audit: overhaul /fix honesty, per-ecosystem filters, scanner safety (v2.10.6 → v2.10.13)

[GaltRanch]

Summary

Seven-commit overhaul of the audit engine that takes KCode from v2.10.6 to v2.10.13. Started as "make audit stop reporting false positives in Flutter ephemeral code" and grew into a full review of the /fix pipeline after dogfooding surfaced a serious honesty bug: the previous /fix claimed success for every finding but ~230 of the ~240 patterns only inserted a TODO-style comment and left the bug in place.

Commits in order

Commit	Version	What
3d301cc	2.10.7	Flutter/iOS/Android false-positive skip dirs + terminal title polish + sh-001 language fix
2a92947	2.10.8	Exhaustive per-ecosystem skip filters (JS/Python/Ruby/Rust/Go/Elixir/Scala/Haskell/C-C++/Swift/.NET) + path substrings + generated filename patterns + minified-file heuristic
b15e350	2.10.9	py-020-global-keyword verify_prompt refined to recognize circuit breakers / rate limiters / connection pools as FALSE_POSITIVE
e7a7d8c	2.10.10	/fix no longer lies: new FixKind = transformed|annotated|skipped field separates real code transforms from advisory comments. UI shows three buckets. Added 2 real bespoke Dart fixers (dart-007-json-null-check, dart-005-setstate-after-dispose).
c63cfa3	2.10.11	Closes 6 self-review holes: json-scoped dart-007 regex, atomic file writes, full-span setState guard detection, State class verification, scanner symlink cycle + root-escape protection
c2b0be8	2.10.12	applyRecipe no longer duplicates annotations on stale re-runs (±3 line window check)
f106671	2.10.13	Closes the 2 real HIGH/MEDIUM findings from KCode's own self-audit: prototype pollution in McpManager.loadFromConfigs + unguarded JSON.parse in parseNotebook

Key changes

Scanner — src/core/audit-engine/scanner.ts

• SKIP_DIRS expanded from 17 entries to ~55, covering every ecosystem the audit engine understands.
• New SKIP_PATH_SUBSTRINGS catches generated dirs that aren't a literal top-level name (/generated/, /build/intermediates/, etc.).
• New SKIP_FILENAME_PATTERNS catches generated files by basename regex (Dart code-gen, protobuf, Qt moc, C# designer, Swift generated, minified JS/CSS).
• New looksMinified() heuristic skips files whose longest line exceeds 5000 chars.
• Full realpath-based traversal: every directory and file resolves through realpathSync and is checked against visitedDirs/visitedFiles sets — cyclic symlinks can't loop, and links that escape the project root are rejected.

Fixer — src/core/audit-engine/fixer.ts

• FixResult / OneFixResult carry a new kind: "transformed" | "annotated" | "skipped" field.
• applyRecipe (generic advisory path) returns kind: "annotated" — the buggy code is UNCHANGED; the comment is a TODO.
• Bespoke fixers return kind: "transformed" — real code is rewritten.
• Two new bespoke Dart fixers:
  • dart-007-json-null-check: narrow regex requires json['...'] context, then rewrites as int|double|num|bool|String to the nullable + default form. Whole-file sweep for multi-match files.
  • dart-005-setstate-after-dispose: inserts if (!mounted) return; before setState, with full-span guard detection and class-context verification (only inserts when we're inside a State<T> subclass).
• atomicWriteFileSync() writes to <target>.kcode-fix-<rand>.tmp then renames — atomic on POSIX.
• applyRecipe dedup guard scans ±3 lines around the insertion point, not just idx - 1 — absorbs line drift from stale audit reports.

UI — src/ui/actions/file-actions.ts

• /fix output now has three buckets with distinct icons and counts:
  • ✅ Fixed: N (real code transforms)
  • 📝 Annotated: N (advisory comment only — still needs manual fix)
  • ⏭ Skipped: N
• Annotated findings are listed with the command grep -rn KCODE-AUDIT hint so users can find their open TODOs.

Workflow orchestrator — src/core/task-orchestrator/workflow-chain.ts

• fixes_applied now counts only transformed entries. Annotations no longer inflate the success number.

Security fixes from KCode's own self-audit

• src/core/mcp.ts: McpManager.loadFromConfigs rejects __proto__ / constructor / prototype as MCP server names and uses Object.create(null) as the accumulator.
• src/tools/notebook-utils.ts: parseNotebook wraps JSON.parse in try/catch, re-raises as Invalid notebook JSON: …, and rejects non-object roots.

Pattern library — src/core/audit-engine/patterns.ts

• sh-001-eval-injection moved from [c,cpp,python,js,ts,go,rust,java] to [shell] (new language in the Language union).
• py-020-global-keyword verify_prompt expanded to list 9 idiomatic module-level-state patterns the verifier should mark FALSE_POSITIVE (circuit breakers, rate limiters, connection pools, memoization caches, etc.).

Verified against SmartSolar

A /fix run on SmartSolar with the new pipeline:

• 4 Dart model files get 14 as T → as T? ?? default transforms (real code change).
• 1 websocket_service.dart finding is honestly reported as 📝 annotated because dart-006-future-no-error still routes through the generic recipe.
• 0 false positives in vendored Flutter plugin code (was 17 in the original run).

Tests

• Audit-engine: 34 passing (was 25). New coverage:
  • Dart 007 scope: rewrites json[...] casts, leaves non-JSON casts alone.
  • Dart 007 idempotency: second run on already-fixed file is a no-op.
  • Dart 005 context: skips insertion when setState isn't inside State<T>.
  • Dart 005 guard detection: recognizes a mounted guard 6+ lines before setState.
  • Generic recipes reported as annotated, not transformed.
  • applyRecipe no-duplicate guarantee across three /fix runs.
  • Scanner rejects symlinks that escape the project root.
  • Scanner terminates on cyclic symlinks.
• MCP sanitization: 45 passing (added 2 new prototype-pollution regression tests).
• Notebook utils: 11 passing (added 2 new JSON.parse error-path tests).

Test plan

• bun test src/core/audit-engine/ — should report 34 pass.
• bun test src/core/mcp-proto-pollution.test.ts src/tools/notebook-utils.test.ts — should report all green.
• bun run build — should produce a working dist/kcode binary.
• kcode --version — should report 2.10.13.
• Run /scan . and /fix against any project with .plugin_symlinks/, Pods/, or .dart_tool/ in its tree and verify no findings come out of those directories.
• Verify /fix output shows three buckets (✅ Fixed / 📝 Annotated / ⏭ Skipped) not a single Applied count.

🤖 Generated with Claude Code

[github-actions]

🔍 KCode Security Audit

Audit Report — KCode

Auditor: Astrolexis.space — Kulvex Code
Date: 2026-04-11
Project: /home/runner/work/KCode/KCode
Languages: shell, typescript, kotlin, javascript, ruby, swift, python

---

Summary

• Files scanned: 500
• Candidates found: 108
• Confirmed findings: 108
• False positives: 0
• Scan duration: 10.4s

Severity breakdown

Severity	Count
🔴 CRITICAL	24
🟠 HIGH	43
🟡 MEDIUM	13
🟢 LOW	28

---

Full report

Audit Report — KCode

Auditor: Astrolexis.space — Kulvex Code
Date: 2026-04-11
Project: /home/runner/work/KCode/KCode
Languages: shell, typescript, kotlin, javascript, ruby, swift, python

---

Summary

• Files scanned: 500
• Candidates found: 108
• Confirmed findings: 108
• False positives: 0
• Scan duration: 10.4s

Severity breakdown

Severity	Count
🔴 CRITICAL	24
🟠 HIGH	43
🟡 MEDIUM	13
🟢 LOW	28

---

Findings

1. 🔴 Shell command with template literal (injection) — CWE-78

File: backend/src/db.ts:23
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

21: 
22: function migrate(db: Database): void {
23:   db.exec(`
24:     CREATE TABLE IF NOT EXISTS customers (
25:       id            TEXT PRIMARY KEY,
26:       stripe_id     TEXT UNIQUE NOT NULL,

Verification: Verification skipped — static-only mode

Fix template: Use spawn/execFile with array args instead of shell string.

---

2. 🔴 Shell command with template literal (injection) — CWE-78

File: src/cli/commands/web.ts:56
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

54:                   ? "start"
55:                   : "xdg-open";
56:             exec(`${cmd} "${fullUrl}"`);
57:           } catch {
58:             console.log(`  Open in browser: ${fullUrl}`);
59:           }

Verification: Verification skipped — static-only mode

Fix template: Use spawn/execFile with array args instead of shell string.

