Generated by merge_verdicts.py from the verdict tables in */result.md. Do not edit by hand;
fix the audit result and re-run. One row per document; replaces lists the candidate ids it
absorbs. Restricted sources may ground only what restriction states.
Pinned:
- Candidate rows read: 480, from 7 audit groups; distinct documents: 443.
- Register entries: 412 (T1 307, T2 90, T3 15), of which restricted 261.
- Rejected documents: 31.
- Auditor disagreements on one document: 8; parse errors: 0.
| src | tier | verdict | title | url | slots | replaces | restriction |
|---|---|---|---|---|---|---|---|
| SRC-001 | T1 | admit | ECMA-262 17th edition (ECMAScript 2026), added by audit as the current published edition | https://262.ecma-international.org/17.0/ | 01_lang | LANG-K36 | - |
| SRC-002 | T1 | admit | ESLint rule: eqeqeq | https://eslint.org/docs/latest/rules/eqeqeq | 01_lang | LANG-K23 | - |
| SRC-003 | T1 | admit-restricted | ESLint rule: no-implicit-coercion | https://eslint.org/docs/latest/rules/no-implicit-coercion | 01_lang | LANG-K24 | What the rule flags and its options; its rationale is ESLint's readability position, not a mechanism |
| SRC-004 | T1 | admit | ESLint rule: no-var (candidate LANG-K25, first document) | https://eslint.org/docs/latest/rules/no-var | 01_lang | LANG-K25a | - |
| SRC-005 | T1 | admit | ESLint rule: prefer-const (candidate LANG-K25, second document) | https://eslint.org/docs/latest/rules/prefer-const | 01_lang | LANG-K25b | - |
| SRC-006 | T1 | admit | MDN: Array.prototype.toSorted() | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/toSorted | 01_lang | LANG-K22 | - |
| SRC-007 | T1 | admit | MDN: BigInt | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/BigInt | 01_lang | LANG-K07 | - |
| SRC-008 | T1 | admit | MDN: Classes | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Classes | 01_lang | LANG-K11 | - |
| SRC-009 | T1 | admit | MDN: const | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/const | 01_lang | LANG-K09 | - |
| SRC-010 | T1 | admit | MDN: Deprecated and obsolete features | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Deprecated_and_obsolete_features | 01_lang | LANG-K13 | - |
| SRC-011 | T1 | admit | MDN: Equality (==) operator | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Equality | 01_lang | LANG-K05 | - |
| SRC-012 | T1 | admit | MDN: Equality comparisons and sameness | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Equality_comparisons_and_sameness | 01_lang | LANG-K04 | - |
| SRC-013 | T1 | admit | MDN: Nullish coalescing (??) (candidate LANG-K20, second document) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Nullish_coalescing | 01_lang | LANG-K20b | - |
| SRC-014 | T1 | admit | MDN: Number | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number | 01_lang | LANG-K06 | - |
| SRC-015 | T1 | admit | MDN: Object.freeze() | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze | 01_lang | LANG-K08 | - |
| SRC-016 | T1 | admit | MDN: Optional chaining (?.) (candidate LANG-K20, first document) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Optional_chaining | 01_lang | LANG-K20a | - |
| SRC-017 | T1 | admit | MDN: Strict mode | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Strict_mode | 01_lang | LANG-K03 | - |
| SRC-018 | T1 | admit | MDN: structuredClone() | https://developer.mozilla.org/en-US/docs/Web/API/Window/structuredClone | 01_lang | LANG-K21 | - |
| SRC-019 | T1 | admit-restricted | MDN: Temporal | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Temporal | 01_lang | LANG-K19 | API semantics; availability status only as of the page date (2025-12-08), recheck before citing |
| SRC-020 | T1 | admit | MDN: this | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/this | 01_lang | LANG-K10 | - |
| SRC-021 | T1 | admit | MDN: var | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/var | 01_lang | LANG-K15 | - |
| SRC-022 | T1 | admit | MDN: with statement | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/with | 01_lang | LANG-K14 | - |
| SRC-023 | T1 | admit-restricted | TC39 BigInt proposal repository (origin of LANG-K30, added by audit) | https://github.com/tc39/proposal-bigint | 01_lang | LANG-K30o | Motivation and use cases (integers above 2^53, 64-bit IDs, timestamps); semantics from ECMA-262 6.1.6.2 and MDN |
| SRC-024 | T1 | admit-restricted | TC39 class fields proposal repository (origin of LANG-K31, added by audit) | https://github.com/tc39/proposal-class-fields | 01_lang | LANG-K31o | Design rationale for public and private fields ("no backdoor" to private state); semantics from ECMA-262 and MDN |
| SRC-025 | T1 | admit-restricted | Temporal proposal repository | https://github.com/tc39/proposal-temporal | 01_lang | LANG-K18 | Design intent, "all Temporal objects are immutable", shipping status as dated facts; normative semantics from ECMA-262 once merged |
| SRC-026 | T1 | admit | typescript-eslint rule: no-unnecessary-condition | https://typescript-eslint.io/rules/no-unnecessary-condition/ | 01_lang | LANG-K26 | - |
| SRC-027 | T1 | admit | ECMAScript Language Specification, living draft (ECMAScript 2027) | https://tc39.es/ecma262/ | 01_lang, 02_types, 03_async, 04_struct | ASYNC-K01, LANG-K01, STRUCT-K01, TYPES-K26 | - |
| SRC-028 | T1 | admit-restricted | TC39 finished proposals | https://github.com/tc39/proposals/blob/main/finished-proposals.md | 01_lang, 03_async | ASYNC-K07, LANG-K17 | 01_lang: Stage 4 status and expected edition year per feature only; feature semantics from ECMA-262 or MDN; 03_async: register facts only: stage 4 status, champions and publication year of each feature; no semantics |
| SRC-029 | T1 | admit-restricted | JavaScript modules (MDN guide) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules | 01_lang, 04_struct | LANG-K12, STRUCT-K02 | unrestricted for 01_lang; 04_struct: mechanism facts (live bindings, how cycles fail, aggregation syntax, top-level await, hoisting); its advice "You should usually avoid cyclic imports" and its cycle-elimination moves are MDN's editorial position |
| SRC-030 | T1 | admit | Node.js: Modules: ECMAScript modules | https://nodejs.org/api/esm.html | 01_lang, 04_struct | LANG-K16, STRUCT-K05 | - |
| SRC-031 | T1 | admit-restricted | Ajv documentation | https://ajv.js.org/ | 02_types | TYPES-K32 | Facts about Ajv's own behaviour only, including its security page (schemas treated as trusted code, ReDoS in formats); no performance or preference claims |
| SRC-032 | T1 | admit-restricted | Announcing TypeScript 5.8 | https://devblogs.microsoft.com/typescript/announcing-typescript-5-8/ | 02_types | TYPES-K11 | Facts about TypeScript's own behaviour only (erasableSyntaxOnly introduced in 5.8 for Node type stripping); no normative claim |
| SRC-033 | T1 | admit-restricted | Announcing TypeScript 6.0 | https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/ | 02_types | TYPES-K12 | Facts about TypeScript 6.0 behaviour only (strict default true, types default empty, deprecations); no normative claim |
| SRC-034 | T1 | admit-restricted | Announcing TypeScript 7.0 | https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/ | 02_types | TYPES-K13 | Facts about TypeScript 7.0 behaviour only (Go-native compiler, 6.0 defaults kept, JSDoc rework removing @enum, Closure-style syntax, standalone ?, postfix !; no API until 7.1); speed figures are vendor measurements |
| SRC-035 | T1 | admit | MDN: JSON.parse() | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/parse | 02_types | TYPES-K25 | - |
| SRC-036 | T1 | admit-restricted | microsoft/typescript-go repository (archived) | https://github.com/microsoft/typescript-go | 02_types | TYPES-K15 | Facts on known differences of the TypeScript 7 port (declaration emit, JS and JSDoc checking) as of archiving on 2026-09-01 |
| SRC-037 | T1 | admit | Node.js previous releases | https://nodejs.org/en/about/previous-releases | 02_types | TYPES-K27 | - |
| SRC-038 | T1 | admit | Node.js: Modules: TypeScript (type stripping) | https://nodejs.org/api/typescript.html | 02_types | TYPES-K01 | - |
| SRC-039 | T1 | admit | OWASP ASVS 5.0.0, V2 Validation and Business Logic | https://raw.githubusercontent.com/OWASP/ASVS/master/5.0/en/0x11-V2-Validation-and-Business-Logic.md | 02_types | TYPES-K22 | - |
| SRC-040 | T1 | admit-restricted | OWASP Mass Assignment Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html | 02_types | TYPES-K23 | Language-neutral sections only (DTOs, allowlisted binding, why denylists fail); not the Node and Mongoose library recommendations |
| SRC-041 | T1 | admit-restricted | Standard Schema specification | https://github.com/standard-schema/standard-schema | 02_types | TYPES-K28 | Facts about the Standard Schema V1 interface only; adoption unverified; never grounds a claim that it should be used |
| SRC-042 | T1 | admit-restricted | TC39 stage 1 proposals list | https://github.com/tc39/proposals/blob/main/stage-1-proposals.md | 02_types | TYPES-K04 | Proposal status facts only (Type Annotations: Stage 1, last presented 2023-09-27) |
| SRC-043 | T1 | admit | TypeScript handbook: Everyday Types | https://www.typescriptlang.org/docs/handbook/2/everyday-types.html | 02_types | TYPES-K08 | - |
| SRC-044 | T1 | admit-restricted | TypeScript handbook: JSDoc Reference | https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html | 02_types | TYPES-K07 | Supported JSDoc tags for TypeScript up to 6.x; the @enum and Closure-style syntax entries are superseded by 7.0 (TYPES-K13) |
| SRC-045 | T1 | admit | TypeScript handbook: More on Functions | https://www.typescriptlang.org/docs/handbook/2/functions.html | 02_types | TYPES-K09 | - |
| SRC-046 | T1 | admit | TypeScript handbook: Narrowing | https://www.typescriptlang.org/docs/handbook/2/narrowing.html | 02_types | TYPES-K10 | - |
| SRC-047 | T1 | admit-restricted | TypeScript handbook: Type Checking JavaScript Files | https://www.typescriptlang.org/docs/handbook/type-checking-javascript-files.html | 02_types | TYPES-K06 | JS-file checking behaviour of TypeScript up to 6.x; for 7.0 changes to JS and JSDoc checking, TYPES-K13 governs |
| SRC-048 | T1 | admit | typescript-eslint rule: no-explicit-any | https://typescript-eslint.io/rules/no-explicit-any | 02_types | TYPES-K17 | - |
| SRC-049 | T1 | admit | typescript-eslint rule: no-unsafe-assignment | https://typescript-eslint.io/rules/no-unsafe-assignment | 02_types | TYPES-K18 | - |
| SRC-050 | T1 | admit-restricted | Valibot documentation | https://valibot.dev/guides/introduction/ | 02_types | TYPES-K31 | Facts about Valibot's own behaviour only; excludes the "up to 95% smaller than Zod" and bundle-size claims |
| SRC-051 | T1 | admit-restricted | Zod documentation | https://zod.dev/ | 02_types | TYPES-K30 | Facts about Zod's own behaviour only (parse, safeParse, inference, versions); never a claim that it should be preferred |
| SRC-052 | T1 | admit | TypeScript TSConfig Reference | https://www.typescriptlang.org/tsconfig/ | 02_types, 04_struct | STRUCT-K09, TYPES-K05 | - |
| SRC-053 | T1 | admit-restricted | OWASP Input Validation Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html | 02_types, 06_runsec | RUNSEC-K15, TYPES-K21 | unrestricted for 02_types; 06_runsec: Regex-safety statements only (bound length, non-backtracking engine or timeout, timeout as failure), each cross-checked against K20 |
| SRC-054 | T1 | admit-restricted | typescript-eslint shared configs | https://typescript-eslint.io/users/configs/ | 02_types, 08_quality | QUALITY-K04, TYPES-K19 | unrestricted for 08_quality; 02_types: Config contents and stability facts; "strict only if a nontrivial share of developers are highly proficient" is the project's position |
| SRC-055 | T1 | admit | AbortSignal (MDN reference) | https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal | 03_async | ASYNC-K21 | - |
| SRC-056 | T1 | admit | async function (MDN reference) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/async_function | 03_async | ASYNC-K20 | - |
| SRC-057 | T1 | admit | DOM Standard: aborting ongoing activities | https://dom.spec.whatwg.org/#aborting-ongoing-activities | 03_async | ASYNC-K05 | - |
| SRC-058 | T1 | admit | Error: cause (MDN reference) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error/cause | 03_async | ASYNC-K22 | - |
| SRC-059 | T1 | admit-restricted | ESLint rule no-async-promise-executor | https://eslint.org/docs/latest/rules/no-async-promise-executor | 03_async | ASYNC-K28 | rule behaviour and stated rationale (errors thrown in an async executor are lost); not a tool-preference ground |
| SRC-060 | T1 | admit-restricted | ESLint rule require-atomic-updates | https://eslint.org/docs/latest/rules/require-atomic-updates | 03_async | ASYNC-K29 | rule behaviour and the race it targets (stale read across await or yield); the rule is not shown as recommended and its detection is heuristic |
| SRC-061 | T1 | admit | HTML Standard: event loops, microtasks, unhandled promise rejections | https://html.spec.whatwg.org/multipage/webappapis.html | 03_async | ASYNC-K02 | - |
| SRC-062 | T1 | admit | HTML Standard: timers | https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html | 03_async | ASYNC-K03 | - |
| SRC-063 | T1 | admit | HTML Standard: Web Workers | https://html.spec.whatwg.org/multipage/workers.html | 03_async | ASYNC-K04 | - |
| SRC-064 | T1 | admit | Node.js asynchronous context tracking | https://nodejs.org/api/async_context.html | 03_async | ASYNC-K17 | - |
| SRC-065 | T1 | admit | Node.js errors | https://nodejs.org/api/errors.html | 03_async | ASYNC-K15 | - |
