{"schemaVersion":1,"id":"io.github.letsfg.flights","name":"LetsFG Flights","repo":"https://github.com/LetsFG/LetsFG","listingState":"listed","marketplaceUrl":"https://plugins.omarchy.org/plugin.html?id=io.github.letsfg.flights","combined":{"verdict":"caution","basis":"trusted","contested":false,"commits":["26b1fa823756f164b472c7eab0d22f102044dc35"],"reasons":["marketplace [unsigned]: caution","opc [core]: caution"],"tree":"f84060a635365d4825d50589adb0fbe12b31859a"},"providers":[{"provider":"marketplace","tier":"unsigned","verification":"unsigned","signer":null,"signedAt":null,"commit":"26b1fa823756f164b472c7eab0d22f102044dc35","tree":null,"verdict":"caution","effectiveVerdict":"caution","adjustments":[],"counted":true,"timeReviewed":"2026-08-27T17:17:31Z","statement":null,"summary":"marketplace baseline: review-required","detail":{"outcome":"review-required","findings":[],"capabilities":["package-manager","installer"],"enforcementMode":"selective"}},{"provider":"opc","tier":"core","verification":"sigstore","signer":"https://github.com/PrometheusRoot/omarchy-plugin-check-data/.github/workflows/sign.yml@refs/heads/master","signedAt":"2026-10-03T20:06:24Z","commit":"26b1fa823756f164b472c7eab0d22f102044dc35","tree":"f84060a635365d4825d50589adb0fbe12b31859a","verdict":"caution","effectiveVerdict":"caution","adjustments":[],"counted":true,"timeReviewed":"2026-10-02T10:51:03Z","statement":"plugins/io.github.letsfg.flights/opc/26b1fa823756f164b472c7eab0d22f102044dc35.json","summary":"caution: injection, secret, package, supply-chain (17 finding(s) above info)","criteria":{"checked":["no-network","no-exec","no-persistence","no-privilege","no-obfuscation","no-secrets"],"failed":["no-network","no-exec"],"notChecked":["safe-to-run","reviewed-by-human"]},"findings":[{"category":"injection","severity":"low","confidence":0.95,"message":"MCP 'letsfg.description' field carries hidden instructions / references to secrets — classic tool poisoning. [CG701/mcp-tool-poisoning]","locations":[{"path":".mcp.json","startLine":11}]},{"category":"secret","severity":"low","confidence":0.6,"message":"Reads the CLI's token file ~/.letsfg/config.json and sends the bearer token to letsfg.co. This is the plugin's stated purpose, and the file is read-only to the plugin.","locations":[{"path":"Panel.qml","startLine":1071}]},{"category":"package","severity":"low","confidence":0.9,"message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","locations":[{"path":"openapi.yaml","startLine":32}]},{"category":"supply-chain","severity":"low","confidence":0.6,"message":"guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)","locations":[{"path":"sdk/mcp/src/index.ts","startLine":29}]},{"category":"supply-chain","severity":"low","confidence":0.6,"message":"guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)","locations":[{"path":"sdk/mcp/src/index.ts","startLine":30}]},{"category":"injection","severity":"low","confidence":0.8,"message":"Hidden-priority marker of the kind used in MCP tool-poisoning payloads. [CG105/instruction-override]","locations":[{"path":"sdk/mcp/src/index.ts","startLine":291}]},{"category":"other","severity":"low","confidence":0.9,"message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","locations":[{"path":"sdk/python/letsfg/cli.py","startLine":852}]},{"category":"other","severity":"low","confidence":0.9,"message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","locations":[{"path":"sdk/python/letsfg/client.py","startLine":1035}]},{"category":"other","severity":"low","confidence":0.9,"message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","locations":[{"path":"sdk/python/letsfg/client.py","startLine":1075}]},{"category":"other","severity":"low","confidence":0.9,"message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","locations":[{"path":