---

3. 🔴 eval() with potentially untrusted input — CWE-95

File: src/core/audit-engine/fixer.ts:521
Severity: CRITICAL
Pattern: js-001-eval

Why this matters:
eval() executes arbitrary JavaScript. If input is user-controlled, this is XSS/RCE.

Code:

519: 
520: /**
521:  * py-001: Replace eval() with ast.literal_eval().
522:  */
523: function fixPyEval(lines: string[], finding: Finding): OneFixResult {
524:   const idx = finding.line - 1;

Verification: Verification skipped — static-only mode (+3 more matches of this pattern in the same file)

Fix template: Remove eval() or use JSON.parse() for data, Function constructor for controlled cases.

---

4. 🔴 eval() with potentially untrusted input — CWE-95

File: src/core/audit-engine/patterns.ts:261
Severity: CRITICAL
Pattern: js-001-eval

Why this matters:
eval() executes arbitrary JavaScript. If input is user-controlled, this is XSS/RCE.

Code:

259:   {
260:     id: "py-001-eval-exec",
261:     title: "eval()/exec() with potentially untrusted input",
262:     severity: "critical",
263:     languages: ["python"],
264:     regex: /\b(eval|exec)\s*\(/g,

Verification: Verification skipped — static-only mode (+16 more matches of this pattern in the same file)

Fix template: Remove eval() or use JSON.parse() for data, Function constructor for controlled cases.

---

5. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/audit-engine/pr-generator.ts:37
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

35: 
36: function git(cwd: string, args: string): string {
37:   return execSync(`git ${args}`, { cwd, encoding: "utf-8", timeout: 30_000, stdio: ["pipe", "pipe", "pipe"] }).trim();
38: }
39: 
40: function gh(cwd: string, args: string): string {

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

6. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/audit-logger.ts:52
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

50: 
51:     // Create audit table
52:     db.exec(`CREATE TABLE IF NOT EXISTS audit_log (
53:       id INTEGER PRIMARY KEY AUTOINCREMENT,
54:       timestamp TEXT NOT NULL DEFAULT (datetime('now')),
55:       event_type TEXT NOT NULL,

Verification: Verification skipped — static-only mode (+3 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

7. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/benchmarks.ts:12
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

10: export function initBenchmarkSchema(): void {
11:   const db = getDb();
12:   db.exec(`
13:     CREATE TABLE IF NOT EXISTS benchmarks (
14:       id INTEGER PRIMARY KEY AUTOINCREMENT,
15:       model TEXT NOT NULL,

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

8. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/change-review.ts:460
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

458:   let numstatOutput: string;
459:   try {
460:     nameStatusOutput = execSync(`git diff ${diffFlag} --name-status`, {
461:       cwd,
462:       encoding: "utf-8",
463:       timeout: 10000,

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

9. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/codebase-index.ts:272
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

270:     const db = getDb();
271:     try {
272:       db.exec(`CREATE TABLE IF NOT EXISTS codebase_index (
273:         path TEXT PRIMARY KEY,
274:         relative_path TEXT NOT NULL,
275:         ext TEXT NOT NULL,

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

10. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/db.ts:69
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

67: function initSchema(db: Database): void {
68:   // narrative.ts tables
69:   db.exec(`CREATE TABLE IF NOT EXISTS narrative (
70:     id INTEGER PRIMARY KEY AUTOINCREMENT,
71:     summary TEXT NOT NULL,
72:     project TEXT NOT NULL DEFAULT '',

Verification: Verification skipped — static-only mode (+34 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

11. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/gpu-orchestrator.ts:102
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

100:   for (const smiPath of NVIDIA_SMI_PATHS) {
101:     try {
102:       const output = execSync(`${smiPath} ${NVIDIA_QUERY} ${NVIDIA_FORMAT}`, {
103:         encoding: "utf-8",
104:         timeout: 10_000,
105:         stdio: ["pipe", "pipe", "pipe"],

Verification: Verification skipped — static-only mode

Fix template: Use spawn/execFile with array args instead of shell string.

---

12. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/hardware.ts:94
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

92:     for (const smiPath of nvidiaSmiPaths) {
93:       try {
94:         output = execSync(`${smiPath} ${queryArgs}`, {
95:           encoding: "utf-8",
96:           timeout: 10000,
97:           stdio: ["pipe", "pipe", "pipe"],

Verification: Verification skipped — static-only mode

Fix template: Use spawn/execFile with array args instead of shell string.

---

13. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/mcp-aliases.ts:22
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

20:   if (schemaInitialized) return;
21:   const db = getDb();
22:   db.exec(`
23:     CREATE TABLE IF NOT EXISTS mcp_tool_aliases (
24:       alias TEXT PRIMARY KEY,
25:       target TEXT NOT NULL,

Verification: Verification skipped — static-only mode

Fix template: Use spawn/execFile with array args instead of shell string.

---

14. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/memory-store.ts:49
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

47: 
48: export function initMemoryStoreSchema(db: Database): void {
49:   db.exec(`CREATE TABLE IF NOT EXISTS memory_store (
50:     id INTEGER PRIMARY KEY AUTOINCREMENT,
51:     category TEXT NOT NULL DEFAULT 'fact',
52:     key TEXT NOT NULL,

Verification: Verification skipped — static-only mode (+7 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

15. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/model-engine.ts:367
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

365:   for (const cmd of prerequisites) {
366:     try {
367:       execSync(`which ${cmd}`, { stdio: "pipe", timeout: 5000 });
368:     } catch {
369:       log.error("setup", `Build prerequisite missing: ${cmd}`);
370:       progress(`Cannot build from source: '${cmd}' not found. Install it and retry.\n`);

Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

16. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/narrative.test.ts:11
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

9:   // Isolated in-memory DB for tests
10:   const testDb = new Database(":memory:");
11:   testDb.exec(`CREATE TABLE IF NOT EXISTS narrative (
12:     id INTEGER PRIMARY KEY AUTOINCREMENT,
13:     summary TEXT NOT NULL,
14:     project TEXT NOT NULL DEFAULT '',

Verification: Verification skipped — static-only mode

Fix template: Use spawn/execFile with array args instead of shell string.

---

17. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/narrative.ts:45
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

43:       ).run(summary, data.project, data.toolsUsed.join(", "), data.actionsCount);
44:       // Prune: keep last 50 or last 30 days
45:       db.exec(
46:         `DELETE FROM narrative WHERE id NOT IN (SELECT id FROM narrative ORDER BY created_at DESC LIMIT 50) OR created_at < datetime('now', '-30 days')`,
47:       );
48:       log.info("narrative", `Session narrative saved: ${summary.slice(0, 80)}...`);

Verification: Verification skipped — static-only mode

Fix template: Use spawn/execFile with array args instead of shell string.

---

18. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/post-turn.ts:141
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

139:     const { execSync } = require("node:child_process");
140:     if (process.platform === "linux") {
141:       execSync(`notify-send "${safeTitle}" "${safeBody}" 2>/dev/null`, { timeout: 3000 });
142:     } else if (process.platform === "darwin") {
143:       execSync(
144:         `osascript -e 'display notification "${safeBody}" with title "${safeTitle}"' 2>/dev/null`,

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

19. 🔴 eval() with potentially untrusted input — CWE-95

File: src/core/skills/code-skills.ts:358
Severity: CRITICAL
Pattern: js-001-eval

Why this matters:
eval() executes arbitrary JavaScript. If input is user-controlled, this is XSS/RCE.

Code:

356:    - Insufficient logging & monitoring
357: 3. Check for language-specific issues:
358:    - TypeScript/JS: eval(), innerHTML, dangerouslySetInnerHTML, prototype pollution
359:    - Python: pickle, exec, shell=True, format string injection
360:    - Go: sql.Query with string concat, unsafe pointer use
361: 4. Report findings with severity (CRITICAL/HIGH/MEDIUM/LOW), file:line, and fix recommendation.

Verification: Verification skipped — static-only mode

Fix template: Remove eval() or use JSON.parse() for data, Function constructor for controlled cases.

