Fix security-scanner and duplicate-detector false positives (revised: addresses #63 review)#65

Merged

braedonsaunders merged 22 commits into

braedonsaunders:mainfrom

abk1969:security-scanner-precision

Jul 14, 2026

Commits on Jul 11, 2026

docs: add design spec for security/duplicate-detector precision fixes
abk1969
committed
docs: add implementation plan for security/duplicate-detector precision fixes
abk1969
committed
fix(security): exclude test/tooling paths from Hardcoded Secret rule
abk1969
committed
fix(security): scope Command/Shell Execution rules to product paths and real exec calls
abk1969
committed
fix(security): anchor SQL Injection Risk to a real DB-call receiver
abk1969
committed
fix(security): skip XSS Vulnerability for literal-only dangerouslySetInnerHTML
abk1969
committed
fix(security): check every dangerouslySetInnerHTML occurrence for XSS literal-safety, not just the first

abk1969
and
claude
committed
fix(security): anchor Function Constructor rule to an actual constructor call
abk1969
committed
fix(security): downgrade Debug Statements severity for server-only code
abk1969
committed
fix(duplicates): recognize Next.js route-handler exports as idiomatic, not duplicated
abk1969
committed
docs: document security scanner path exclusions
abk1969
committed
fix(security): gate XSS Vulnerability by isNonProductionPath, matching the other rules and the documented behavior

abk1969
and
claude
committed
fix(test): relocate XSS path-guard fixture to avoid tripping an unrelated architecture-diagram grouping issue
abk1969
committed

Commits on Jul 13, 2026