FP-FIX(security): eliminate false positives across security + security-scan rules - #993

Merged

aidenybai merged 10 commits into

split/foundationfrom

Jul 2, 2026

Commits on Jun 30, 2026

fix(security): eliminate false positives across security + security-scan rules
aidenybai
committed
29f5247

Commits on Jul 1, 2026

refactor(security): deslop command-exec, metadata-secret, postmessage rules

rayhanadev
and
claude
committed
6ed26cb

Commits on Jul 2, 2026

fix(security): catch leaked JWT credentials in package metadata
aidenybai
committed
08cba09
fix(security): tighten spawn/shell taint detection in command-execution-input-risk
aidenybai
committed
0dd7190
fix(security): walk every concat operand in raw-sql-injection-risk
aidenybai
committed
ac8d701
fix(security): cover ancestor and arrow-prop filter shapes in svg-filter-clickjacking-risk
aidenybai
committed
fe0bbc8
fix(security): catch concat-built role params and string-safe firebase windows
aidenybai
committed
b3ce1b9
fix(security): treat #fragment credentials as credentialed URLs in no-secrets-in-client-code
aidenybai
committed
ed01d42
Merge remote-tracking branch 'origin/split/foundation' into split/security
aidenybai
committed
853a418
fix(secret-in-fallback): only exempt env names public by construction
aidenybai
committed
656f551