---

20. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/system-prompt-context.ts:447
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

445: export function getDiskUsage(cwd: string): string | null {
446:   try {
447:     const output = execSync(
448:       `df -h "${cwd}" 2>/dev/null | tail -1 | awk '{print $4 " available (" $5 " used)"}'`,
449:       {
450:         stdio: "pipe",

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

21. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/user-model.test.ts:10
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

8: function createTestDb(): Database {
9:   const db = new Database(":memory:");
10:   db.exec(`CREATE TABLE IF NOT EXISTS user_model (
11:     key TEXT PRIMARY KEY, value REAL NOT NULL, samples INTEGER NOT NULL DEFAULT 1,
12:     updated_at TEXT NOT NULL DEFAULT (datetime('now'))
13:   )`);

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

22. 🔴 Shell command with template literal (injection) — CWE-78

File: src/core/voice.ts:77
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

75:   // Try arecord first (ALSA), then sox
76:   try {
77:     execSync(
78:       `arecord -f S16_LE -r ${SAMPLE_RATE} -c 1 -d ${durationSec} "${outPath}" 2>/dev/null`,
79:       { stdio: "pipe", timeout: (durationSec + 2) * 1000 },
80:     );

Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

23. 🔴 Shell command with template literal (injection) — CWE-78

File: src/index.ts:1174
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

1172:       };
1173:       try {
1174:         const raw = execSync(`gh pr view ${prNumber} --json title,body,files,comments`, {
1175:           encoding: "utf-8",
1176:           timeout: 15_000,
1177:         }).trim();

Verification: Verification skipped — static-only mode

Fix template: Use spawn/execFile with array args instead of shell string.

---

24. 🔴 Shell command with template literal (injection) — CWE-78

File: src/telemetry/sinks/sqlite.ts:22
Severity: CRITICAL
Pattern: js-007-command-injection

Why this matters:
Running shell commands with template literals allows injection if any interpolated value is user-controlled.

Code:

20: 
21:   private ensureTable(): void {
22:     this.db.exec(`
23:       CREATE TABLE IF NOT EXISTS telemetry_events (
24:         id INTEGER PRIMARY KEY AUTOINCREMENT,
25:         name TEXT NOT NULL,

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Use spawn/execFile with array args instead of shell string.

---

25. 🟠 dangerouslySetInnerHTML with dynamic content — CWE-79

File: benchmarks/certification/tasks.ts:930
Severity: HIGH
Pattern: react-001-dangerously-set

Why this matters:
dangerouslySetInnerHTML bypasses React's XSS protection. With dynamic content → XSS.

Code:

928: \`\`\`tsx
929: function UserComment({ comment }: { comment: string }) {
930:   return <div dangerouslySetInnerHTML={{ __html: comment }} />;
931: }
932: \`\`\`
933: 

Verification: Verification skipped — static-only mode

Fix template: Use DOMPurify: { __html: DOMPurify.sanitize(content) }

---

26. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79

File: ide/vscode/src/sidebar.ts:322
Severity: HIGH
Pattern: js-002-innerhtml

Why this matters:
Setting innerHTML with dynamic content enables XSS. Use textContent or a sanitizer.

Code:

320:       div.className = 'message ' + role;
321:       if (id) div.dataset.id = id;
322:       div.innerHTML = '<div class="role">' + (role === 'user' ? 'You' : 'KCode') + '</div>' +
323:         '<div class="content">' + escapeHtml(content) + '</div>';
324:       messagesEl.appendChild(div);
325:       messagesEl.scrollTop = messagesEl.scrollHeight;

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Use element.textContent = value, or DOMPurify.sanitize(html).

---

27. 🟠 innerHTML assignment with dynamic content (XSS) — CWE-79

File: ide/vscode/src/sidebar.ts:322
Severity: HIGH
Pattern: js-010-innerhtml-xss

Why this matters:
Assigning dynamic content to innerHTML enables XSS. Attacker-controlled HTML can execute scripts, steal cookies, and hijack sessions.

Code:

320:       div.className = 'message ' + role;
321:       if (id) div.dataset.id = id;
322:       div.innerHTML = '<div class="role">' + (role === 'user' ? 'You' : 'KCode') + '</div>' +
323:         '<div class="content">' + escapeHtml(content) + '</div>';
324:       messagesEl.appendChild(div);
325:       messagesEl.scrollTop = messagesEl.scrollHeight;

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Use textContent for text, or sanitize: el.innerHTML = DOMPurify.sanitize(html).

---

28. 🟠 UserDefaults for sensitive data (should use Keychain) — CWE-312

File: mobile-ios/Models/AppSettings.swift:9
Severity: HIGH
Pattern: swift-004-keychain-no-access

Why this matters:
UserDefaults is stored unencrypted on disk. Sensitive data (passwords, tokens) should use Keychain Services.

Code:

7: class AppSettings: ObservableObject {
8:     @Published var serverURL: String {
9:         didSet { UserDefaults.standard.set(serverURL, forKey: "serverURL") }
10:     }
11: 
12:     @Published var model: String {

Verification: Verification skipped — static-only mode (+7 more matches of this pattern in the same file)

Fix template: Use KeychainAccess library or Security framework: SecItemAdd/SecItemCopyMatching.

---

29. 🟠 Hardcoded password, secret, or API key — CWE-798

File: mobile/src/api/client.ts:4
Severity: HIGH
Pattern: py-006-hardcoded-secret

Why this matters:
Hardcoded secrets in source code are exposed to anyone with repo access. Use environment variables or a secrets manager.

Code:

2: 
3: const STORAGE_SERVER_URL = "kcode_server_url";
4: const STORAGE_API_KEY = "kcode_api_key";
5: 
6: const DEFAULT_SERVER_URL = "http://localhost:10091";
7: 

Verification: Verification skipped — static-only mode

Fix template: Move to environment variable: os.environ.get('SECRET_KEY')

---

30. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/cli/commands/mcp.ts:89
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

87:       if (args.length > 0) entry.args = args;
88: 
89:       data.mcpServers[name] = entry;
90: 
91:       // Ensure directory exists
92:       const { mkdirSync } = await import("node:fs");

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

31. 🟠 Hardcoded password, secret, or API key — CWE-798

File: src/cli/commands/plugin-sdk/publish.test.ts:41
Severity: HIGH
Pattern: py-006-hardcoded-secret

Why this matters:
Hardcoded secrets in source code are exposed to anyone with repo access. Use environment variables or a secrets manager.

Code:

39:     test("returns env var if set", () => {
40:       const original = process.env.KCODE_AUTH_TOKEN;
41:       process.env.KCODE_AUTH_TOKEN = "test-token-123";
42:       try {
43:         expect(getAuthToken()).toBe("test-token-123");
44:       } finally {

Verification: Verification skipped — static-only mode

Fix template: Move to environment variable: os.environ.get('SECRET_KEY')

---

32. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/cli/commands/template.ts:97
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

95:           const value = rawArgs[i + 1];
96:           if (value && !value.startsWith("--")) {
97:             params[key] = value === "true" ? true : value === "false" ? false : value;
98:             i++;
99:           } else {
100:             params[key] = true;

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

33. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79

File: src/core/audit-engine/patterns.ts:712
Severity: HIGH
Pattern: js-002-innerhtml

Why this matters:
Setting innerHTML with dynamic content enables XSS. Use textContent or a sanitizer.

Code:

710:       "If any user data is concatenated or interpolated, respond CONFIRMED.",
711:     cwe: "CWE-79",
712:     fix_template: "Use textContent for text, or sanitize: el.innerHTML = DOMPurify.sanitize(html).",
713:   },
714:   {
715:     id: "js-011-eval-new-function",

Verification: Verification skipped — static-only mode

Fix template: Use element.textContent = value, or DOMPurify.sanitize(html).

---

34. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/audit-engine/patterns.ts:3105
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

3103:       "If the index could be nil (from function return, optional parameter), respond CONFIRMED.",
3104:     cwe: "CWE-476",
3105:     fix_template: "Add nil guard: if key ~= nil then tbl[key] = value end",
3106:   },
3107:   {
3108:     id: "lua-004-string-concat-loop",

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

35. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/auto-agents.ts:144
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

142:       for (const [key, value] of Object.entries(process.env)) {
143:         if (value !== undefined && AGENT_ENV_ALLOWLIST.has(key)) {
144:           env[key] = value;
145:         }
146:       }
147:       // Inject credentials from the parent session's config

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

36. 🟠 Hardcoded password, secret, or API key — CWE-798

File: src/core/config.test.ts:500
Severity: HIGH
Pattern: py-006-hardcoded-secret

Why this matters:
Hardcoded secrets in source code are exposed to anyone with repo access. Use environment variables or a secrets manager.

