Security, Code Quality & Performance Audit of OpenMCT Using Claude Code (AI-Assisted Review)

[swenger287]

---

AI-Assisted Security & Code Quality Audit of OpenMCT

I recently used [[Claude Code](https://claude.ai/code)](https://claude.ai/code) (Anthropic's CLI-based AI coding agent) to perform a comprehensive audit of the OpenMCT codebase covering security vulnerabilities, code quality issues, and performance concerns. I wanted to share both the methodology and findings with the community.

How I Did It

Tool: Claude Code (powered by Claude Opus 4.6), running locally on my machine.

Methodology:

1. Asked Claude Code to review the repository at https://github.com/nasa/openmct
2. Claude Code cloned the repo locally, then spawned three parallel analysis agents — each focused on a different domain:
   • Security audit agent — searched for XSS sinks (v-html, innerHTML, eval), prototype pollution, injection risks, unsafe JSON.parse, CORS misconfigurations, and unvalidated message passing
   • Code quality agent — searched for Vue anti-patterns, memory leaks, error handling gaps, legacy patterns, and missing test coverage
   • Performance agent — analyzed rendering efficiency, data handling at scale, polling patterns, and bundle size concerns
3. Each agent used pattern-matching (grep/glob), file reads, and contextual analysis to trace data flows and identify real issues with specific file paths and line numbers
4. Claude Code compiled the parallel results into a single prioritized report

The entire process took roughly 10 minutes from prompt to final report. I initially prompted it as a C++ review (my mistake — I was confusing it with another NASA repo), and Claude Code corrected me that OpenMCT is JavaScript/Vue.js before proceeding with the appropriate analysis.

---

Security Findings

S1. XSS via v-html in TextHighlight Component — High

File: src/utils/textHighlight/TextHighlight.vue:48-59

Both this.text and this.highlight are interpolated directly into raw HTML with no escaping. If search text or content names contain HTML characters like <img onerror=...>, the markup is injected as-is. The regex on line 55 also constructs a pattern from unescaped user input, which can break the regex or enable injection.

Current code:

highlightedText() {
  const highlight = this.highlight;
  const normalCharsRegex = /^[^A-Za-z0-9]+$/g;
  const newHighLight = normalCharsRegex.test(highlight) ? `\\${highlight}` : highlight;
  const highlightRegex = new RegExp(`(?<!<[^>]*)(${newHighLight})`, 'gi');
  const replacement = `<span class="${this.highlightClass}">${highlight}</span>`;
  return this.text.replace(highlightRegex, replacement);
}

Recommended fix — escape HTML entities before interpolation and use a proper regex-escape utility:

highlightedText() {
  const highlight = this.highlight;
  if (!highlight) {
    return this.escapeHtml(this.text);
  }

  // Properly escape for use in RegExp (all special chars, not just non-alphanumeric)
  const escapedHighlight = highlight.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
  const highlightRegex = new RegExp(`(${escapedHighlight})`, 'gi');

  // Escape the base text first, then wrap matches in highlight spans
  const escapedText = this.escapeHtml(this.text);
  const escapedHighlightText = this.escapeHtml(highlight);
  const replacement = `<span class="${this.highlightClass}">${escapedHighlightText}</span>`;

  return escapedText.replace(highlightRegex, replacement);
},
methods: {
  escapeHtml(str) {
    const div = document.createElement('div');
    div.appendChild(document.createTextNode(str));
    return div.innerHTML;
  }
}

---

S2. CouchDB CORS Wildcard Origin with Credentials — High

File: src/plugins/persistence/couch/setup-couchdb.sh:59-60

The setup script sets origins: * AND credentials: true. Per the Fetch specification, Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true is forbidden by browsers, but some CouchDB versions may serve it in a way that older or misconfigured clients accept. More importantly, if an operator changes this to a broad pattern later, the credentials: true is already in place.

