Public example›Example SaaS Applicationdraft
Browse findings
Executive overview · Review summary

Code audit review

Start with the highest-risk work, confirm the evidence, then verify each correction.

Finding candidates6

Unique findings linked to captured evidence

Critical + high1

Pending candidates requiring prioritization

Grouped work25

Root-cause tasks instead of repeated occurrences

Coverage14 / 2

Complete capabilities / partial capabilities

1Choose a risk

Start with critical and high items at the top.

2Confirm the evidence

Open the task and inspect the listed files before changing code.

3Fix and verify

Run tests, build, and a new audit before closing the item.

01 · Prioritize

Top risks

Start here. Each row groups evidence that points to the same underlying problem.

  1. 01Configured webhook destination lacks complete SSRF controlsA webhook or destination delivery module sends a dynamic URL without mechanical evidence that private networks are rejected and automatic redirects are disabled. The value may come from stored configuration rather than the current request.high1 finding
  2. 02Outbound destinations are server-owned or safely constrained1 request-derived outbound destination candidate(s) require review.medium1 control
  3. 03Browser security policies are declared and observed1 header policy candidate(s) require review.medium1 control
  4. 04Sensitive entry points validate caller-controlled input75 of 77 sensitive entry point(s) contain a recognized validation call within five explicit call hops.medium1 control
  5. 05Abuse-sensitive routes apply rate limits0 of 11 mapped login, registration, recovery, invitation, verification, checkout, or billing boundary(s) contain a recognized rate-limit operation.medium1 control
  6. 06Webhook side effects resist duplicate delivery0 of 1 mapped webhook/callback boundary(s) contain a recognized idempotency claim or event-recording operation.medium1 control
02 · Act

Grouped fix queue

Choose a task to see the problem, affected files, next steps, and completion checks.

0

Apply corrections

Upgrade dependencies, patch source, and add focused tests.

    REMEDIATION QUEUE

    Prioritized work items

    Open a task to understand what was found, where to look, what to do next, and how to verify the result.

    Showing 20 of 25 tasks, ordered by urgency.

    1. highNeeds investigationConfigured webhook destination lacks complete SSRF controls1 finding

      What we found

      A webhook or destination delivery module sends a dynamic URL without mechanical evidence that private networks are rejected and automatic redirects are disabled. The value may come from stored configuration rather than the current request.

      Where to look

      • apps/marketing/src/lib/analytics/webhook-destination.ts

      What to do next

      1. Validate the candidate against its evidence and surrounding source before proposing a change.
      2. Do not suppress, lower severity, or broaden the patch automatically.
      3. Add or update a focused regression test when the behavior can be exercised safely.

      Consider it resolved when

      • A new CodebaseScan scan no longer reports the same issue.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.

      Open supporting evidence →

    2. mediumNeeds verificationOutbound destinations are server-owned or safely constrained1 control

      What we found

      1 request-derived outbound destination candidate(s) require review.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Test untrusted public, private, loopback, metadata, DNS-rebinding, and redirect destinations against the effective egress policy.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    3. mediumNeeds verificationBrowser security policies are declared and observed1 control

      What we found

      1 header policy candidate(s) require review.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Observe representative production responses and verify CSP, frame, MIME, referrer, permissions, and transport policies.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    4. mediumNeeds verificationSensitive entry points validate caller-controlled input1 control

      What we found

      75 of 77 sensitive entry point(s) contain a recognized validation call within five explicit call hops.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Test malformed, oversized, unexpected-type, and boundary input before the sensitive operation.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    5. mediumNeeds verificationAbuse-sensitive routes apply rate limits1 control

      What we found

      0 of 11 mapped login, registration, recovery, invitation, verification, checkout, or billing boundary(s) contain a recognized rate-limit operation.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Burst requests by IP and account identifier, then confirm bounded retries, useful backoff, and no easy key rotation bypass.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    6. mediumNeeds verificationWebhook side effects resist duplicate delivery1 control

      What we found

      0 of 1 mapped webhook/callback boundary(s) contain a recognized idempotency claim or event-recording operation.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Replay the same provider event concurrently and after a failure; confirm one durable effect and safe retry recovery.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    7. mediumNeeds verificationTenant-aware data operations enforce a server-side scope1 control

      What we found

      57 of 77 mapped database boundary(s) in a tenant-aware project contain a recognized tenant scope or explicit authorization decision.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Exercise every operation as two tenants, including list, lookup, update, delete, export, background job, and administrative paths; inspect effective RLS separately.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    8. mediumNeeds verificationClient navigation, storage, and messaging use constrained browser boundaries1 control

      What we found

      1 client navigation, storage, messaging, or new-tab candidate(s) require review.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Exercise untrusted URLs, message origins, storage access after script injection, and external new-tab navigation.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    9. mediumNeeds verificationCookie-authenticated mutations validate request origin or CSRF token1 control

      What we found

      0 of 9 mapped cookie-using sensitive mutation boundary(s) contain a recognized CSRF or origin validation operation.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Send cross-site form, fetch, null-Origin, and sibling-subdomain requests; confirm rejection before the sensitive effect.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    10. mediumNeeds verificationSensitive mutations authenticate a principal1 control

      What we found

      44 of 45 mapped sensitive mutation boundary(s) contain a recognized authentication or authorization fact in applicable middleware or within five explicit call hops.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Test each boundary without a session/token and confirm rejection before the sensitive operation.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    11. mediumNeeds verificationBilling mutations derive charged values on the server1 control

      What we found

      2 billing mutation boundary(s) were mapped; 0 were directly inspected for request-derived price, product, plan, or amount fields.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Tamper with plan, price, product, amount, currency, quantity, discount, and tenant ownership; compare the provider-side charge with the server catalog.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    12. mediumNeeds verificationRecovery and invitation tokens have a bounded lifecycle1 control

      What we found

      1 recovery, invitation, or verification boundary(s) were mapped without a decisive token-generation/storage candidate; atomic one-time use remains unverified.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Test expiry, replay, concurrent redemption, account binding, user enumeration, token disclosure, and invalidation after password or email changes.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    13. mediumNeeds investigationSensitive-shaped value is placed in a URL parameter1 finding

      What we found

      A URL or search-parameter key names credential or personal data. URLs can reach histories, logs, referrers, and monitoring systems.

      Where to look

      • apps/analytics/src/lib/handoff.ts

      What to do next

      1. Validate the candidate against its evidence and surrounding source before proposing a change.
      2. Do not suppress, lower severity, or broaden the patch automatically.
      3. Add or update a focused regression test when the behavior can be exercised safely.

      Consider it resolved when

      • A new CodebaseScan scan no longer reports the same issue.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.

      Open supporting evidence →

    14. mediumNeeds verificationFilesystem paths remain inside server-owned roots1 control

      What we found

      1 filesystem boundary(s) were mapped without enough evidence to prove containment.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Test decoded parent traversal, absolute paths, separators, symlinks, and race conditions against the canonical storage root.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    15. mediumNeeds verificationCross-origin access is intentionally constrained1 control

      What we found

      No effective cross-origin policy was observed; same-origin-only operation is possible but unverified.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Test trusted and untrusted Origin values, credential mode, preflight behavior, and server-side authorization independently.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    16. mediumNeeds verificationSensitive operations emit security-relevant audit events1 control

      What we found

      0 of 77 mapped sensitive boundary(s) contain a recognized audit/security logging call.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Confirm event content, actor, target, outcome, correlation ID, retention, access controls, and alerting in the real logging system.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    17. mediumNeeds verificationResolved dependencies are checked against OSV1 control

      What we found

      1086 resolved dependency record(s) were available; 0 OSV finding(s) are attached.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Review advisory freshness, runtime reachability, exploit preconditions, and supported upgrade paths.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    18. mediumNeeds verificationApproved HTTP response posture is observed1 control

      What we found

      No target URL was explicitly approved for runtime observation.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Probe representative production routes and deployment layers under explicit authorization.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    19. mediumNeeds verificationFile uploads enforce size, content, and storage-path constraints1 control

      What we found

      No decisive upload gap was mapped, but the profiler cannot prove that uploads are absent or fully constrained.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Test byte limits, file count, MIME/content mismatch, polyglots, generated names, traversal, overwrite, and storage execution policy.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.
    20. mediumNeeds verificationRedirect destinations are constrained1 control

      What we found

      93 redirect boundary(s) were mapped without enough evidence to establish the effective destination policy.

      Where to look

      This check spans an application flow; no single file was identified yet.

      What to do next

      1. Test external, scheme-relative, encoded, mixed-case, and userinfo-form destinations against the effective redirect policy.
      2. Preserve missing runtime evidence as unknown.

      Consider it resolved when

      • The expected control has direct evidence.
      • The relevant project tests pass.
      • The production build passes.
      • A fresh CodebaseScan audit completes after the change.

    The complete queue remains available in Agent data.

    03 · Trust boundaries

    Coverage

    Complete, partial, skipped, and unsupported checks remain distinct. Missing coverage never becomes a clean result.

    14 complete · 10 not complete
    10 gaps
    • COMPLETE
      Project structure profile

      Parsed 739 captured TypeScript/JavaScript file(s) as data; mapped 124 entry point(s), 5711 symbol(s), 9590 resolved call edge(s), 1659 security-relevant fact(s), 15 declared component(s), 16 cross-component import edge(s), 21 declarative TypeScript path alias(es), 11 captured workspace package entry point(s), and 0 declarative SaaS semantics file(s).

    • COMPLETE
      Framework-aware authorization

      Evaluated 124 mapped entry point(s), request-data flows, SQL/NoSQL, process, filesystem, outbound, deserialization, regex, object-write, upload, cookie, and client/server boundaries. Cross-file authorization and selected taint flows follow explicit call relationships up to five hops and include applicable Next.js middleware. Missing runtime, RLS, and external policy evidence remains unverified.

    • COMPLETE
      SaaS application security

      Nine bounded TypeScript/JavaScript rules review client-controlled billing, ownership or privilege assignment, token lifecycle, internal error exposure, sensitive logging and URLs, and OAuth redirect trust. Findings are source candidates, not runtime proof.

    • COMPLETE
      Next.js application security

      Evaluated 124 mapped entry point(s) for authenticated reads, object scope, input validation, user-specific caching, public environment exposure, and sensitive response fields.

    • COMPLETE
      React client security

      Analyzed 262 runtime JSX/TSX file(s), including 130 explicit Client Component module(s), for rendering, navigation, browser storage, messaging, new-tab, and server/client boundary risks.

    • COMPLETE
      Static accessibility

      Inspected 262 JSX file(s) for six bounded semantic candidates; 0 parse failure(s). Runtime focus, contrast, layout, and assistive-technology behavior require imported external evidence.

    • NOT PERFORMED
      Imported Axe runtime accessibility

      No root codebasescan.axe.json, axe-results.json, or axe-report.json artifact was captured. CodebaseScan did not execute the target application or a browser.

    • COMPLETE
      Web discovery and SEO posture

      Checked 3 web app root(s) for robots policy, sitemap, Next.js metadata, and optional llms.txt presence. robots=2; sitemap=2; llms.txt=0. Deployment behavior was not inferred from source.

    • COMPLETE
      Static privacy

      Inspected 743 source file(s) for bounded URL, logging, and browser-storage privacy candidates; 0 parse failure(s). Data purpose, retention, consent, and runtime transfers remain unverified.

    • COMPLETE
      Static reliability

      Inspected 743 source file(s) for bounded request-timeout and swallowed-error candidates; 0 parse failure(s). Platform timeouts, queues, retries, and runtime recovery remain unverified.

    • COMPLETE
      Node.js supply-chain integrity

      Inspected 15 manifest(s), 1 lockfile(s), 133 dependency specifier(s), and 1086 resolved lock entry(s) without installing packages.

    • PARTIAL
      JavaScript/TypeScript dependency structure

      739 modules and 295 local dependencies were mapped; 1 cycle(s) found (1 retained), 49 orphan candidate(s) found (49 retained), and 188 coupling hotspot(s) found (100 retained). These are mechanical review data, not vulnerabilities. Target configuration was not loaded. dependency-cruiser 18.2.0 is covered by the CodebaseScan scanner compatibility fixtures.