Code:

498: 
499:     test("reads KCODE_API_KEY from env", async () => {
500:       process.env.KCODE_API_KEY = "sk-env-key";
501:       const settings = await loadSettings(tempDir);
502:       expect(settings.apiKey).toBe("sk-env-key");
503:     });

Verification: Verification skipped — static-only mode

Fix template: Move to environment variable: os.environ.get('SECRET_KEY')

---

37. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/custom-agents.ts:137
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

135: 
136:       if (isArray) {
137:         meta[key] = collected.filter(Boolean);
138:       } else if (collected.length > 0) {
139:         // Try parsing as JSON (for mcpServers, hooks)
140:         const joined = collected.join("\n");

Verification: Verification skipped — static-only mode (+9 more matches of this pattern in the same file)

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

38. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/feature-flags.test.ts:24
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

22:       "KCODE_FF_ENABLE_EXPERIMENTAL_TOOLS",
23:     ]) {
24:       savedEnv[key] = process.env[key];
25:       delete process.env[key];
26:     }
27:   });

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

39. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/feature-flags.ts:61
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

59:   if (settingsFlags) {
60:     for (const key of Object.keys(flags) as (keyof RuntimeFeatureFlags)[]) {
61:       if (key in settingsFlags && typeof settingsFlags[key] === "boolean") {
62:         flags[key] = settingsFlags[key] as boolean;
63:       }
64:     }

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

40. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/hookify.ts:91
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

89:       }
90: 
91:       meta[key] = parseYamlValue(value);
92:     }
93:   }
94: 

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

41. 🟠 Hardcoded password, secret, or API key — CWE-798

File: src/core/http-server-e2e.test.ts:10
Severity: HIGH
Pattern: py-006-hardcoded-secret

Why this matters:
Hardcoded secrets in source code are exposed to anyone with repo access. Use environment variables or a secrets manager.

Code:

8: // ─── Real Server Setup ──────────────────────────────────────────
9: 
10: const TEST_API_KEY = "e2e-test-key-" + Date.now();
11: let server: ReturnType<typeof Bun.serve> | null = null;
12: let BASE = "";
13: let serverAvailable = false;

Verification: Verification skipped — static-only mode

Fix template: Move to environment variable: os.environ.get('SECRET_KEY')

---

42. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/marketplace.ts:306
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

304:     }
305: 
306:     config.installed[name] = {
307:       version: plugin.version,
308:       installedAt: new Date().toISOString(),
309:     };

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

43. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/mcp-client.ts:132
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

130:     if (DANGEROUS_KEYS.has(key)) continue;
131:     if (typeof value === "string" && value.length > MAX_STRING_FIELD_SIZE) {
132:       result[key] =
133:         value.slice(0, MAX_STRING_FIELD_SIZE) + `\n[Truncated at ${MAX_STRING_FIELD_SIZE} bytes]`;
134:     } else if (value !== null && typeof value === "object" && !Array.isArray(value)) {
135:       result[key] = sanitizeMcpInput(value as Record<string, unknown>, depth + 1);

Verification: Verification skipped — static-only mode (+5 more matches of this pattern in the same file)

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

44. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/mcp-oauth.ts:200
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

198:   const data: Record<string, TokenStorageEntry> = {};
199:   for (const [key, entry] of store) {
200:     data[key] = {
201:       ...entry,
202:       tokens: encryptTokens(entry.tokens as OAuthTokens),
203:       encrypted: true,

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

45. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/mcp.ts:175
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

173:       if (UNSAFE_KEYS.has(name)) continue;
174:       if (isValidServerConfig(config)) {
175:         validated[name] = config as McpServerConfig;
176:       }
177:     }
178:     if (Object.keys(validated).length === 0) return;

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

46. 🟠 Hardcoded password, secret, or API key — CWE-798

File: src/core/mesh/security.test.ts:94
Severity: HIGH
Pattern: py-006-hardcoded-secret

Why this matters:
Hardcoded secrets in source code are exposed to anyone with repo access. Use environment variables or a secrets manager.

Code:

92: describe("buildAuthHeaders", () => {
93:   test("includes X-Team-Token and Content-Type", () => {
94:     const token = "test-token-123";
95:     const headers = buildAuthHeaders(token);
96:     expect(headers["X-Team-Token"]).toBe(token);
97:     expect(headers["Content-Type"]).toBe("application/json");

Verification: Verification skipped — static-only mode

Fix template: Move to environment variable: os.environ.get('SECRET_KEY')

---

47. 🟠 Hardcoded password, secret, or API key — CWE-798

File: src/core/payments.test.ts:55
Severity: HIGH
Pattern: py-006-hardcoded-secret

Why this matters:
Hardcoded secrets in source code are exposed to anyone with repo access. Use environment variables or a secrets manager.

Code:

53:   test("loads config from env vars", async () => {
54:     process.env.STRIPE_SECRET_KEY = "sk_test_abc123";
55:     process.env.STRIPE_WEBHOOK_SECRET = "whsec_test_xyz";
56:     process.env.STRIPE_PRICE_ID = "price_test_pro";
57:     process.env.STRIPE_PORTAL_RETURN_URL = "https://kulvex.ai/dashboard";
58: 

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Move to environment variable: os.environ.get('SECRET_KEY')

---

48. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/plugin-manager.ts:388
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

386:         for (const [serverName, config] of Object.entries(manifest.mcpServers)) {
387:           const key = `${manifest.name}__${serverName}`;
388:           configs[key] = config;
389:         }
390:       }
391:     }

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

49. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/plugin-marketplace.ts:219
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

217:   writeFileSync(join(pluginDir, "plugin.json"), JSON.stringify(manifest, null, 2), "utf-8");
218: 
219:   config.installed[name] = {
220:     version: plugin.version,
221:     installedAt: new Date().toISOString(),
222:   };

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

50. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/profiler/startup-profiler.test.ts:26
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

24:     const restore = (key: string, val: string | undefined) => {
25:       if (val === undefined) delete process.env[key];
26:       else process.env[key] = val;
27:     };
28:     restore("KCODE_PROFILE", savedProfile);
29:     restore("KCODE_PROFILE_STARTUP", savedStartup);

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

51. 🟠 Hardcoded password, secret, or API key — CWE-798

File: src/core/request-builder.test.ts:36
Severity: HIGH
Pattern: py-006-hardcoded-secret

Why this matters:
Hardcoded secrets in source code are exposed to anyone with repo access. Use environment variables or a secrets manager.

Code:

34: 
35:   test("GPT model resolves OPENAI_API_KEY", () => {
36:     process.env.OPENAI_API_KEY = "sk-openai-test";
37:     expect(resolveApiKey("gpt-4", "http://example.com", baseConfig)).toBe("sk-openai-test");
38:   });
39: 

Verification: Verification skipped — static-only mode (+6 more matches of this pattern in the same file)

Fix template: Move to environment variable: os.environ.get('SECRET_KEY')

---

52. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/skills.ts:314
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

312:           const key = part.slice(0, eqIdx);
313:           const value = part.slice(eqIdx + 1);
314:           templateArgs[key] = value;
315:         } else {
316:           freeArgs.push(part);
317:         }

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

53. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/core/startup-profiler.test.ts:25
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

23:     const restore = (key: string, val: string | undefined) => {
24:       if (val === undefined) delete process.env[key];
25:       else process.env[key] = val;
26:     };
27:     restore("KCODE_PROFILE_STARTUP", savedProfileEnv);
28:     restore("KCODE_PROFILE", savedProfileEnv2);

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

54. 🟠 Hardcoded password, secret, or API key — CWE-798

File: src/remote/triggers/trigger-api.test.ts:9
Severity: HIGH
Pattern: py-006-hardcoded-secret

Why this matters:
Hardcoded secrets in source code are exposed to anyone with repo access. Use environment variables or a secrets manager.

Code:

7: 
8: const BASE_URL = "https://cloud.kulvex.ai/api/v1";
9: const AUTH_TOKEN = "test-token-abc123";
10: 
11: const sampleTrigger: RemoteTrigger = {
12:   id: "trg_001",

Verification: Verification skipped — static-only mode

Fix template: Move to environment variable: os.environ.get('SECRET_KEY')

---

55. 🟠 Hardcoded secret/key in JavaScript/TypeScript — CWE-798

File: src/remote/triggers/trigger-api.test.ts:9
Severity: HIGH
Pattern: js-006-hardcoded-secret

Why this matters:
Hardcoded secrets in source code are exposed to anyone with repo access.

Code:

7: 
8: const BASE_URL = "https://cloud.kulvex.ai/api/v1";
9: const AUTH_TOKEN = "test-token-abc123";
10: 
11: const sampleTrigger: RemoteTrigger = {
12:   id: "trg_001",

Verification: Verification skipped — static-only mode

Fix template: Use process.env.SECRET_KEY or a secrets manager.

