security: 9 Critical/High panic-attack findings need human triage (Track C)

[hyperpolymath]

panic-attack estate sweep — Track C tracking issue

panic-attack assail flagged the findings below in this repo on 2026-05-26. They are aggregated here for human triage rather than as individual PRs because each requires judgement (supply-chain pin choice, schema-design call, mutation-test gap, etc.).

PA001/PA007 UnsafeCode/UnsafeFFI findings are NOT in this list. Findings already suppressed in audits/assail-classifications.a2ml are also excluded.

Estate tracker: hyperpolymath/panic-attack#32.

CryptoMisuse (2 findings)

file:line list

Critical  ssg-fixes/poly-ssg/engines/milk-ssg/milk-ssg.py:?  Timing-unsafe == comparison on 'key'-named variable in ssg-fixes/poly-ssg/engines/milk-ssg/milk-ssg.py — use hmac.compare_digest()

### `DynamicCodeExecution` (3 findings)

file:line list

Critical  variants/saur/tests/security_test.js:?  eval() usage in variants/saur/tests/security_test.js
Critical  variants/macrauchenia/tests/security/validation_test.js:?  eval() usage in variants/macrauchenia/tests/security/validation_test.js

### `HardcodedSecret` (1 findings)

file:line list

### `SupplyChain` (1 findings)

file:line list

### `UnboundedAllocation` (2 findings)

file:line list

Critical  implementations/wokelang/src/content.rs:?  Potential unbounded allocation pattern detected in implementations/wokelang/src/content.rs

---

🤖 Discovered during the panic-attack estate sweep (2026-05-26). See hyperpolymath/panic-attack#32 for campaign tracker.