| SRC-066 | T1 | admit | Node.js globals: AbortController, AbortSignal | https://nodejs.org/api/globals.html | 03_async | ASYNC-K14 | - |
| SRC-067 | T1 | admit | Node.js timers and timers/promises | https://nodejs.org/api/timers.html | 03_async | ASYNC-K13 | - |
| SRC-068 | T1 | admit-restricted | Node.js v15.0.0 release notes (Throw on unhandled rejections) | https://nodejs.org/en/blog/release/v15.0.0 | 03_async | ASYNC-K09o | history of the --unhandled-rejections default only (warn to throw in Node 15, PR 33021); current behaviour comes from ASYNC-K08 and ASYNC-K09 |
| SRC-069 | T1 | admit | Node.js worker_threads | https://nodejs.org/api/worker_threads.html | 03_async | ASYNC-K12 | - |
| SRC-070 | T1 | admit | proposal-error-cause | https://github.com/tc39/proposal-error-cause | 03_async | ASYNC-K06 | - |
| SRC-071 | T1 | admit | The Node.js Event Loop, timers and process.nextTick | https://nodejs.org/en/learn/asynchronous-work/event-loop-timers-and-nexttick | 03_async | ASYNC-K11 | - |
| SRC-072 | T1 | admit-restricted | typescript-eslint rule no-floating-promises | https://typescript-eslint.io/rules/no-floating-promises/ | 03_async | ASYNC-K25 | what the rule reports and its stated rationale; never a ground that typescript-eslint be preferred; the runtime consequence is grounded in ASYNC-K02 and K08 |
| SRC-073 | T1 | admit-restricted | typescript-eslint rule no-misused-promises | https://typescript-eslint.io/rules/no-misused-promises/ | 03_async | ASYNC-K26 | as ASYNC-K25 |
| SRC-074 | T1 | admit-restricted | typescript-eslint rule only-throw-error | https://typescript-eslint.io/rules/only-throw-error/ | 03_async | ASYNC-K27 | as ASYNC-K25 |
| SRC-075 | T1 | admit-restricted | Using promises (MDN guide) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Using_promises | 03_async | ASYNC-K19 | mechanism facts that agree with ASYNC-K01 and ASYNC-K02 (chaining, error propagation, microtask timing); its recommendations are recorded as MDN's editorial position |
| SRC-076 | T1 | admit-restricted | Using Web Workers (MDN guide) | https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Using_web_workers | 03_async | ASYNC-K23 | facts that agree with ASYNC-K04; guide advice recorded as MDN's position |
| SRC-077 | T1 | admit | Window: unhandledrejection event (MDN reference) | https://developer.mozilla.org/en-US/docs/Web/API/Window/unhandledrejection_event | 03_async | ASYNC-K24 | - |
| SRC-078 | T1 | admit-restricted | Node.js Security Best Practices (supply chain section) | https://nodejs.org/en/learn/getting-started/security-best-practices | 03_async, 06_runsec, 07_supply | ASYNC-K18, RUNSEC-K01, SUPPLY-K12 | unrestricted for 03_async, 06_runsec; 07_supply: attack-vector list and mitigations not superseded by npm 12 docs; ignore-scripts advice applies to npm before v12 only; the Socket mention never grounds a tool choice |
| SRC-079 | T1 | admit | Node.js CLI: --unhandled-rejections=mode | https://nodejs.org/api/cli.html | 03_async, 06_runsec, 09_runtime | ASYNC-K09, RUNSEC-K06, RUNTIME-K14 | - |
| SRC-080 | T1 | admit-restricted | Don't Block the Event Loop (or the Worker Pool) | https://nodejs.org/en/learn/asynchronous-work/dont-block-the-event-loop | 03_async, 09_runtime | ASYNC-K10, RUNTIME-K23 | 03_async: mechanism only: event loop versus worker pool, what runs where, blocking examples (ReDoS, JSON DoS, sync core APIs), task partitioning; its offloading recommendations are excluded; 09_runtime: Mechanism (event loop vs worker pool, blocking classes, JSON and regex cost); its API list (complete "as of Node.js v9") and third-party module suggestions not admitted |
| SRC-081 | T1 | admit | Node.js events | https://nodejs.org/api/events.html | 03_async, 09_runtime | ASYNC-K16, RUNTIME-K07 | - |
| SRC-082 | T1 | admit | Node.js process API: unhandledRejection, rejectionHandled | https://nodejs.org/api/process.html | 03_async, 09_runtime | ASYNC-K08, RUNTIME-K05 | - |
| SRC-083 | T1 | admit-restricted | Closures (MDN guide) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Closures | 04_struct | STRUCT-K14 | closure mechanism and the performance note only; the var, IIFE and "emulating private methods" patterns are superseded by modules and STRUCT-K12 |
| SRC-084 | T1 | admit-restricted | ESLint rule max-params | https://eslint.org/docs/latest/rules/max-params | 04_struct | STRUCT-K15 | rule behaviour and stated rationale (memorising order and types); the default of 3 is a configuration default, not evidence |
| SRC-085 | T1 | admit-restricted | ESLint rule no-restricted-imports | https://eslint.org/docs/latest/rules/no-restricted-imports | 04_struct | STRUCT-K16 | the mechanism for forbidding imports by name or pattern; grounds no layering principle |
| SRC-086 | T1 | admit | export statement (MDN reference) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/export | 04_struct | STRUCT-K04 | - |
| SRC-087 | T1 | admit | import statement (MDN reference) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/import | 04_struct | STRUCT-K03 | - |
| SRC-088 | T1 | admit-restricted | Inheritance and the prototype chain (MDN guide) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Inheritance_and_the_prototype_chain | 04_struct | STRUCT-K13 | mechanism facts: classes over prototypes, setPrototypeOf de-optimisation warning, forward-compatibility risk of extending built-in prototypes |
| SRC-089 | T1 | admit | Node.js CommonJS modules | https://nodejs.org/api/modules.html | 04_struct | STRUCT-K07 | - |
| SRC-090 | T1 | admit | Node.js packages | https://nodejs.org/api/packages.html | 04_struct | STRUCT-K06 | - |
| SRC-091 | T1 | admit | Private elements (MDN reference) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Classes/Private_elements | 04_struct | STRUCT-K12 | - |
| SRC-092 | T1 | admit | Top-level await proposal | https://github.com/tc39/proposal-top-level-await | 04_struct | STRUCT-K08 | - |
| SRC-093 | T1 | admit-restricted | TypeScript handbook: Do's and Don'ts | https://www.typescriptlang.org/docs/handbook/declaration-files/do-s-and-don-ts.html | 04_struct | STRUCT-K11 | signature-shape rules for declared APIs (optional parameters over overloads, unions over overloads, callback types) with their stated why; transfer to implementation API design is inference |
| SRC-094 | T1 | admit | TypeScript handbook: Modules, theory | https://www.typescriptlang.org/docs/handbook/modules/theory.html | 04_struct | STRUCT-K10 | - |
| SRC-095 | T1 | admit-restricted | webpack Tree Shaking guide | https://webpack.js.org/guides/tree-shaking/ | 04_struct | STRUCT-K29 | webpack's own behaviour for the sideEffects field and pure annotations; not a language or Node rule (Node ignores the field, STRUCT-K06); never a ground for preferring webpack |
| SRC-096 | T1 | admit-restricted | Content Security Policy Level 3 | https://www.w3.org/TR/CSP3/ | 05_domsec, 14_secgap2 | DOMSEC-K19, SECGAP2-K43 | unrestricted for 14_secgap2; 05_domsec: Only what CSP means for code (inline script, eval, Trusted Types directives); CSP as a deployment policy belongs to web_architecture_guidelines |
| SRC-097 | T1 | admit | Cross-site scripting (XSS) (MDN) | https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS | 05_domsec | DOMSEC-K23 | - |
| SRC-098 | T1 | admit-restricted | DOMPurify README | https://github.com/cure53/DOMPurify | 05_domsec | DOMSEC-K13 | Facts about DOMPurify's own behaviour only (what it removes, RETURN_TRUSTED_TYPE, the sanitize-then-modify warning); never grounds a preference for DOMPurify |
| SRC-099 | T1 | admit-restricted | DOMPurify security advisories | https://github.com/cure53/DOMPurify/security/advisories | 05_domsec | DOMSEC-K14 | Facts only: bypass history (10 advisories May to Oct 2026, GHSA-cg2g-xh64-v4q7 High); no advice |
| SRC-100 | T1 | admit | Element: setHTMLUnsafe() (MDN) | https://developer.mozilla.org/en-US/docs/Web/API/Element/setHTMLUnsafe | 05_domsec | DOMSEC-K25 | - |
| SRC-101 | T1 | admit | HTML Sanitizer API (MDN) | https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API | 05_domsec | DOMSEC-K11 | - |
| SRC-102 | T1 | admit | HTML Standard, Dynamic markup insertion and HTML Sanitization (sections 8.5.2 and 8.6) | https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html | 05_domsec | DOMSEC-K12o | - |
| SRC-103 | T1 | admit | HTML Standard, link types noopener and noreferrer | https://html.spec.whatwg.org/multipage/links.html#link-type-noopener | 05_domsec | DOMSEC-K26 | - |
| SRC-104 | T1 | admit | HTML Standard, Web messaging | https://html.spec.whatwg.org/multipage/web-messaging.html | 05_domsec | DOMSEC-K06 | - |
| SRC-105 | T1 | admit | iframe element (MDN) | https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/iframe | 05_domsec | DOMSEC-K27 | - |
| SRC-106 | T1 | admit-restricted | OWASP ASVS 5.0, V3 Web Frontend Security | https://github.com/OWASP/ASVS/blob/master/5.0/en/0x12-V3-Web-Frontend-Security.md | 05_domsec, 14_secgap2 | DOMSEC-K18, SECGAP2-K56 | 05_domsec: Verification requirements as checklist items (3.2.2, 3.2.3, 3.5.5, 3.6.1 and others); mechanisms must come from another T1; headers and cookies are web-architecture; 14_secgap2: Adds to SRC-106 these ids, checklist items only, each with its stated topic: 3.3.2 (SameSite per cookie purpose, CSRF), 3.4.6 (frame-ancestors on every response), 3.5.1 and 3.5.2 (CORS preflight reliance, cross-origin request validation), 3.5.3 (sensitive functionality uses non-safe HTTP methods), 3.7.2 (redirect to another host only if allowlisted); cookie and header deployment stay web-architecture |
| SRC-107 | T1 | admit-restricted | OWASP Content Security Policy Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html | 05_domsec | DOMSEC-K20 | Only the claim that CSP is a second layer behind secure code, and strict-CSP effects on code; deployment policy is web-architecture |
| SRC-108 | T1 | admit-restricted | OWASP DOM based XSS Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html | 05_domsec | DOMSEC-K01 | JavaScript sink, source and safe-DOM-method rules only; server-side encoder library mentions (ESAPI, Java Encoder, Jtidy) out of scope; no Trusted Types content |
| SRC-109 | T1 | admit | OWASP DOM Clobbering Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html | 05_domsec | DOMSEC-K15 | - |
| SRC-110 | T1 | admit | OWASP HTML5 Security Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html | 05_domsec | DOMSEC-K08 | - |
| SRC-111 | T1 | admit-restricted | OWASP Session Management Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html | 05_domsec | DOMSEC-K21 | Code-level rule only: no tokens or credentials in localStorage or sessionStorage; session architecture is web-architecture |
| SRC-112 | T1 | admit | OWASP Third Party JavaScript Management Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html | 05_domsec | DOMSEC-K16 | - |
| SRC-113 | T1 | admit | Subresource Integrity (MDN) | https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity | 05_domsec | DOMSEC-K10 | - |
| SRC-114 | T1 | admit | Subresource Integrity (W3C WD, SRI 2) | https://www.w3.org/TR/SRI/ | 05_domsec | DOMSEC-K09 | - |
| SRC-115 | T1 | admit | Trusted Types (W3C WD) | https://www.w3.org/TR/trusted-types/ | 05_domsec | DOMSEC-K03 | - |
| SRC-116 | T1 | admit | URL Standard | https://url.spec.whatwg.org/ | 05_domsec | DOMSEC-K17 | - |
| SRC-117 | T1 | admit | Web Storage API (MDN) | https://developer.mozilla.org/en-US/docs/Web/API/Web_Storage_API | 05_domsec | DOMSEC-K22 | - |
| SRC-118 | T1 | admit | Window: postMessage() (MDN) | https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage | 05_domsec | DOMSEC-K07 | - |
| SRC-119 | T1 | admit | OWASP Cross Site Scripting Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html | 05_domsec, 10_frameworks | DOMSEC-K02, FW-K04 | - |
| SRC-120 | T1 | admit | Trusted Types API (MDN) | https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API | 05_domsec, 10_frameworks | DOMSEC-K04, FW-K03 | - |
| SRC-121 | T1 | admit | Correctly Using Regular Expressions for Secure Input Validation | https://best.openssf.org/Correctly-Using-Regular-Expressions | 06_runsec | RUNSEC-K20 | - |
| SRC-122 | T1 | admit | ECMAScript Language Specification, Annex B | https://tc39.es/ecma262/multipage/additional-ecmascript-features-for-web-browsers.html | 06_runsec | RUNSEC-K11 | - |
| SRC-123 | T1 | admit | eval() (MDN) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval | 06_runsec | RUNSEC-K08 | - |
| SRC-124 | T1 | admit | Function() constructor (MDN) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/Function | 06_runsec | RUNSEC-K09 | - |
| SRC-125 | T1 | admit-restricted | GHSA-jf85-cpcp-j695 / CVE-2019-10744: Prototype Pollution in lodash | https://github.com/advisories/GHSA-jf85-cpcp-j695 | 06_runsec | RUNSEC-K21o | Facts only: lodash before 4.17.12 defaultsDeep via constructor.prototype, CVSS 9.1, published 2019-07-10 |
| SRC-126 | T1 | admit | Node.js API: child_process | https://nodejs.org/api/child_process.html | 06_runsec | RUNSEC-K04 | - |
| SRC-127 | T1 | admit | Node.js API: path | https://nodejs.org/api/path.html | 06_runsec | RUNSEC-K36 | - |
| SRC-128 | T1 | admit | Node.js API: Permissions | https://nodejs.org/api/permissions.html | 06_runsec | RUNSEC-K02 | - |
| SRC-129 | T1 | admit | Node.js API: vm | https://nodejs.org/api/vm.html | 06_runsec | RUNSEC-K05 | - |
| SRC-130 | T1 | admit-restricted | Node.js security releases, January 2026 (CVE-2025-55130 permission-model symlink bypass) | https://nodejs.org/en/blog/vulnerability/december-2025-security-releases | 06_runsec | RUNSEC-K22o | Facts only: --allow-fs-read and --allow-fs-write bypass via relative symlinks, High, Node 20, 22, 24, 25, fixed in 20.20.0, 22.22.0, 24.13.0, 25.3.0 |