---

56. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/telemetry/pii-filter.ts:42
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

40:   // Hash path fields
41:   for (const field of PATH_FIELDS) {
42:     if (typeof attrs[field] === "string") {
43:       attrs[`${field}_hash`] = sha256Short(attrs[field] as string);
44:       delete attrs[field];
45:     }

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

57. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/telemetry/sampling.ts:33
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

31: 
32:   // Look for an explicit rate for this event name
33:   const rate = typeof config[name] === "number" ? (config[name] as number) : config.default;
34: 
35:   if (rate >= 1) return true;
36:   if (rate <= 0) return false;

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

58. 🟠 Hardcoded secret or API key in JavaScript/TypeScript — CWE-798

File: src/web/api.test.ts:24
Severity: HIGH
Pattern: js-017-hardcoded-secret-inline

Why this matters:
Hardcoded API keys and secrets in source code are exposed in git history, build artifacts, and client-side bundles. They can be extracted and abused.

Code:

22:       fallbackModel: null,
23:       pro: false,
24:       apiKey: "sk-secret-key-do-not-expose",
25:       anthropicApiKey: "secret-anthropic-key",
26:     }),
27:     getUsage: () => ({

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Use process.env.API_KEY or a secrets manager. Never commit real keys.

---

59. 🟠 Prototype pollution via bracket notation with user key — CWE-1321

File: src/web/static/analytics-dashboard.js:65
Severity: HIGH
Pattern: js-008-prototype-pollution-bracket

Why this matters:
Setting object properties via bracket notation with a user-controlled key allows prototype pollution. An attacker can set proto.isAdmin = true to affect all objects.

Code:

63:       while ((match = re.exec(content)) !== null) {
64:         var name = match[1];
65:         usage[name] = (usage[name] || 0) + 1;
66:       }
67:     }
68:     this.toolUsage = usage;

Verification: Verification skipped — static-only mode

Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects.

---

60. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79

File: src/web/static/analytics-dashboard.js:72
Severity: HIGH
Pattern: js-002-innerhtml

Why this matters:
Setting innerHTML with dynamic content enables XSS. Use textContent or a sanitizer.

Code:

70: 
71:   AnalyticsDashboard.prototype.render = function () {
72:     this.container.innerHTML = "";
73: 
74:     var wrapper = document.createElement("div");
75:     wrapper.className = "dashboard-panel analytics-dashboard";

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Use element.textContent = value, or DOMPurify.sanitize(html).

---

61. 🟠 Hardcoded password, secret, or API key — CWE-798

File: src/web/static/app.js:175
Severity: HIGH
Pattern: py-006-hardcoded-secret

Why this matters:
Hardcoded secrets in source code are exposed to anyone with repo access. Use environment variables or a secrets manager.

Code:

173:     var proto = window.location.protocol === "https:" ? "wss:" : "ws:";
174:     this.wsUrl =
175:       proto + "//" + window.location.host + "/ws?token=" + encodeURIComponent(this.authToken);
176:   };
177: 
178:   KCodeWebUI.prototype.connect = function () {

Verification: Verification skipped — static-only mode

Fix template: Move to environment variable: os.environ.get('SECRET_KEY')

---

62. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79

File: src/web/static/app.js:357
Severity: HIGH
Pattern: js-002-innerhtml

Why this matters:
Setting innerHTML with dynamic content enables XSS. Use textContent or a sanitizer.

Code:

355:       var rendered = window.MarkdownRenderer.renderMarkdown(msg.content);
356:       if (window.DOMPurify) {
357:         body.innerHTML = window.DOMPurify.sanitize(rendered);
358:       } else {
359:         body.innerHTML = rendered;
360:       }

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Use element.textContent = value, or DOMPurify.sanitize(html).

---

63. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79

File: src/web/static/config-panel.js:44
Severity: HIGH
Pattern: js-002-innerhtml

Why this matters:
Setting innerHTML with dynamic content enables XSS. Use textContent or a sanitizer.

Code:

42: 
43:   ConfigPanel.prototype.render = function () {
44:     this.container.innerHTML = "";
45: 
46:     var wrapper = document.createElement("div");
47:     wrapper.className = "dashboard-panel config-panel";

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Use element.textContent = value, or DOMPurify.sanitize(html).

---

64. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79

File: src/web/static/model-dashboard.js:46
Severity: HIGH
Pattern: js-002-innerhtml

Why this matters:
Setting innerHTML with dynamic content enables XSS. Use textContent or a sanitizer.

Code:

44: 
45:   ModelDashboard.prototype.render = function () {
46:     this.container.innerHTML = "";
47: 
48:     var wrapper = document.createElement("div");
49:     wrapper.className = "dashboard-panel model-dashboard";

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Use element.textContent = value, or DOMPurify.sanitize(html).

---

65. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79

File: src/web/static/session-viewer.js:48
Severity: HIGH
Pattern: js-002-innerhtml

Why this matters:
Setting innerHTML with dynamic content enables XSS. Use textContent or a sanitizer.

Code:

46: 
47:   SessionViewer.prototype.render = function () {
48:     this.container.innerHTML = "";
49: 
50:     var wrapper = document.createElement("div");
51:     wrapper.className = "dashboard-panel session-viewer";

Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file)

Fix template: Use element.textContent = value, or DOMPurify.sanitize(html).

---

66. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79

File: vscode-extension/src/chat-panel.ts:509
Severity: HIGH
Pattern: js-002-innerhtml

Why this matters:
Setting innerHTML with dynamic content enables XSS. Use textContent or a sanitizer.

Code:

507:         // Sanitize markdown output to prevent XSS from model-generated content
508:         const rendered = formatMarkdown(content);
509:         div.innerHTML = typeof DOMPurify !== 'undefined' ? DOMPurify.sanitize(rendered) : rendered;
510:       } else {
511:         div.textContent = content;
512:       }

Verification: Verification skipped — static-only mode (+3 more matches of this pattern in the same file)

Fix template: Use element.textContent = value, or DOMPurify.sanitize(html).

---

67. 🟠 innerHTML assignment with dynamic content (XSS) — CWE-79

File: vscode-extension/src/chat-panel.ts:594
Severity: HIGH
Pattern: js-010-innerhtml-xss

Why this matters:
Assigning dynamic content to innerHTML enables XSS. Attacker-controlled HTML can execute scripts, steal cookies, and hijack sessions.

Code:

592:           const toolDiv = document.createElement('div');
593:           toolDiv.className = 'tool-indicator' + (msg.isError ? ' error' : '');
594:           toolDiv.innerHTML = '<span class="tool-name">' + escapeHtml(msg.name) + '</span>';
595:           if (msg.result) {
596:             const resultText = typeof msg.result === 'string'
597:               ? msg.result.slice(0, 200)

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Use textContent for text, or sanitize: el.innerHTML = DOMPurify.sanitize(html).

---

68. 🟡 Retain cycle: strong reference in closure without [weak self] — CWE-401

File: mobile-ios/Models/AppSettings.swift:24
Severity: MEDIUM
Pattern: swift-008-retain-cycle

Why this matters:
Closures that capture self strongly can create retain cycles, causing memory leaks. If self holds a strong reference to the closure (directly or through a chain), neither will be deallocated.

Code:

22:     }
23: 
24:     init() {
25:         self.serverURL = UserDefaults.standard.string(forKey: "serverURL") ?? "http://localhost:10100"
26:         self.model = UserDefaults.standard.string(forKey: "model") ?? "claude-opus-4-6"
27:         self.cwd = UserDefaults.standard.string(forKey: "cwd") ?? ""

Verification: Verification skipped — static-only mode

Fix template: Add [weak self] or [unowned self] capture list: { [weak self] in guard let self else { return } ... }

---

69. 🟡 Retain cycle: strong reference in closure without [weak self] — CWE-401

File: mobile-ios/Models/ChatMessage.swift:34
Severity: MEDIUM
Pattern: swift-008-retain-cycle

Why this matters:
Closures that capture self strongly can create retain cycles, causing memory leaks. If self holds a strong reference to the closure (directly or through a chain), neither will be deallocated.

Code:

32: }
33: 
34: struct ChatMessage: Identifiable {
35:     let id = UUID()
36:     let role: MessageRole
37:     let kind: MessageKind

Verification: Verification skipped — static-only mode

Fix template: Add [weak self] or [unowned self] capture list: { [weak self] in guard let self else { return } ... }

---

70. 🟡 Retain cycle: strong reference in closure without [weak self] — CWE-401

File: mobile-ios/Services/ChatSession.swift:29
Severity: MEDIUM
Pattern: swift-008-retain-cycle

Why this matters:
Closures that capture self strongly can create retain cycles, causing memory leaks. If self holds a strong reference to the closure (directly or through a chain), neither will be deallocated.