"sdk/python/letsfg/connectors/auth.py","startLine":128}]},{"category":"other","severity":"low","confidence":0.9,"message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","locations":[{"path":"sdk/python/letsfg/local.py","startLine":129}]},{"category":"other","severity":"low","confidence":0.9,"message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","locations":[{"path":"sdk/python/letsfg/local.py","startLine":148}]},{"category":"other","severity":"low","confidence":0.9,"message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","locations":[{"path":"sdk/python/letsfg/local.py","startLine":227}]},{"category":"external-code","severity":"low","confidence":0.9,"message":"Declares 7 runtime dependencies fetched from a package registry at install/build time (not reviewed): pydantic, httpx, airportsdata, requests, typer, rich, click","locations":[{"path":"sdk/python/pyproject.toml"}]},{"category":"exec","severity":"low","confidence":0.9,"message":"subprocess_popen_with_shell_equals_true: subprocess call with shell=True identified, security issue.","locations":[{"path":"tools/build-ranking.py","startLine":101}]},{"category":"other","severity":"low","confidence":0.9,"message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","locations":[{"path":"tools/split-comparison.py","startLine":71}]},{"category":"other","severity":"low","confidence":0.9,"message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","locations":[{"path":"tools/split-comparison.py","startLine":77}]}],"detail":{"scope":{"kind":"full","path":""},"method":["static","ai"],"target":"marketplace-verified","report":{"schemaVersion":1,"plugin":{"id":"io.github.letsfg.flights","name":"LetsFG Flights","repo":"https://github.com/LetsFG/LetsFG","listingState":"listed","marketplace":{"verificationCommit":"26b1fa823756f164b472c7eab0d22f102044dc35","listingValidatedCommit":"26b1fa823756f164b472c7eab0d22f102044dc35","upstreamObservedCommit":"3a309f60e2e0a52082728a277f319148fa60bff1","baselineOutcome":"passed","verificationStatus":"unverified","caps":[],"stars":2075,"catalogGeneratedAt":"2026-09-30T14:53:56.598Z","manifestPath":"manifest.json","repositoryLayout":"root-plugin","author":"LetsFG","description":"Search hundreds of airlines from the bar. Uses your own LetsFG token; no keys are bundled.","category":"Productivity","kind":"Bar widget","tags":["bar","quickshell"],"license":"MIT","installCommand":"omarchy plugin add https://github.com/LetsFG/LetsFG.git --enable"}},"review":{"commit":"26b1fa823756f164b472c7eab0d22f102044dc35","scanTarget":"marketplace-verified","pluginPath":"","reviewedAt":"2026-10-02T10:51:03Z","aiModel":"sonnet+fable","upstreamHeadAtScan":"3a309f60e2e0a52082728a277f319148fa60bff1","previousCommit":null,"tools":[{"name":"inventory","version":null,"status":"ok"},{"name":"textscan","version":null,"status":"ok"},{"name":"extcode","version":null,"status":"ok"},{"name":"heckler","version":"1.0.0","status":"ok"},{"name":"ctxsentry","version":"0.5.0","status":"ok"},{"name":"opengrep","version":"1.30.0","status":"ok"},{"name":"yara","version":"4.5.4","status":"ok"},{"name":"malcontent","version":"1.26.1","status":"ok"},{"name":"shellcheck","version":"0.11.0","status":"ok"},{"name":"bandit","version":"1.9.4","status":"ok"},{"name":"eslint","version":"10.11.0","status":"ok"},{"name":"qmllint","version":"6.4.2","status":"ok"},{"name":"gitleaks","version":"8.30.1","status":"ok"},{"name":"guarddog","version":"3.2.0","status":"ok"},{"name":"osv","version":"2.6.0","status":"failed"},{"name":"zizmor","version":"1.30.1","status":"ok"},{"name":"clamav","version":"1.4.3","status":"ok"},{"name":"perf","version":null,"status":"ok"},{"name":"quality","version":null,"status":"ok"}],"rulesVersion":"r-05e7b1572de1","scannerVersion":"0.1.0"},"verdict":{"outcome":"caution","score":37,"hardFails":[],"aiEscalation":null,"summary":"caution: score 37; 16 low; uses processExec, network, fileWrite, packageInstall, externalCode","reasons":["score in the caution band","capabilities: processExec, network, fileWrite, packageInstall","relies on external code not in the reviewed commit, so safe-to-run is not checked: airportsdata (package, pypi), click (package, pypi), httpx (package, pypi), pydantic (package, pypi), requests (package, pypi), rich (package, pypi) +1 more"],"criteria":{"checked":["no-network","no-exec","no-persistence","no-privilege","no-obfuscation","no-secrets"],"failed":["no-network","no-exec"],"notChecked":["safe-to-run","reviewed-by-human"]}},"whatItDoes":{"oneLiner":"A bar widget with a flight-search panel that calls letsfg.co over XHR using the user's LetsFG token, with an anonymous install ID sent for analytics.","kinds":["bar-widget"],"entryPoints":[{"key":"barWidget","path":"BarWidget.qml"}],"manifestValid":true,"manifestError":null},"capabilities":{"processExec":{"level":"low","evidence":["F-9bb31a0a0ba8","F-613fbd1cd574","F-2834f7fba7a4"]},"network":{"level":"med","evidence":["F-3ec51272b374","F-3bb1cde4ceae","F-bebf5503c2b8","F-6213a2a19e5e","F-38e0f24cdd7c","F-34c22b5f6f5c","F-459e3e20f7cf","F-85c6a758dd2f","F-57e2cb2cee6f","F-15b442a65ebe","F-b6d605e4bc50","F-160e83a55e09","F-2901a310cca6","F-042fea2a1f78","F-417619fae0e1","F-b08348627ccb","F-71bffd63ddb0","F-2c8e3f68909e","F-3c63aa2bc026","F-d6929d9bcf10","F-5e11aeb0f27e","F-91edb1e736ed","F-f4b9bfada07e","F-7f1b0535cc86","F-9228052c8cec","F-038f69b45752","F-a80e14dfa0f8","F-b004b991086a"]},"fileWrite":{"level":"low","evidence":["F-fb1b58ee725e","F-bf29f8791c7c","F-a9d84b871079"]},"persistence":{"level":"none","evidence":[]},"privilege":{"level":"none","evidence":[]},"packageInstall":{"level":"low","evidence":["F-6586cc326adf"]},"bundledBinary":{"level":"none","evidence":[]},"clipboard":{"level":"none","evidence":[]},"screenCapture":{"level":"none","evidence":[]},"hyprlandIpc":{"level":"none","evidence":[]},"externalCode":{"level":"low","evidence":["F-33305cc9351a"],"externals":[{"name":"airportsdata","kind":"package","source":"pypi","evidence":["F-33305cc9351a"]},{"name":"click","kind":"package","source":"pypi","evidence":["F-33305cc9351a"]},{"name":"httpx","kind":"package","source":"pypi","evidence":["F-33305cc9351a"]},{"name":"pydantic","kind":"package","source":"pypi","evidence":["F-33305cc9351a"]},{"name":"requests","kind":"package","source":"pypi","evidence":["F-33305cc9351a"]},{"name":"rich","kind":"package","source":"pypi","evidence":["F-33305cc9351a"]},{"name":"typer","kind":"package","source":"pypi","evidence":["F-33305cc9351a"]}]}},"systemAreas":{"touched":["omarchy-shell"],"evidence":[{"area":"omarchy-shell","findings":["F-2aceb3996e4d","F-e62e3ebbdde3","F-1f74a0e338bd","F-16f66ec8f83e","F-6cf73f3f9cf7","F-3ff72e64efd0"]}]},"network":{"hosts":[{"host":"basemaps.cartocdn.com","schemes":["https"],"evidence":["F-e2b33e484ab4"]},{"host":"booking.flyscoot.com","schemes":["https"],"evidence":["F-b233b59367f3"]},{"host":"bookingportal.china-airlines.com","schemes":["https"],"evidence":["F-223afcc575b8"]},{"host":"checknfly.co.uk","schemes":["https"],"evidence":["F-bb894d2ba7fa"]},{"host":"checkout.stripe.com","schemes":["https"],"evidence":["F-80c48163c0c3"]},{"host":"checkout.stripe.com.evil.com","schemes":["https"],"evidence":["F-74bb0cf05caf"]},{"host":"context7.com","schemes":["https"],"evidence":["F-dfbc363724eb"]},{"host":"github.com","schemes":["https"],"evidence":["F-00f7fe0ebf6e","F-79169d733f5c","F-c32ffe17778f","F-1f7cbee848c0","F-8fe919aff9f9","F-30390d6bbf35","F-3b05523eb152"]},{"host":"glama.ai","schemes":["https"],"evidence":["F-e3ca7624bf6d"]},{"host":"i.travelapi.com","schemes":["https"],"evidence":["F-21ddc2397c04"]},{"host":"images.kiwi.com