Current code:

curl ... /_config/cors/origins -d '"*"'
curl ... /_config/cors/credentials -d '"true"'

Recommended fix — use an environment variable for the allowed origin and default to a safe value:

OPENMCT_ORIGIN="${OPENMCT_ORIGIN:-http://localhost:8080}"

enable_cors() {
    curl -su "${CURL_USERPASS_ARG}" -o /dev/null -X PUT \
      "$COUCH_BASE_LOCAL"/_node/"$COUCH_NODE_NAME"/_config/httpd/enable_cors -d '"true"'
    curl -su "${CURL_USERPASS_ARG}" -o /dev/null -X PUT \
      "$COUCH_BASE_LOCAL"/_node/"$COUCH_NODE_NAME"/_config/cors/origins -d "\"$OPENMCT_ORIGIN\""
    curl -su "${CURL_USERPASS_ARG}" -o /dev/null -X PUT \
      "$COUCH_BASE_LOCAL"/_node/"$COUCH_NODE_NAME"/_config/cors/credentials -d '"true"'
    curl -su "${CURL_USERPASS_ARG}" -o /dev/null -X PUT \
      "$COUCH_BASE_LOCAL"/_node/"$COUCH_NODE_NAME"/_config/cors/methods -d '"GET, PUT, POST, HEAD, DELETE"'
    curl -su "${CURL_USERPASS_ARG}" -o /dev/null -X PUT \
      "$COUCH_BASE_LOCAL"/_node/"$COUCH_NODE_NAME"/_config/cors/headers \
      -d '"accept, authorization, content-type, origin, referer, x-csrf-token"'
}

---

S3. Unprotected JSON.parse on External Data — High

Multiple locations parse external data (SSE events, drag/drop payloads, localStorage) without try/catch. A malformed payload will throw an unhandled exception and crash the component or worker.

File	Line	Data Source
CouchChangesFeed.js	63	CouchDB SSE event.data
CouchObjectProvider.js	663	CouchDB SSE event.data
DisplayLayout.vue	437	Drag/drop dataTransfer
NotebookEntry.vue	569	Drag/drop dataTransfer
Browse.js	158	window.localStorage
notebook-storage.js	56	window.localStorage

Example — current code in CouchChangesFeed.js:59-68:

self.onCouchMessage = function (event) {
    self.updateCouchStateIndicator();
    const objectChanges = JSON.parse(event.data);   // 💥 unguarded
    connections.forEach(function (connection) {
      connection.postMessage({ objectChanges });
    });
};

Recommended fix:

self.onCouchMessage = function (event) {
    self.updateCouchStateIndicator();
    let objectChanges;
    try {
      objectChanges = JSON.parse(event.data);
    } catch (e) {
      console.error('Failed to parse CouchDB change event:', e);
      return;
    }
    connections.forEach(function (connection) {
      connection.postMessage({ objectChanges });
    });
};

Same pattern should be applied to all 6 locations listed above. For DisplayLayout.vue:437 and NotebookEntry.vue:569, wrap the JSON.parse in try/catch and show an openmct.notifications.error() on failure.

---

S4. Incomplete Prototype Pollution Defense — Medium

File: src/utils/sanitization.js

The filter__proto__ reviver correctly strips __proto__ keys during JSON.parse, but it is only used in 3 of 60+ JSON.parse call sites (specifically: ImportFromJSONAction.js:77, LocalStorageObjectProvider.js:92).

Current usage is sparse:

// Only used here:
const objectTree = JSON.parse(jsonTree, filter__proto__);            // ImportFromJSONAction.js
return JSON.parse(this.getSpace(), filter__proto__);                  // LocalStorageObjectProvider.js

Recommended fix — create a safe parse utility and use it project-wide:

// src/utils/sanitization.js
function filter__proto__(key, value) {
  if (key !== '__proto__') {
    return value;
  }
}

function safeParse(jsonString, reviver) {
  const composedReviver = reviver
    ? (key, value) => {
        const filtered = filter__proto__(key, value);
        return filtered !== undefined ? reviver(key, filtered) : undefined;
      }
    : filter__proto__;
  return JSON.parse(jsonString, composedReviver);
}

export { filter__proto__, safeParse };

Then adopt safeParse in CouchChangesFeed.js:63, CouchObjectProvider.js:663, DisplayLayout.vue:437, NotebookEntry.vue:569, notebook-storage.js:56, Browse.js:158, and other locations that parse external input.

---

S5. mathjs evaluate() on User Expressions — Medium

File: src/plugins/comps/CompsMathWorker.js:125

User-defined mathematical expressions are passed directly to mathjs.evaluate(). While mathjs provides a sandboxed parser, it has had historical sandbox-escape CVEs. The expression is user-authored configuration data.