    • COMPLETE
      JavaScript/TypeScript code duplication

      54 clone(s), 1070 duplicated line(s), and 2.6987% duplication were measured. Source fragments were discarded. Duplicates are maintainability evidence, not vulnerabilities. jscpd 5.2.0 is covered by the CodebaseScan scanner compatibility fixtures.

    • PARTIAL
      Code quality metrics

      6068 function(s) measured; 259 complexity, size, or parameter hotspot(s) found (200 retained). 0 existing coverage artifact(s) imported. Metrics are review evidence, not vulnerabilities.

    • COMPLETE
      Dead code and dependency usage

      55 unused file candidate(s) found (55 retained), 6 source-unreferenced runtime dependency candidate(s) found (6 retained), and 226 unused export/type candidate(s) found (226 retained). All target plugins and executable configuration loaders were disabled. knip 6.35.1 is covered by the CodebaseScan scanner compatibility fixtures.

    • COMPLETE
      Built-in static patterns

      Seven bounded regex heuristics. Not a complete SAST engine or interprocedural analysis.

    • DISABLED
      Static code analysis

      Disabled. Install the binary and opt in through local configuration.

    • DISABLED
      Secret scanning

      Disabled. Install the binary and opt in through local configuration.

    • DISABLED
      Dependency vulnerabilities

      The local advisory database has no records for 1000 resolved package(s). No network request was made and no clean result is implied.

    • COMPLETE
      Security configuration

      Conservative checks for security headers, session cookies, CORS, route and server-action authorization, and environment configuration in TypeScript/Node.js/Next.js projects.

    • NOT RUN
      HTTP runtime posture

      Not run. No HTTP target was explicitly approved for this audit.

    • NOT SUPPORTED
      Infrastructure as Code

      No dedicated Terraform, CloudFormation, or equivalent policy scanner is implemented.

    • NOT SUPPORTED
      Cloud IAM

      Cloud account and effective IAM policy analysis are outside this release.

    • NOT PERFORMED
      Dynamic exploitation

      CodebaseScan does not exploit targets, brute-force authentication, or crawl applications.

    04 · Inspect

    Technical data

    Secondary evidence stays collapsed until a reviewer needs it.

    Open only the evidence needed for the current decision.

    Policy, modes, and review state
    AUDIT MODES

    Selected review lenses

    Enabled modes decide which mechanical checks contribute evidence. Disabled modes are explicit gaps, not passing results.

    enabled security · 1.0.0enabled saas · 1.0.0enabled accessibility-static · 1.0.0enabled privacy · 1.0.0enabled reliability · 1.0.0enabled next-react · 1.0.0enabled maintainability · 1.0.0enabled release-readiness · 1.0.0enabled web-posture · 1.0.0
    Source model and correlated evidence
    SOURCE MODEL

    Project structure

    complete

    739 source files and 513143 AST nodes were parsed as data. Target code was not executed.

    124 entry points5711 symbols9590 call edges1659 security facts15 components16 cross-component imports

    Frameworks: Next.js App Router 16 [supported], React 19 [supported], Drizzle ORM ^0.45.2 [unverified], Zod 4 [unverified].

    Declared package boundaries

    • Example SaaS Application (.): 52 source file(s).
    • @sample/analytics (apps/analytics): 74 source file(s).
    • @example/docs (apps/docs): 28 source file(s).
    • @example/marketing (apps/marketing): 469 source file(s).
    • @example/ai (packages/ai): 2 source file(s).
    • @sample/analytics-core (packages/analytics-core): 24 source file(s).
    • @example/analytics (packages/analytics): 3 source file(s).
    • @example/auth (packages/auth): 16 source file(s).
    • @example/billing (packages/billing): 5 source file(s).
    • @sample/booking-core (packages/booking-core): 20 source file(s).
    • @example/notification (packages/notification): 6 source file(s).
    • @example/observability (packages/observability): 1 source file(s).
    • @sample/referrals-core (packages/referrals-core): 19 source file(s).
    • @example/saas (packages/saas): 17 source file(s).
    • @example/storage (packages/storage): 3 source file(s).

    Cross-component imports

    • @example/marketing → @example/saas: 136 import(s).
    • @example/marketing → @example/auth: 53 import(s).
    • @sample/analytics → @sample/analytics-core: 43 import(s).
    • @example/marketing → @example/observability: 22 import(s).
    • @example/marketing → @example/analytics: 17 import(s).
    • @example/marketing → @example/billing: 10 import(s).
    • @example/marketing → @example/notification: 9 import(s).
    • @example/auth → @example/notification: 6 import(s).
    • @example/marketing → @example/ai: 4 import(s).
    • @example/saas → @example/notification: 2 import(s).
    • @example/marketing → @example/storage: 2 import(s).
    • @example/auth → @example/observability: 2 import(s).
    • @example/notification → @example/observability: 1 import(s).
    • @sample/analytics → @example/auth: 1 import(s).
    • @example/ai → @example/observability: 1 import(s).
    • @example/auth → @example/saas: 1 import(s).
    TEST RELATIONSHIPS

    Security-critical test evidence

    partial

    Captured test imports are traced to source entry points and sensitive operations without executing tests.

    321Test files inspected
    92Critical source files
    48Related imports observed
    44Not observed

    Critical files without a related captured test import

    • apps/analytics/src/app/api/account/billing/route.ts
    • apps/analytics/src/app/api/account/members/route.ts
    • apps/analytics/src/app/api/account/route.ts
    • apps/analytics/src/app/api/activation/route.ts
    • apps/analytics/src/app/api/connections/route.ts
    • apps/analytics/src/app/api/export/route.ts
    • apps/analytics/src/app/api/history/route.ts
    • apps/analytics/src/app/api/onboarding/route.ts
    • apps/analytics/src/app/api/operations/route.ts
    • apps/analytics/src/app/api/overview/route.ts
    • apps/analytics/src/app/api/preview/route.ts
    • apps/analytics/src/app/api/properties/route.ts
    • apps/analytics/src/app/api/sync/route.ts
    • apps/docs/src/app/api/search/route.ts
    • apps/docs/src/proxy.ts
    • apps/marketing/src/app/admin/waitlist/export/route.ts
    • apps/marketing/src/app/api/analytics/business/churn/route.ts
    • apps/marketing/src/app/api/analytics/business/revenue-series/route.ts
    • apps/marketing/src/app/api/analytics/business/subscriptions/route.ts
    • apps/marketing/src/app/api/analytics/destinations/route.ts
    • apps/marketing/src/app/api/analytics/limits/route.ts
    • apps/marketing/src/app/api/analytics/overview/route.ts
    • apps/marketing/src/app/api/analytics/traffic/countries/route.ts
    • apps/marketing/src/app/api/analytics/traffic/devices/route.ts
    • apps/marketing/src/app/api/analytics/traffic/referrers/route.ts
    • apps/marketing/src/app/api/analytics/traffic/top-pages/route.ts
    • apps/marketing/src/app/api/analytics/usage/route.ts
    • apps/marketing/src/app/api/billing/webhook/route.ts
    • apps/marketing/src/app/api/health/route.ts
    • apps/marketing/src/app/api/inngest/route.ts
    • apps/marketing/src/app/api/support/route.ts
    • apps/marketing/src/app/api/v1/analytics/usage/route.ts
    • apps/marketing/src/app/app/billing/actions.ts
    • apps/marketing/src/app/app/notifications/actions.ts
    • apps/marketing/src/lib/mdx.tsx
    • apps/marketing/src/proxy.ts
    • scripts/dev-marketing.mjs
    • scripts/docker-app-start.mjs
    • scripts/docker-compose.mjs
    • scripts/run-marketing-next.mjs
    • scripts/run-playwright-web-server.mjs
    • scripts/setup-local.mjs
    • scripts/setup-verify.mjs
    • scripts/sync-working-copy.mjs

    Test evidence limitations

    • A related import is source-reference evidence only; it does not prove that a test asserts the security-relevant behavior.
    • Tests are not executed, and coverage artifacts are not attributed to individual source files by this analysis.
    • Import traversal is bounded to 5 resolved captured hops and can miss dynamic loading or unsupported aliases.
    • Black-box and end-to-end tests that reach routes only by URL cannot be attributed to source targets mechanically.
    • Not observed means no related captured test import was found, not that the code is untested.

    Open the complete test evidence map

    DATA FLOW INVENTORY

    Observed signals and declared context

    Observed entries come from static source facts. Declared data and boundaries come from project configuration and are not proof of runtime behavior.

    707 observed signals8 operation types0 declared data classes0 declared boundaries

    Observed operations

    • sensitive-read: 298
    • response: 187
    • outbound-transfer: 26
    • url-or-redirect: 136
    • cookie: 7
    • browser-storage: 6
    • persistent-storage: 45
    • financial-operation: 2
    Contracts and control evidence
    DEPLOYMENT CONTRACT

    Environment configuration

    complete

    Named source accesses are compared with sanitized environment templates. Values and free-form comments are discarded; uncommented and commented NAME= declarations are retained.