","schemes":["https"],"evidence":["F-268c7f2ce764"]},{"host":"images.pexels.com","schemes":["https"],"evidence":["F-8fd59c87cd6e"]},{"host":"letsfg.co","schemes":["https"],"evidence":["F-6a3feea33bf4","F-e0c1b4687acb","F-de7124e4e1e7","F-c315c37e635a","F-cad11f864e6d","F-5ca62be49ed1","F-3858790fdecb","F-fa7b8109e101","F-920d49da1f49","F-61ac33f817c8","F-23ad1af5b21b","F-3feafcd98d07","F-4b8e0350ed94","F-128a5fe61a40","F-7d4d8d5e60ba","F-9e50ba582395","F-474d3ce00bb5","F-d5dc6d83b69d"]},{"host":"localhost","schemes":["http"],"evidence":["F-c06edb69186b"]},{"host":"lucide.dev","schemes":["https"],"evidence":["F-c3ccdbaec617"]},{"host":"oversea.csair.com","schemes":["https"],"evidence":["F-042adf30d0a6"]},{"host":"pics.avs.io","schemes":["https"],"evidence":["F-24ac49e0179b"]},{"host":"q-xx.bstatic.com","schemes":["https"],"evidence":["F-33d5384409df"]},{"host":"smithery.ai","schemes":["https"],"evidence":["F-ec9bbdd3a4af"]},{"host":"static.modelcontextprotocol.io","schemes":["https"],"evidence":["F-d0e83aa384dd"]},{"host":"tickets.vueling.com","schemes":["https"],"evidence":["F-13b483e45193","F-e16c1d372e1a"]},{"host":"upload.wikimedia.org","schemes":["https"],"evidence":["F-5ab3f8706a32"]},{"host":"www.delta.com","schemes":["https"],"evidence":["F-80fddcdcd00f"]},{"host":"www.despegar.com.mx","schemes":["https"],"evidence":["F-4fa5404280dc","F-d21d93ca125d"]},{"host":"www.flighthub.com","schemes":["https"],"evidence":["F-5067b1b4c444"]},{"host":"www.google.com","schemes":["https"],"evidence":["F-81c37b85012c","F-973709b3fb4b","F-b4674b0207cd"]},{"host":"www.lastminute.com","schemes":["https"],"evidence":["F-f3064451e95d"]},{"host":"www.lionair.co.id","schemes":["https"],"evidence":["F-8434130c620a","F-34c90c7c1dec"]},{"host":"www.martigo.pl","schemes":["https"],"evidence":["F-ad4ac2783452","F-c9e108a0afc0"]},{"host":"www.mea.com.lb","schemes":["https"],"evidence":["F-03702aad1616"]},{"host":"www.vietjetair.com","schemes":["https"],"evidence":["F-10af199081f2","F-656f14c5236f"]}]},"dependencies":{"packages":[{"name":"@types/node","version":"^25.3.3","ecosystem":"npm","direct":true,"pinned":true,"manifestPath":"sdk/js/package.json"},{"name":"tsup","version":"^8.0.0","ecosystem":"npm","direct":true,"pinned":true,"manifestPath":"sdk/js/package.json"},{"name":"tsx","version":"^4.19.0","ecosystem":"npm","direct":true,"pinned":true,"manifestPath":"sdk/js/package.json"},{"name":"typescript","version":"^5.3.0","ecosystem":"npm","direct":true,"pinned":true,"manifestPath":"sdk/js/package.json"},{"name":"@types/node","version":"^25.5.0","ecosystem":"npm","direct":true,"pinned":true,"manifestPath":"sdk/mcp/package.json"},{"name":"tsup","version":"^8.0.0","ecosystem":"npm","direct":true,"pinned":true,"manifestPath":"sdk/mcp/package.json"},{"name":"tsx","version":"^4.19.0","ecosystem":"npm","direct":true,"pinned":true,"manifestPath":"sdk/mcp/package.json"},{"name":"typescript","version":"^5.3.0","ecosystem":"npm","direct":true,"pinned":true,"manifestPath":"sdk/mcp/package.json"}],"systemPackages":[],"vulnerabilities":[]},"secrets":{"count":27,"items":[{"findingId":"F-ad63c538d1a3","kind":"curl-auth-header","live":null},{"findingId":"F-885777f4fce4","kind":"curl-auth-header","live":null},{"findingId":"F-e1e24552fd6f","kind":"curl-auth-header","live":null},{"findingId":"F-c7875da9b52f","kind":"curl-auth-header","live":null},{"findingId":"F-1f9546d4adb0","kind":"generic-api-key","live":null},{"findingId":"F-0af0c6ef5062","kind":"curl-auth-header","live":null},{"findingId":"F-afd2d39ebf68","kind":"curl-auth-header","live":null},{"findingId":"F-332e313edf65","kind":"curl-auth-header","live":null},{"findingId":"F-e15cf9eee111","kind":"curl-auth-header","live":null},{"findingId":"F-72e4b69ca387","kind":"curl-auth-header","live":null},{"findingId":"F-a71d1ac93388","kind":