security: 10 Critical/High panic-attack findings need human triage (Track C)

[hyperpolymath]

panic-attack estate sweep — Track C tracking issue

panic-attack assail flagged the findings below in this repo on 2026-05-26. They are aggregated here for human triage rather than as individual PRs because each requires judgement (supply-chain pin choice, schema-design call, mutation-test gap, etc.).

PA001/PA007 UnsafeCode/UnsafeFFI findings are NOT in this list. Findings already suppressed in audits/assail-classifications.a2ml are also excluded.

Estate tracker: hyperpolymath/panic-attack#32.

DynamicCodeExecution (3 findings)

file:line list

High  assets/js/hooks/evidence_graph_hook.js:?  DOM manipulation (innerHTML/document.write) in assets/js/hooks/evidence_graph_hook.js
High  assets/js/hooks/timeline_hook.js:?  DOM manipulation (innerHTML/document.write) in assets/js/hooks/timeline_hook.js

### `HardcodedSecret` (6 findings)

file:line list

Critical  config/dev.exs:?  Possible hardcoded secret in config/dev.exs
Critical  test/evidence_graph/accounts_test.exs:?  Possible hardcoded secret in test/evidence_graph/accounts_test.exs
Critical  lib/evidence_graph/zotero/client.ex:?  Possible hardcoded secret in lib/evidence_graph/zotero/client.ex
Critical  lib/evidence_graph/accounts.ex:?  Possible hardcoded secret in lib/evidence_graph/accounts.ex
Critical  lib/evidence_graph/lithoglyph/client.ex:?  Possible hardcoded secret in lib/evidence_graph/lithoglyph/client.ex

### `SupplyChain` (1 findings)

file:line list

---

🤖 Discovered during the panic-attack estate sweep (2026-05-26). See hyperpolymath/panic-attack#32 for campaign tracker.