    164Named uses
    67Undocumented
    0Unverified
    9Dynamic accesses

    Sanitized templates

    • .env.example: 131 names
    • apps/marketing/.env.example: 29 names

    Undocumented named uses

    • ANALYTICS_CRON_SECRET — apps/marketing/src/lib/cron-auth.ts:8
    • APP_PACKAGE — scripts/docker-app-start.mjs:4
    • APP_PORT — scripts/docker-app-start.mjs:5
    • APP_RUN_DB_MIGRATE — scripts/docker-app-start.mjs:7
    • APP_RUN_DB_PUSH — scripts/docker-app-start.mjs:8
    • APP_TEMPLATE_SLUG — scripts/docker-app-start.mjs:3
    • AUTH_BASE_URL — apps/analytics/src/lib/handoff.ts:254
    • AUTH_DISABLE_RATE_LIMIT — packages/auth/src/index.ts:732
    • AUTH_SECRET — apps/analytics/src/lib/handoff.ts:247
    • AUTH_TRUSTED_ORIGINS — packages/auth/src/index.ts:325
    • BETTER_AUTH_TRUSTED_ORIGINS — packages/auth/src/index.ts:326
    • DEPLOY_TARGET — scripts/deploy-check.mjs:7
    • sample_ANALYTICS_ACCOUNT_LINK_STORE_MODE — apps/analytics/src/lib/account-link-store.ts:102
    • sample_ANALYTICS_ACCOUNT_LINK_STORE_PATH — apps/analytics/src/lib/account-link-store.ts:117
    • sample_ANALYTICS_ACCOUNT_LINK_TABLE — apps/analytics/src/lib/account-link-store.ts:128
    • sample_ANALYTICS_APP_URL — apps/marketing/src/lib/platform-auth/analytics-handoff.ts:117
    • sample_ANALYTICS_BILLING_PLAN_CURRENCY — apps/analytics/src/lib/commercial.ts:217
    • sample_ANALYTICS_BILLING_PLAN_ID — apps/analytics/src/lib/commercial.ts:207
    • sample_ANALYTICS_BILLING_PLAN_LABEL — apps/analytics/src/lib/commercial.ts:210
    • sample_ANALYTICS_BILLING_PLAN_PRICE_LABEL — apps/analytics/src/lib/commercial.ts:213
    • sample_ANALYTICS_CONNECTION_ENCRYPTION_KEY — apps/analytics/src/lib/connection-crypto.ts:16
    • sample_ANALYTICS_CONNECTION_STORE_MODE — apps/analytics/src/lib/connections-store.ts:135
    • sample_ANALYTICS_CONNECTION_STORE_PATH — apps/analytics/src/lib/connections-store.ts:150
    • sample_ANALYTICS_CONNECTION_TABLE — apps/analytics/src/lib/connections-store.ts:161
    • sample_ANALYTICS_DATA_HANDLING_URL — apps/analytics/src/lib/onboarding.ts:109
    • sample_ANALYTICS_ENCRYPTION_KEY — apps/analytics/src/lib/connection-crypto.ts:17
    • sample_ANALYTICS_MAX_ACTIVE_CONNECTIONS — apps/analytics/src/lib/operations.ts:270
    • sample_ANALYTICS_MAX_MEMBERS — apps/analytics/src/lib/membership.ts:74
    • sample_ANALYTICS_MAX_PROPERTIES — apps/analytics/src/lib/properties.ts:111
    • sample_ANALYTICS_MEMBERSHIP_STORE_MODE — apps/analytics/src/lib/membership-store.ts:81
    • sample_ANALYTICS_MEMBERSHIP_STORE_PATH — apps/analytics/src/lib/membership-store.ts:96
    • sample_ANALYTICS_MEMBERSHIP_TABLE — apps/analytics/src/lib/membership-store.ts:103
    • sample_ANALYTICS_OFFBOARDING_EXPORTS_DURING_GRACE — apps/analytics/src/lib/launch-policy.ts:77
    • sample_ANALYTICS_OFFBOARDING_GRACE_DAYS — apps/analytics/src/lib/launch-policy.ts:64
    • sample_ANALYTICS_OFFBOARDING_RETENTION_DAYS — apps/analytics/src/lib/launch-policy.ts:70
    • sample_ANALYTICS_PLATFORM_AUTH_AUDIENCE — apps/analytics/src/lib/handoff.ts:261
    • sample_ANALYTICS_PRIVACY_URL — apps/analytics/src/lib/onboarding.ts:106
    • sample_ANALYTICS_PROPERTY_STORE_MODE — apps/analytics/src/lib/property-store.ts:43
    • sample_ANALYTICS_PROPERTY_STORE_PATH — apps/analytics/src/lib/property-store.ts:58
    • sample_ANALYTICS_PROPERTY_TABLE — apps/analytics/src/lib/property-store.ts:65
    • sample_ANALYTICS_SUPPORT_EMAIL — apps/analytics/src/lib/onboarding.ts:104
    • sample_ANALYTICS_SYNC_STORE_MODE — apps/analytics/src/lib/sync-store.ts:61
    • sample_ANALYTICS_SYNC_STORE_PATH — apps/analytics/src/lib/sync-store.ts:76
    • sample_ANALYTICS_SYNC_TABLE — apps/analytics/src/lib/sync-store.ts:83
    • sample_ANALYTICS_TERMS_URL — apps/analytics/src/lib/onboarding.ts:107
    • sample_PLATFORM_AUTH_ISSUER — apps/analytics/src/lib/handoff.ts:253
    • sample_PLATFORM_AUTH_RETURN_ORIGINS — apps/analytics/src/lib/handoff.ts:269
    • sample_PLATFORM_AUTH_SECRET — apps/analytics/src/lib/handoff.ts:245
    • sample_PLATFORM_AUTH_TTL_SECONDS — apps/marketing/src/lib/platform-auth/analytics-handoff.ts:110
    • HEALTHCHECK_URL — scripts/deploy-check.mjs:333

    Declared but not observed

    • ANALYTICS_WEBHOOK_AUTO_REFRESH_STALE_HOURS
    • ANALYTICS_WEBHOOK_MAX_ATTEMPTS
    • ANALYTICS_WEBHOOK_REDELIVERY_MAX_ATTEMPTS
    • ANALYTICS_WEBHOOK_REDELIVERY_MIN_AGE_MS
    • ANALYTICS_WEBHOOK_RETRY_BASE_MS
    • ANALYTICS_WEBHOOK_TIMEOUT_MS
    • AUTH_MAGIC_LINK_ENABLED
    • AUTH_MAGIC_LINK_EXPIRES_IN
    • AUTH_TWO_FACTOR_ENABLED
    • AUTH_TWO_FACTOR_ISSUER
    • BILLING_PER_SEAT_EXPERIMENT_PLANS
    • BILLING_PROVIDER
    • BILLING_SUBSCRIPTION_EXPERIMENT_INTERVAL
    • BILLING_SUBSCRIPTION_EXPERIMENT_PLANS
    • BILLING_USAGE_BASED_EXPERIMENT_PLANS
    • example_LAUNCH_UPSTREAM_ORIGIN_URL
    • example_SCALE_UPSTREAM_ORIGIN_URL
    • STORAGE_SIGNED_URL_TTL_SECONDS
    • STRIPE_CREDITS_GROWTH_PRICE_ID
    • STRIPE_CREDITS_SCALE_PRICE_ID
    • STRIPE_CREDITS_STARTER_PRICE_ID
    • STRIPE_PRO_PER_SEAT_PRICE_ID
    • STRIPE_PRO_PER_SEAT_PRICE_ID_EUR
    • STRIPE_PRO_PER_SEAT_PRICE_ID_USD
    • STRIPE_PRO_PRICE_ID
    • STRIPE_PRO_PRICE_ID_EUR
    • STRIPE_PRO_PRICE_ID_USD
    • STRIPE_PRO_SUBSCRIPTION_PRICE_ID
    • STRIPE_PRO_SUBSCRIPTION_PRICE_ID_EUR
    • STRIPE_PRO_SUBSCRIPTION_PRICE_ID_USD
    • STRIPE_PRO_USAGE_PRICE_ID
    • STRIPE_PRO_USAGE_PRICE_ID_EUR
    • STRIPE_PRO_USAGE_PRICE_ID_USD
    • STRIPE_SCALE_PER_SEAT_PRICE_ID
    • STRIPE_SCALE_PER_SEAT_PRICE_ID_EUR
    • STRIPE_SCALE_PER_SEAT_PRICE_ID_USD
    • STRIPE_SCALE_PRICE_ID
    • STRIPE_SCALE_PRICE_ID_EUR
    • STRIPE_SCALE_PRICE_ID_USD
    • STRIPE_SCALE_SUBSCRIPTION_PRICE_ID
    • STRIPE_SCALE_SUBSCRIPTION_PRICE_ID_EUR
    • STRIPE_SCALE_SUBSCRIPTION_PRICE_ID_USD
    • STRIPE_SCALE_USAGE_PRICE_ID
    • STRIPE_SCALE_USAGE_PRICE_ID_EUR
    • STRIPE_SCALE_USAGE_PRICE_ID_USD
    • STRIPE_STARTER_PRICE_ID
    • STRIPE_STARTER_PRICE_ID_EUR
    • STRIPE_STARTER_PRICE_ID_USD

    Dynamic accesses

    • process.env — apps/marketing/src/lib/billing-credits-catalog.ts:139
    • process.env — packages/billing/src/catalog.ts:126
    • process.env — packages/billing/src/catalog.ts:132
    • process.env — packages/billing/src/catalog.ts:138
    • process.env — packages/billing/src/catalog.ts:168
    • process.env — packages/billing/src/index.ts:612
    • process.env — packages/billing/src/index.ts:652
    • process.env — packages/billing/src/index.ts:1529
    • process.env — packages/billing/src/index.ts:1533

    Contract limitations

    • Only named process.env, import.meta.env, and direct destructuring accesses in captured JavaScript or TypeScript are compared.
    • Template values are discarded before the snapshot; this analysis retains names only. Commented NAME= placeholders count as documented optional declarations.
    • A name missing from captured templates may still be intentionally supplied by deployment infrastructure.
    • Unused declarations may be consumed by frameworks, package scripts, external services, or files outside the bounded snapshot.
    • Only security-, authentication-, credential-, data-service-, or payment-shaped undocumented names with at least one required-looking read become findings. Writes, comparisons, and recognized fallback/default reads remain visible in the contract without creating a candidate.

    Open the complete environment contract

    API CONTRACT

    OpenAPI and source consistency

    complete

    Captured declarations are compared with statically mapped Next.js and Express route operations.

    5Declared operations
    73Source operations
    5Matched
    0Consistency candidates

    68 unmatched source operation(s) were outside the inferred contract path scope and are not counted as differences.

    API contract limitations

    • OpenAPI and Swagger files are parsed as inert JSON or YAML; external references and executable generators are not loaded.
    • Path parameters are compared structurally across OpenAPI, Next.js, and Express syntax.
    • Unmatched source operations become candidates only inside the common static path scope inferred from each captured specification.
    • A declared-only or source-only operation is a documentation consistency candidate, not proof that an endpoint is missing or exposed.
    • Server base paths, rewrites, mounted routers, generated specifications, and runtime registration can prevent a static match.
    • Routes with no statically observed HTTP method remain unverified and are not counted as source-only operations.

    Open the complete API contract map

    DATABASE CONTRACT

    Schema, migration, and source consistency

    complete

    Captured declarations and SQL migration references are compared with statically mapped database call chains.

    39Declared entities
    39Migration entities
    33Source entities
    0Consistency candidates

    Database contract limitations

    • Schema, migration, and source files are parsed as inert text or syntax trees; no ORM, migration, or target code is executed.
    • A gap is a consistency candidate, not proof that a database object is missing or stale at runtime.
    • Squashed, externally managed, generated, renamed, or excluded migrations can make declaration-to-migration evidence incomplete.
    • Source entity correlation is limited to statically mapped database call chains and can miss aliases, raw SQL, repositories, and dynamic access.
    • Names are compared case-insensitively after punctuation removal; semantic renames cannot be inferred.

    Open the complete database contract map

    WEBHOOK CONTRACT

    Endpoint controls and event vocabulary

    complete

    Bounded call relationships connect each endpoint to captured signature, idempotency, and literal event-name evidence.

    1Webhook endpoints
    1Verification evidenced
    0Idempotency evidenced
    3Locally paired events

    Mapped webhook endpoints

    • POST /api/billing/webhook: verification evidenced; idempotency unverified

    Unpaired event names remain external provider/customer boundaries, not mismatch findings.

    Webhook contract limitations

    • Target TypeScript and JavaScript are parsed as inert syntax; modules, configuration, and handlers are never imported or executed.
    • Endpoints are limited to statically mapped HTTP routes whose names contain webhook/hook, or callback routes linked to captured signature-verification evidence.
    • Call reachability follows statically resolved project-profile call edges to a bounded depth; dynamic dispatch and generated code remain unverified.
    • Event names come only from literal discriminant branches, literal returned contracts, and literal payloads passed to recognized dispatch-like calls.
    • Consumer-only and producer-only names are labeled external boundaries, not defects, because the other side may live at a provider or customer endpoint.
    • Verification and idempotency statuses report captured evidence only; unverified does not prove the runtime control is absent.

    Open the complete webhook contract map

    FEATURE FLAGS

    Declarations, usages, and defaults

    complete

    Literal declarations and evaluation keys are correlated without loading target configuration or provider SDKs.

    7Declared flags
    9Literal usages
    7Matched flags
    0Consistency candidates

    4 dynamic usage(s) remain visible but unpaired.

    Feature flag limitations

    • JSON and TypeScript are parsed as inert data or syntax; target modules, configuration, providers, and flag SDKs are never loaded or executed.
    • Declarations are limited to JSON featureFlags maps and literal TypeScript definition collections with feature/flag-shaped names.
    • Usages are limited to literal keys passed to recognized flag-evaluation calls; dynamic keys remain visible but unpaired.
    • Different declaration defaults across files may represent plans, environments, or variants and are not treated as conflicts.
    • A default conflict requires inconsistent literal source defaults, or one unambiguous declared default that differs from one literal source default.
    • Declaration-only and usage-only records are consistency candidates, not proof that a feature is dead, unreachable, or incorrectly configured at runtime.

    Open the complete feature flag map

    CONTROL PACK 0.5.0

    Security checklist

    10 EVIDENCED8 GAP CANDIDATE8 UNVERIFIED3 NOT APPLICABLE3 PARTIAL0 FAILED
    PARTIALauthentication · TW-CTRL-AUTHN-001

    Sensitive mutations authenticate a principal

    44 of 45 mapped sensitive mutation boundary(s) contain a recognized authentication or authorization fact in applicable middleware or within five explicit call hops.