| SRC-131 | T1 | admit | Object.prototype.proto (MDN) | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/proto | 06_runsec | RUNSEC-K10 | - |
| SRC-132 | T1 | admit-restricted | OWASP ASVS 5.0 | https://github.com/OWASP/ASVS/tree/master/5.0/en | 06_runsec | RUNSEC-K19 | Verification requirements only; read: 5.3.2 (file paths), 5.4.1, 15.3.6 (prototype pollution, Set or Map), 15.1.5 (dangerous functionality incl. deserialization); mechanisms come from another T1 |
| SRC-133 | T1 | admit-restricted | OWASP Deserialization Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html | 06_runsec | RUNSEC-K18 | Language-neutral principles only; JavaScript not covered (PHP, Python, Java, .NET) |
| SRC-134 | T1 | admit | OWASP JavaScript and TypeScript Security Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/JavaScript_and_TypeScript_Security_Cheat_Sheet.html | 06_runsec | RUNSEC-K14 | - |
| SRC-135 | T1 | admit-restricted | OWASP NodeJS Security Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html | 06_runsec | RUNSEC-K13 | Statements on Node core API risks only (eval, child_process.exec, ReDoS, path traversal); its third-party npm package recommendations are excluded |
| SRC-136 | T1 | admit-restricted | OWASP OS Command Injection Defense Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html | 06_runsec | RUNSEC-K17 | Principles only (avoid shell, parameterize, allowlist); examples are Java, .NET, PHP |
| SRC-137 | T1 | admit | OWASP Prototype Pollution Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html | 06_runsec | RUNSEC-K12 | - |
| SRC-138 | T1 | admit-restricted | OWASP Secrets Management Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html | 06_runsec | RUNSEC-K16 | Language-neutral principles only (no hardcoded secrets, env variables as weaker option, pre-commit detection); no JavaScript-specific claim |
| SRC-139 | T1 | admit | Prototype pollution (MDN) | https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution | 06_runsec | RUNSEC-K07 | - |
| SRC-140 | T1 | admit | Node.js SECURITY.md (threat model) | https://github.com/nodejs/node/blob/main/SECURITY.md | 06_runsec, 07_supply, 14_secgap2 | RUNSEC-K03, SECGAP2-K58, SUPPLY-K13 | - |
| SRC-141 | T1 | admit-restricted | About access tokens | https://docs.npmjs.com/about-access-tokens | 07_supply | SUPPLY-K10 | facts about npm token policy and dates (legacy tokens removed Nov 2025, bypass-2FA limits Aug 2026, direct publishing with GAT removed Jan 2027); publisher side |
| SRC-142 | T1 | admit-restricted | About ECDSA registry signatures | https://docs.npmjs.com/about-registry-signatures | 07_supply | SUPPLY-K09 | facts about registry signatures (ecdsa-sha2-nistp256, protects against tampering mirrors and proxies) |
| SRC-143 | T1 | admit-restricted | About scopes | https://docs.npmjs.com/about-scopes | 07_supply | SUPPLY-K11 | facts about scope ownership and namespacing only; the page does not address typosquatting or dependency confusion |
| SRC-144 | T1 | admit | Concise Guide for Evaluating Open Source Software | https://best.openssf.org/Concise-Guide-for-Evaluating-Open-Source-Software | 07_supply | SUPPLY-K15 | - |
| SRC-145 | T1 | admit-restricted | CVE-2021-24105, Package Managers Configurations Remote Code Execution Vulnerability | https://cveawg.mitre.org/api/cve/CVE-2021-24105 | 07_supply | SUPPLY-K43 | facts only: dependency-confusion class across pip, NuGet, Maven, npm, published 2021-02-25 by Microsoft, CVSS 8.4; no advice |
| SRC-146 | T1 | admit-restricted | Dependabot options reference, cooldown | https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference | 07_supply | SUPPLY-K40o | facts about Dependabot cooldown (3-day default for version updates, security updates exempt, per-semver parameters); no preference for Dependabot |
| SRC-147 | T1 | admit-restricted | Generating provenance statements (npm Docs) | https://docs.npmjs.com/generating-provenance-statements | 07_supply | SUPPLY-K01 | facts about npm provenance behaviour and its stated limit (provenance does not guarantee absence of malicious code); no preference for npm over other clients |
| SRC-148 | T1 | admit-restricted | GHSA-4x49-vf9v-38px, CVE-2025-59144, debug 4.4.2 | https://github.com/advisories/GHSA-4x49-vf9v-38px | 07_supply | SUPPLY-K20 | incident facts only (phishing takeover 2025-09-08, browser-only payload, fixed 4.4.3); remediation steps are not guideline advice |
| SRC-149 | T1 | admit-restricted | npm audit (npm CLI v12.2.0) | https://docs.npmjs.com/cli/v12/commands/npm-audit | 07_supply | SUPPLY-K03 | facts about npm audit and audit signatures behaviour (data sent to registry, lockfile dependence, manual fixes); not evidence of audit accuracy |
| SRC-150 | T1 | admit-restricted | npm ci (npm CLI v12.2.0) | https://docs.npmjs.com/cli/v12/commands/npm-ci | 07_supply | SUPPLY-K04 | facts about npm ci (requires lockfile, errors on mismatch); no preference for npm |
| SRC-151 | T1 | admit-restricted | npm CLI v12.0.0 changelog | https://docs.npmjs.com/cli/v12/using-npm/changelog/ | 07_supply | SUPPLY-K08 | facts about v12 breaking changes (dependency lifecycle scripts blocked, allow-git and allow-remote none, shrinkwrap removed), dated 2026-07-08 |
| SRC-152 | T1 | admit-restricted | npm config (npm CLI v12.2.0) | https://docs.npmjs.com/cli/v12/using-npm/config | 07_supply | SUPPLY-K06 | facts about config keys and defaults (ignore-scripts, allow-scripts, min-release-age, before, allow-git default none); not evidence that delay works |
| SRC-153 | T1 | admit-restricted | npm install-scripts (npm CLI v12.2.0) | https://docs.npmjs.com/cli/v12/commands/npm-install-scripts/ | 07_supply | SUPPLY-K07 | facts about install-script approval (blocked by default, version-pinned approvals); no preference for npm |
| SRC-154 | T1 | admit-restricted | OpenSSF npm Best Practices Guide v1.1 | https://github.com/ossf/package-manager-best-practices/blob/main/published/npm.md | 07_supply | SUPPLY-K14 | items not superseded by npm 12 docs (K05 to K08), recorded as archived 2023 guidance; shrinkwrap items excluded; no provenance coverage |
| SRC-155 | T1 | admit-restricted | OWASP NPM Security Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html | 07_supply | SUPPLY-K18 | mitigation items not superseded by npm 12 docs; named tools (Snyk, LavaMoat, Verdaccio) never ground a tool choice; ignore-scripts advice applies to npm before v12 |
| SRC-156 | T1 | admit | OWASP Software Supply Chain Security Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.html | 07_supply | SUPPLY-K19 | - |
| SRC-157 | T1 | admit-restricted | package-lock.json (npm CLI v12.2.0) | https://docs.npmjs.com/cli/v12/configuring-npm/package-lock-json | 07_supply | SUPPLY-K05 | facts about npm lockfile format and integrity field; shrinkwrap no longer read or written as of v12 |
| SRC-158 | T1 | admit-restricted | pnpm: Mitigating supply chain attacks, and build settings | https://pnpm.io/supply-chain-security | 07_supply | SUPPLY-K41 | facts about pnpm behaviour (dependency build scripts blocked since v10, allowBuilds, strictDepBuilds default true, minimumReleaseAge default 1440 minutes, trustPolicy); the page's framing in favour of pnpm is excluded; second page https://pnpm.io/settings/build |
| SRC-159 | T1 | admit | SLSA specification v1.2 | https://slsa.dev/spec/v1.2/ | 07_supply | SUPPLY-K16 | - |
| SRC-160 | T1 | admit-restricted | Trusted publishing for npm packages | https://docs.npmjs.com/trusted-publishers | 07_supply | SUPPLY-K02 | facts about npm trusted publishing (OIDC, supported CI providers, npm 11.5.1+ and Node 22.14+); no preference for npm |
| SRC-161 | T1 | admit-restricted | OpenSSF Scorecard checks | https://github.com/ossf/scorecard/blob/main/docs/checks.md | 07_supply, 08_quality | QUALITY-K08, SUPPLY-K17 | 07_supply: facts about what each check detects and its stated limits (GitHub-only checks, false negatives); a score is never evidence a package is safe; 08_quality: Facts about what Scorecard checks and how it rates risk; presence of a check grounds "Scorecard rewards X", not that X is effective |
| SRC-162 | T1 | admit-restricted | Biome: Linter | https://biomejs.dev/linter/ | 08_quality | QUALITY-K24 | Facts about Biome's own behaviour (one tool for linting and formatting, rule set); never grounds preferring Biome |
| SRC-163 | T1 | admit-restricted | Concise Guide for Developing More Secure Software | https://best.openssf.org/Concise-Guide-for-Developing-More-Secure-Software | 08_quality | QUALITY-K10 | OpenSSF Best Practices WG recommendations as that body's positions; the claim that a ~3-day cooldown counters most malicious releases needs its origin before use |
| SRC-164 | T1 | admit-restricted | eslint-plugin-security | https://github.com/eslint-community/eslint-plugin-security | 08_quality | QUALITY-K34 | Facts about the plugin, including its maintainers' statement that it "finds a lot of false positives"; boundary RUNSEC |
| SRC-165 | T1 | admit | ESLint: Command Line Interface | https://eslint.org/docs/latest/use/command-line-interface | 08_quality | QUALITY-K03 | - |
| SRC-166 | T1 | admit | ESLint: Configuration Files | https://eslint.org/docs/latest/use/configure/configuration-files | 08_quality | QUALITY-K01 | - |
| SRC-167 | T1 | admit | ESLint: Rules Reference | https://eslint.org/docs/latest/rules/ | 08_quality | QUALITY-K02 | - |
| SRC-168 | T1 | admit-restricted | fast-check documentation and repository | https://fast-check.dev/docs/introduction/ | 08_quality | QUALITY-K30 | Facts about fast-check's own behaviour (generation, shrinking, seed and path replay); never grounds that property-based testing beats example tests |
| SRC-169 | T1 | admit-restricted | GitHub Docs: About protected branches | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches | 08_quality | QUALITY-K33 | Facts about GitHub's own platform (required status checks, required reviews) |
| SRC-170 | T1 | admit-restricted | Jest: Getting Started | https://jestjs.io/docs/getting-started | 08_quality | QUALITY-K27 | Facts about Jest's own behaviour only; never grounds runner choice |
| SRC-171 | T1 | admit | Node.js: Assert | https://nodejs.org/api/assert.html | 08_quality | QUALITY-K07 | - |
| SRC-172 | T1 | admit-restricted | Node.js: Test runner (node:test) | https://nodejs.org/api/test.html | 08_quality | QUALITY-K06 | Facts about node:test; coverage collection only as an experimental feature (Stability 1, --experimental-test-coverage); never grounds preferring node:test over other runners |
| SRC-173 | T1 | admit-restricted | npm CLI: npm ci | https://docs.npmjs.com/cli/v11/commands/npm-ci | 08_quality | QUALITY-K11 | Facts about npm ci, re-read from the current docs (https://docs.npmjs.com/cli/v12/commands/npm-ci, v12.2.0) before citing |
| SRC-174 | T1 | admit | OpenSSF Best Practices Badge criteria (passing) | https://www.bestpractices.dev/en/criteria/0 | 08_quality | QUALITY-K09 | - |
| SRC-175 | T1 | admit-restricted | Playwright: Best Practices | https://playwright.dev/docs/best-practices | 08_quality | QUALITY-K28 | Facts about Playwright's own behaviour (locator auto-wait, web-first assertions retry); its testing advice and product recommendations are not admitted |
| SRC-176 | T1 | admit-restricted | Prettier: CLI | https://prettier.io/docs/cli#--check | 08_quality | QUALITY-K23 | Facts about the Prettier CLI (--check exit codes 0/1/2, --list-different, --write) |
| SRC-177 | T1 | admit-restricted | Prettier: Integrating with Linters | https://prettier.io/docs/integrating-with-linters | 08_quality | QUALITY-K22 | Prettier's own integration policy (eslint-config-prettier; eslint-plugin-prettier generally not recommended) as that project's position |
| SRC-178 | T1 | admit-restricted | Prettier: Rationale | https://prettier.io/docs/rationale | 08_quality | QUALITY-K21 | Facts about Prettier's own design and behaviour (prints, does not transform; printWidth as a guideline); never grounds adopting Prettier or its style as better |
| SRC-179 | T1 | admit-restricted | StrykerJS introduction | https://stryker-mutator.io/docs/stryker-js/introduction/ | 08_quality | QUALITY-K31 | Facts about StrykerJS's own behaviour only; its coverage analogy (docs root) is a position, not evidence |
| SRC-180 | T1 | admit-restricted | Testing Library: Guiding Principles | https://testing-library.com/docs/guiding-principles/ | 08_quality | QUALITY-K29 | The library's stated design principles as a fact about the library only; never evidence for a testing strategy |
| SRC-181 | T1 | admit | typescript-eslint: Linting with Type Information | https://typescript-eslint.io/getting-started/typed-linting | 08_quality | QUALITY-K05 | - |
| SRC-182 | T1 | admit-restricted | Vitest: Coverage | https://vitest.dev/guide/coverage.html | 08_quality | QUALITY-K26 | Vitest's own statements about its V8 and Istanbul providers (AST remapping since v3.2.0); threshold configuration not confirmed in my read |
| SRC-183 | T1 | admit-restricted | Vitest: Getting Started | https://vitest.dev/guide/ | 08_quality | QUALITY-K25 | Facts about Vitest's own behaviour only; never grounds runner choice |
| SRC-184 | T1 | admit-restricted | Backpressuring in Streams | https://nodejs.org/en/learn/modules/backpressuring-in-streams | 09_runtime | RUNTIME-K02 | Mechanism (reconfirmed by K01); the ~88 MB vs ~1.52 GB RSS and GC figures only as an illustration from an unstated Node version |
| SRC-185 | T1 | admit | Buffer | https://nodejs.org/api/buffer.html | 09_runtime | RUNTIME-K21 | - |