Code:

27:     private var settings: AppSettings?
28: 
29:     func configure(settings: AppSettings) {
30:         self.settings = settings
31:     }
32: 

Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file)

Fix template: Add [weak self] or [unowned self] capture list: { [weak self] in guard let self else { return } ... }

---

71. 🟡 Missing error handling in async/await — CWE-755

File: mobile-ios/Services/ChatSession.swift:129
Severity: MEDIUM
Pattern: swift-015-missing-async-error-handling

Why this matters:
Async/await calls to throwing functions without try/catch will propagate errors silently. In non-throwing contexts, this may cause compile errors or unhandled failures.

Code:

127:                 // Reset mood after 2s
128:                 Task { @MainActor in
129:                     try? await Task.sleep(nanoseconds: 2_000_000_000)
130:                     if self.kodiMood == .done { self.kodiMood = .idle }
131:                 }
132: 

Verification: Verification skipped — static-only mode

Fix template: Wrap in do/catch: do { let result = try await fetchData() } catch { handleError(error) }

---

72. 🟡 Retain cycle: strong reference in closure without [weak self] — CWE-401

File: mobile-ios/Services/SSEClient.swift:22
Severity: MEDIUM
Pattern: swift-008-retain-cycle

Why this matters:
Closures that capture self strongly can create retain cycles, causing memory leaks. If self holds a strong reference to the closure (directly or through a chain), neither will be deallocated.

Code:

20: }
21: 
22: class SSEClient: NSObject, URLSessionDataDelegate {
23:     weak var delegate: SSEClientDelegate?
24:     private var dataTask: URLSessionDataTask?
25:     private var buffer = Data()

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Add [weak self] or [unowned self] capture list: { [weak self] in guard let self else { return } ... }

---

73. 🟡 Missing error handling in async/await — CWE-755

File: mobile-ios/Views/SettingsView.swift:102
Severity: MEDIUM
Pattern: swift-015-missing-async-error-handling

Why this matters:
Async/await calls to throwing functions without try/catch will propagate errors silently. In non-throwing contexts, this may cause compile errors or unhandled failures.

Code:

100:             }
101:             do {
102:                 let (_, response) = try await URLSession.shared.data(from: url)
103:                 if let http = response as? HTTPURLResponse, http.statusCode == 200 {
104:                     testResult = "✓ Connected"
105:                 } else {

Verification: Verification skipped — static-only mode

Fix template: Wrap in do/catch: do { let result = try await fetchData() } catch { handleError(error) }

---

74. 🟡 Security-related TODO/FIXME/HACK comment — CWE-1035

File: src/core/audit-engine/fixer.ts:1089
Severity: MEDIUM
Pattern: uni-002-security-todo

Why this matters:
A developer left a security-related TODO. This may indicate a known vulnerability that was deferred.

Code:

1087:   // ── Universal ──────────────────────────────────────────────
1088:   "uni-001-hardcoded-ip": r("hardcoded IP", "Move the IP address to config — hardcoding makes deployment brittle."),
1089:   "uni-002-security-todo": r("security TODO", "Address this security TODO before shipping."),
1090: 
1091:   // ── Zig ────────────────────────────────────────────────────
1092:   "zig-001-use-after-free": r("use-after-free", "Don't use memory after free — null the pointer or use defer."),

Verification: Verification skipped — static-only mode

Fix template: Address the security concern or remove the stale comment.

---

75. 🟡 window.location set from user input (open redirect) — CWE-601

File: src/core/audit-engine/patterns.ts:804
Severity: MEDIUM
Pattern: js-016-open-redirect

Why this matters:
Setting window.location from user-controlled input enables open redirect attacks. An attacker can craft a URL that redirects users to a phishing site.

Code:

802:     cwe: "CWE-601",
803:     fix_template:
804:       "Validate redirect URL against allowlist: const allowed = ['/dashboard', '/home']; if (allowed.includes(url)) location.href = url;",
805:   },
806:   {
807:     id: "js-017-hardcoded-secret-inline",

Verification: Verification skipped — static-only mode

Fix template: Validate redirect URL against allowlist: const allowed = ['/dashboard', '/home']; if (allowed.includes(url)) location.href = url;

---

76. 🟡 document.write() usage (XSS vector, performance issue) — CWE-79

File: src/core/audit-engine/patterns.ts:823
Severity: MEDIUM
Pattern: js-018-document-write

Why this matters:
document.write() can inject arbitrary HTML/scripts into the page. Called after page load, it replaces the entire document. It's both an XSS vector and a performance anti-pattern.

Code:

821:   {
822:     id: "js-018-document-write",
823:     title: "document.write() usage (XSS vector, performance issue)",
824:     severity: "medium",
825:     languages: ["javascript", "typescript"],
826:     regex: /\bdocument\.write(?:ln)?\s*\(/g,

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Use DOM APIs: document.createElement() + appendChild(), or element.textContent for text.

---

77. 🟡 Security-related TODO/FIXME/HACK comment — CWE-1035

File: src/core/audit-engine/patterns.ts:2191
Severity: MEDIUM
Pattern: uni-002-security-todo

Why this matters:
A developer left a security-related TODO. This may indicate a known vulnerability that was deferred.

Code:

2189:     verify_prompt: "Is this a real connection string with credentials or a placeholder? If real, respond CONFIRMED." +
2190:       "\n\nRespond FALSE_POSITIVE if ANY of these is true:\n" +
2191:       "1. The password is a placeholder ('changeme', 'xxx', 'password', 'TODO', 'REPLACE_ME')\n" +
2192:       "2. This is in test, example, or documentation code\n" +
2193:       "3. The connection string is loaded from configuration/environment at runtime\n" +
2194:       "4. This is a local development connection (localhost with default credentials)\n" +

Verification: Verification skipped — static-only mode (+5 more matches of this pattern in the same file)

Fix template: Address the security concern or remove the stale comment.

---

78. 🟡 Promise chain without .catch() (unhandled rejection) — CWE-755

File: src/core/config.ts:773
Severity: MEDIUM
Pattern: js-015-promise-no-catch

Why this matters:
A Promise .then() chain without .catch() leads to unhandled promise rejections. In Node.js, unhandled rejections crash the process by default.

Code:

771:     }
772:   };
773:   _settingsSaveLock = _settingsSaveLock.then(op, op);
774:   return _settingsSaveLock;
775: }
776: 

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Add .catch(err => { /* handle */ }) at the end of the chain, or use async/await with try/catch.

---

79. 🟡 Security-related TODO/FIXME/HACK comment — CWE-1035

File: src/core/logger.ts:120
Severity: MEDIUM
Pattern: uni-002-security-todo

Why this matters:
A developer left a security-related TODO. This may indicate a known vulnerability that was deferred.

Code:

118:     /(["']?(?:api[_-]?key|secret|token|password|authorization|bearer|credential|private[_-]?key|access[_-]?key)["']?\s*[:=]\s*["']?)([^\s"',}{[\]]{8,})/gi;
119: 
120:   /** API keys embedded in URLs (e.g., ?key=xxx or &token=xxx) */
121:   private static readonly URL_KEY_RE =
122:     /([?&](?:key|token|api_key|apikey|access_token|secret|password)=)([^\s&"']{8,})/gi;
123: 

Verification: Verification skipped — static-only mode

Fix template: Address the security concern or remove the stale comment.

---

80. 🟡 JSON.parse without try/catch (crash on invalid input) — CWE-754

File: src/core/session-branch.ts:117
Severity: MEDIUM
Pattern: js-014-json-parse-no-catch

Why this matters:
JSON.parse() throws SyntaxError on invalid JSON. Without try/catch, malformed input crashes the process or rejects the promise unhandled.

Code:

115:       if (existsSync(filePath)) {
116:         const content = readFileSync(filePath, "utf-8");
117:         return JSON.parse(content) as SessionBranch;
118:       }
119:     }
120:   } catch {

Verification: Verification skipped — static-only mode

Fix template: Wrap in try/catch: try { const obj = JSON.parse(data); } catch (e) { /* handle */ }

---

81. 🟢 Hardcoded IP address or internal URL — CWE-798

File: backend/src/index.ts:465
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

463: 
464: const PORT = Number(process.env.PORT) || 10080;
465: const HOST = process.env.HOST ?? "0.0.0.0";
466: 
467: console.log(`KCode Backend starting on ${HOST}:${PORT}`);
468: 

Verification: Verification skipped — static-only mode

Fix template: Move to configuration file or environment variable.

