication.md:206 advanced/authentication.md:211 advanced/authentication.md:443 advanced/authentication.md:491 advanced/authentication.md:492 advanced/authentication.md:627 advanced/authentication.md:628 advanced/authentication.md:108 advanced/authentication.md:109 advanced/authentication.md:201 advanced/authentication.md:206 advanced/authentication.md:211 advanced/authentication.md:443 advanced/authentication.md:491 advanced/authentication.md:492 advanced/authentication.md:627 advanced/authentication.md:628 advanced/third-party.md:331 advanced/third-party.md:344 advanced/third-party.md:331 advanced/third-party.md:344 advanced/third-party.md:331 advanced/third-party.md:344 architecture/when-to-mock.md:204 architecture/when-to-mock.md:219 architecture/when-to-mock.md:234 architecture/when-to-mock.md:246 architecture/when-to-mock.md:204 architecture/when-to-mock.md:219 architecture/when-to-mock.md:234 architecture/when-to-mock.md:246 core/annotations.md:39 core/annotations.md:53 core/annotations.md:88 core/annotations.md:356 core/annotations.md:366 core/annotations.md:39 core/annotations.md:53 core/annotations.md:88 core/annotations.md:356 core/annotations.md:366 core/configuration.md:44 core/configuration.md:83 core/configuration.md:84 core/configuration.md:85 core/configuration.md:87 core/configuration.md:95

Audité par: codex

← Retour à la compétence