Current code:

const rawComputedValue = evaluate(expression, scope);

Recommended fix — use math.compile() + restrict to a limited function set:

import { create, all } from 'mathjs';

const math = create(all);

// Whitelist safe functions only
const ALLOWED_FUNCTIONS = new Set([
  'add', 'subtract', 'multiply', 'divide', 'pow', 'sqrt',
  'abs', 'ceil', 'floor', 'round', 'min', 'max', 'mean',
  'log', 'log2', 'log10', 'exp', 'sin', 'cos', 'tan'
]);

function safeEvaluate(expression, scope) {
  const node = math.parse(expression);

  // Walk the AST and reject calls to non-whitelisted functions
  node.traverse((node) => {
    if (node.type === 'FunctionNode' && !ALLOWED_FUNCTIONS.has(node.fn.name)) {
      throw new Error(`Function "${node.fn.name}" is not permitted`);
    }
  });

  const compiled = node.compile();
  return compiled.evaluate(scope);
}

---

S6. No Origin Validation on SharedWorker Messages — Medium

Files: InMemorySearchWorker.js:41, CouchChangesFeed.js:14, CompsMathWorker.js:7

SharedWorkers accept messages from any page on the same origin. Any tab on the same domain (e.g., a compromised or malicious page on the same host) can send commands to these workers.

Current code (InMemorySearchWorker.js):

port.onmessage = function (event) {
  if (event.data.type === 'search') {
    port.postMessage(searchForObjects(event.data));
  }
  // ... no validation of event source
};

Recommended fix — validate message structure with a type guard:

const VALID_MESSAGE_TYPES = new Set(['search', 'searchForAnnotations', 'searchForTags', 'index']);

port.onmessage = function (event) {
  if (!event.data || !VALID_MESSAGE_TYPES.has(event.data.type)) {
    console.warn('Rejected invalid message to search worker:', event.data?.type);
    return;
  }
  // ... process message
};

---

S1a. Notebook Markdown Rendering — Mitigated (Informational)

Upon deeper inspection, NotebookEntry.vue:446-448 does pass marked output through sanitize-html with a strict allowlist (SANITIZATION_SCHEMA at line 165). This properly mitigates XSS from markdown. The initial scan flagged the innerHTML usage but the sanitization pipeline is present. Credit to the team for this defense.

However, the eslint-disable vue/no-v-html at line 1 suppresses the linter for the entire file. Consider scoping it to only the specific line that needs it.

---

Code Quality Findings

Q1. Monolithic Components — High

File	Lines	Concern
src/plugins/plot/MctPlot.vue	1,929	Handles rendering, zoom, drag, selection, annotations, keyboard, data loading in one file
src/plugins/imagery/components/ImageryView.vue	1,458	Handles images, zoom, thumbnails, annotations, keyboard, duration tracking in one file

Recommended fix — extract into Vue composables:

// src/plugins/plot/composables/useZoom.js
import { ref } from 'vue';

export function useZoom(plotConfig) {
  const isZooming = ref(false);
  const zoomHistory = ref([]);

  function startZoom(event) { /* extracted from MctPlot.vue */ }
  function endZoom(event) { /* ... */ }
  function resetZoom() { /* ... */ }

  return { isZooming, zoomHistory, startZoom, endZoom, resetZoom };
}

// Similarly create: useAnnotation.js, useKeyboardNav.js, usePlotSelection.js
// Then in MctPlot.vue setup():
// const { isZooming, startZoom, endZoom } = useZoom(config);

---

Q2. Tight Coupling via $parent.$refs — High

File: src/plugins/plot/MctPlot.vue — lines 639, 645, 650, 661, 683, 979, 1906

7+ references to this.$parent.$refs.plotWrapper, creating fragile coupling to parent internals.

Current code (line 639 and similar):

const wrapper = this.$parent.$refs.plotWrapper;

Recommended fix — use provide/inject:

// In parent (StackedPlot.vue or wherever plotWrapper lives):
import { provide, ref } from 'vue';
const plotWrapper = ref(null);
provide('plotWrapper', plotWrapper);

// In MctPlot.vue:
import { inject } from 'vue';
const plotWrapper = inject('plotWrapper');

---

Q3. Memory Leak — Anonymous Event Listener in ImageryTimeView — High

File: src/plugins/imagery/components/ImageryTimeView.vue:415

Anonymous arrow function passed to addEventListener — can never be removed. These wrappers are created dynamically per image.