---

82. 🟢 addEventListener without corresponding removeEventListener — CWE-401

File: ide/vscode/src/sidebar.ts:371
Severity: LOW
Pattern: js-012-event-listener-leak

Why this matters:
Adding event listeners without removing them causes memory leaks, especially in SPAs where components mount/unmount. Each re-render adds another listener.

Code:

369:     }
370: 
371:     sendBtn.addEventListener('click', send);
372:     inputEl.addEventListener('keydown', (e) => {
373:       if (e.key === 'Enter' && !e.shiftKey) {
374:         e.preventDefault();

Verification: Verification skipped — static-only mode

Fix template: Store reference and remove in cleanup: const handler = () => {}; el.addEventListener('click', handler); // later: el.removeEventListener('click', handler);

---

83. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/cli/commands/serve.ts:8
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

6:     .description("Start KCode as an HTTP API server")
7:     .option("-p, --port <port>", "Port to listen on", (v: string) => parseInt(v, 10), 10101)
8:     .option("-h, --host <host>", "Host to bind to", "127.0.0.1")
9:     .option("--api-key <key>", "Require this API key for authentication")
10:     .action(async (opts: { port?: number; host?: string; apiKey?: string }) => {
11:       try {

Verification: Verification skipped — static-only mode (+3 more matches of this pattern in the same file)

Fix template: Move to configuration file or environment variable.

---

84. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/cli/commands/web.ts:16
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

14:     .description("Start the browser-based Web UI")
15:     .option("-p, --port <port>", "Port to listen on", (v: string) => parseInt(v, 10))
16:     .option("--host <host>", "Host to bind to", "127.0.0.1")
17:     .option("--no-open", "Don't open browser automatically")
18:     .option("--no-auth", "Disable token authentication (insecure)")
19:     .action(async (opts: { port?: number; host?: string; open?: boolean; auth?: boolean }) => {

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Move to configuration file or environment variable.

---

85. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697

File: src/cli/completions/generator.ts:97
Severity: LOW
Pattern: js-013-loose-equality

Why this matters:
The == operator performs type coercion, leading to surprising results: '' == false, 0 == '', null == undefined. This causes subtle bugs in conditionals.

Code:

95: 
96:   # Flags
97:   if [[ "$cur" == -* ]]; then
98:     COMPREPLY=($(compgen -W "${flags} ${shorts}" -- "$cur"))
99:     return
100:   fi

Verification: Verification skipped — static-only mode (+3 more matches of this pattern in the same file)

Fix template: Use === for strict equality, or == null specifically for null/undefined checks.

---

86. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697

File: src/core/audit-engine/patterns.ts:146
Severity: LOW
Pattern: js-013-loose-equality

Why this matters:
The == operator performs type coercion, leading to surprising results: '' == false, 0 == '', null == undefined. This causes subtle bugs in conditionals.

Code:

144:     severity: "high",
145:     languages: ["c", "cpp"],
146:     // Match ptr->field followed by if (ptr == NULL) within 100 chars,
147:     // BUT exclude when there's a return/break/goto between them
148:     // (those exit the scope, so the null check is for a different path).
149:     regex: /\b(\w+)\s*->\s*\w+(?![\s\S]{0,100}?\b(?:return|break|goto)\b)[\s\S]{0,100}?\bif\s*\(\s*\1\s*(?:==|!=)\s*(?:NULL|nullptr|0)\s*\)/g,

Verification: Verification skipped — static-only mode (+20 more matches of this pattern in the same file)

Fix template: Use === for strict equality, or == null specifically for null/undefined checks.

---

87. 🟢 addEventListener without corresponding removeEventListener — CWE-401

File: src/core/audit-engine/patterns.ts:743
Severity: LOW
Pattern: js-012-event-listener-leak

Why this matters:
Adding event listeners without removing them causes memory leaks, especially in SPAs where components mount/unmount. Each re-render adds another listener.

Code:

741:     cwe: "CWE-401",
742:     fix_template:
743:       "Store reference and remove in cleanup: const handler = () => {}; el.addEventListener('click', handler); // later: el.removeEventListener('click', handler);",
744:   },
745:   {
746:     id: "js-013-loose-equality",

Verification: Verification skipped — static-only mode

Fix template: Store reference and remove in cleanup: const handler = () => {}; el.addEventListener('click', handler); // later: el.removeEventListener('click', handler);

---

88. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697

File: src/core/auto-update.ts:67
Severity: LOW
Pattern: js-013-loose-equality

Why this matters:
The == operator performs type coercion, leading to surprising results: '' == false, 0 == '', null == undefined. This causes subtle bugs in conditionals.

Code:

65:  * Compare two semver strings. Returns:
66:  *  -1 if a < b
67:  *   0 if a == b
68:  *   1 if a > b
69:  */
70: export function compareSemver(a: string, b: string): number {

Verification: Verification skipped — static-only mode

Fix template: Use === for strict equality, or == null specifically for null/undefined checks.

---

89. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/doctor.ts:308
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

306:         server.close(() => resolve(true));
307:       });
308:       server.listen(10101, "127.0.0.1");
309:     });
310:     if (portAvailable) {
311:       results.push({ name: "HTTP server port", status: "ok", message: "Port 10101 is available" });

Verification: Verification skipped — static-only mode

Fix template: Move to configuration file or environment variable.

---

90. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/extension-api/types.ts:37
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

35: export const DEFAULT_EXTENSION_API_CONFIG: ExtensionApiConfig = {
36:   port: 19300,
37:   host: "127.0.0.1",
38:   rateLimit: 60,
39:   corsOrigins: ["*"],
40: };

Verification: Verification skipped — static-only mode

Fix template: Move to configuration file or environment variable.

---

91. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/hook-executor.ts:225
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

223:   if (/^169\.254\./.test(h)) return true;
224:   // Cloud provider metadata endpoints (AWS/GCP link-local + Azure wireserver)
225:   if (h === "168.63.129.16") return true; // Azure Instance Metadata / wireserver
226:   if (/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(h)) return true; // AWS VPC carrier-grade NAT (100.64-127.x)
227:   if (/^0\./.test(h) || h === "0.0.0.0") return true;
228:   if (h === "::1" || h === "[::1]") return true;

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Move to configuration file or environment variable.

---

92. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/http-server.ts:1031
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

1029:   // Default to loopback — binding to 0.0.0.0 without auth is RCE from the network
1030:   const host =
1031:     options.host === "0.0.0.0" || options.host === "::"
1032:       ? options.host
1033:       : options.host || "127.0.0.1";
1034:   const isExposed = host === "0.0.0.0" || host === "::";

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Move to configuration file or environment variable.

---

93. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/llama-server.ts:128
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

126:     mx.set_wired_limit = lambda *a, **kw: _orig(${wiredBytes})
127: import sys
128: sys.argv = ['mlx_lm.server', '--model', '${safeModel}', '--port', '${safePort}', '--host', '127.0.0.1']
129: from mlx_lm.server import main
130: main()`;
131:       args = ["-c", wrapperScript];

Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file)

Fix template: Move to configuration file or environment variable.

---

94. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/mcp-oauth.ts:77
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

75:   if (
76:     parsed.protocol === "http:" &&
77:     (host === "localhost" || host === "127.0.0.1" || host === "::1")
78:   )
79:     return;
80:   throw new Error(

Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file)

Fix template: Move to configuration file or environment variable.

---

95. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/mcp.ts:77
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

75:             parsed.protocol === "http:" &&
76:             (parsed.hostname === "localhost" ||
77:               parsed.hostname === "127.0.0.1" ||
78:               parsed.hostname === "::1");
79:           if (parsed.protocol !== "https:" && !isLocalhost) return false;
80:         } catch {

Verification: Verification skipped — static-only mode

Fix template: Move to configuration file or environment variable.

---

96. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/mesh/discovery.ts:9
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

7: // ─── Constants ─────────────────────────────────────────────────
8: 
9: const MDNS_MULTICAST_ADDR = "224.0.0.251";
10: const MDNS_PORT = 5353;
11: const KCODE_SERVICE_TYPE = "_kcode-mesh._tcp";
12: const ANNOUNCE_INTERVAL_MS = 30_000; // Re-announce every 30s

Verification: Verification skipped — static-only mode

Fix template: Move to configuration file or environment variable.

