v0.13.0 — AI Review Rewrite + PDF Export

AI Review Rewrite

• Model: switched from gemma3:12b to qwen2.5-coder:14b (benchmarked 4 models)
  • Malicious code: 0/10 score, 100% confidence (gemma gave 2/10, 95%)
  • Safe code: 9/10 score, 95% confidence (gemma gave 5/10, 50%)
• Single-step prompt: was 2-step (analysis → JSON conversion) which lost file paths and context
• System prompt: now used for Ollama (was only used for public API)
• No duplicate findings: AI findings that repeat static analysis are filtered
• No fabricated findings: prompt explicitly forbids repeating/inventing issues

PDF Export

• New /api/report/{id}/pdf endpoint
• PDF button in report modal (next to CSV and HTML)
• DejaVu Unicode font on Alpine, Helvetica fallback elsewhere

Bug Fixes

• Findings display: HTML in code field (e.g. innerHTML = '<div...') was parsed as DOM, hiding subsequent findings — all fields now HTML-escaped
• HTML export: same escape fix applied
• XSS hardening: onclick handlers use JSON.stringify() instead of manual escaping

AI Benchmark Results

Model	Time	Score (malicious)	Coverage	Confidence
gemma3:12b	33.8s	2/10	3/4	95%
qwen2.5-coder:14b	188s	0/10	4/4	100%
qwen3:14b	48.7s	1/10	3/4	95%
deepseek-coder-v2:16b	77.8s	4/10	4/4	70%