| SRC-186 | T1 | admit | Diagnostic report | https://nodejs.org/api/report.html | 09_runtime | RUNTIME-K15 | - |
| SRC-187 | T1 | admit | Diagnostics: User Journey | https://nodejs.org/en/learn/diagnostics/user-journey | 09_runtime | RUNTIME-K20 | - |
| SRC-188 | T1 | admit | File system | https://nodejs.org/api/fs.html | 09_runtime | RUNTIME-K22 | - |
| SRC-189 | T1 | admit-restricted | Flame Graphs | https://nodejs.org/en/learn/diagnostics/flame-graphs | 09_runtime | RUNTIME-K18 | Only what current docs (K14) reconfirm, such as the --perf-basic-prof flags; Node 8.x branch and the 0x tool not admitted |
| SRC-190 | T1 | admit | HTTP | https://nodejs.org/api/http.html | 09_runtime | RUNTIME-K06 | - |
| SRC-191 | T1 | admit | Inspector | https://nodejs.org/api/inspector.html | 09_runtime | RUNTIME-K16 | - |
| SRC-192 | T1 | admit | Memory (diagnostics) | https://nodejs.org/en/learn/diagnostics/memory | 09_runtime | RUNTIME-K08 | - |
| SRC-193 | T1 | admit | Memory management | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Memory_management | 09_runtime | RUNTIME-K24 | - |
| SRC-194 | T1 | admit | Performance measurement APIs | https://nodejs.org/api/perf_hooks.html | 09_runtime | RUNTIME-K19 | - |
| SRC-195 | T1 | admit-restricted | Profiling Node.js Applications | https://nodejs.org/en/learn/getting-started/profiling | 09_runtime | RUNTIME-K17 | --prof workflow; the 5.33 to 19.46 req/s (pbkdf2Sync vs pbkdf2) figures only as an illustration from an unstated Node version |
| SRC-196 | T1 | admit | Stream | https://nodejs.org/api/stream.html | 09_runtime | RUNTIME-K01 | - |
| SRC-197 | T1 | admit | Streams Standard | https://streams.spec.whatwg.org/ | 09_runtime | RUNTIME-K03 | - |
| SRC-198 | T1 | admit | Tracing Garbage Collection | https://nodejs.org/en/learn/diagnostics/memory/using-gc-traces | 09_runtime | RUNTIME-K12 | - |
| SRC-199 | T1 | admit | Understanding and Tuning Memory | https://nodejs.org/en/learn/diagnostics/memory/understanding-and-tuning-memory | 09_runtime | RUNTIME-K09 | - |
| SRC-200 | T1 | admit | Using Heap Profiler | https://nodejs.org/en/learn/diagnostics/memory/using-heap-profiler | 09_runtime | RUNTIME-K11 | - |
| SRC-201 | T1 | admit | Using Heap Snapshot | https://nodejs.org/en/learn/diagnostics/memory/using-heap-snapshot | 09_runtime | RUNTIME-K10 | - |
| SRC-202 | T1 | admit | V8 (module) | https://nodejs.org/api/v8.html | 09_runtime | RUNTIME-K13 | - |
| SRC-203 | T1 | admit | WeakRef | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WeakRef | 09_runtime | RUNTIME-K25 | - |
| SRC-204 | T1 | admit | Web Streams API (Node) | https://nodejs.org/api/webstreams.html | 09_runtime | RUNTIME-K04 | - |
| SRC-205 | T1 | admit-restricted | Angular Security Guide | https://angular.dev/best-practices/security | 10_frameworks | FW-K10 | facts about Angular's behaviour (all values untrusted by default, sanitization contexts, bypassSecurityTrust, CSP nonces, Trusted Types, XSRF, SSRF); no preference for Angular |
| SRC-206 | T1 | admit-restricted | Angular security policy (GitHub) | https://github.com/angular/angular/security/policy | 10_frameworks | FW-K13 | reporting channel and Google OSS VRP only; states no supported versions and no governance |
| SRC-207 | T1 | admit-restricted | Angular version compatibility | https://angular.dev/reference/versions | 10_frameworks | FW-K12 | facts about Angular's TypeScript and Node ranges per version (v22: TypeScript 6.0.x; Node 22.22.3+, 24.15.0+, 26) |
| SRC-208 | T1 | admit-restricted | Angular versioning and releases | https://angular.dev/reference/releases | 10_frameworks | FW-K11 | facts about Angular's support policy (12 months active plus 12 LTS, yearly major from v22, deprecation at least one major; v22 active, v21 and v20 LTS) |
| SRC-209 | T1 | admit-restricted | Critical Security Vulnerability in React Server Components | https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components | 10_frameworks | FW-K17 | disclosure facts with CVE ids (CVE-2025-55182 and four others, affected 19.0.0 to 19.2.0, fixed 19.0.1, 19.1.2, 19.2.1); boundary web-architecture for the server tier |
| SRC-210 | T1 | admit-restricted | GitHub Advisory Database, reviewed npm advisories (Svelte query) and React Server Components CVE records | https://github.com/advisories?query=ecosystem%3Anpm+type%3Areviewed+svelte | 10_frameworks | FW-K05 | individual records cited by GHSA or CVE id, facts only; the search listing and its count are not a comparison metric (query returns non-framework packages such as open-webui and devalue) |
| SRC-211 | T1 | admit | HTML Living Standard, custom elements | https://html.spec.whatwg.org/multipage/custom-elements.html | 10_frameworks | FW-K01 | - |
| SRC-212 | T1 | admit-restricted | htmx 4 documentation, security considerations | https://four.htmx.org/docs/ | 10_frameworks | FW-K41 | facts about htmx 4.x (config.mode same-origin default, hx-ignore, hx-csp extension, eval features disableable, 2.x to 4.x migration) |
| SRC-213 | T1 | admit-restricted | htmx documentation, security section (2.x) | https://htmx.org/docs/#security | 10_frameworks | FW-K37 | facts about htmx 2.x only (selfRequestsOnly, allowEval, allowScriptTags, hx-disable, CSP); its version status is out of date |
| SRC-214 | T1 | admit-restricted | htmx security policy | https://github.com/bigskysoftware/htmx/security/policy | 10_frameworks | FW-K39 | facts: supported versions 4.x, 2.x, 1.9.x; private GitHub reporting |
| SRC-215 | T1 | admit-restricted | Lit development tools, TypeScript | https://lit.dev/docs/tools/development/ | 10_frameworks | FW-K34 | facts: works with tsc and other compilers; experimental vs standard decorators, useDefineForClassFields setting |
| SRC-216 | T1 | admit-restricted | Lit documentation overview | https://lit.dev/docs/ | 10_frameworks | FW-K32 | facts: every Lit component is a standard web component; maintained by a Google team; copyright OpenJS Foundation and the Lit Project |
| SRC-217 | T1 | admit-restricted | Lit security policy | https://github.com/lit/lit/security/policy | 10_frameworks | FW-K33 | facts: security updates for the latest two majors, private GitHub reporting, 90-day disclosure |
| SRC-218 | T1 | admit-restricted | OpenJS Foundation projects | https://openjsf.org/projects | 10_frameworks | FW-K35 | facts on hosting and stage only (Lit: Incubation) |
| SRC-219 | T1 | admit-restricted | React 19.3 release, Trusted Types | https://react.dev/blog/2026/09/09/react-19-3 | 10_frameworks | FW-K19 | facts about React 19.3 behaviour (Trusted Types values passed without coercion) |
| SRC-220 | T1 | admit-restricted | React DOM common components, dangerouslySetInnerHTML | https://react.dev/reference/react-dom/components/common | 10_frameworks | FW-K14 | facts about React's behaviour (XSS warning, TrustedHTML passed without string conversion) |
| SRC-221 | T1 | admit-restricted | React versioning policy | https://react.dev/community/versioning-policy | 10_frameworks | FW-K15 | facts about React's release policy (semver, security fixes backported to all affected majors, no formal LTS) |
| SRC-222 | T1 | admit-restricted | Solid CONTRIBUTING | https://github.com/solidjs/solid/blob/main/CONTRIBUTING.md | 10_frameworks | FW-K31 | governance facts: core and ecosystem teams selected by core members only, no applications; no formal decision procedure |
| SRC-223 | T1 | admit-restricted | Solid security policy and advisory | https://github.com/solidjs/solid/security | 10_frameworks | FW-K30 | facts: report to security@ address, embargo rules, one High advisory GHSA-3qxh-p7jc-5xh6 (JSX fragment escaping, 2025-02-21); no supported versions; no security guide exists |
| SRC-224 | T1 | admit-restricted | Solid TypeScript configuration | https://docs.solidjs.com/configuration/typescript | 10_frameworks | FW-K29 | facts: Solid written in TypeScript, types out of the box, jsx preserve and jsxImportSource solid-js required |
| SRC-225 | T1 | admit-restricted | Svelte security policy and advisories | https://github.com/sveltejs/svelte/security/policy | 10_frameworks | FW-K27 | facts: reporting via Vercel HackerOne bounty, 2 and 4 week targets, no supported-versions statement; advisories at https://github.com/sveltejs/svelte/security/advisories (10 Moderate on first page, mostly SSR XSS, 2026) |
| SRC-226 | T1 | admit-restricted | Svelte TypeScript | https://svelte.dev/docs/svelte/typescript | 10_frameworks | FW-K26 | facts: type-only TypeScript by default, enums and similar need a preprocessor |
| SRC-227 | T1 | admit-restricted | Svelte {@html} reference | https://svelte.dev/docs/svelte/@html | 10_frameworks | FW-K24 | facts: raw HTML is not escaped, developer must sanitize |
| SRC-228 | T1 | admit-restricted | SvelteKit configuration, csp and csrf | https://svelte.dev/docs/kit/configuration | 10_frameworks | FW-K25 | facts about SvelteKit CSP modes (hash, nonce, auto) and CSRF options (checkOrigin deprecated, trustedOrigins); boundary web-architecture |
| SRC-229 | T1 | admit-restricted | The React Foundation: A New Home for React Hosted by the Linux Foundation | https://react.dev/blog/2026/02/24/the-react-foundation | 10_frameworks | FW-K18 | governance facts as of 2026-02-24 (Linux Foundation host, eight platinum board members, technical governance independent of the board, provisional leadership council); mark provisional |
| SRC-230 | T1 | admit-restricted | Using TypeScript (React) | https://react.dev/learn/typescript | 10_frameworks | FW-K16 | facts: React types come from @types/react and @types/react-dom, maintained in DefinitelyTyped outside the React package |
| SRC-231 | T1 | admit-restricted | Vue releases | https://vuejs.org/about/releases | 10_frameworks | FW-K21 | facts about Vue's release policy (no fixed cycle, minors every 3 to 6 months, typings may break in minors); states no LTS or EOL |
| SRC-232 | T1 | admit-restricted | Vue Security guide | https://vuejs.org/guide/best-practices/security | 10_frameworks | FW-K20 | facts about Vue's behaviour (auto-escaping of interpolation and attribute bindings, v-html, URL, style and template-injection risks, what Vue does not treat as vulnerabilities) |
| SRC-233 | T1 | admit-restricted | Vue team page and Team Charter | https://vuejs.org/about/team | 10_frameworks | FW-K23 | governance facts (core team, emeriti, partners; project lead approves core members per charter at https://github.com/vuejs/governance/blob/master/Team-Charter.md); no legal entity or funding stated |
| SRC-234 | T1 | admit-restricted | Vue TypeScript overview | https://vuejs.org/guide/typescript/overview | 10_frameworks | FW-K22 | facts: Vue written in TypeScript, bundled types, vue-tsc for SFC type checking |
| SRC-235 | T1 | admit | Web Components (MDN) | https://developer.mozilla.org/en-US/docs/Web/API/Web_components | 10_frameworks | FW-K02 | - |
| SRC-236 | T2 | admit-restricted | Goldberg, What Every Computer Scientist Should Know About Floating-Point Arithmetic (ACM Computing Surveys, March 1991) | https://docs.oracle.com/cd/E19957-01/806-3568/ncg_goldberg.html | 01_lang | LANG-K29 | Floating-point mechanism (rounding error, NaN, signed zero, epsilon) from the 1991 paper; not the reprinter's added sections; no JavaScript-specific rule |
| SRC-237 | T2 | admit-restricted | Gong, Pradel, Sridharan, Sen, DLint: Dynamically Checking Bad Coding Practices in JavaScript (ISSTA 2015) | https://www2.eecs.berkeley.edu/Pubs/TechRpts/2015/EECS-2015-5.html | 01_lang | LANG-K28 | Evidence that the named practices occur and cause visible bugs on 200+ sites in 2015; the 28 checkers must be read in the paper; no current-language claim |
| SRC-238 | T2 | admit-restricted | Pradel and Sen, An Empirical Study of Implicit Type Conversions in JavaScript (ECOOP 2015) | https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ECOOP.2015.519 | 01_lang | LANG-K27 | Coercion prevalence (80.42% of function executions) and harm (98.85% likely harmless) as measured on its 2015 corpus; never a rule by itself |
| SRC-239 | T2 | admit-restricted | Google JavaScript Style Guide | https://google.github.io/styleguide/jsguide.html | 01_lang, 03_async, 04_struct, 08_quality | ASYNC-K36, LANG-K32, QUALITY-K19, STRUCT-K17 | 01_lang: Positions of the Google JS guide only, as frozen; where the Google TS guide (TYPES-K16) covers the same point, cite that one; 03_async: Google's positions only (throw only Error objects; a no-op catch must explain why in a comment), never evidence; 04_struct: Google's positions only (no default exports, no cycles between ES modules, exports not mutated after initialisation, optional trailing underscore for @private), never evidence; 08_quality: Google's positions as of the guide's freeze only; not for tooling choices (clang-format, Closure); superseded where the TS guide differs |
| SRC-240 | T2 | admit-restricted | Gao, Bird, Barr, To Type or Not to Type: Quantifying Detectable Bugs in JavaScript (ICSE 2017) | https://janvitek.org/events/NEU/7575/pubs/no-type.pdf | 02_types | TYPES-K20 | Measured detectability of public bugs by Flow 0.30 and TypeScript 2.0 (15%), conservative by the authors' own statement; not a measure of current strict TypeScript, nor of benefit in private development |
| SRC-241 | T2 | admit-restricted | JSON Schema 2020-12 specification | https://json-schema.org/specification | 02_types | TYPES-K29 | Vocabulary semantics of JSON Schema 2020-12 as a language-neutral format; never evidence that JSON Schema should be chosen |