    Verify: Test each boundary without a session/token and confirm rejection before the sensitive operation.

    EVIDENCEDauthentication · TW-CTRL-AUTHN-002

    Sensitive read routes receive an authentication review

    No missing-authentication candidate was found across 31 mapped sensitive read route(s).

    Verify: Test anonymous and wrong-tenant reads. Confirm intentionally public routes expose only approved fields.

    EVIDENCEDauthorization · TW-CTRL-AUTHZ-001

    Administrative mutations enforce permission

    10 of 10 privileged-looking mutation boundary(s) contain a recognized permission decision.

    Verify: Test an authenticated non-admin principal against every privileged action.

    EVIDENCEDauthorization · TW-CTRL-AUTHZ-002

    Dynamic resource access is tenant or owner scoped

    2 of 2 dynamic database boundary(s) contain a recognized tenant, owner, account, organization, or user scope in the captured call arguments.

    Verify: Run cross-tenant and wrong-owner identifier tests and inspect effective RLS/database policy.

    GAP_CANDIDATEinput-validation · TW-CTRL-INPUT-001

    Sensitive entry points validate caller-controlled input

    75 of 77 sensitive entry point(s) contain a recognized validation call within five explicit call hops.

    Verify: Test malformed, oversized, unexpected-type, and boundary input before the sensitive operation.

    NOT_APPLICABLEinput-validation · TW-CTRL-INJECTION-001

    Raw SQL keeps request data out of query structure

    No supported raw SQL boundary was mapped.

    Verify: Trace each query fragment, replace structural interpolation with parameters, and test metacharacter payloads without modifying production data.

    NOT_APPLICABLEinput-validation · TW-CTRL-COMMAND-001

    Process execution keeps request data out of commands and executable selection

    No supported process execution boundary was mapped.

    Verify: Use fixed executables and argument arrays without a shell, then test separators, option injection, encoding, and unexpected executable names.

    UNVERIFIEDinput-validation · TW-CTRL-PATH-001

    Filesystem paths remain inside server-owned roots

    1 filesystem boundary(s) were mapped without enough evidence to prove containment.

    Verify: Test decoded parent traversal, absolute paths, separators, symlinks, and race conditions against the canonical storage root.

    GAP_CANDIDATEintegrations · TW-CTRL-OUTBOUND-001

    Outbound destinations are server-owned or safely constrained

    1 request-derived outbound destination candidate(s) require review.

    Verify: Test untrusted public, private, loopback, metadata, DNS-rebinding, and redirect destinations against the effective egress policy.

    UNVERIFIEDintegrations · TW-CTRL-REDIRECT-001

    Redirect destinations are constrained

    93 redirect boundary(s) were mapped without enough evidence to establish the effective destination policy.

    Verify: Test external, scheme-relative, encoded, mixed-case, and userinfo-form destinations against the effective redirect policy.

    UNVERIFIEDinput-validation · TW-CTRL-UPLOAD-001

    File uploads enforce size, content, and storage-path constraints

    No decisive upload gap was mapped, but the profiler cannot prove that uploads are absent or fully constrained.

    Verify: Test byte limits, file count, MIME/content mismatch, polyglots, generated names, traversal, overwrite, and storage execution policy.

    EVIDENCEDintegrations · TW-CTRL-WEBHOOK-001

    Webhook authenticity is verified before processing

    1 of 1 mapped webhook/callback boundary(s) contain a recognized signature or HMAC verification call.

    Verify: Send missing, invalid, replayed, and stale signatures and confirm rejection before parsing or persistence.

    GAP_CANDIDATEintegrations · TW-CTRL-SAAS-WEBHOOK-001

    Webhook side effects resist duplicate delivery

    0 of 1 mapped webhook/callback boundary(s) contain a recognized idempotency claim or event-recording operation.

    Verify: Replay the same provider event concurrently and after a failure; confirm one durable effect and safe retry recovery.

    GAP_CANDIDATEauthentication · TW-CTRL-SAAS-ABUSE-001

    Abuse-sensitive routes apply rate limits

    0 of 11 mapped login, registration, recovery, invitation, verification, checkout, or billing boundary(s) contain a recognized rate-limit operation.

    Verify: Burst requests by IP and account identifier, then confirm bounded retries, useful backoff, and no easy key rotation bypass.

    PARTIALauthorization · TW-CTRL-SAAS-BILLING-001

    Billing mutations derive charged values on the server

    2 billing mutation boundary(s) were mapped; 0 were directly inspected for request-derived price, product, plan, or amount fields.

    Verify: Tamper with plan, price, product, amount, currency, quantity, discount, and tenant ownership; compare the provider-side charge with the server catalog.

    PARTIALauthentication · TW-CTRL-SAAS-RECOVERY-001

    Recovery and invitation tokens have a bounded lifecycle

    1 recovery, invitation, or verification boundary(s) were mapped without a decisive token-generation/storage candidate; atomic one-time use remains unverified.

    Verify: Test expiry, replay, concurrent redemption, account binding, user enumeration, token disclosure, and invalidation after password or email changes.

    NOT_APPLICABLEauthentication · TW-CTRL-SAAS-OAUTH-001

    OAuth/OIDC flows bind redirects and authorization responses

    No supported OAuth/OIDC boundary was mapped.

    Verify: Test missing/reused state, PKCE mismatch, nonce mismatch, redirect variants, login CSRF, account-link confusion, and authorization-code replay.

    GAP_CANDIDATEauthorization · TW-CTRL-SAAS-TENANT-001

    Tenant-aware data operations enforce a server-side scope

    57 of 77 mapped database boundary(s) in a tenant-aware project contain a recognized tenant scope or explicit authorization decision.

    Verify: Exercise every operation as two tenants, including list, lookup, update, delete, export, background job, and administrative paths; inspect effective RLS separately.

    GAP_CANDIDATEbrowser-security · TW-CTRL-SAAS-CSRF-001

    Cookie-authenticated mutations validate request origin or CSRF token

    0 of 9 mapped cookie-using sensitive mutation boundary(s) contain a recognized CSRF or origin validation operation.

    Verify: Send cross-site form, fetch, null-Origin, and sibling-subdomain requests; confirm rejection before the sensitive effect.

    GAP_CANDIDATEbrowser-security · TW-CTRL-HEADERS-001

    Browser security policies are declared and observed

    1 header policy candidate(s) require review.

    Verify: Observe representative production responses and verify CSP, frame, MIME, referrer, permissions, and transport policies.

    EVIDENCEDauthentication · TW-CTRL-SESSION-001

    Sensitive cookies use explicit protection attributes

    511 cookie operation(s) were mapped without a related deterministic candidate.

    Verify: Inspect effective Set-Cookie attributes and test production HTTPS, expiry, logout, fixation, and CSRF behavior.

    UNVERIFIEDbrowser-security · TW-CTRL-CORS-001

    Cross-origin access is intentionally constrained

    No effective cross-origin policy was observed; same-origin-only operation is possible but unverified.

    Verify: Test trusted and untrusted Origin values, credential mode, preflight behavior, and server-side authorization independently.

    UNVERIFIEDsecrets · TW-CTRL-SECRETS-001

    Captured current source has no detected secret exposure candidate

    The result reflects only enabled scanners over the bounded current-source snapshot.

    Verify: Review Git history, CI variables, deployment secrets, rotation, and provider-side secret scanning separately.

    UNVERIFIEDdependencies · TW-CTRL-DEPS-001

    Resolved dependencies are checked against OSV

    1086 resolved dependency record(s) were available; 0 OSV finding(s) are attached.

    Verify: Review advisory freshness, runtime reachability, exploit preconditions, and supported upgrade paths.

    UNVERIFIEDruntime · TW-CTRL-RUNTIME-001

    Approved HTTP response posture is observed

    No target URL was explicitly approved for runtime observation.

    Verify: Probe representative production routes and deployment layers under explicit authorization.

    UNVERIFIEDlogging · TW-CTRL-LOGGING-001

    Sensitive operations emit security-relevant audit events

    0 of 77 mapped sensitive boundary(s) contain a recognized audit/security logging call.

    Verify: Confirm event content, actor, target, outcome, correlation ID, retention, access controls, and alerting in the real logging system.

    EVIDENCEDlogging · TW-CTRL-ERRORS-001

    Sensitive boundaries define explicit failure handling

    77 of 77 mapped sensitive boundary(s) contain an explicit catch clause within five call hops.

    Verify: Exercise dependency, validation, authorization, and storage failures; confirm safe responses and useful internal diagnostics.

    EVIDENCEDauthorization · TW-CTRL-NEXT-001

    Next.js caching keeps user and tenant data isolated

    No supported user-specific cache isolation candidate was found in the bounded Next.js scan.

    Verify: Test two users or tenants against warm cache entries and inspect Cache-Control behavior at the deployed edge.

    EVIDENCEDsecrets · TW-CTRL-NEXT-002

    Next.js client boundaries exclude privileged configuration and response data

    No supported privileged public environment or sensitive server response field candidate was found.

    Verify: Inspect production client bundles, RSC payloads, and API responses for privileged values.

    EVIDENCEDinput-validation · TW-CTRL-REACT-001

    Dynamic HTML preserves React output encoding

    No unsanitized dynamic dangerouslySetInnerHTML candidate was found in the bounded React scan.

    Verify: Test script, event-handler, URL, SVG, malformed markup, and mutation-XSS payloads at every intentional HTML rendering boundary.

    GAP_CANDIDATEbrowser-security · TW-CTRL-REACT-002

    Client navigation, storage, and messaging use constrained browser boundaries

    1 client navigation, storage, messaging, or new-tab candidate(s) require review.

    Verify: Exercise untrusted URLs, message origins, storage access after script injection, and external new-tab navigation.

    EVIDENCEDsecrets · TW-CTRL-REACT-003

    Server and Client Component boundaries keep privileged data on the server

    No supported server-only import, sensitive prop, async Client Component, or private environment boundary candidate was found.

    Verify: Inspect serialized RSC payloads and production client bundles for credentials, privileged session objects, and server-only modules.

    Mechanical analysis and rule quality
    CAUSE-ORIENTED REVIEW

    Likely root causes

    Repeated findings are grouped by rule and location so reviewers can judge one underlying problem before opening every occurrence.

    6Finding candidates
    25Root-cause groups
    25Actionable tasks
    25Require human input
    1. highcause-e5a21decb425af8d

      1 TW-AST005 candidate in apps/marketing/src/lib/analytics/webhook-destination.ts.

      1 finding · 1 task · priority 62
    2. mediumcause-19cf08731afcffbc

      Missing or partial evidence for TW-CTRL-SAAS-ABUSE-001.

      0 findings · 1 task · priority 60
    3. mediumcause-406be7e28998873e

      Missing or partial evidence for TW-CTRL-SAAS-TENANT-001.

      0 findings · 1 task · priority 60
    4. mediumcause-7fc48b39d64abfce

      Missing or partial evidence for TW-CTRL-SAAS-CSRF-001.

      0 findings · 1 task · priority 60
    5. mediumcause-91d19e4cbd01a907

      Missing or partial evidence for TW-CTRL-SAAS-WEBHOOK-001.

      0 findings · 1 task · priority 60
    6. mediumcause-9ca2ae96a895fec2

      Missing or partial evidence for TW-CTRL-OUTBOUND-001.

      0 findings · 1 task · priority 60
    7. mediumcause-eff57b5fc20935b0

      Missing or partial evidence for TW-CTRL-REACT-002.

      0 findings · 1 task · priority 60
    8. mediumcause-f06a6f18ab0523e8

      Missing or partial evidence for TW-CTRL-INPUT-001.

      0 findings · 1 task · priority 60
    9. mediumcause-ff7aa5d2cf578a6d

      Missing or partial evidence for TW-CTRL-HEADERS-001.

      0 findings · 1 task · priority 60
    10. mediumcause-0812859c3fca4bc5

      Missing or partial evidence for TW-CTRL-SAAS-BILLING-001.

      0 findings · 1 task · priority 45
    11. mediumcause-084430276579bed6

      Missing or partial evidence for TW-CTRL-AUTHN-001.