Current code:

imageWrapper.addEventListener('mousedown', (e) => {
  if (e.button === 0) {
    this.expand(image.time);
  }
});

Recommended fix — use event delegation on the parent container instead of per-element listeners:

// In mounted(), one listener on the container:
this.$refs.imageContainer.addEventListener('mousedown', this.handleImageClick);

// In methods:
handleImageClick(e) {
  const wrapper = e.target.closest('.image-wrapper');
  if (wrapper && e.button === 0) {
    const time = wrapper.dataset.time;
    this.expand(time);
  }
},

// In beforeUnmount():
this.$refs.imageContainer.removeEventListener('mousedown', this.handleImageClick);

When building image wrappers, add data-time attribute:

imageWrapper.dataset.time = image.time;

---

Q4. Memory Leak — FileInput Missing Cleanup — High

File: src/api/forms/components/controls/FileInput.vue:79-81

addEventListener in mounted() with no corresponding unmounted() hook.

Current code:

mounted() {
  this.$refs.fileInput.addEventListener('change', this.handleFiles, false);
},
// ← no unmounted hook

Recommended fix:

mounted() {
  this.$refs.fileInput.addEventListener('change', this.handleFiles, false);
},
unmounted() {
  this.$refs.fileInput?.removeEventListener('change', this.handleFiles, false);
},

---

Q5. Memory Leak — NotebookSnapshotIndicator Missing Cleanup — High

File: src/plugins/notebook/components/NotebookSnapshotIndicator.vue:69-76

Event subscription and setTimeout created in mounted() with no cleanup on unmount.

Current code:

mounted() {
  this.snapshotContainer.on(EVENT_SNAPSHOTS_UPDATED, this.snapshotsUpdated);
  this.updateSnapshotIndicatorTitle();
},
// ← no beforeUnmount hook

Recommended fix:

mounted() {
  this.snapshotContainer.on(EVENT_SNAPSHOTS_UPDATED, this.snapshotsUpdated);
  this.updateSnapshotIndicatorTitle();
},
beforeUnmount() {
  this.snapshotContainer.off(EVENT_SNAPSHOTS_UPDATED, this.snapshotsUpdated);
  if (this._notifyTimeout) {
    clearTimeout(this._notifyTimeout);
  }
},
methods: {
  notifyNewSnapshot() {
    this.flashIndicator = true;
    this._notifyTimeout = setTimeout(this.removeNotify, 15000);
  },
  // ...
}

---

Q6. Unbounded Recursive setTimeout in MctTree — High

File: src/ui/layout/MctTree.vue:958-994

calculateHeights() returns a Promise that recursively calls setTimeout(checkHeights, 100) until DOM conditions are met. There is no maximum retry count, no reject path, and no component unmount guard. If the component is destroyed while polling, this loops forever and the promise never settles.

Current code:

calculateHeights() {
  const RECHECK = 100;
  return new Promise((resolve, reject) => {
    let checkHeights = () => {
      if (/* DOM conditions met */) {
        resolve();
      } else {
        setTimeout(checkHeights, RECHECK);  // ← infinite loop if never met
      }
    };
    checkHeights();
  });
}

Recommended fix:

calculateHeights() {
  const RECHECK = 100;
  const MAX_RETRIES = 50; // 5 seconds max

  return new Promise((resolve, reject) => {
    let retries = 0;
    let timeoutId;

    const checkHeights = () => {
      if (this.isDestroyed) {
        reject(new Error('Component destroyed before layout complete'));
        return;
      }

      if (retries++ > MAX_RETRIES) {
        reject(new Error('calculateHeights timed out'));
        return;
      }

      let treeTopMargin = this.getElementStyleValue(this.$refs.mainTree, 'marginTop');
      if (this.$el && this.$refs.search && this.$refs.mainTree &&
          this.$refs.treeContainer && this.$refs.dummyItem &&
          this.$el.offsetHeight !== 0 && treeTopMargin > 0) {
        // ... set values ...
        resolve();
      } else {
        timeoutId = setTimeout(checkHeights, RECHECK);
      }
    };

    this._calculateHeightsTimeout = timeoutId;
    checkHeights();
  });
},

// In beforeUnmount:
beforeUnmount() {
  this.isDestroyed = true;
  if (this._calculateHeightsTimeout) {
    clearTimeout(this._calculateHeightsTimeout);
  }
}

---

Q7. Promise Constructor Anti-Patterns — Medium

File: src/api/objects/Transaction.js:78-89

Wraps action() (which already returns a Promise) inside new Promise() — the classic unnecessary Promise constructor.

Current code:

createDirtyObjectPromise(object, action, ...args) {
  return new Promise((resolve, reject) => {
    action(object, ...args)
      .then((success) => {
        const key = this.objectAPI.makeKeyString(object.identifier);
        delete this.dirtyObjects[key];
        resolve(success);
      })
      .catch(reject);
  });
}

Recommended fix:

async createDirtyObjectPromise(object, action, ...args) {
  const success = await action(object, ...args);
  const key = this.objectAPI.makeKeyString(object.identifier);
  delete this.dirtyObjects[key];
  return success;
}

File: src/api/Editor.js:69-87 — same pattern.