| SRC-242 | T2 | admit-restricted | Sassaman et al., Security Applications of Formal Language Theory (Dartmouth TR2011-709) | https://sergey.cs.dartmouth.edu/langsec/papers/langsec-tr.pdf | 02_types | TYPES-K24 | The recognizer-before-processing principle as a mechanism and as the authors' position; not JavaScript-specific |
| SRC-243 | T2 | admit-restricted | TC39 proposal-type-annotations repository | https://github.com/tc39/proposal-type-annotations | 02_types | TYPES-K02 | Status, champions and design intent of a Stage 1 proposal; never as language semantics or as a forecast |
| SRC-244 | T2 | admit-restricted | Google TypeScript Style Guide | https://google.github.io/styleguide/tsguide.html | 02_types, 04_struct, 08_quality | QUALITY-K20, STRUCT-K18, TYPES-K16 | unrestricted for 08_quality; 02_types: Positions of Google's TS guide only, never evidence; 04_struct: Google's positions with their stated reasons (default exports have no canonical name; export let banned; namespaces banned; interfaces over type literals), never evidence |
| SRC-245 | T2 | admit-restricted | A Model for Reasoning About JavaScript Promises | https://plg.uwaterloo.ca/~olhotak/pubs/oopsla17b.pdf | 03_async | ASYNC-K34 | formal model of ES2015 promise semantics and the bug classes it explains; no async/await coverage; its Stack Overflow case study shows bug classes, not prevalence |
| SRC-246 | T2 | admit-restricted | DrAsync: anti-patterns in asynchronous JavaScript | https://conf.researchr.org/details/icse-2022/icse-2022-papers/61/DrAsync-Identifying-and-Visualizing-Anti-Patterns-in-Asynchronous-JavaScript | 03_async | ASYNC-K35 | the 8 anti-patterns as the paper defines them and the 2.5k instances in 20 repositories; no prevalence claim beyond that sample |
| SRC-247 | T2 | admit-restricted | Prioritized Task Scheduling (WICG) | https://wicg.github.io/scheduling-apis/ | 03_async | ASYNC-K32 | the API as drafted, for engines that ship it, with support status from MDN (limited availability, not Baseline); never a cross-browser recommendation |
| SRC-248 | T2 | admit-restricted | proposal-async-context (AsyncContext) | https://github.com/tc39/proposal-async-context | 03_async | ASYNC-K31 | only the fact that AsyncContext is not in the language (stage 2 as of Oct 2026) and its stated use cases; no API claims |
| SRC-249 | T2 | admit-restricted | V8 blog: Faster async functions and promises | https://v8.dev/blog/fast-async | 03_async | ASYNC-K30 | history of the await tick reduction and V8's implementation as of 2018; current semantics from ASYNC-K01; 2018 performance figures are not current |
| SRC-250 | T2 | admit-restricted | Freezing the Web: ReDoS in JavaScript-based web servers | https://www.usenix.org/conference/usenixsecurity18/presentation/staicu | 03_async, 06_runsec | ASYNC-K33, RUNSEC-K24 | 03_async: evidence that one ReDoS request blocks a Node server, and the 2018 prevalence figures (25 new vulnerabilities, 339 of 2,846 sites); figures are dated; 06_runsec: Mechanism and impact; figures only with their year (25 new flaws, 339 of 2,846 sites, 2018) |
| SRC-251 | T2 | admit-restricted | A Large Scale Study of Programming Languages and Code Quality in Github (Ray, Posnett, Filkov, Devanbu) | https://cs.uwaterloo.ca/~m2nagapp/courses/CS846/1189/papers/ray_fse14.pdf | 04_struct | STRUCT-K25o | the original finding that language design has a modest effect (functional somewhat better than procedural, strong over weak typing) dominated by process factors; contested by STRUCT-K25 |
| SRC-252 | T2 | admit-restricted | A Relational Model of Data for Large Shared Data Banks (Codd) | https://www.engineering.upenn.edu/~zives/03f/cis550/codd.pdf | 04_struct | STRUCT-K35o | normal form and the redundancy and consistency problem for shared data, as a principle; transfer to in-memory JavaScript application state is inference |
| SRC-253 | T2 | admit-restricted | Exploring Language Support for Immutability | https://www.cs.cmu.edu/~jssunshi/assets/pdf/coblenz2016exploring.pdf | 04_struct | STRUCT-K26 | taxonomy of immutability and read-only mechanisms and expert-interview requirements (Java-oriented); no effect evidence; not a JS rule |
| SRC-254 | T2 | admit-restricted | How Developers Choose Names | https://arxiv.org/abs/2103.07487 | 04_struct | STRUCT-K24 | the name-agreement finding (median 6.9% over 47 instances, 334 subjects) and the three-step naming model; language of the experiments not yet checked |
| SRC-255 | T2 | admit | I Depended on You and You Broke Me (npm breaking changes) | https://arxiv.org/abs/2301.04563 | 04_struct | STRUCT-K27 | - |
| SRC-256 | T2 | admit-restricted | JavaScript modules (V8 feature page) | https://v8.dev/features/modules | 04_struct | STRUCT-K20 | the module-granularity mechanism; the bundling advice and module-count figures are a 2018 position |
| SRC-257 | T2 | admit-restricted | On the Criteria To Be Used in Decomposing Systems into Modules | https://www.cse.sc.edu/~mgv/csce590f20/ParnasCriteria.pdf | 04_struct | STRUCT-K21 | information hiding as the decomposition criterion, as a language-agnostic principle; never a JS-specific rule |
| SRC-258 | T2 | admit-restricted | On the Impact of Programming Languages on Code Quality: A Reproduction Study | https://arxiv.org/abs/1901.10220 | 04_struct | STRUCT-K25 | language-to-defect associations in GitHub data are small or absent; cited only together with STRUCT-K25o and K33; never a ground for a paradigm choice inside JavaScript |
| SRC-259 | T2 | admit-restricted | On Understanding Data Abstraction, Revisited | https://www.cs.utexas.edu/~wcook/Drafts/2009/essay.pdf | 04_struct | STRUCT-K22 | the conceptual distinction between objects and abstract data types; no evidence for choosing either in JavaScript |
| SRC-260 | T2 | admit-restricted | Shorter Identifier Names Take Longer to Comprehend | https://www.se.cs.uni-saarland.de/publications/docs/HoSeHo17.pdf | 04_struct | STRUCT-K23 | experimental effect of naming style (72 professional C# developers; words about 19% faster than letters or abbreviations); transfer to JS is inference |
| SRC-261 | T2 | admit-restricted | Web Platform Design Principles | https://www.w3.org/TR/design-principles/ | 04_struct | STRUCT-K19 | W3C TAG positions for web platform API design (options dictionaries, optional arguments, naming, constructors only for stateful classes, Promises and AbortSignal); transfer to library and application APIs is inference |
| SRC-262 | T2 | admit-restricted | 25 Million Flows Later: Large-scale Detection of DOM-based XSS | https://notify.cispa.uni-saarland.de/papers/lekies2013flows.pdf | 05_domsec | DOMSEC-K28 | Taint-flow classes; prevalence figures only with their year (Alexa top 5000 in 2013: 6167 flaws, 480 domains, 9.6 percent) |
| SRC-263 | T2 | admit-restricted | CSP Is Dead, Long Live CSP! | https://research.google/pubs/pub45542/ | 05_domsec | DOMSEC-K33 | Measurement of allowlist bypasses and strict-dynamic rationale only, with year 2016; deployment policy is web-architecture |
| SRC-264 | T2 | admit | It's (DOM) Clobbering Time: Attack Techniques, Prevalence, and Defenses | https://cispa.de/en/research/publications/71734-it-s-dom-clobbering-time-attack-techniques-prevalence-and-defenses | 05_domsec | DOMSEC-K31 | - |
| SRC-265 | T2 | admit-restricted | Mozilla standards position: Trusted Types | mozilla/standards-positions#20 | 05_domsec | DOMSEC-K35 | Mozilla's position (positive since 2023-12-13) and stated concerns, as that vendor's position |
| SRC-266 | T2 | admit-restricted | mXSS Attacks: Attacking well-secured Web-Applications by using innerHTML Mutations | https://cure53.de/fp170.pdf | 05_domsec | DOMSEC-K34 | mXSS mechanism and subclasses; browser-specific findings (IE, 2013 filters) are historical |
| SRC-267 | T2 | admit-restricted | Prevent DOM-based XSS with Trusted Types (web.dev) | https://web.dev/articles/trusted-types | 05_domsec | DOMSEC-K05 | Rollout method only (report-only, fix, enforce, default policy as last resort) as the spec editor's position; API facts come from K03 and K04 |
| SRC-268 | T2 | admit-restricted | The Postman Always Rings Twice: Attacking and Defending postMessage in HTML5 Websites | https://www.ndss-symposium.org/ndss2013/postman-always-rings-twice-attacking-and-defending-postmessage-html5-websites | 05_domsec | DOMSEC-K29 | Origin-check failure classes; figure only with its year (84 exploitable sites among Alexa top 10,000 in 2013) |
| SRC-269 | T2 | admit | Trust Me If You Can: How Usable Is Trusted Types In Practice? | https://www.usenix.org/conference/usenixsecurity24/presentation/roth | 05_domsec | DOMSEC-K32 | - |
| SRC-270 | T2 | admit-restricted | You Are What You Include: Large-scale Evaluation of Remote JavaScript Inclusions | https://iseclab.org/publications/nikiforakis2012you_are/ | 05_domsec | DOMSEC-K30 | Remote-inclusion trust mechanism; figure only with its year (88.45 percent of Alexa top 10,000 in 2012) |
| SRC-271 | T2 | admit-restricted | An experimental non-backtracking RegExp engine | https://v8.dev/blog/non-backtracking-regexp | 06_runsec | RUNSEC-K31 | Backtracking mechanism in Irregexp and the experimental engine's limits as of 2021; its current status must not be assumed |
| SRC-272 | T2 | admit-restricted | CWE-22: Path Traversal | https://cwe.mitre.org/data/definitions/22.html | 06_runsec | RUNSEC-K33 | Taxonomy and language-neutral mitigations (canonicalize, allowlist) only |
| SRC-273 | T2 | admit-restricted | Detecting Node.js Prototype Pollution Vulnerabilities via Object Lookup Analysis | https://2021.esec-fse.org/details/fse-2021-papers/12/Detecting-Node-js-Prototype-Pollution-Vulnerabilities-via-Object-Lookup-Analysis | 06_runsec | RUNSEC-K27 | Prevalence evidence only (61 zero-days, 11 CVEs); not a recommendation of the detector |
| SRC-274 | T2 | admit | Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8 | https://nodejs.org/en/blog/vulnerability/march-2026-hashdos | 06_runsec | RUNSEC-K32 | - |
| SRC-275 | T2 | admit-restricted | How Bad Can It Git? Characterizing Secret Leakage in Public GitHub Repositories | https://www.ndss-symposium.org/ndss-paper/how-bad-can-it-git-characterizing-secret-leakage-in-public-github-repositories/ | 06_runsec | RUNSEC-K28 | Language-neutral evidence with year (over 100,000 repositories, 2019) |
| SRC-276 | T2 | admit | SecBench.js: An Executable Security Benchmark Suite for Server-Side JavaScript | https://conf.researchr.org/details/icse-2023/icse-2023-technical-track/99/SecBench-js-An-Executable-Security-Benchmark-Suite-for-Server-Side-JavaScript | 06_runsec | RUNSEC-K30 | - |
| SRC-277 | T2 | admit | Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js | https://www.usenix.org/conference/usenixsecurity23/presentation/shcherbakov | 06_runsec | RUNSEC-K23 | - |
| SRC-278 | T2 | admit-restricted | Synode: Understanding and Automatically Preventing Injection Attacks on Node.js | https://www.ndss-symposium.org/wp-content/uploads/2018/02/ndss2018_07A-2_Staicu_paper.pdf | 06_runsec, 13_srvsec | RUNSEC-K25, SRVSEC-K35 | 06_runsec: eval and exec injection prevalence with year (235,850 modules, 2018) and the template-policy mechanism; not a recommendation of the Synode tool; 13_srvsec: Prevalence evidence for eval and exec injection in 235,850 Node modules only; not about SQL or paths; belongs to slot 06 |
| SRC-279 | T2 | admit-restricted | The Impact of ReDoS in Practice: An Empirical Study at the Ecosystem Scale | https://researchconnect.stonybrook.edu/en/publications/the-impact-of-regular-expression-denial-of-service-redos-in-pract/ | 06_runsec | RUNSEC-K26 | Abstract-level findings only until the full text is read (anti-pattern heuristics have many false positives; developers revise the regex rather than cap input) |
| SRC-280 | T2 | admit-restricted | Containing Malicious Package Updates in npm with a Lightweight Permission System | https://arxiv.org/abs/2103.05769 | 06_runsec, 07_supply | RUNSEC-K29, SUPPLY-K26 | unrestricted for 07_supply; 06_runsec: Evidence that many npm packages need no fs or network access, and the per-package design as a research proposal; not a description of Node's permission model |
| SRC-281 | T2 | admit | A Qualitative Study of Dependency Management and Its Security Implications | https://research.vu.nl/en/publications/a-qualitative-study-of-dependency-management-and-its-security-imp/ | 07_supply | SUPPLY-K32 | - |
| SRC-282 | T2 | admit | Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks | https://arxiv.org/abs/2005.09535 | 07_supply, 14_secgap2 | SECGAP2-K32, SUPPLY-K31 | - |
| SRC-283 | T2 | admit | Beyond Typosquatting: An In-depth Look at Package Confusion | https://www.usenix.org/conference/usenixsecurity23/presentation/neupane | 07_supply | SUPPLY-K25 | - |
| SRC-284 | T2 | admit-restricted | Details about the event-stream incident | https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident | 07_supply | SUPPLY-K35 | incident facts only (2018 maintainer handover, flatmap-stream, Copay target); remedies (npm audit) are superseded and not advice |
| SRC-285 | T2 | admit-restricted | From Noise to Signal: Precisely Identify Affected Packages of Known Vulnerabilities in npm Ecosystem | https://www.ndss-symposium.org/ndss-paper/from-noise-to-signal-precisely-identify-affected-packages-of-known-vulnerabilities-in-npm-ecosystem/ | 07_supply | SUPPLY-K29 | measurement findings on npm audit noise (94% FP reduction, 68.28% of package-level impacts unreachable); never a preference for the authors' tool |
| SRC-286 | T2 | admit | Not All Dependencies are Equal: An Empirical Study on Production Dependencies in NPM | https://arxiv.org/abs/2207.14711 | 07_supply | SUPPLY-K30 | - |