      0 findings · 1 task · priority 45
    12. mediumcause-16c891eebcc7b336

      Missing or partial evidence for TW-CTRL-SAAS-RECOVERY-001.

      0 findings · 1 task · priority 45

    Only the 12 highest-priority root causes are shown here. The agent plan retains every bounded group and linked finding.

    SOURCE REVIEW

    Supply chain, quality, structure, and duplication

    15 manifests1 lockfiles133 dependency specs0 supply-chain candidates

    Supply-chain checks

    • dangerousLifecycleScripts: 0
    • unsafeDependencySpecs: 0
    • weakLockfileIntegrity: 0
    • insecureLockfileUrls: 0
    • unexpectedLockfileHosts: 0
    • manifestLockMismatches: 0
    6068 functions measured259 quality hotspots55 unused file candidates0 coverage artifacts

    Quality hotspots (200 of 259 retained)

    • apps/marketing/src/app/app/settings/page.tsx:122 SettingsPage: complexity 49, 560 lines, 1 parameters
    • apps/marketing/src/app/ativar-acesso/page.tsx:134 ActivateAccessPage: complexity 33, 248 lines, 1 parameters
    • apps/marketing/src/components/app/workspace-analytics-destinations-panel.tsx:1128 DestinationCard: complexity 33, 220 lines, 1 parameters
    • apps/marketing/src/components/auth/login-form.tsx:44 LoginForm: complexity 32, 398 lines, 1 parameters
    • apps/marketing/src/app/app/billing/page.tsx:130 BillingPage: complexity 32, 268 lines, 1 parameters
    • packages/billing/src/index.ts:1125 parseWebhook: complexity 32, 150 lines, 1 parameters
    • scripts/lib/distribution.mjs:1306 createLocalizedTemplateStartHere: complexity 31, 553 lines, 3 parameters
    • packages/auth/src/platform.ts:288 parsePlatformActivationIntentPayload: complexity 31, 103 lines, 1 parameters
    • apps/marketing/src/app/app/[workspaceSlug]/dashboard/page.tsx:266 WorkspaceDashboardPage: complexity 30, 442 lines, 1 parameters
    • packages/saas/src/index.ts:10647 claimBillingCheckoutForUser: complexity 30, 138 lines, 1 parameters
    • packages/referrals-core/src/integrity.ts:367 buildReferralsStorageIntegrityReport: complexity 29, 119 lines, 1 parameters
    • scripts/doctor-edition-upstreams.mjs:153 printPlanStatus: complexity 29, 79 lines, 3 parameters
    • apps/analytics/src/lib/connections-store.ts:270 readStoredAnalyticsConnectionRecord: complexity 27, 108 lines, 1 parameters
    • packages/booking-core/src/integrity.ts:278 buildBookingStorageIntegrityReport: complexity 26, 130 lines, 1 parameters
    • packages/saas/src/index.ts:4498 mapBillingCheckoutClaimRecord: complexity 25, 104 lines, 1 parameters
    • apps/marketing/src/components/auth/sign-up-form.tsx:45 SignUpForm: complexity 24, 433 lines, 1 parameters
    • packages/saas/src/payment-analytics.ts:151 normalizeBillingRecordToPaymentTransaction: complexity 24, 55 lines, 2 parameters
    • scripts/lib/distribution.mjs:4564 pruneBuyerSafeArtifactsForPlan: complexity 23, 258 lines, 2 parameters
    • apps/marketing/src/app/invite/[token]/page.tsx:166 InvitePage: complexity 23, 193 lines, 1 parameters
    • packages/saas/src/index.ts:4387 mapBillingRecord: complexity 23, 110 lines, 1 parameters
    • packages/saas/src/index.ts:10549 completeBillingCheckoutClaim: complexity 23, 97 lines, 1 parameters
    • apps/marketing/src/lib/analytics/destinations-shared.ts:136 isAnalyticsDestinationRecentDelivery: complexity 23, 29 lines, 1 parameters
    • packages/auth/src/platform.ts:450 verifyPlatformActivationIntent: complexity 22, 165 lines, 1 parameters
    • apps/marketing/src/lib/route-paths.ts:319 buildWorkspaceAwareAppPath: complexity 22, 56 lines, 3 parameters
    • apps/marketing/src/lib/billing-repository-delivery-request.ts:28 isBillingRepositoryDeliverySnapshotEntry: complexity 22, 38 lines, 1 parameters
    • apps/marketing/src/components/sections/pricing-hero.tsx:113 anonymous@113: complexity 21, 156 lines, 1 parameters
    • packages/analytics-core/src/report-exports.ts:170 buildStandaloneAnalyticsExportCsv: complexity 21, 138 lines, 1 parameters
    • apps/analytics/src/features/integrations/integrations-preview.tsx:278 readStandaloneConnection: complexity 21, 88 lines, 1 parameters
    • packages/analytics-core/src/activation.ts:95 buildChecklist: complexity 21, 62 lines, 1 parameters
    • apps/docs/src/lib/changelog.ts:49 readChangelogReleaseFileEntry: complexity 21, 43 lines, 2 parameters
    • apps/marketing/src/app/admin/accounts/[userId]/page.tsx:195 AdminAccountDetailPage: complexity 20, 960 lines, 1 parameters
    • apps/marketing/src/app/api/billing/checkout/route.ts:62 POST: complexity 20, 110 lines, 1 parameters
    • scripts/setup-local.mjs:134 main: complexity 20, 106 lines, 0 parameters
    • apps/analytics/src/lib/account-link.ts:234 createStandaloneAccountLinkState: complexity 20, 89 lines, 1 parameters
    • packages/saas/src/index.ts:10786 registerBillingCheckoutForUser: complexity 20, 73 lines, 1 parameters
    • apps/marketing/src/app/entrar/page.tsx:26 SignInPage: complexity 19, 125 lines, 1 parameters
    • apps/marketing/src/app/admin/workspaces/[workspaceId]/page.tsx:70 AdminWorkspaceDetailPage: complexity 18, 549 lines, 1 parameters
    • apps/marketing/src/app/api/support/route.ts:26 POST: complexity 18, 109 lines, 1 parameters
    • packages/billing/src/index.ts:544 loadStripePricingCatalog: complexity 18, 96 lines, 0 parameters
    • apps/analytics/src/lib/account.ts:252 mergeStoredAccountRecordIntoHostedReadModel: complexity 18, 89 lines, 1 parameters
    • packages/saas/src/index.ts:8217 updatePrivacyRequestStatusForAdmin: complexity 18, 84 lines, 1 parameters
    • apps/marketing/src/app/app/analytics/page-content.tsx:49 loadAnalyticsPageState: complexity 18, 83 lines, 1 parameters
    • packages/saas/src/index.ts:10860 completeBillingCheckout: complexity 18, 73 lines, 1 parameters
    • packages/ai/src/index.ts:285 readOpenAIResponsePayload: complexity 18, 71 lines, 1 parameters
    • apps/analytics/src/lib/property-store.ts:142 readStoredAnalyticsPropertyRecord: complexity 18, 64 lines, 1 parameters
    • apps/analytics/src/lib/connections.ts:312 buildUmamiEnvConnection: complexity 18, 55 lines, 1 parameters
    • apps/marketing/src/lib/analytics/webhook-destination.ts:554 deliverAnalyticsWebhookPayloadForUser: complexity 17, 198 lines, 1 parameters
    • apps/marketing/src/lib/analytics-dashboard-data.ts:2605 applyModeledFinancialMonthMetrics: complexity 17, 162 lines, 1 parameters
    • apps/marketing/src/lib/analytics/operational-alerts.ts:80 getAnalyticsOperationalAlerts: complexity 17, 160 lines, 1 parameters
    • scripts/vercel-env.mjs:310 collectIssues: complexity 17, 65 lines, 3 parameters
    • apps/analytics/src/components/analytics-membership-manager.tsx:151 readMembershipResponse: complexity 17, 53 lines, 1 parameters
    • apps/marketing/src/components/layout/navbar.tsx:43 Navbar: complexity 16, 404 lines, 1 parameters
    • apps/analytics/src/app/api/connections/route.ts:34 POST: complexity 16, 150 lines, 1 parameters
    • apps/marketing/src/components/pricing/pricing-plan-cards.tsx:42 anonymous@42: complexity 16, 111 lines, 1 parameters
    • apps/marketing/src/lib/analytics/webhook-destination.ts:880 retryAnalyticsWebhookDeliveryForUser: complexity 16, 110 lines, 1 parameters
    • packages/saas/src/index.ts:7736 upsertRuntimeFeatureFlagForAdmin: complexity 16, 98 lines, 1 parameters
    • scripts/lib/release-edition-full.mjs:7 parseEditionReleaseFullArgs: complexity 16, 94 lines, 1 parameters
    • packages/auth/src/captcha.ts:209 verifyCaptchaResponse: complexity 16, 93 lines, 1 parameters
    • apps/analytics/src/components/analytics-handoff-panel.tsx:9 AnalyticsHandoffPanel: complexity 16, 88 lines, 1 parameters
    • packages/analytics-core/src/stripe-client.ts:293 readStripeSubscription: complexity 16, 59 lines, 1 parameters
    • apps/analytics/src/app/page.tsx:29 OverviewPage: complexity 15, 372 lines, 1 parameters
    • apps/marketing/src/lib/analytics/webhook-redelivery-refresh.ts:154 refreshFailedWebhookDeliveries: complexity 15, 162 lines, 1 parameters
    • apps/marketing/src/components/app/workspace-danger-zone-panel.tsx:50 WorkspaceDangerZonePanel: complexity 15, 158 lines, 1 parameters
    • apps/marketing/src/components/app/workspace-role-assignments-section.tsx:91 anonymous@91: complexity 15, 125 lines, 1 parameters
    • packages/analytics-core/src/stripe-live-provider.ts:478 getRevenueSnapshot: complexity 15, 116 lines, 1 parameters
    • apps/analytics/src/lib/onboarding.ts:206 buildSteps: complexity 15, 113 lines, 1 parameters
    • apps/marketing/src/components/app/analytics/analytics-data-freshness-card.tsx:197 AnalyticsDataFreshnessCard: complexity 15, 106 lines, 1 parameters
    • scripts/import-stripe-products.mjs:193 parseCsv: complexity 15, 62 lines, 1 parameters
    • apps/marketing/src/lib/analytics-dashboard-data.ts:2845 buildYearComparisonData: complexity 15, 60 lines, 1 parameters
    • scripts/lib/distribution.mjs:1971 buildFilteredDockerCompose: complexity 15, 57 lines, 1 parameters
    • scripts/verify-env-example.mjs:198 buildExpectedEnvKeys: complexity 15, 42 lines, 1 parameters
    • packages/auth/src/session-payload.ts:35 isBetterAuthUserPayload: complexity 15, 24 lines, 1 parameters
    • apps/marketing/src/lib/analytics/export.ts:233 buildAnalyticsExportForUser: complexity 14, 145 lines, 1 parameters
    • apps/marketing/src/components/app/settings-auth-security-mfa-section.tsx:32 SettingsAuthSecurityMfaSection: complexity 14, 140 lines, 1 parameters
    • packages/saas/src/index.ts:5788 assignWorkspaceRoleToMemberForUser: complexity 14, 130 lines, 1 parameters
    • apps/marketing/src/app/api/billing/credits/checkout/route.ts:50 POST: complexity 14, 125 lines, 1 parameters
    • apps/marketing/src/app/api/contact/route.ts:28 POST: complexity 14, 117 lines, 1 parameters
    • packages/booking-core/src/integrity.ts:147 validateReservation: complexity 14, 103 lines, 2 parameters
    • scripts/setup-verify.mjs:291 main: complexity 14, 85 lines, 0 parameters
    • apps/analytics/src/features/integrations/integrations-preview.tsx:429 IntegrationsPreview: complexity 13, 528 lines, 1 parameters
    • apps/marketing/src/components/auth/change-password-form.tsx:18 ChangePasswordForm: complexity 13, 184 lines, 0 parameters
    • apps/marketing/src/lib/analytics-dashboard-data.ts:3098 buildAnalyticsDashboardData: complexity 13, 168 lines, 1 parameters
    • apps/analytics/src/app/api/properties/route.ts:35 POST: complexity 13, 144 lines, 1 parameters
    • apps/marketing/src/components/ui/sidebar.tsx:150 anonymous@150: complexity 13, 107 lines, 2 parameters
    • apps/marketing/src/app/api/waitlist/route.ts:38 POST: complexity 13, 100 lines, 1 parameters
    • scripts/deploy-check.mjs:223 maybeValidatePublishedEditions: complexity 13, 99 lines, 3 parameters
    • packages/saas/src/index.ts:7835 rollbackRuntimeFeatureFlagForAdmin: complexity 13, 96 lines, 1 parameters
    • packages/saas/src/index.ts:10265 createProjectDocumentForUser: complexity 13, 92 lines, 1 parameters
    • packages/referrals-core/src/integrity.ts:125 validateEntry: complexity 13, 91 lines, 2 parameters
    • packages/booking-core/src/recurrence.ts:270 expandAvailabilityRules: complexity 13, 87 lines, 1 parameters
    • apps/marketing/src/components/app/workspace-analytics-destinations-panel.tsx:834 WebhookDeliveryHistoryItem: complexity 13, 86 lines, 1 parameters
    • apps/marketing/src/components/app/docs-assistant-panel.tsx:27 DocsAssistantPanel: complexity 12, 182 lines, 1 parameters
    • apps/marketing/src/components/auth/reset-password-form.tsx:22 ResetPasswordForm: complexity 12, 167 lines, 0 parameters
    • apps/marketing/src/app/admin/page.tsx:41 AdminOverviewPage: complexity 12, 140 lines, 0 parameters
    • packages/analytics-core/src/snapshot-overview.ts:139 buildStandaloneSnapshotDocumentFromPreview: complexity 12, 95 lines, 1 parameters
    • scripts/lib/distribution.mjs:982 buildTemplateProductionChecks: complexity 12, 94 lines, 2 parameters
    • scripts/import-stripe-products.mjs:395 upsertProduct: complexity 12, 84 lines, 4 parameters
    • apps/analytics/src/lib/operations.ts:532 buildGuardrails: complexity 12, 82 lines, 1 parameters
    • apps/marketing/src/components/app/analytics/analytics-billing-usage-card.tsx:323 AnalyticsBillingUsageCard: complexity 11, 123 lines, 1 parameters