Current code:

cancel() {
  this.editing = false;
  this.emit('isEditing', false);
  return new Promise((resolve, reject) => {
    const transaction = this.openmct.objects.getActiveTransaction();
    if (!transaction) {
      return resolve();
    }
    transaction.cancel().then(resolve).catch(reject).finally(() => {
      this.openmct.objects.endTransaction();
    });
  });
}

Recommended fix:

async cancel() {
  this.editing = false;
  this.emit('isEditing', false);
  const transaction = this.openmct.objects.getActiveTransaction();
  if (!transaction) {
    return;
  }
  try {
    await transaction.cancel();
  } finally {
    this.openmct.objects.endTransaction();
  }
}

---

Q8. Swallowed Errors — Medium

File: src/plugins/persistence/couch/CouchObjectProvider.js:579

} catch (e) {
  //do nothing
}

File: src/plugins/inspectorViews/styles/SavedStyleSelector.vue:141

.catch(() => {});

Recommended fix for CouchObjectProvider.js:

} catch (e) {
  console.error('Failed to parse CouchDB response:', e);
}

Recommended fix for SavedStyleSelector.vue — distinguish cancellation from error:

.catch((error) => {
  if (error !== 'dialogCancelled') {
    console.error('Failed to delete style:', error);
  }
});

---

Q9. Missing Test Coverage for Critical Plugins — Medium

Plugin Directory	Test Files	Concern
src/plugins/comps/	0	Computed telemetry — processes and transforms real-time data
src/plugins/events/	0	Event timeline — displays mission events

Recommended: Add at minimum unit tests for CompsMathWorker.js (expression evaluation), CompsTelemetryProvider.js (subscription lifecycle), and the events plugin rendering logic.

---

Q10. Legacy SummaryWidget Architecture — Medium

Directory: src/plugins/summaryWidget/src/

The entire plugin uses pre-ES6 patterns: constructor functions with .prototype methods, manual DOM manipulation, const self = this. Architecturally inconsistent with the rest of the Vue 3 / ES6+ codebase.

Example from Condition.js:197:

inputArea.innerHTML = '';

Recommended: Refactor incrementally to ES6 classes and Vue components when touching this module, consistent with the rest of the codebase.

---

Performance Findings

P1. No Virtual Scrolling for Telemetry Tables — High

File: src/plugins/telemetryTable/collections/TableRowCollection.js:176-178

Grep for "virtual scroll" returns zero results. Telemetry table rows are pushed into arrays and all visible rows are rendered to the DOM. Under high data rates (thousands of parameters/sec), this causes severe DOM thrashing.

Recommended fix — implement a virtual scroller that only renders visible rows:

// In TableComponent.vue, replace the full row render with a windowed approach:
computed: {
  visibleRows() {
    const startIndex = Math.floor(this.scrollTop / this.rowHeight);
    const endIndex = Math.min(
      startIndex + Math.ceil(this.viewportHeight / this.rowHeight) + this.overscan,
      this.allRows.length
    );
    return this.allRows.slice(startIndex, endIndex);
  },
  totalHeight() {
    return this.allRows.length * this.rowHeight;
  },
  offsetY() {
    return Math.floor(this.scrollTop / this.rowHeight) * this.rowHeight;
  }
}

// Template:
// <div :style="{ height: totalHeight + 'px', position: 'relative' }">
//   <div :style="{ transform: `translateY(${offsetY}px)` }">
//     <tr v-for="row in visibleRows" :key="row.objectKeyString + row.datum.timestamp">
//       ...
//     </tr>
//   </div>
// </div>

---

P2. setInterval Polling Instead of ResizeObserver — Medium

File: src/plugins/telemetryTable/components/SizingRow.vue:61

Polls element height every 300ms via setInterval. Similar pattern in MctPlot.vue:681.

