Audit findings: hidden political bias in CII scores, formula opacity, and security defects

[tg12]

What this is

This is a summary of a full audit of this codebase, posted because this project has 8,700+ forks and the methodology issues documented below affect every deployment. This is not a complaint about code quality — it is a record that the core product claims are not supported by what the code actually does.

Canonical issue: #3726
Full programme context: https://labs.jamessawyer.co.uk/ai-slop-intelligence-dashboards/

---

Five documented defects

1. Hidden country event multipliers (up to 10×) in CII scores — #3722

The Combined Intelligence Index applies per-country multipliers that are never shown to users. North Korea events score 10x higher than identical US events (KP=3.0, US=0.3). China events score 8x higher than Ukraine events (CN=2.5, UA=0.8). These are political judgments in code presented as objective intelligence.

2. Score floor hard-coded at 15, scale compressed to 15-85 — #3725

Math.min(100, Math.round((weightedSum / totalWeight) * 0.7 + 15)) — the +15 offset means it is impossible to score below 15. Users see a number out of 100 with no indication the bottom 15% is unreachable.

3. MCP proxy accessible without authentication — #3723

isDisallowedOrigin() returns false when no Origin header is present, so any curl request bypasses the CORS gate entirely and can proxy calls to any external MCP server.

4. LLM prompt injection via news headline path — #3724

Most headline paths use sanitizeHeadline() (structural only), which by design preserves phrases like "Ignore previous instructions". The sanitizer's own docs say it is "inherently bypassable" and requires additional controls. None are present.

5. Rate limiter trusts X-Forwarded-For despite comment saying not to — #3721

The fallback IP source for rate limiting is x-forwarded-for — client-settable and trivially spoofed — despite a comment in the same file that reads: "x-forwarded-for is client-settable and MUST NOT be trusted for rate limiting."

---

For fork maintainers

If you have deployed a fork of this project, the risk scores your users see are shaped by hardcoded multipliers that encode undisclosed political assumptions. Users making operational decisions based on these scores cannot reproduce or audit the outputs. The security issues (#3721, #3723) affect any deployment that is publicly reachable.

Full documentation: https://labs.jamessawyer.co.uk/ai-slop-intelligence-dashboards/