    • apps/analytics/src/app/api/account/members/route.ts:29 POST: complexity 11, 108 lines, 1 parameters
    • apps/marketing/src/app/app/projects/actions.ts:220 uploadProjectDocumentAction: complexity 11, 103 lines, 3 parameters
    • scripts/import-stripe-products.mjs:569 main: complexity 11, 86 lines, 0 parameters
    • apps/marketing/src/app/app/layout.tsx:26 AuthenticatedAppLayout: complexity 11, 84 lines, 1 parameters
    • packages/referrals-core/src/integrity.ts:235 validateBatch: complexity 11, 84 lines, 2 parameters
    • packages/saas/src/index.ts:6314 updateWorkspaceIdentityForUser: complexity 11, 84 lines, 1 parameters
    • apps/analytics/src/lib/operations.ts:748 buildOperationsKpis: complexity 11, 82 lines, 1 parameters
    • apps/marketing/src/app/app/billing/actions.ts:34 syncBillingUsageMeterAction: complexity 11, 80 lines, 1 parameters
    • apps/marketing/src/components/app/workspace-roles-manager.tsx:67 WorkspaceRolesManager: complexity 10, 328 lines, 1 parameters
    • packages/referrals-core/src/memory-store.ts:50 createReferralsMemoryStore: complexity 10, 314 lines, 1 parameters
    • apps/analytics/src/features/settings/settings-preview.tsx:82 SettingsPreview: complexity 10, 241 lines, 1 parameters
    • apps/analytics/src/components/analytics-operations-manager.tsx:21 AnalyticsOperationsManager: complexity 10, 203 lines, 1 parameters
    • apps/marketing/src/components/app/workspace-analytics-destinations-panel.tsx:1374 WebhookHistorySheet: complexity 10, 128 lines, 1 parameters
    • packages/saas/src/index.ts:6076 acceptWorkspaceInvitationRecord: complexity 10, 113 lines, 2 parameters
    • apps/marketing/src/components/app/workspace-analytics-connections-panel.tsx:128 AnalyticsProviderConnectionForm: complexity 10, 106 lines, 1 parameters
    • packages/billing/src/index.ts:1334 getBillingUsageMeterSummary: complexity 10, 98 lines, 1 parameters
    • apps/marketing/src/app/app/settings/actions.ts:1142 deleteWorkspaceAction: complexity 10, 94 lines, 1 parameters
    • apps/marketing/src/app/app/[workspaceSlug]/dashboard/page.tsx:175 renderDeliveryEntry: complexity 10, 90 lines, 1 parameters
    • apps/marketing/src/components/sections/blog-post-layout.tsx:15 BlogPostLayout: complexity 10, 88 lines, 1 parameters
    • apps/marketing/src/components/app/analytics/traffic-analytics-summary.tsx:534 TrafficAnalyticsSummary: complexity 10, 85 lines, 1 parameters
    • packages/auth/src/index.ts:1063 listAuthUsersForAdmin: complexity 10, 84 lines, 1 parameters
    • apps/analytics/src/app/api/operations/route.ts:45 POST: complexity 10, 83 lines, 1 parameters
    • apps/marketing/src/lib/analytics-dashboard-data.ts:1787 buildModeledRecurringMetrics: complexity 9, 444 lines, 1 parameters
    • scripts/lib/distribution.mjs:3262 genericizeExportBranding: complexity 9, 353 lines, 1 parameters
    • apps/marketing/src/app/admin/audit/page.tsx:67 AdminAuditPage: complexity 9, 278 lines, 1 parameters
    • packages/booking-core/src/memory-store.ts:62 createBookingMemoryStore: complexity 9, 223 lines, 1 parameters
    • apps/marketing/src/components/app/privacy-data-panel.tsx:46 PrivacyDataPanel: complexity 9, 178 lines, 1 parameters
    • apps/marketing/src/lib/analytics/snapshot-refresh.ts:14 refreshDailyAnalyticsSnapshots: complexity 9, 174 lines, 1 parameters
    • packages/saas/src/index.ts:9748 createWorkspaceInvitationForUser: complexity 9, 127 lines, 1 parameters
    • apps/marketing/src/components/app/settings-auth-security-email-section.tsx:24 SettingsAuthSecurityEmailSection: complexity 9, 110 lines, 1 parameters
    • packages/saas/src/index.ts:11549 anonymous@11549: complexity 9, 109 lines, 1 parameters
    • apps/marketing/src/lib/analytics/snapshot-history.ts:101 getAnalyticsSnapshotHistoryForUser: complexity 9, 90 lines, 1 parameters
    • apps/marketing/src/app/app/settings/actions.ts:554 saveProfileSettingsAction: complexity 9, 88 lines, 1 parameters
    • apps/marketing/src/components/app/workspace-analytics-destinations-panel.tsx:1622 WorkspaceAnalyticsDestinationsPanel: complexity 8, 217 lines, 1 parameters
    • apps/marketing/src/app/admin/messages/page.tsx:40 AdminMessagesPage: complexity 8, 193 lines, 1 parameters
    • apps/marketing/src/components/app/workspace-activity-log-panel.tsx:43 WorkspaceActivityLogPanel: complexity 8, 164 lines, 1 parameters
    • apps/marketing/src/components/app/members-page-content.tsx:421 anonymous@421: complexity 8, 157 lines, 1 parameters
    • apps/marketing/src/components/app/workspace-analytics-destinations-panel.tsx:927 WebhookDeliveryHealthCard: complexity 8, 157 lines, 1 parameters
    • apps/analytics/src/components/analytics-account-bootstrap-form.tsx:38 AnalyticsAccountBootstrapForm: complexity 8, 154 lines, 1 parameters
    • apps/marketing/src/components/app/settings-workspace-form.tsx:31 SettingsWorkspaceForm: complexity 8, 149 lines, 1 parameters
    • apps/marketing/src/lib/app-shell-navigation.ts:79 buildAppShellNavGroups: complexity 8, 131 lines, 1 parameters
    • apps/marketing/src/app/admin/runtime-flags/page.tsx:170 anonymous@170: complexity 8, 126 lines, 1 parameters
    • apps/marketing/src/app/api/billing/delivery/[deliveryPlan]/download/route.ts:38 GET: complexity 8, 124 lines, 2 parameters
    • packages/saas/src/index.ts:11382 anonymous@11382: complexity 8, 121 lines, 1 parameters
    • packages/saas/src/index.ts:11252 anonymous@11252: complexity 8, 117 lines, 1 parameters
    • packages/saas/src/index.ts:2303 consumeSharedRateLimit: complexity 8, 116 lines, 1 parameters
    • apps/analytics/src/lib/sync.ts:33 syncStandaloneSnapshot: complexity 8, 111 lines, 0 parameters
    • packages/analytics-core/src/umami-live-provider.ts:230 getTrafficSnapshot: complexity 8, 107 lines, 1 parameters
    • packages/saas/src/index.ts:5423 listWorkspaceRolesForUser: complexity 8, 103 lines, 1 parameters
    • apps/marketing/src/components/app/workspace-access-panel.tsx:204 anonymous@204: complexity 8, 102 lines, 1 parameters
    • apps/marketing/src/components/app/analytics/analytics-export-actions.tsx:260 AnalyticsExportActions: complexity 8, 96 lines, 1 parameters
    • packages/saas/src/index.ts:9600 listAnalyticsSnapshotTargets: complexity 8, 88 lines, 0 parameters
    • apps/marketing/src/components/app/workspace-access-panel.tsx:65 WorkspaceAccessPanel: complexity 7, 396 lines, 1 parameters
    • apps/marketing/src/components/app/project-documents-panel.tsx:40 ProjectDocumentsPanel: complexity 7, 156 lines, 1 parameters
    • apps/marketing/src/components/app/settings-auth-security-sessions-section.tsx:29 SettingsAuthSecuritySessionsSection: complexity 7, 148 lines, 1 parameters
    • apps/marketing/src/components/auth/two-factor-form.tsx:23 TwoFactorForm: complexity 7, 144 lines, 0 parameters
    • apps/analytics/src/components/analytics-activation-panel.tsx:7 AnalyticsActivationPanel: complexity 7, 134 lines, 1 parameters
    • apps/marketing/src/components/app/members-page-content.tsx:595 buildMembersPageMutationsController: complexity 7, 120 lines, 1 parameters
    • apps/marketing/src/lib/analytics/export.ts:116 buildAnalyticsExportCsv: complexity 7, 116 lines, 1 parameters
    • apps/marketing/src/app/admin/waitlist/page.tsx:140 anonymous@140: complexity 7, 115 lines, 1 parameters
    • apps/marketing/src/app/admin/audit/page.tsx:237 anonymous@237: complexity 7, 100 lines, 1 parameters
    • apps/analytics/src/components/analytics-onboarding-manager.tsx:9 AnalyticsOnboardingManager: complexity 7, 89 lines, 1 parameters
    • apps/marketing/src/components/app/analytics/analytics-snapshot-history.tsx:422 AnalyticsSnapshotHistory: complexity 7, 87 lines, 1 parameters
    • apps/marketing/src/lib/developer-api/analytics-v1.ts:312 getDeveloperApiAnalyticsOverview: complexity 7, 80 lines, 1 parameters
    • apps/analytics/src/components/analytics-property-manager.tsx:166 AnalyticsPropertyManager: complexity 6, 352 lines, 1 parameters
    • apps/marketing/src/components/sections/contact-section.tsx:37 ContactSection: complexity 6, 319 lines, 1 parameters
    • apps/marketing/src/components/sections/support-section.tsx:35 SupportSection: complexity 6, 242 lines, 1 parameters
    • apps/marketing/src/components/app/developer-api-keys-panel.tsx:45 DeveloperApiKeysPanel: complexity 6, 224 lines, 1 parameters
    • apps/analytics/src/components/analytics-membership-manager.tsx:209 AnalyticsMembershipManager: complexity 6, 196 lines, 1 parameters
    • apps/marketing/src/components/app/settings-auth-security-panel.tsx:159 SettingsAuthSecurityPanel: complexity 6, 154 lines, 1 parameters
    • scripts/lib/distribution.mjs:4413 pruneLocalizedMessagesForPlan: complexity 6, 150 lines, 2 parameters
    • apps/analytics/src/components/analytics-activation-progress-form.tsx:122 AnalyticsActivationProgressForm: complexity 6, 148 lines, 1 parameters
    • apps/marketing/src/app/admin/messages/[submissionId]/page.tsx:32 AdminMessageDetailPage: complexity 6, 143 lines, 1 parameters
    • packages/referrals-core/src/playbooks.ts:19 getReferralsOperationalPlaybook: complexity 6, 128 lines, 1 parameters
    • apps/marketing/src/components/app/notification-center-panel.tsx:27 NotificationCenterPanel: complexity 6, 108 lines, 1 parameters
    • apps/analytics/src/lib/operations.ts:424 resolveFreshnessItems: complexity 6, 107 lines, 1 parameters
    • apps/analytics/src/features/history/history-surface.tsx:25 HistorySurface: complexity 6, 106 lines, 1 parameters
    • apps/marketing/src/components/sections/hero-section.tsx:49 HeroSection: complexity 6, 102 lines, 0 parameters
    • packages/booking-core/src/availability.ts:87 buildBookableSlots: complexity 6, 94 lines, 1 parameters
    • apps/marketing/src/lib/analytics-dashboard-data.ts:1690 buildModeledFinancialMonthMetrics: complexity 6, 90 lines, 1 parameters
    • packages/saas/src/index.ts:8014 getAccountDeletionReadinessForUser: complexity 6, 90 lines, 1 parameters
    • apps/marketing/src/lib/analytics/combined-analytics-overview.ts:253 getCombinedAnalyticsOverviewForUser: complexity 6, 87 lines, 2 parameters
    • packages/saas/src/index.ts:5668 updateWorkspaceRoleForUser: complexity 6, 84 lines, 1 parameters
    • scripts/lib/distribution.mjs:3915 genericizeExportResidualContent: complexity 5, 448 lines, 1 parameters
    • apps/marketing/src/app/admin/accounts/[userId]/page.tsx:763 anonymous@763: complexity 5, 212 lines, 1 parameters
    • apps/analytics/src/components/analytics-commercial-manager.tsx:54 AnalyticsCommercialManager: complexity 5, 209 lines, 1 parameters
    • apps/marketing/src/components/layout/footer.tsx:21 Footer: complexity 5, 180 lines, 1 parameters
    • packages/saas/src/index.ts:11505 expireDueWorkspaceCredits: complexity 5, 167 lines, 1 parameters
    • apps/marketing/src/components/app/app-support-page.tsx:38 AppSupportPage: complexity 5, 157 lines, 1 parameters
    • apps/marketing/src/components/app/workspace-traffic-analytics-panel.tsx:519 WorkspaceTrafficAnalyticsPanel: complexity 5, 152 lines, 1 parameters
    • apps/docs/src/app/[locale]/changelog/[slug]/page.tsx:45 ChangelogDetailPage: complexity 5, 117 lines, 1 parameters
    • packages/referrals-core/src/payouts.ts:40 createCommissionPayoutBatch: complexity 5, 117 lines, 1 parameters
    • packages/booking-core/src/playbooks.ts:19 getBookingOperationalPlaybook: complexity 5, 104 lines, 1 parameters
    • apps/marketing/src/lib/analytics/destinations.ts:593 getAnalyticsDestinationsOverviewForUser: complexity 5, 90 lines, 1 parameters
    • apps/marketing/src/components/auth/sign-up-form.tsx:227 anonymous@227: complexity 5, 83 lines, 1 parameters
    • apps/marketing/src/components/app/members-page-content.tsx:268 MembersPageHeader: complexity 5, 82 lines, 1 parameters
    • packages/saas/src/index.ts:6399 getWorkspaceDeletionReadinessForUser: complexity 5, 81 lines, 1 parameters
    • apps/marketing/src/components/sections/pricing-hero.tsx:63 MetafiPricingHero: complexity 4, 215 lines, 0 parameters
    • apps/marketing/src/app/admin/accounts/page.tsx:37 AdminAccountsPage: complexity 4, 209 lines, 1 parameters
    • apps/marketing/src/app/admin/workspaces/page.tsx:34 AdminWorkspacesPage: complexity 4, 206 lines, 1 parameters
    • apps/marketing/src/components/sections/waitlist-section.tsx:25 WaitlistSection: complexity 4, 168 lines, 1 parameters

