Audit History

Most static alerts are false positives from generated declarations, documentation, relative imports, regular-expression .exec, and a commented eval. Nine intended fetch calls are confirmed as low-risk network behavior, but semantic review found high-risk credential disclosure, unrestricted endpoints, arbitrary attachment reads, and unsafe autonomous email handling. Static review was capped at 400/864 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

All 400 presented static findings were adjudicated as false positives or expected capabilities of a JMAP mail client. The findings primarily stem from generated declarations, source maps, documentation, credential storage, protocol requests, and JavaScript syntax misclassified as process execution. No prompt injection, unauthorized credential exfiltration, or malicious persistence intent was found in the reviewed files. Static review was capped at 400/864 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

All 400 presented static findings were adjudicated as false positives or expected capabilities of a JMAP mail client. The findings primarily stem from generated declarations, source maps, documentation, credential storage, protocol requests, and JavaScript syntax misclassified as process execution. No prompt injection, unauthorized credential exfiltration, or malicious persistence intent was found in the reviewed files. Static review was capped at 400/864 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

All 400 presented static findings were adjudicated as false positives or expected capabilities of a JMAP mail client. The findings primarily stem from generated declarations, source maps, documentation, credential storage, protocol requests, and JavaScript syntax misclassified as process execution. No prompt injection, unauthorized credential exfiltration, or malicious persistence intent was found in the reviewed files. Static review was capped at 400/864 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Most scanner alerts are lexical false positives from generated files, documentation, regular expressions, and intended configuration access. Confirmed risks involve sending secrets to configurable or session-provided endpoints. Additional findings cover API-key output, unrestricted attachment paths, scheduled email prompt injection, and existing-file permissions. Static review was capped at 400/864 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.