Current code:

pollForRowHeight() {
  this.clearPoll();
  this.pollID = window.setInterval(this.heightPoll, 300);
},
heightPoll() {
  let height = this.$el.offsetHeight;
  if (height !== this.height) {
    this.$emit('change-height', height);
    this.height = height;
  }
}

Recommended fix:

mounted() {
  this.resizeObserver = new ResizeObserver((entries) => {
    for (const entry of entries) {
      const height = entry.contentRect.height;
      if (height !== this.height) {
        this.$emit('change-height', height);
        this.height = height;
      }
    }
  });
  if (this.isEditing) {
    this.resizeObserver.observe(this.$el);
  }
},
unmounted() {
  this.resizeObserver?.disconnect();
}

---

P3. JSON.parse(JSON.stringify()) Deep Cloning — Medium

60+ occurrences across the codebase use this pattern for deep cloning. It blocks the main thread, drops undefined values, and cannot clone Map, Set, Date, or RegExp. The codebase even acknowledges this at InMemorySearchProvider.js:290.

Example (MutableDomainObject.js:77):

const oldModel = JSON.parse(JSON.stringify(this));

Recommended fix — replace with structuredClone() (supported in all target browsers):

const oldModel = structuredClone(this);

Apply project-wide via search-and-replace. For cases where structuredClone doesn't work (e.g., objects with functions), keep JSON.parse(JSON.stringify()) but add a comment explaining why.

---

P4. Full Lodash Import — Low

Files: src/plugins/telemetryTable/TelemetryTable.js:24, src/plugins/notebook/components/NotebookEntry.vue:152, and others.

import _ from 'lodash';     // imports entire 71KB library

Recommended fix:

import debounce from 'lodash/debounce';   // imports only what's needed (~1KB)

The project already has eslint-plugin-you-dont-need-lodash-underscore configured — consider promoting its rules to errors.

---

Positive Finding: BatchingWebSocket

File: src/api/telemetry/BatchingWebSocket.js

This is a well-architected component. WebSocket connection runs in a dedicated Worker, uses requestIdleCallback for back-pressure, has configurable buffer limits (setMaxBufferSize), throttle rate control, and user notification when telemetry is dropped. The VisibilityObserver utility (src/utils/visibility/VisibilityObserver.js) also intelligently pauses requestAnimationFrame when elements are not visible. These are good patterns that other parts of the codebase could learn from.

---

Summary

#	Finding	Category	Severity	Fix Effort
S1	XSS in TextHighlight (unescaped HTML interpolation)	Security	High	Low
S2	CouchDB CORS wildcard + credentials in setup script	Security	High	Low
S3	Unprotected JSON.parse on external data (6+ locations)	Security	High	Low
S4	Incomplete prototype pollution defense (3 of 60+ call sites)	Security	Medium	Medium
S5	mathjs.evaluate() on user expressions	Security	Medium	Medium
S6	No message validation on SharedWorker handlers	Security	Medium	Low
Q1	Monolithic 1900+ line components	Quality	High	High
Q2	$parent.$refs tight coupling (7+ locations)	Quality	High	Medium
Q3	Anonymous event listener leak in ImageryTimeView	Quality	High	Low
Q4	FileInput missing removeEventListener on unmount	Quality	High	Low
Q5	NotebookSnapshotIndicator missing event/timeout cleanup	Quality	High	Low
Q6	Unbounded recursive setTimeout in MctTree	Quality	High	Low
Q7	Promise constructor anti-patterns in Transaction/Editor	Quality	Medium	Low
Q8	Swallowed errors in CouchObjectProvider/SavedStyleSelector	Quality	Medium	Low
Q9	Zero tests for comps and events plugins	Quality	Medium	Medium
Q10	Legacy pre-ES6 SummaryWidget architecture	Quality	Medium	High
P1	No virtual scrolling for telemetry tables	Performance	High	High
P2	setInterval polling vs ResizeObserver	Performance	Medium	Low
P3	60+ JSON.parse(JSON.stringify()) instead of structuredClone	Performance	Medium	Low
P4	Full lodash imports	Performance	Low	Low

Caveats

• This was a static analysis performed by an AI agent. Some findings may be false positives if there are sanitization steps not visible in the source, or runtime protections elsewhere.
• I have not verified these findings through exploitation — this is a read-only audit.
• The initial scan flagged Notebook markdown rendering as XSS, but closer inspection revealed it is properly sanitized via sanitize-html with an allowlist schema (S1a). The AI corrected itself after tracing the full data flow.
• Claude Code does not have access to private deployment configurations, so findings like S2 (CORS) may not reflect production settings.
• The mathjs finding (S5) depends on whether the deployed version has known sandbox-escape CVEs — the library's sandboxing may be sufficient for this use case.

Why Share This

OpenMCT is critical infrastructure used in real mission operations. AI-assisted code review isn't a replacement for human security review, but it can surface issues quickly and at scale. I hope the maintainers and community find this useful as a starting point for further investigation.