    Unused file candidates

    • apps/docs/src/app/robots.ts
    • apps/docs/src/app/sitemap.ts
    • apps/marketing/src/app/app/error.tsx
    • apps/marketing/src/app/app/loading.tsx
    • apps/marketing/src/app/error.tsx
    • apps/marketing/src/app/global-error.tsx
    • apps/marketing/src/app/loading.tsx
    • apps/marketing/src/app/not-found.tsx
    • apps/marketing/src/app/robots.ts
    • apps/marketing/src/app/sitemap.ts
    • apps/marketing/src/components/app/analytics/analytics-billing-usage-card.tsx
    • apps/marketing/src/components/app/analytics/analytics-data-freshness-card.tsx
    • apps/marketing/src/components/app/analytics/analytics-operational-alerts-card.tsx
    • apps/marketing/src/components/app/analytics/analytics-snapshot-history.tsx
    • apps/marketing/src/components/app/analytics/dashboard6-reference.tsx
    • apps/marketing/src/components/app/app-placeholder-page.tsx
    • apps/marketing/src/components/app/project-documents-panel.tsx
    • apps/marketing/src/components/app/workspace-access-panel.tsx
    • apps/marketing/src/components/auth/change-password-form.tsx
    • apps/marketing/src/components/layout/banner.tsx
    • apps/marketing/src/components/layout/error-boundary-state.tsx
    • apps/marketing/src/components/layout/page-loading-state.tsx
    • apps/marketing/src/components/sections/blog-featured.tsx
    • apps/marketing/src/components/sections/blog-grid.tsx
    • apps/marketing/src/components/sections/careers-hero.tsx
    • apps/marketing/src/components/sections/feature-benefits.tsx
    • apps/marketing/src/components/sections/feature-pricing.tsx
    • apps/marketing/src/components/sections/features-hero.tsx
    • apps/marketing/src/components/sections/features-included.tsx
    • apps/marketing/src/components/sections/integrations-hero.tsx
    • apps/marketing/src/components/sections/job-openings.tsx
    • apps/marketing/src/components/sections/logos-section.tsx
    • apps/marketing/src/components/sections/partner-logos.tsx
    • apps/marketing/src/components/sections/perks-section.tsx
    • apps/marketing/src/components/sections/pricing-hero.tsx
    • apps/marketing/src/components/sections/support-section.tsx
    • apps/marketing/src/components/sections/team-section.tsx
    • apps/marketing/src/components/sections/testimonials-section.tsx
    • apps/marketing/src/components/theme-toggle.tsx
    • apps/marketing/src/components/ui/animation-checkout.tsx
    • apps/marketing/src/components/ui/animation-invoicing.tsx
    • apps/marketing/src/components/ui/animation-payment-link.tsx
    • apps/marketing/src/components/ui/animation-recurring-bill.tsx
    • apps/marketing/src/components/ui/carousel.tsx
    • apps/marketing/src/components/ui/navigation-menu.tsx
    • apps/marketing/src/components/ui/shadow-root-host.tsx
    • apps/marketing/src/lib/analytics/billing-plan-guidance.ts
    • apps/marketing/src/lib/mdx.tsx
    • apps/marketing/src/types/post.ts
    • scripts/delivery-ready.mjs
    • scripts/dev-marketing.mjs
    • scripts/docker-app-start.mjs
    • scripts/run-marketing-next.mjs
    • scripts/run-playwright-web-server.mjs
    • scripts/verify-analytics-boundary.mjs

    Unused dependency candidates

    • @hookform/resolvers
    • @mdx-js/loader
    • @mdx-js/react
    • embla-carousel-autoplay
    • react-hook-form
    • tailwindcss-animate
    739 modules295 local dependencies1 cycles49 orphan candidates

    Dependency cycles (1 of 1 retained)

    • packages/saas/src/index.ts → packages/saas/src/payment-analytics.ts
    54 clones1070 duplicated lines2.6987% duplication