---

97. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/mesh/node.ts:290
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

288:       nodeId: this.nodeId,
289:       hostname: this.hostname,
290:       ip: "127.0.0.1",
291:       port: this.settings.port,
292:       capabilities: { ...this.capabilities },
293:       status: this._status === "running" ? "online" : "offline",

Verification: Verification skipped — static-only mode

Fix template: Move to configuration file or environment variable.

---

98. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697

File: src/core/project-templates.ts:155
Severity: LOW
Pattern: js-013-loose-equality

Why this matters:
The == operator performs type coercion, leading to surprising results: '' == false, 0 == '', null == undefined. This causes subtle bugs in conditionals.

Code:

153:     postCreate: "python -m venv venv && source venv/bin/activate && pip install fastapi uvicorn",
154:     files: {
155:       "main.py": `from fastapi import FastAPI\n\napp = FastAPI(title="{{name}}")\n\n@app.get("/health")\ndef health():\n    return {"status": "ok"}\n\n@app.get("/api/hello")\ndef hello(name: str = "world"):\n    return {"message": f"Hello, {name}!"}\n\nif __name__ == "__main__":\n    import uvicorn\n    uvicorn.run(app, host="0.0.0.0", port=10080)\n`,
156:       "requirements.txt": "fastapi>=0.115.0\nuvicorn>=0.34.0\n",
157:       ".gitignore": "venv/\n__pycache__/\n*.pyc\n.env\n",
158:     },

Verification: Verification skipped — static-only mode

Fix template: Use === for strict equality, or == null specifically for null/undefined checks.

---

99. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/project-templates.ts:155
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

153:     postCreate: "python -m venv venv && source venv/bin/activate && pip install fastapi uvicorn",
154:     files: {
155:       "main.py": `from fastapi import FastAPI\n\napp = FastAPI(title="{{name}}")\n\n@app.get("/health")\ndef health():\n    return {"status": "ok"}\n\n@app.get("/api/hello")\ndef hello(name: str = "world"):\n    return {"message": f"Hello, {name}!"}\n\nif __name__ == "__main__":\n    import uvicorn\n    uvicorn.run(app, host="0.0.0.0", port=10080)\n`,
156:       "requirements.txt": "fastapi>=0.115.0\nuvicorn>=0.34.0\n",
157:       ".gitignore": "venv/\n__pycache__/\n*.pyc\n.env\n",
158:     },

Verification: Verification skipped — static-only mode

Fix template: Move to configuration file or environment variable.

---

100. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697

File: src/core/push-notifications.ts:48
Severity: LOW
Pattern: js-013-loose-equality

Why this matters:
The == operator performs type coercion, leading to surprising results: '' == false, 0 == '', null == undefined. This causes subtle bugs in conditionals.

Code:

46:   let padded = str.replace(/-/g, "+").replace(/_/g, "/");
47:   const mod = padded.length % 4;
48:   if (mod === 2) padded += "==";
49:   else if (mod === 3) padded += "=";
50:   return Buffer.from(padded, "base64");
51: }

Verification: Verification skipped — static-only mode

Fix template: Use === for strict equality, or == null specifically for null/undefined checks.

---

101. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/request-builder.ts:303
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

301:   const isLocalModel =
302:     apiBase.includes("localhost") ||
303:     apiBase.includes("127.0.0.1") ||
304:     apiBase.startsWith("http://[::1]");
305:   const toolOverhead = estimateToolDefinitionTokens(tools, profileToolFilter ?? undefined);
306:   if ((isLocalModel || toolOverhead > contextWindow * 0.15) && !profileToolFilter) {

Verification: Verification skipped — static-only mode

Fix template: Move to configuration file or environment variable.

---

102. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697

File: src/core/semantic-guards.ts:52
Severity: LOW
Pattern: js-013-loose-equality

Why this matters:
The == operator performs type coercion, leading to surprising results: '' == false, 0 == '', null == undefined. This causes subtle bugs in conditionals.

Code:

50:   const added = newCount - oldCount;
51: 
52:   // Check: did the old string compensate by having `cmp(...) == 0` that the
53:   // new string converted to `!cmp(...)`? That's a stylistic change, not an
54:   // inversion. Look for `(str|wcs|...)cmp\([^)]*\)\s*==\s*0` pattern in old.
55:   const cmpEqZeroRegex =

Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file)

Fix template: Use === for strict equality, or == null specifically for null/undefined checks.

---

103. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697

File: src/core/system-prompt-layers.ts:151
Severity: LOW
Pattern: js-013-loose-equality

Why this matters:
The == operator performs type coercion, leading to surprising results: '' == false, 0 == '', null == undefined. This causes subtle bugs in conditionals.

Code:

149: - "no bugs found" when you read fewer than 10 files
150: - Findings with "Status: Requires runtime testing" — if you couldn't verify it, DON'T list it
151: - Speculative/defensive bugs ("what if a listener isn't deregistered", "if neutral == min this would divide by zero") — these are architectural suggestions, not verified bugs. Only list bugs you can point to in actual code paths that WILL execute.
152: - Marketing language of any kind
153: - A final "Verdict" or "Conclusion" that grades the code as safe/approved/ready — just list the findings and stop. The user decides if the code is ready.
154: - Multiple report files. ONE file only: \`AUDIT_REPORT.md\`. Never also create FIXES_SUMMARY.txt, AUDIT_INDEX.md, REMEDIATION_FIXES.md, README_AUDIT.txt, FIXES_APPLIED.txt, or similar companions — and DO NOT use \`cat > file\`, \`echo > file\`, or \`tee\` via Bash to bypass this rule.

Verification: Verification skipped — static-only mode

Fix template: Use === for strict equality, or == null specifically for null/undefined checks.

---

104. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/core/system-prompt.ts:107
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

105:     const isLocal =
106:       apiBase.includes("localhost") ||
107:       apiBase.includes("127.0.0.1") ||
108:       apiBase.startsWith("http://[::1]");
109:     if (isLocal && userMessage) {
110:       try {

Verification: Verification skipped — static-only mode

Fix template: Move to configuration file or environment variable.

---

105. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697

File: src/core/training/fine-tuner.ts:254
Severity: LOW
Pattern: js-013-loose-equality

Why this matters:
The == operator performs type coercion, leading to surprising results: '' == false, 0 == '', null == undefined. This causes subtle bugs in conditionals.

Code:

252:     model_name=BASE_MODEL,
253:     max_seq_length=4096,
254:     load_in_4bit=(QUANT == "4bit"),
255: )
256: 
257: print(f"Applying LoRA (rank={LORA_RANK})")

Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file)

Fix template: Use === for strict equality, or == null specifically for null/undefined checks.

---

106. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697

File: src/core/updater.ts:32
Severity: LOW
Pattern: js-013-loose-equality

Why this matters:
The == operator performs type coercion, leading to surprising results: '' == false, 0 == '', null == undefined. This causes subtle bugs in conditionals.

Code:

30:  * Compare two semver strings. Returns:
31:  *  -1 if a < b
32:  *   0 if a == b
33:  *   1 if a > b
34:  */
35: function compareSemver(a: string, b: string): number {

Verification: Verification skipped — static-only mode

Fix template: Use === for strict equality, or == null specifically for null/undefined checks.

---

107. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/index.ts:1288
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

1286:         if (
1287:           hostname === "localhost" ||
1288:           hostname === "127.0.0.1" ||
1289:           hostname === "::1" ||
1290:           hostname.startsWith("169.254.") ||
1291:           hostname.startsWith("10.") ||

Verification: Verification skipped — static-only mode

Fix template: Move to configuration file or environment variable.

---

108. 🟢 Hardcoded IP address or internal URL — CWE-798

File: src/web/types.ts:79
Severity: LOW
Pattern: uni-001-hardcoded-ip

Why this matters:
Hardcoded IP addresses make the code environment-dependent and may expose internal infrastructure.

Code:

77: export const DEFAULT_WEB_CONFIG: WebServerConfig = {
78:   port: 19300,
79:   host: "127.0.0.1",
80:   auth: {
81:     enabled: true,
82:     token: crypto.randomUUID(),

Verification: Verification skipped — static-only mode

Fix template: Move to configuration file or environment variable.

---

Methodology

This audit was produced by the KCode audit engine: a deterministic pattern library scanned the project for known-dangerous code patterns, then every candidate was verified against the actual execution path. Findings listed here are only those where the execution path was confirmed.

Pattern library version: 1.0 — patterns derived from real bugs found in production C/C++ codebases (network I/O, USB/HID decoders, resource lifecycle, integer arithmetic).

---

Generated by KCode — Astrolexis.space

---

Astrolexis.space — Kulvex Code