Fix security scanning and evidence exports - #17
Conversation
code-to-gate PR ReviewGate Verdict
Blocking Reasons
Acceptable Risks
Suggested Tests
Spec Drift
Drift Budget
Evidence Links
Suppression / Baseline Summary
Gate Explainability
Generated by code-to-gate v1.5.1 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 53897b912b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| /your[_-]?(?:key|token|secret)/i, | ||
| /replace[_-]?(?:me|with)/i, | ||
| /change[_-]?me/i, | ||
| /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/, |
There was a problem hiding this comment.
When a real credential is formatted as uppercase segments—for example, const password = "PROD_DB_SECRET_8F31C7A942"—this new pattern makes isSafeValue return true, so the assignment check silently skips the hardcoded secret. Environment-variable-name placeholders should be distinguished more narrowly rather than exempting every sufficiently long uppercase underscore string.
Useful? React with 👍 / 👎.
| const ROUTE_PATTERNS_BY_LANG: Record<string, RegExp[]> = { | ||
| ts: [ | ||
| /\.(?:get|post|put|delete|patch)\s*\(\s*["'`]([^"'`]+)["'`]/g, | ||
| /\b(?:app|router|server|api|fastify|express|[A-Za-z_$][\w$]*(?:App|Router|Server))\s*\.\s*(?:get|post|put|delete|patch)\s*\(\s*["'`]([^"'`]+)["'`]/g, |
There was a problem hiding this comment.
For Express code using a common alias such as const routes = express.Router(); routes.post('/auth/login', handler), the restricted receiver expression no longer matches because routes/authRoutes is neither an exact listed name nor suffixed with Router. Consequently, sensitive endpoints without rate limiting disappear from this security rule's results; the receiver detection should also cover established router aliases or derive them from router construction.
Useful? React with 👍 / 👎.
| // Buffer | ||
| { pattern: /new\s+Buffer\s*\(/g, name: "new Buffer()", replacement: "Buffer.from(), Buffer.alloc(), or Buffer.allocUnsafe()" }, | ||
| { pattern: /(?<![\w$.])Buffer\(\s*\)/g, name: "Buffer()", replacement: "Buffer.from(), Buffer.alloc(), or Buffer.allocUnsafe()" }, | ||
| { pattern: /\bBuffer\(\s*\)/g, name: "Buffer()", replacement: "Buffer.from(), Buffer.alloc(), or Buffer.allocUnsafe()" }, |
There was a problem hiding this comment.
When application code defines or invokes an unrelated qualified method such as codec.Buffer(), the new word-boundary pattern matches the Buffer() suffix and reports it as the deprecated Node global. The previous negative lookbehind excluded member access while already rejecting ArrayBuffer, so the replacement should preserve that qualification check.
Useful? React with 👍 / 👎.
1 participant
Summary
export sarif --scope securityand upload only security-relevant findings to GitHub Code Scanning while retaining the full SARIF artifactWhy
The repository had newly surfaced Dependabot alerts and was uploading maintainability findings as GitHub Security alerts. The QEG fixture also referenced future output paths and claimed producer-side approval that belongs to the authorized release workflow.
Impact
GitHub Code Scanning receives only auth, payment, validation, data, and security categories. Full SARIF remains available as an artifact. Root and demo fixture dependency installs audit cleanly, and QEG remains the final verdict owner.
Validation
npm run test:ci:stable: 3,579 passed, 4 skippednpm run release:validate: passed0835903:validateandgatepassedgit diff --check: passedThe demo GitHub Actions fixture intentionally retains its pre-existing failing build/typecheck/lint signals for CI-analysis coverage.