| SRC-287 | T2 | admit | Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks | https://arxiv.org/abs/2502.06662 | 07_supply | SUPPLY-K28 | - |
| SRC-288 | T2 | admit-restricted | Postmortem for Malicious Packages Published on July 12th, 2018 | https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes | 07_supply | SUPPLY-K36 | incident facts only (password reuse, no 2FA, postinstall token theft, eslint-scope 3.7.2) |
| SRC-289 | T2 | admit | Sigstore: Software Signing for Everybody | https://par.nsf.gov/biblio/10470793 | 07_supply | SUPPLY-K34 | - |
| SRC-290 | T2 | admit-restricted | Small World with High Risks: A Study of Security Threats in the npm Ecosystem | https://www.usenix.org/conference/usenixsecurity19/presentation/zimmerman | 07_supply | SUPPLY-K21 | ecosystem measurements as of the study's snapshot, cited with that date; not a current-state claim (2FA, provenance and token policy changed since) |
| SRC-291 | T2 | admit | Taxonomy of Attacks on Open-Source Software Supply Chains | https://arxiv.org/abs/2204.04008 | 07_supply | SUPPLY-K22 | - |
| SRC-292 | T2 | admit | The Design Space of Lockfiles Across Package Managers | https://arxiv.org/abs/2505.04834 | 07_supply | SUPPLY-K27 | - |
| SRC-293 | T2 | admit | Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages | https://ndss-symposium.org/ndss-paper/towards-measuring-supply-chain-attacks-on-package-managers-for-interpreted-languages | 07_supply | SUPPLY-K23 | - |
| SRC-294 | T2 | admit | What are Weak Links in the npm Supply Chain? | https://arxiv.org/abs/2112.10165 | 07_supply | SUPPLY-K24 | - |
| SRC-295 | T2 | admit-restricted | Widespread Supply Chain Compromise Impacting npm Ecosystem (CISA alert) | https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem | 07_supply | SUPPLY-K37 | incident facts (Shai-Hulud, 500+ packages, credential-harvesting worm); its recommended actions recorded as CISA's position |
| SRC-296 | T2 | admit-restricted | An Empirical Analysis of Flaky Tests | https://huang.isis.vanderbilt.edu/cs8395/paper/flakytest.pdf | 08_quality | QUALITY-K16 | Root-cause taxonomy and fix strategies from 201 commits in 51 Apache projects (mostly Java); transfer to JavaScript inferred |
| SRC-297 | T2 | admit-restricted | Coverage Is Not Strongly Correlated with Test Suite Effectiveness | https://cs.ubc.ca/~rtholmes/papers/icse_2014_inozemtseva.pdf | 08_quality | QUALITY-K14 | The study's finding for five large Java systems (31,000 suites); transfer to JavaScript recorded as inferred |
| SRC-298 | T2 | admit | Deprecation of formatting rules | https://eslint.org/blog/2023/10/deprecating-formatting-rules/ | 08_quality | QUALITY-K12 | - |
| SRC-299 | T2 | admit-restricted | Practical Mutation Testing at Scale: A View from Google | https://arxiv.org/abs/2102.11378 | 08_quality | QUALITY-K15 | Abstract-level facts only (incremental mutation at code review, filtering, 24,000+ developers, 1,000+ projects) until the full text is read; Google setting |
| SRC-300 | T2 | admit-restricted | QuickCheck: A Lightweight Tool for Random Testing of Haskell Programs | https://www.cs.tufts.edu/~nr/cs257/archive/john-hughes/quick.pdf | 08_quality | QUALITY-K13 | Origin of the concept and method of property-based testing (properties, random generation, custom generators) only; not shrinking (absent from this paper), not JavaScript tooling |
| SRC-301 | T2 | admit-restricted | Concurrent marking in V8 | https://v8.dev/blog/concurrent-marking | 09_runtime | RUNTIME-K28 | Mechanism and 65%/70% marking-time reduction as of 2018 (default since Node.js v10) |
| SRC-302 | T2 | admit-restricted | Elements kinds in V8 | https://v8.dev/blog/elements-kinds | 09_runtime | RUNTIME-K31 | Mechanism plus its measured statement that the holey vs packed difference is "usually too small to matter or even be measurable"; the tips are the holder's opinion |
| SRC-303 | T2 | admit-restricted | Fast properties in V8 | https://v8.dev/blog/fast-properties | 09_runtime | RUNTIME-K30 | Mechanism (hidden classes, dictionary mode, inline caches) as of 2017; no performance prescriptions, since no measurement is given |
| SRC-304 | T2 | admit | How to write and run benchmarks in Node.js core | https://github.com/nodejs/node/blob/main/doc/contributing/writing-and-running-benchmarks.md | 09_runtime | RUNTIME-K32 | - |
| SRC-305 | T2 | admit-restricted | Producing Wrong Data Without Doing Anything Obviously Wrong! | https://sape.inf.usi.ch/publications/asplos09 | 09_runtime | RUNTIME-K33 | Abstract-level claims only (measurement bias from setup, setup randomization); measured on SPEC CPU2006 C programs |
| SRC-306 | T2 | admit | Speeding up V8 heap snapshots | https://v8.dev/blog/speeding-up-v8-heap-snapshots | 09_runtime | RUNTIME-K29 | - |
| SRC-307 | T2 | admit-restricted | Statistically Rigorous Java Performance Evaluation | https://dri.es/files/oopsla07-georges.pdf | 09_runtime | RUNTIME-K34 | Method (confidence intervals; separate start-up and steady-state measurement across VM invocations and iterations); no Java numbers transferred |
| SRC-308 | T2 | admit-restricted | Trash talk: the Orinoco garbage collector | https://v8.dev/blog/trash-talk | 09_runtime | RUNTIME-K27 | GC mechanism and the 20-50% young-generation figure as of 2019 |
| SRC-309 | T2 | admit-restricted | Web Almanac 2024, Jamstack chapter | https://almanac.httparchive.org/en/2024/jamstack | 10_frameworks | FW-K07 | meta-framework shares among prerendered (0.5%) and hybrid (5%) sites only, with the stated scoring heuristic and its admitted miscategorization; boundary web-architecture |
| SRC-310 | T2 | admit-restricted | Web Almanac 2024, JavaScript chapter | https://almanac.httparchive.org/en/2024/javascript | 10_frameworks | FW-K06 | measured prevalence figures (jQuery 74 to 75%, React 10%, custom elements 7.8%, shadow DOM 2.5%) with the Wappalyzer detection caveat and the 2024 crawl date; no recommendation |
| SRC-311 | T2 | admit-restricted | Web Almanac 2025, Security chapter | https://almanac.httparchive.org/en/2025/security | 10_frameworks | FW-K08 | whole-web CSP (21.9%) and SRI (23.6% mobile) adoption; not segmented by framework, so it grounds no framework comparison; primary home area 05 |
| SRC-312 | T3 | admit-restricted | Airbnb JavaScript Style Guide | https://github.com/airbnb/javascript | 01_lang, 04_struct, 08_quality | LANG-K35, QUALITY-K32, STRUCT-K32 | 01_lang: Positions of the Airbnb guide only, never evidence (policy standing rule on popular guides); 04_struct: Airbnb's positions only (10.3 no export directly from an import, 10.6 prefer default export, 23.4 no leading or trailing underscores), never evidence; 08_quality: Positions of the Airbnb guide only, never evidence; its shareable config is not a current tooling route |
| SRC-313 | T3 | admit-restricted | eslint-plugin-import rule no-cycle | https://github.com/import-js/eslint-plugin-import/blob/main/docs/rules/no-cycle.md | 04_struct | STRUCT-K30 | the rule's behaviour and cost (documented as computationally expensive); "Cyclic dependencies are always a dangerous anti-pattern" is the plugin maintainers' position, never evidence |
| SRC-314 | T3 | admit-restricted | Rebuttal to Berger et al., TOPLAS 2019 | https://arxiv.org/pdf/1911.07393 | 04_struct | STRUCT-K33 | the original authors' position in their dispute with STRUCT-K25; not peer-reviewed |
| SRC-315 | T3 | admit-restricted | Speeding up the JavaScript ecosystem: the barrel file debacle | https://marvinh.dev/blog/speeding-up-javascript-ecosystem-part-7/ | 04_struct | STRUCT-K28 | his synthetic measurement of module-count load cost (500 to 50,000 modules on one machine) only; "Get rid of all barrel files" is his position |
| SRC-316 | T3 | admit-restricted | DOM-based vulnerabilities (Web Security Academy) | https://portswigger.net/web-security/dom-based | 05_domsec | DOMSEC-K24 | Source and sink catalogue facts only (14 classes); no advice; no tool claim |
| SRC-317 | T3 | admit-restricted | Regular Expression Denial of Service (ReDoS Revisited), OWASP Israel 2009 | https://wiki.owasp.org/images/2/23/OWASP_IL_2009_ReDoS.pdf | 06_runsec | RUNSEC-K34o | Mechanism and the evil-regex shapes only, as historical origin; no mitigation advice (2009); current mitigations come from K20 and K14 |
| SRC-318 | T3 | admit-restricted | Server-side prototype pollution: Black-box detection without the DoS | https://portswigger.net/research/server-side-prototype-pollution | 06_runsec | RUNSEC-K35o | Its own black-box detection techniques and Express-specific gadgets as facts; child_process gadgets must be cited from K23; no tool claim |
| SRC-319 | T3 | admit-restricted | The case for a cooldown: why Dependabot now waits before issuing version updates | https://github.blog/security/supply-chain-security/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates/ | 07_supply | SUPPLY-K40 | GitHub's incident-window figures (21 incidents pulled within hours, about 6,500 npm malware advisories in a year) as the vendor's own analysis, single-source; behaviour facts come from K40o |
| SRC-320 | T3 | admit-restricted | Software Engineering at Google, ch. 11 Testing Overview | https://abseil.io/resources/swe-book/html/ch11.html | 08_quality | QUALITY-K17 | Google's stated practice and its own reported figures (80/15/5 mix, flakiness ~0.15%, value lost near 1%), recorded as Google's position, never as general evidence |
| SRC-321 | T3 | admit-restricted | Software Engineering at Google, ch. 12 Unit Testing | https://abseil.io/resources/swe-book/html/ch12.html | 08_quality | QUALITY-K18 | Google's positions (test via public APIs, test behaviours, DAMP over DRY) as Google's, never as evidence |
| SRC-322 | T1 | admit-restricted | Express: res.sendFile and res.download | https://expressjs.com/en/5x/api/response/ | 13_srvsec | SRVSEC-K31 | Facts about Express sendFile: warning on user-built paths, root option validates the path resolves within root, dotfiles default ignore |
| SRC-323 | T1 | admit-restricted | Fetch Standard: redirects | https://fetch.spec.whatwg.org/#http-redirect-fetch | 13_srvsec | SRVSEC-K24 | Browser-defined semantics of redirect modes follow, error, manual (opaque-redirect response); redirect limit 20; says nothing on Node or undici |
| SRC-324 | T1 | admit-restricted | GitHub Security Advisory: node-serialize code execution | https://github.com/advisories/GHSA-q4v7-4rhw-9hqm | 13_srvsec | SRVSEC-K28 | Facts only: CVE-2017-5941, node-serialize up to 0.0.4, IIFE code execution via unserialize(), no patched version; the maintainer recommendation is excluded |
| SRC-325 | T1 | admit-restricted | GitHub Security Advisory: node-tar arbitrary file creation | https://github.com/advisories/GHSA-3jfq-g458-7qm9 | 13_srvsec | SRVSEC-K32 | Facts only: CVE-2021-32804, repeated root slashes survive single-root stripping, patched 3.2.2, 4.4.14, 5.0.6, 6.1.1 |
| SRC-326 | T1 | admit | HTML Standard: structured serialize and deserialize | https://html.spec.whatwg.org/multipage/structured-data.html | 13_srvsec | SRVSEC-K30 | - |
| SRC-327 | T1 | admit-restricted | js-yaml CHANGELOG | https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md | 13_srvsec | SRVSEC-K27 | Facts about js-yaml: 4.0.0 (2021-01-03) moved !!js/function, !!js/regexp, !!js/undefined to js-yaml-js-types, removed safe*, load safe by default; 3.14.1 and 4.0.0 fix code execution in (already unsafe) .load() |
| SRC-328 | T1 | admit | MDN: Crypto.getRandomValues() and randomUUID() | https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues | 13_srvsec | SRVSEC-K03 | - |
| SRC-329 | T1 | admit | MDN: Math.random() | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/random | 13_srvsec | SRVSEC-K02 | - |
| SRC-330 | T1 | admit | MDN: structuredClone() and structured clone algorithm | https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm | 13_srvsec | SRVSEC-K29 | - |
| SRC-331 | T1 | admit | MDN: SubtleCrypto | https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto | 13_srvsec | SRVSEC-K04 | - |
| SRC-332 | T1 | admit-restricted | MongoDB manual: FAQ on query injection and $where | https://www.mongodb.com/docs/manual/faq/fundamentals/ | 13_srvsec | SRVSEC-K15 | Facts about MongoDB: queries are BSON; $where, mapReduce, $accumulator, $function run JavaScript; --noscripting; $where cannot use indexes |
| SRC-333 | T1 | admit-restricted | Mongoose: sanitizeFilter() | https://mongoosejs.com/docs/api/mongoose.html | 13_srvsec | SRVSEC-K16 | Facts about sanitizeFilter() (wraps nested objects with $ keys in $eq) |
| SRC-334 | T1 | admit-restricted | node-mysql2: Prepared Statements | https://sidorares.github.io/node-mysql2/docs/documentation/prepared-statements | 13_srvsec | SRVSEC-K13 | Facts about execute() (prepares and caches statements, LRU 16,000 default) and prepare(); no claim about injection safety or about query() escaping |
| SRC-335 | T1 | admit-restricted | node-postgres: Queries | https://node-postgres.com/features/queries | 13_srvsec | SRVSEC-K12 | Facts about pg: parameters go to the server unaltered; no parameters for identifiers; pg-format named for identifiers |
| SRC-336 | T1 | admit-restricted | Node.js crypto API | https://nodejs.org/api/crypto.html | 13_srvsec | SRVSEC-K01 | Facts about timingSafeEqual (same-length inputs, does not make surrounding code constant-time) and its constant-time purpose; other crypto functions only after the extractor reads each section verbatim |
| SRC-337 | T1 | admit | Node.js dns: lookup versus resolve | https://nodejs.org/api/dns.html | 13_srvsec | SRVSEC-K22 | - |
| SRC-338 | T1 | admit | Node.js net: BlockList | https://nodejs.org/api/net.html | 13_srvsec | SRVSEC-K21 | - |