    Largest duplicate blocks

    • apps/marketing/src/app/api/analytics/traffic/countries/route.ts:1-46 and apps/marketing/src/app/api/analytics/traffic/referrers/route.ts:1-46
    • apps/marketing/src/app/api/analytics/traffic/countries/route.ts:1-46 and apps/marketing/src/app/api/analytics/traffic/top-pages/route.ts:1-46
    • apps/marketing/src/app/api/analytics/traffic/countries/route.ts:1-46 and apps/marketing/src/app/api/analytics/traffic/devices/route.ts:1-46
    • apps/marketing/src/app/api/analytics/limits/route.ts:1-43 and apps/marketing/src/app/api/analytics/usage/route.ts:1-43
    • apps/marketing/src/app/api/analytics/limits/route.ts:8-44 and apps/marketing/src/app/api/analytics/usage/route.ts:8-44
    • apps/marketing/src/app/api/contact/route.ts:40-71 and apps/marketing/src/app/api/support/route.ts:38-69
    • scripts/lib/release-edition-candidate.mjs:32-62 and scripts/release-edition-upstreams.mjs:23-53
    • apps/marketing/src/app/api/v1/analytics/limits/route.ts:1-26 and apps/marketing/src/app/api/v1/analytics/usage/route.ts:1-26
    • apps/marketing/src/app/api/analytics/business/churn/route.ts:3-27 and apps/marketing/src/app/api/analytics/business/overview/route.ts:3-27
    • apps/marketing/src/app/api/analytics/destinations/deliveries/health/route.ts:7-31 and apps/marketing/src/app/api/analytics/destinations/deliveries/route.ts:10-34
    • apps/marketing/src/app/api/analytics/business/churn/route.ts:3-27 and apps/marketing/src/app/api/analytics/business/subscriptions/route.ts:3-27
    • apps/marketing/src/app/api/analytics/traffic/countries/route.ts:1-25 and apps/marketing/src/app/api/analytics/traffic/overview/route.ts:1-25
    • apps/marketing/src/app/api/analytics/business/churn/route.ts:27-50 and apps/marketing/src/app/api/analytics/business/overview/route.ts:27-50
    • apps/marketing/src/app/api/analytics/business/churn/route.ts:27-50 and apps/marketing/src/app/api/analytics/business/subscriptions/route.ts:27-50
    • apps/marketing/src/app/api/analytics/business/churn/route.ts:9-30 and apps/marketing/src/app/api/analytics/destinations/deliveries/route.ts:9-32
    • apps/marketing/src/components/app/email-sequence-preferences-panel.tsx:85-106 and apps/marketing/src/components/app/notification-preferences-panel.tsx:126-147
    • scripts/lib/release-edition-candidate.mjs:32-53 and scripts/lib/release-edition-full.mjs:41-62
    • apps/marketing/src/app/admin/waitlist/actions.ts:41-62 and apps/marketing/src/app/admin/waitlist/actions.ts:90-111
    • scripts/lib/edition-upstream.mjs:23-44 and scripts/run-marketing-next.mjs:34-55
    • scripts/lib/release-edition-candidate.mjs:43-63 and scripts/release-edition-upstreams.mjs:34-54
    • scripts/check-edition-upstreams.mjs:22-42 and scripts/release-edition-upstreams.mjs:18-38
    • scripts/init-edition-upstreams.mjs:33-53 and scripts/lib/release-edition-full.mjs:36-56
    • packages/booking-core/src/persisted-store.ts:89-108 and packages/referrals-core/src/persisted-store.ts:118-137
    • apps/analytics/src/app/api/account/members/route.ts:20-39 and apps/analytics/src/app/api/properties/route.ts:26-45
    • apps/marketing/src/components/app/email-sequence-preferences-panel.tsx:37-56 and apps/marketing/src/components/app/notification-preferences-panel.tsx:53-72
    • apps/analytics/src/app/api/account/members/route.ts:20-39 and apps/analytics/src/app/api/connections/route.ts:25-44
    • apps/marketing/src/components/ui/animation-checkout.tsx:44-62 and apps/marketing/src/components/ui/animation-payment-link.tsx:53-71
    • scripts/dev-marketing.mjs:20-38 and scripts/lib/edition-upstream.mjs:26-44
    • apps/marketing/src/app/api/billing/webhook/route.ts:20-38 and apps/marketing/src/app/api/billing/webhook/route.ts:87-105
    • apps/marketing/src/app/api/analytics/business/churn/route.ts:6-24 and apps/marketing/src/app/api/analytics/overview/route.ts:2-23
    • scripts/check-edition-upstreams.mjs:22-38 and scripts/push-edition-upstreams.mjs:17-33
    • scripts/push-edition-upstreams.mjs:1-17 and scripts/release-edition-upstreams.mjs:1-17
    • apps/marketing/src/app/api/analytics/destinations/route.ts:7-23 and apps/marketing/src/app/api/analytics/limits/route.ts:7-23
    • apps/marketing/src/app/api/contact/route.ts:56-71 and apps/marketing/src/app/api/waitlist/route.ts:65-80
    • apps/marketing/src/app/api/analytics/business/churn/route.ts:6-21 and apps/marketing/src/app/api/analytics/destinations/route.ts:2-17
    • apps/marketing/src/app/api/billing/webhook/route.ts:105-120 and apps/marketing/src/app/api/billing/webhook/route.ts:38-53
    • packages/booking-core/src/storage-document.ts:13-28 and packages/referrals-core/src/storage-document.ts:13-28
    • apps/marketing/src/i18n/server.ts:51-65 and apps/marketing/src/i18n/server.ts:72-86
    • apps/marketing/src/app/api/contact/route.ts:23-37 and apps/marketing/src/app/api/support/route.ts:21-35
    • apps/marketing/src/components/sections/logos-section.tsx:25-39 and apps/marketing/src/components/sections/logos-section.tsx:43-57
    • apps/marketing/src/components/sections/careers-hero.tsx:25-39 and apps/marketing/src/components/sections/integrations-hero.tsx:39-54
    • packages/referrals-core/src/overview.ts:8-21 and packages/referrals-core/src/review.ts:29-42
    • apps/marketing/src/app/api/analytics/business/churn/route.ts:9-22 and apps/marketing/src/app/api/analytics/destinations/deliveries/health/route.ts:6-19
    • apps/marketing/src/app/api/analytics/business/churn/route.ts:9-22 and apps/marketing/src/app/api/analytics/business/revenue-series/route.ts:10-23
    • apps/marketing/src/app/app/accounts/page.tsx:9-21 and apps/marketing/src/app/app/notifications/page.tsx:7-19
    • apps/marketing/src/app/api/analytics/traffic/countries/route.ts:25-37 and apps/marketing/src/app/api/analytics/traffic/overview/route.ts:25-37
    • scripts/edition-publish-if-needed.mjs:2-14 and scripts/edition-publish-status.mjs:1-13
    • apps/marketing/src/lib/analytics/demo-analytics.ts:6-18 and apps/marketing/src/lib/analytics/snapshot-history.ts:41-53
    • apps/marketing/src/app/app/accounts/page.tsx:10-21 and apps/marketing/src/app/app/members/page.tsx:12-23
    • packages/referrals-core/src/compliance.ts:2-13 and packages/referrals-core/src/overview.ts:8-19
    • apps/marketing/src/app/app/accounts/page.tsx:10-21 and apps/marketing/src/app/app/settings/developer/page.tsx:14-25
    • apps/marketing/src/app/app/members/page.tsx:12-23 and apps/marketing/src/app/app/settings/roles/page.tsx:21-32
    • apps/marketing/src/app/api/analytics/connections/umami/disable/route.ts:37-48 and apps/marketing/src/app/api/analytics/connections/umami/enable/route.ts:41-52
    • apps/marketing/src/components/sections/logos-section.tsx:3-13 and apps/marketing/src/components/sections/partner-logos.tsx:7-17

    These measurements are bounded review evidence, not vulnerabilities or proof of adequate testing.

    06 · Evidence

    All findings

    6 review candidates. Open one row for evidence, remediation, analysis, and human disposition.

    highCode flow · needs reviewConfigured webhook destination lacks complete SSRF controlsapps/marketing/src/lib/analytics/webhook-destination.ts

    What CodebaseScan found

    A webhook or destination delivery module sends a dynamic URL without mechanical evidence that private networks are rejected and automatic redirects are disabled. The value may come from stored configuration rather than the current request.

    Why it matters

    If confirmed, this could affect the effective protection provided by application or deployment settings. The high label comes from the detector; this report does not establish runtime exploitability.

    Where to look

    apps/marketing/src/lib/analytics/webhook-destination.ts:603–608

    fetch sends a dynamic configured destination without complete SSRF control evidence.

    Show captured source 
    		try {
			const response = await fetch(resolved.endpointUrl, {
				method: "POST",
				headers: {
					"content-type": "application/json",

    How to verify manually

    1. Trace the captured declaration to the effective environment or framework configuration.
    2. Verify the resulting runtime behavior separately; source declarations alone are not proof.

    Confidence and limitations

    Confidence: medium · Detector: Code flow · Rule: TW-AST005

    • Review the cited evidence and scanner coverage before deciding.

    What to do next

    Resolve destinations from a server-owned allowlist or reject private, loopback, link-local, and metadata addresses after DNS resolution. Disable automatic redirects and revalidate every followed location.

    Back to summary ↑

    mediumPrivacy check · needs reviewSensitive-shaped value is placed in a URL parameterapps/analytics/src/lib/handoff.ts

    What CodebaseScan found

    A URL or search-parameter key names credential or personal data. URLs can reach histories, logs, referrers, and monitoring systems.

    Why it matters

    If confirmed, this could affect how personal or sensitive data is collected, exposed, retained, or transferred. The medium label comes from the detector; this report does not establish runtime exploitability.

    Where to look

    apps/analytics/src/lib/handoff.ts:109–114

    Sensitive-shaped URL parameter key: ownerEmail.

    Show captured source 
    	if (input.ownerEmail) {
		params.set("ownerEmail", input.ownerEmail);
	}

	if (input.ownerName) {

    How to verify manually

    1. Start at the cited line and trace the value or operation through the local guards shown in source.
    2. Confirm the input, caller, authorization context, and final operation before accepting or rejecting the candidate.

    Confidence and limitations

    Confidence: medium · Detector: Privacy check · Rule: TW-PRIV001

    • Review the cited evidence and scanner coverage before deciding.

    What to do next

    Keep sensitive values out of URLs. Use a protected request body or an opaque, short-lived reference where appropriate.

    Back to summary ↑

    lowReact check · needs reviewNew-tab link lacks explicit referrer protectionapps/marketing/src/components/layout/banner.tsx

    What CodebaseScan found

    A target=_blank link does not declare noreferrer. Referrer disclosure may remain; noreferrer also provides opener isolation in modern browsers.

    Why it matters

    If confirmed, this could affect the effective protection provided by application or deployment settings. The low label comes from the detector; this report does not establish runtime exploitability.

    Where to look

    apps/marketing/src/components/layout/banner.tsx:39–44

    a opens a new tab without complete rel protection.

    Show captured source 
    					</span>
					<Button size="sm" variant="secondary" asChild>
						<a href={url} target="_blank" rel="noopener">
							Get Template
						</a>
					</Button>

    How to verify manually

    1. Trace the captured declaration to the effective environment or framework configuration.
    2. Verify the resulting runtime behavior separately; source declarations alone are not proof.

    Confidence and limitations

    Confidence: medium · Detector: React check · Rule: TW-REACT006

    • Review the cited evidence and scanner coverage before deciding.

    What to do next

    Add rel="noopener noreferrer" to external new-tab links.

    Back to summary ↑

    lowReliability check · needs reviewCaught failure is silently discardedpackages/billing/src/index.ts

    What CodebaseScan found

    An undocumented empty catch block discards an exception with no recovery, observability, or explicit rationale.

    Why it matters

    If confirmed, this could affect timeouts, retries, duplicate work, cleanup, and predictable failure behavior. The low label comes from the detector; this report does not establish runtime exploitability.

    Where to look

    packages/billing/src/index.ts:632–637

    Catch block contains no statements or documented rationale.

    Show captured source 
    				catalog[definition.id][targetCurrency] = validatedPrice;
			} catch {}
		}
	}

    How to verify manually

    1. Start at the cited line and trace the value or operation through the local guards shown in source.
    2. Confirm the input, caller, authorization context, and final operation before accepting or rejecting the candidate.

    Confidence and limitations

    Confidence: medium · Detector: Reliability check · Rule: TW-REL002

    • Review the cited evidence and scanner coverage before deciding.

    What to do next

    Handle the expected failure, add bounded observability, rethrow it, or document a narrow intentional ignore next to explicit logic.

    Back to summary ↑

    lowReliability check · needs reviewCaught failure is silently discardedscripts/import-stripe-products.mjs

    What CodebaseScan found

    An undocumented empty catch block discards an exception with no recovery, observability, or explicit rationale.

    Why it matters

    If confirmed, this could affect timeouts, retries, duplicate work, cleanup, and predictable failure behavior. The low label comes from the detector; this report does not establish runtime exploitability.

    Where to look

    scripts/import-stripe-products.mjs:442–447

    Catch block contains no statements or documented rationale.

    Show captured source 
    				return { action: "update-product", product: updatedProduct };
			}
		} catch {}
	}

	const matchedProduct = await findExistingProduct(stripe, plan);

    How to verify manually

    1. Start at the cited line and trace the value or operation through the local guards shown in source.
    2. Confirm the input, caller, authorization context, and final operation before accepting or rejecting the candidate.

    Confidence and limitations

    Confidence: medium · Detector: Reliability check · Rule: TW-REL002

    • Review the cited evidence and scanner coverage before deciding.

    What to do next

    Handle the expected failure, add bounded observability, rethrow it, or document a narrow intentional ignore next to explicit logic.

    Back to summary ↑

    lowSecurity posture · needs reviewDeclared response security-header coverage is incompleteapps/analytics/next.config.ts

    What CodebaseScan found

    CodebaseScan could not find these declarations in the captured Next.js, proxy, or deployment configuration: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, frame protection. A CDN, ingress, framework default, or production-only layer outside this snapshot may still provide them.

    Why it matters

    If confirmed, this could affect the effective protection provided by application or deployment settings. The low label comes from the detector; this report does not establish runtime exploitability.

    Where to look

    apps/analytics/next.config.ts:1–4

    One or more recommended browser security policies were not found across the captured configuration sources. This is a coverage candidate, not proof that the runtime response is unsafe.

    Show captured source 
    import { dirname, resolve } from "node:path";
import { fileURLToPath } from "node:url";
import type { NextConfig } from "next";

    How to verify manually

    1. Trace the captured declaration to the effective environment or framework configuration.
    2. Verify the resulting runtime behavior separately; source declarations alone are not proof.

    Confidence and limitations

    Confidence: low · Detector: Security posture · Rule: TW-P001

    • Review the cited evidence and scanner coverage before deciding.

    What to do next

    Confirm the effective production response headers. Define missing policy at one authoritative layer and use the opt-in HTTP probe to verify what reaches a browser.

    Back to summary ↑