| SRC-339 | T1 | admit-restricted | Node.js security releases, 29 July 2026 | https://nodejs.org/en/blog/vulnerability/july-2026-security-releases | 13_srvsec | SRVSEC-K34 | Facts only: CVE-2026-58043 (permission model radix-tree prefix over-grant, High, fixed 22.23.2, 24.18.1, 26.5.1) and CVE-2026-58044 (header truncation can enable request smuggling, Low, same fixed versions) |
| SRC-340 | T1 | admit | Node.js url: legacy url.parse and fileURLToPath | https://nodejs.org/api/url.html | 13_srvsec | SRVSEC-K23 | - |
| SRC-341 | T1 | admit-restricted | OWASP ASVS 5.0 chapters V1, V5, V11, V15, V16 | https://github.com/OWASP/ASVS/blob/master/5.0/en/0x20-V11-Cryptography.md | 13_srvsec, 14_secgap2 | SECGAP2-K57, SRVSEC-K08 | 13_srvsec: Verification requirements only, and only these ids with the topic their text states: 1.2.4 (database queries parameterized), 1.3.6 (SSRF allowlist), 5.2.5 (symlinks in archives), 5.3.2 (file paths from trusted data), 5.3.3 (decompression ignores user path info), 11.2.4 (constant-time operations), 11.5.1 (CSPRNG, 128 bits), 15.1.5 (dangerous functionality documented; deserialization named only in the section introduction), 15.3.2 (no redirects followed by backend), 16.5.1 and 16.4.1 (error exposure, log encoding). Not for deserialization via 15.1.1, not for path containment via 5.2.3, not for SSRF via 5.3.2; 14_secgap2: Adds to SRC-341 (same applies to SRC-132 on the tree URL) these ids, checklist items only, each with its stated topic: 1.2.2, 1.3.5 (scriptable template language content, not SSTI), 1.3.7, 1.5.1, 5.1.1, 5.2.1, 5.2.2, 5.2.3 (archive uncompressed size, not path containment), 5.2.4, 5.2.6, 5.3.1, 5.4.1, 5.4.2, 5.4.3, 15.1.2, 15.2.4; the V1, V5 and V15 files are also admitted as K12, K27 and K36 |
| SRC-342 | T1 | admit-restricted | OWASP Cryptographic Storage Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html | 13_srvsec | SRVSEC-K06 | Principles on CSPRNG use and the listed Node functions crypto.randomBytes, randomInt, randomUUID; nothing on constant-time comparison (page has none) |
| SRC-343 | T1 | admit-restricted | OWASP NoSQL Security Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/NoSQL_Security_Cheat_Sheet.html | 13_srvsec | SRVSEC-K37 | Principles: validate scalar types before building a filter, objects as field values enable operator injection, $where runs untrusted JavaScript, disable server-side JavaScript; quotes come from a summary, extractor reads verbatim |
| SRC-344 | T1 | admit-restricted | OWASP Password Storage Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html | 13_srvsec | SRVSEC-K07 | Language-neutral algorithm parameters as OWASP's position (Argon2id 19 MiB t=2 p=1; scrypt N=2^17 r=8 p=1; bcrypt minimum 10 and 72-byte input limit; PBKDF2-HMAC-SHA256 600,000) |
| SRC-345 | T1 | admit-restricted | OWASP SQL Injection Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html | 13_srvsec | SRVSEC-K11 | Principles: prepared statements, stored procedures, allow-list mapping for identifiers, escaping "STRONGLY DISCOURAGED" and fragile; no JavaScript content |
| SRC-346 | T1 | admit-restricted | OWASP SSRF Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html | 13_srvsec | SRVSEC-K19 | Principles: allowlist over denylist, validate resolved IPs and connect only to validated addresses, disable redirects, IMDSv2; the npm library ip-address it names never grounds a tool choice |
| SRC-347 | T1 | admit-restricted | Prisma Client: Raw queries | https://www.prisma.io/docs/orm/prisma-client/using-raw-sql/raw-queries | 13_srvsec | SRVSEC-K14 | Facts about $queryRaw (tagged template, prepared statements), $queryRawUnsafe and Prisma.raw (injection when concatenated); never a preference for Prisma |
| SRC-348 | T1 | admit-restricted | Web Cryptography API (Level 1) | https://www.w3.org/TR/2017/REC-WebCryptoAPI-20170126/ | 13_srvsec | SRVSEC-K05o | Definitions of getRandomValues and SubtleCrypto only; read through a summary, extractor reads clauses |
| SRC-349 | T2 | admit-restricted | CWE-208: Observable Timing Discrepancy | https://cwe.mitre.org/data/definitions/208.html | 13_srvsec | SRVSEC-K10 | Name and definition only |
| SRC-350 | T2 | admit-restricted | CWE-338: Use of Cryptographically Weak PRNG | https://cwe.mitre.org/data/definitions/338.html | 13_srvsec | SRVSEC-K09 | Name and definition only; mitigation text excluded |
| SRC-351 | T2 | admit-restricted | CWE-502: Deserialization of Untrusted Data | https://cwe.mitre.org/data/definitions/502.html | 13_srvsec | SRVSEC-K26 | Name, definition, generic mitigations; examples are Java and Python only |
| SRC-352 | T2 | admit-restricted | CWE-89: SQL Injection | https://cwe.mitre.org/data/definitions/89.html | 13_srvsec | SRVSEC-K17 | Name, definition and the generic parameterized-statement mitigation |
| SRC-353 | T2 | admit-restricted | CWE-918: Server-Side Request Forgery | https://cwe.mitre.org/data/definitions/918.html | 13_srvsec | SRVSEC-K20 | Name and definition only |
| SRC-354 | T2 | admit-restricted | CWE-943: Improper Neutralization of Special Elements in Data Query Logic | https://cwe.mitre.org/data/definitions/943.html | 13_srvsec | SRVSEC-K18 | Name and definition; observed examples name MongoDB and Mongoose (the discoverer found none) |
| SRC-355 | T2 | admit-restricted | OWASP WSTG: Testing for NoSQL Injection | https://wstg.owasp.org/v4.1/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection/ | 13_srvsec | SRVSEC-K38 | Mechanism of $where JavaScript injection and the CPU exhaustion example; testing guidance, not remediation; version 4.1 page |
| SRC-356 | T2 | admit-restricted | Protecting Browsers from DNS Rebinding Attacks | https://crypto.stanford.edu/dns | 13_srvsec | SRVSEC-K25 | Definition and mechanism of DNS rebinding in browsers; not a Node SSRF recipe |
| SRC-357 | T2 | admit-restricted | Web Cryptography API Level 2 | https://www.w3.org/TR/WebCryptoAPI/ | 13_srvsec | SRVSEC-K05 | API definitions only; no claim about constant-time or timing guarantees (the digest found no such statement, a negative that rests on a summary) |
| SRC-358 | T3 | admit-restricted | Zip Slip Vulnerability | https://security.snyk.io/research/zip-slip-vulnerability | 13_srvsec, 14_secgap2 | SECGAP2-K31, SRVSEC-K33 | 13_srvsec: Origin and mechanism of Zip Slip, disclosure date 5 June 2018; affected npm libraries (adm-zip, unzipper); no fix advice, no tool advice; 14_secgap2: Already SRC-358: origin and mechanism, disclosure 2018-06-05, affected npm libraries adm-zip and unzipper; no fix advice, no tool advice; no code |
| SRC-359 | T1 | admit-restricted | busboy README | https://github.com/mscdex/busboy | 14_secgap2 | SECGAP2-K28 | Facts about busboy only: limits and defaults (fileSize, files, parts, fields unlimited by default; fieldSize 1 MiB; headerPairs 2000), preservePath default false, the filename warning; never a preference for the library |
| SRC-360 | T1 | admit-restricted | EJS security policy (SECURITY.md) | https://github.com/mde/ejs/blob/main/SECURITY.md | 14_secgap2 | SECGAP2-K24 | Facts about EJS only: EJS is effectively a JavaScript runtime, giving end users access to render is out of scope, escape applies to HTML and quoted attributes only; fixes for the current major only |
| SRC-361 | T1 | admit-restricted | Express: csurf archived and the Express Technical Committee deprecation note | https://github.com/expressjs/csurf | 14_secgap2 | SECGAP2-K45 | Facts only: repository archived 2025-05-14, read-only, no replacement named; blog 2025-05-16 by the Express Technical Committee calls csurf long difficult to maintain; no Node CSRF library is endorsed |
| SRC-362 | T1 | admit-restricted | GHSA-2w6w-674q-4c4q Handlebars AST type confusion (CVE-2026-33937) | https://github.com/advisories/GHSA-2w6w-674q-4c4q | 14_secgap2 | SECGAP2-K25b | Facts: Handlebars 4.0.0 to 4.7.8, Critical 9.8, attacker-supplied AST to compile, fixed 4.7.9, published 2026-03-26; workarounds are type validation and runtime-only builds |
| SRC-363 | T1 | admit-restricted | GHSA-3787-6prv-h9w3 undici proxy-authorization in fetch (CVE-2024-24758) | https://github.com/advisories/GHSA-3787-6prv-h9w3 | 14_secgap2 | SECGAP2-K54b | Facts: undici <= 5.28.2 and 6.0.0 to 6.6.0, Low 3.9, fixed 5.28.3 and 6.6.1, Proxy-Authorization not cleared on cross-origin redirect; published 2024-02-16 |
| SRC-364 | T1 | admit-restricted | GHSA-5r9g-qh6m-jxff undici CRLF via host (CVE-2023-23936) | https://github.com/advisories/GHSA-5r9g-qh6m-jxff | 14_secgap2 | SECGAP2-K18 | Facts: undici 2.0.0 to 5.19.1, Moderate 4.6, fixed 5.19.1, workaround sanitise headers.host; credited to a HackerOne reporter |
| SRC-365 | T1 | admit-restricted | GHSA-8cf7-32gw-wr33 jsonwebtoken CVE-2022-23539 (legacy key types) | https://github.com/advisories/GHSA-8cf7-32gw-wr33 | 14_secgap2 | SECGAP2-K06a | Facts: jsonwebtoken <= 8.5.1, High 8.1, fixed 9.0.0, key type and algorithm pairing enforced, allowInvalidAsymmetricKeyTypes escape hatch; no advice |
| SRC-366 | T1 | admit-restricted | GHSA-hjrf-2m68-5959 jsonwebtoken CVE-2022-23541 (RSA to HMAC key retrieval) | https://github.com/advisories/GHSA-hjrf-2m68-5959 | 14_secgap2 | SECGAP2-K06b | Facts: jsonwebtoken <= 8.5.1, Moderate 5.0, fixed 9.0.0; asymmetric token verified as HMAC through a shared key-retrieval function; no advice |
| SRC-367 | T1 | admit-restricted | GHSA-jmr7-xgp7-cmfj fast-xml-parser entity expansion (CVE-2026-26278) | https://github.com/advisories/GHSA-jmr7-xgp7-cmfj | 14_secgap2 | SECGAP2-K13 | Facts: DoS through unlimited text-entity expansion, High 7.5, 4.1.3 to 4.5.3 and 5.0.0 to 5.3.5, fixed 4.5.4 and 5.3.6, workaround processEntities false; it is not an external-entity file read |
| SRC-368 | T1 | admit-restricted | GHSA-m4v8-wqvr-p9f7 undici proxy-authorization in request, stream, pipeline, dispatch (CVE-2024-30260) | https://github.com/advisories/GHSA-m4v8-wqvr-p9f7 | 14_secgap2 | SECGAP2-K54c | Facts: undici < 5.28.4 and 6.0.0 to < 6.11.1, Low 3.9, fixed 5.28.4 and 6.11.1; the header not cleared is Proxy-Authorization (the discoverer wrote authorization, which is wrong); workarounds use fetch or disable redirects via maxRedirections; published 2024-04-04 |
| SRC-369 | T1 | admit-restricted | GHSA-phwq-j96m-2c2q EJS template injection (CVE-2022-29078) | https://github.com/advisories/GHSA-phwq-j96m-2c2q | 14_secgap2 | SECGAP2-K25a | Facts: ejs < 3.1.7, Critical 9.8, via settings view options outputFunctionName, fixed 3.1.7, published 2022-04-26, not disputed; the link to prototype pollution is the discoverer's inference and is not admitted |
| SRC-370 | T1 | admit-restricted | GHSA-rcvq-m9j9-6f4g @hapi/inert static-file confinement bypass (CVE-2026-48049) | https://github.com/advisories/GHSA-rcvq-m9j9-6f4g | 14_secgap2 | SECGAP2-K49o | Facts: raw string-prefix confinement test passes the sibling directory (/app/static against /app/static-secret), Moderate 5.3, 4.0.0 to 7.1.0, fixed 7.1.1, CWE-22; no recipe is stated beyond upgrading or removing shared prefixes |
| SRC-371 | T1 | admit-restricted | GHSA-wqq4-5wpv-mx2g undici cookie header on cross-origin redirect (CVE-2023-45143) | https://github.com/advisories/GHSA-wqq4-5wpv-mx2g | 14_secgap2 | SECGAP2-K54a | Facts: undici < 5.26.2, Low 3.9, fixed 5.26.2, fetch did not clear cookie on a cross-origin redirect while it cleared Authorization; published 2023-10-12 |
| SRC-372 | T1 | admit-restricted | Handlebars guide: Security | https://handlebarsjs.com/guide/security.html | 14_secgap2 | SECGAP2-K23 | Facts about Handlebars only: triple-stash and SafeString disable escaping, escaping is HTML-context only, do not relax prototype access or enable allowCallsToHelperMissing, user-supplied templates need size and depth limits, process isolation and allowlisted helpers, compile only ASTs produced by Handlebars |
| SRC-373 | T1 | admit-restricted | HTTP Header Field X-Frame-Options (RFC 7034) | https://www.rfc-editor.org/rfc/rfc7034.html | 14_secgap2 | SECGAP2-K44 | That the header exists, its DENY and SAMEORIGIN values, and that ALLOW-FROM was not uniformly implemented; its own text says it will be replaced by the CSP directive |
| SRC-374 | T1 | admit | HTTP Semantics (RFC 9110), section 5.5 field values | https://www.rfc-editor.org/rfc/rfc9110.html | 14_secgap2 | SECGAP2-K15 | - |
| SRC-375 | T1 | admit-restricted | jose README and jwtVerify reference | https://github.com/panva/jose | 14_secgap2 | SECGAP2-K08 | Facts about this library only: implemented RFCs, v6 supported, availability of algorithms depends on runtime; whether jwtVerify requires an algorithms option is open (the reference page read lists overloads, not the options) |
| SRC-376 | T1 | admit-restricted | JSON Web Token (RFC 7519) | https://www.rfc-editor.org/rfc/rfc7519.html | 14_secgap2 | SECGAP2-K02 | Claims definitions and the section 7.2 validation steps; the section 8 requirement to implement none is read only together with RFC 8725 (K01), which updates it |
| SRC-377 | T1 | admit | JSON Web Token Best Current Practices (RFC 8725, BCP 225) | https://www.rfc-editor.org/rfc/rfc8725.html | 14_secgap2 | SECGAP2-K01 | - |
| SRC-378 | T1 | admit | MDN: Clickjacking | https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Clickjacking | 14_secgap2 | SECGAP2-K40 | - |
| SRC-379 | T1 | admit | MDN: Cross-site request forgery (CSRF) | https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF | 14_secgap2 | SECGAP2-K39 | - |
| SRC-380 | T1 | admit | MDN: Request.redirect | https://developer.mozilla.org/en-US/docs/Web/API/Request/redirect | 14_secgap2 | SECGAP2-K55 | - |
| SRC-381 | T1 | admit | MDN: Sec-Fetch-Site header | https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Site | 14_secgap2 | SECGAP2-K41 | - |
| SRC-382 | T1 | admit-restricted | MDN: URL.canParse() static method | https://developer.mozilla.org/en-US/docs/Web/API/URL/canParse_static | 14_secgap2 | SECGAP2-K46 | What canParse returns (true for values the URL constructor accepts, false otherwise), Baseline December 2023; MDN does not say validity is a parser question rather than a regex, and allowlisting advice must come from K47 or ASVS 3.7.2 |
| SRC-383 | T1 | admit-restricted | multer README | https://github.com/expressjs/multer | 14_secgap2 | SECGAP2-K29 | Facts about multer only: never add as global middleware, originalname is client-supplied file metadata, limits options and defaults; never a preference for the library |
| SRC-384 | T1 | admit-restricted | node-jsonwebtoken README | https://github.com/auth0/node-jsonwebtoken | 14_secgap2 | SECGAP2-K07 | Facts about this library only: default algorithms inferred from key type when algorithms is omitted, RSA minimum modulus 2048 unless allowInsecureKeySizes, allowInvalidAsymmetricKeyTypes for backwards compatibility only, decode does not verify and must not be used for untrusted tokens; never a preference for the library |
| SRC-385 | T1 | admit-restricted | Node.js source lib/_http_common.js (header character checks) | https://raw.githubusercontent.com/nodejs/node/main/lib/_http_common.js | 14_secgap2 | SECGAP2-K17 | Facts about what Node accepts on the main branch at extraction time: strict regex rejects control characters except HTAB and DEL, lenient regex rejects NUL, LF, CR and characters above 0xff, token regex; no advice; the extractor must read the file at a pinned commit |
| SRC-386 | T1 | admit-restricted | Node.js source lib/v8.js (DefaultDeserializer, deserialize) | https://raw.githubusercontent.com/nodejs/node/main/lib/v8.js | 14_secgap2 | SECGAP2-K50 | Facts about what the code does at a pinned commit: _readHostObject reads a type index, a byte length and bytes and builds a typed array view or an aligned copy; deserialize calls readHeader then readValue; no safety conclusion may be drawn from it |
| SRC-387 | T1 | admit-restricted | npm Docs: Threats and mitigations | https://docs.npmjs.com/threats-and-mitigations | 14_secgap2 | SECGAP2-K35 | Facts about npm's own behaviour only: it detects typosquat attacks and blocks publishing of such packages, scoped packages protect private names; never an argument that screening is unneeded |
| SRC-388 | T1 | admit-restricted | OWASP ASVS 5.0, V1 Encoding and Sanitization | https://raw.githubusercontent.com/OWASP/ASVS/master/5.0/en/0x10-V1-Encoding-and-Sanitization.md | 14_secgap2 | SECGAP2-K12 | Checklist items, ids 1.2.2 (URL encoding and safe protocols), 1.3.5 (sanitize or disable scriptable template language content such as Markdown, CSS or XSL; not SSTI), 1.3.7 (templates not built from untrusted input), 1.5.1 (XML parsers restrictive, no external entities); ids 1.2.6 (LDAP), 1.2.7 (XPath), 1.3.12 (ReDoS) are not this slot's topics |
| SRC-389 | T1 | admit-restricted | OWASP ASVS 5.0, V15 Secure Coding and Architecture | https://raw.githubusercontent.com/OWASP/ASVS/master/5.0/en/0x24-V15-Secure-Coding-and-Architecture.md | 14_secgap2 | SECGAP2-K36 | Checklist items, ids 15.1.2 (inventory or SBOM of third-party libraries, L2) and 15.2.4 (components and transitive dependencies from the expected repository, L3); 15.3.2 (backend does not follow redirects unless intended) is already admitted via SRC-341 |
| SRC-390 | T1 | admit-restricted | OWASP ASVS 5.0, V4 API and Web Service | https://raw.githubusercontent.com/OWASP/ASVS/master/5.0/en/0x13-V4-API-and-Web-Service.md | 14_secgap2 | SECGAP2-K16 | Checklist items, ids 4.2.1 to 4.2.5; 4.2.4 is about HTTP/2 and HTTP/3 requests only, not a general rule on CR and LF; 4.2.1 proxy behaviour is a web-architecture boundary |
| SRC-391 | T1 | admit-restricted | OWASP ASVS 5.0, V5 File Handling | https://raw.githubusercontent.com/OWASP/ASVS/master/5.0/en/0x14-V5-File-Handling.md | 14_secgap2 | SECGAP2-K27 | Checklist items, ids 5.1.1 to 5.4.3 each with its stated topic; 5.2.3 is archive uncompressed size and file count, not path containment; 5.3.2 is file path construction; mechanisms from other T1 |
| SRC-392 | T1 | admit-restricted | OWASP ASVS 5.0, V9 Self-contained Tokens | https://raw.githubusercontent.com/OWASP/ASVS/master/5.0/en/0x18-V9-Self-contained-Tokens.md | 14_secgap2 | SECGAP2-K05 | Verification requirements as checklist items, ids 9.1.1 to 9.1.3 and 9.2.1 to 9.2.4 only, each with its stated topic; mechanisms come from K01 and K02 |
| SRC-393 | T1 | admit-restricted | OWASP Clickjacking Defense Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html | 14_secgap2 | SECGAP2-K38 | frame-ancestors preferred over X-Frame-Options, frame-busting scripts ineffective, DoubleClickjacking mitigation is transaction authorization; header deployment is web-architecture |
| SRC-394 | T1 | admit-restricted | OWASP Cross-Site Request Forgery Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html | 14_secgap2 | SECGAP2-K37 | Code-level duties: synchronizer token, signed double-submit bound to the session, custom header for APIs, Sec-Fetch-Site and Origin checks, constant-time token comparison, no GET for state change; SameSite and session architecture are web-architecture |
| SRC-395 | T1 | admit-restricted | OWASP File Upload Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html | 14_secgap2 | SECGAP2-K26 | Language-neutral principles (extension allowlist, Content-Type is user-controlled, server-generated names, storage outside the web root or on another host, size limits); examples are Java |
| SRC-396 | T1 | admit-restricted | OWASP JSON Web Token Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet.html | 14_secgap2 | SECGAP2-K03 | Language-neutral threat and validation statements (hard-code accepted algorithms, reject alg none, validate iss and aud, revocation as a design topic); its Python examples and revocation or session architecture are not admitted |
| SRC-397 | T1 | admit-restricted | OWASP REST Security Cheat Sheet, JWT section | https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html | 14_secgap2 | SECGAP2-K04 | The JWT section only: integrity protection, do not allow unsecured JWTs, never select the verification algorithm from the token header, verify iss aud exp; the CORS section is a web-architecture boundary and not admitted |
| SRC-398 | T1 | admit-restricted | OWASP Unvalidated Redirects and Forwards Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html | 14_secgap2 | SECGAP2-K47 | Language-neutral rules: avoid redirects, server-side id mapping, allowlist compared on parsed scheme, canonical host and effective port, reject userinfo, no prefix matching; examples Java, Rails, C# |
| SRC-399 | T1 | admit-restricted | OWASP XML External Entity Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html | 14_secgap2 | SECGAP2-K11 | General guidance only: disable DTDs, reject DOCTYPE, disable external entity resolution and limit entity expansion; it has no Node or JavaScript section (headings read: C/C++, ColdFusion, Java, .NET, iOS, PHP, Python, Semgrep) |
| SRC-400 | T1 | admit-restricted | OWASP XML Security Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html | 14_secgap2 | SECGAP2-K14 | Language-neutral: use XSD not DTD, disable external entity processing, bound occurrences, HTTPS for remote schemas; no JavaScript content |
| SRC-401 | T1 | admit-restricted | undici docs: RedirectHandler | https://github.com/nodejs/undici/blob/main/docs/docs/api/RedirectHandler.md | 14_secgap2 | SECGAP2-K52 | Facts about undici's RedirectHandler only: redirects 300/301/302/303/307/308, POST to GET on 301 and 302 and any method to GET on 303, consumed bodies not replayed, headers naming the original URL stripped, stripHeadersOnRedirect and stripHeadersOnCrossOriginRedirect options, throwOnMaxRedirect; it does not describe Node's global fetch |
| SRC-402 | T1 | admit-restricted | undici source lib/web/fetch/index.js (httpRedirectFetch) | https://raw.githubusercontent.com/nodejs/undici/main/lib/web/fetch/index.js | 14_secgap2 | SECGAP2-K53 | Facts about the code on the main branch at extraction time: network error at redirect count 20, cross-origin removal of authorization, proxy-authorization, cookie and host, method to GET and body null for 301 or 302 POST and 303 non-GET/HEAD, error mode returns a network error, manual mode returns the response; the bundled version is given by process.versions.undici |
| SRC-403 | T1 | admit-restricted | V8 src/objects/value-serializer.h | https://raw.githubusercontent.com/v8/v8/main/src/objects/value-serializer.h | 14_secgap2 | SECGAP2-K51 | Facts: class comments say the format allows cloning per the HTML structured clone algorithm, the deserializer reads data written by ValueSerializer or a compatible implementation, ReadHeader may fail if the format is invalid; no trust statement |
| SRC-404 | T2 | admit-restricted | CWE-113 HTTP Request/Response Splitting | https://cwe.mitre.org/data/definitions/113.html | 14_secgap2 | SECGAP2-K20 | Taxonomy and generic mitigations only (allowlist, canonicalize, explicit output encoding); the example is Java |
| SRC-405 | T2 | admit-restricted | CWE-434 Unrestricted Upload of File with Dangerous Type | https://cwe.mitre.org/data/definitions/434.html | 14_secgap2 | SECGAP2-K30 | Taxonomy and generic mitigations (new unique filename, store outside web root, extension allowlist, server-side enforcement); examples PHP, Java, ASP.NET |
| SRC-406 | T2 | admit-restricted | Fetch Metadata Request Headers (W3C Working Draft) | https://www.w3.org/TR/fetch-metadata/ | 14_secgap2 | SECGAP2-K42 | Header definitions and values as a draft; whether it prescribes server rejection logic is open (the fetches disagreed); draft status must be stated |
| SRC-407 | T2 | admit-restricted | OWASP WSTG: Testing for HTTP Splitting and Smuggling (v4.2) | https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/07-Input_Validation_Testing/15-Testing_for_HTTP_Splitting_Smuggling | 14_secgap2 | SECGAP2-K19 | Mechanism of CRLF response splitting and cache poisoning only; the page states no mitigation (the discoverer said it did), no Node content; testing procedure not admitted |
| SRC-408 | T2 | admit-restricted | OWASP WSTG: Testing for Server-side Template Injection (v4.2) | https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/07-Input_Validation_Testing/18-Testing_for_Server-side_Template_Injection | 14_secgap2 | SECGAP2-K22 | Detection mechanism (plaintext against code context) for Jinja2, Twig and FreeMarker only; no JavaScript engine, no remediation section |
| SRC-409 | T3 | admit-restricted | ConfuGuard (formerly TypoSmart) package confusion detection | https://arxiv.org/abs/2502.20528 | 14_secgap2 | SECGAP2-K34 | Evaluation facts as reported (false positives 80 to 28 percent, 14 s added latency) and the package-confusion threat model figure; no claim that the tool should be used; the production figures differ between versions (630 confirmed attacks in v3 text) and are not admitted |
| SRC-410 | T3 | admit-restricted | Critical vulnerabilities in JSON Web Token libraries (T. McLean) | https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ | 14_secgap2 | SECGAP2-K09 | Mechanism of the none and RSA to HMAC attacks as the finder's account; recommendations as the author's position; no vendor-platform advice |
| SRC-411 | T3 | admit-restricted | Server-Side Template Injection: RCE for the modern web app (J. Kettle) | https://portswigger.net/research/server-side-template-injection | 14_secgap2 | SECGAP2-K21 | Mechanism and the Jade case study as research evidence; the three defences (trivial engine such as Mustache, sandbox, container) as the author's positions; no tool claim |
| SRC-412 | T3 | admit-restricted | SpellBound: Defending Against Package Typosquatting | https://arxiv.org/abs/2003.03471 | 14_secgap2 | SECGAP2-K33 | The authors' reported evaluation (lexical similarity plus popularity, 0.5 percent false positives on installs, 2.5 percent overhead) as evidence of one method; no claim that the tool should be used |
- ECMA-262 16th edition (ECMAScript 2025): LANG-K02 (A_lang_types): reject -; RUNTIME-K26 (E_quality_runtime): admit-restricted T1; kept reject -
- JavaScript modules (MDN guide): LANG-K12 (A_lang_types): admit T1; STRUCT-K02 (B_async_struct): admit-restricted T1; kept admit-restricted T1
- Google TypeScript Style Guide: TYPES-K16 (A_lang_types): admit-restricted T2; STRUCT-K18 (B_async_struct): admit-restricted T2; QUALITY-K20 (E_quality_runtime): admit T2; kept admit-restricted T2
- typescript-eslint shared configs: TYPES-K19 (A_lang_types): admit-restricted T1; QUALITY-K04 (E_quality_runtime): admit T1; kept admit-restricted T1
- OWASP Input Validation Cheat Sheet: TYPES-K21 (A_lang_types): admit T1; RUNSEC-K15 (C_domsec_runsec): admit-restricted T1; kept admit-restricted T1
- Node.js Security Best Practices (supply chain section): ASYNC-K18 (B_async_struct): admit T1; RUNSEC-K01 (C_domsec_runsec): admit T1; SUPPLY-K12 (D_supply_fw): admit-restricted T1; kept admit-restricted T1
- Content Security Policy Level 3: DOMSEC-K19 (C_domsec_runsec): admit-restricted T1; SECGAP2-K43 (G_secgap2): admit T1; kept admit-restricted T1
- Containing Malicious Package Updates in npm with a Lightweight Permission System: RUNSEC-K29 (C_domsec_runsec): admit-restricted T2; SUPPLY-K26 (D_supply_fw): admit T2; kept admit-restricted T2