"curl-auth-header","live":null},{"findingId":"F-be62626bb4b5","kind":"curl-auth-header","live":null},{"findingId":"F-e1191d8462e5","kind":"curl-auth-header","live":null},{"findingId":"F-8773cdc825c9","kind":"curl-auth-header","live":null},{"findingId":"F-717965ebc5bf","kind":"curl-auth-header","live":null},{"findingId":"F-ec4b4c43d52b","kind":"curl-auth-header","live":null},{"findingId":"F-b27f6612fae0","kind":"curl-auth-header","live":null},{"findingId":"F-0582d853e753","kind":"curl-auth-header","live":null},{"findingId":"F-6a104cc41fc8","kind":"curl-auth-header","live":null},{"findingId":"F-2d3f8b0e1116","kind":"curl-auth-header","live":null},{"findingId":"F-69d0bc94ac28","kind":"curl-auth-header","live":null},{"findingId":"F-8cb4faec02c1","kind":"curl-auth-header","live":null},{"findingId":"F-20c75a004b08","kind":"curl-auth-header","live":null},{"findingId":"F-1a5eba698eb4","kind":"curl-auth-header","live":null},{"findingId":"F-d83ee621582e","kind":"curl-auth-header","live":null},{"findingId":"F-fec97898e7aa","kind":"curl-auth-header","live":null},{"findingId":"F-126a3ccc7d74","kind":"generic-api-key","live":null}]},"supplyChain":{"scorecard":null,"pinnedDeps":true,"signedCommitRatio":0.34,"busFactor":1,"repoAgeDays":214,"unpinnedRemoteFetches":[]},"injection":{"hiddenUnicode":{"count":28,"evidence":["F-212c56bcb5da","F-845cbe4c4501","F-7679dd2f4a9c","F-80a199cb29d2","F-8b0469256876","F-cb98ba84f4db","F-17ff2e77c4f4","F-bfeef605794d","F-ad67070b54b6","F-3c1cdb98a60b","F-ef045ec60ade","F-cd80c4cff636","F-92b9d3d1b37f","F-70da39f2bb11","F-3ac239a5edd7","F-81efffa01beb","F-d53bf93cfe26","F-7afcbf3ac8ea","F-c217f7d3a805","F-c850d4c1606d","F-9ebd8129be87","F-a7fa52ccdae7","F-39073f132e25","F-cceaf6e1e661","F-2d4390c018ac","F-0694381907da","F-2c244bbe7674","F-9c13b29a16c5"]},"promptInjection":{"count":2,"evidence":["F-88d14336f65f","F-4a5642ee5738"]},"obfuscation":{"count":0,"evidence":[]}},"codeQuality":{"loc":{"total":25185,"byLanguage":[{"language":"Python","files":50,"lines":8677},{"language":"QML","files":18,"lines":4837},{"language":"TypeScript","files":10,"lines":4740},{"language":"JavaScript","files":4,"lines":4329},{"language":"CSS","files":2,"lines":1282},{"language":"YAML","files":8,"lines":1069},{"language":"Shell","files":1,"lines":95},{"language":"Dockerfile","files":2,"lines":80},{"language":"TOML","files":1,"lines":76}]},"lint":[{"tool":"shellcheck","errors":0,"warnings":1},{"tool":"eslint","errors":0,"warnings":107},{"tool":"qmllint","errors":0,"warnings":4782},{"tool":"bandit","errors":1,"warnings":40}],"tests":{"present":true,"files":28},"docs":{"readme":true,"changelog":false},"license":{"spdx":"MIT","file":true},"hotspots":[{"path":"sdk/mcp/src/index.ts","reason":"r.4c1fa8e9227d; r.7e92b014a22b"},{"path":"sdk/python/letsfg/local.py","reason":"r.5705d5a56640"},{"path":"sdk/python/letsfg/client.py","reason":"r.5705d5a56640"},{"path":"tools/split-comparison.py","reason":"r.5705d5a56640"},{"path":".mcp.json","reason":"r.7e92b014a22b"},{"path":"openapi.yaml","reason":"r.0288ce1d8585"},{"path":"sdk/python/letsfg/cli.py","reason":"r.5705d5a56640"},{"path":"sdk/python/letsfg/connectors/auth.py","reason":"r.5705d5a56640"}]},"performance":{"timers":[{"path":"Panel.qml","line":1099,"intervalMs":260,"repeat":false,"spawnsProcess":false},{"path":"Panel.qml","line":1106,"intervalMs":null,"repeat":false,"spawnsProcess":false},{"path":"Panel.qml","line":1118,"intervalMs":null,"repeat":false,"spawnsProcess":false},{"path":"Panel.qml","line":1139,"intervalMs":null,"repeat":false,"spawnsProcess":false},{"path":"Panel.qml","line":1342,"intervalMs":1000,"repeat":true,"spawnsProcess":false}],"estSpawnsPerMin":0.0,"keepLoaded":true,"largeAssets":[{"path":"assets/demo.gif","bytes":4037616},{"path":"assets/demo.mp4","bytes":2541044}],"polling":[]},"maintenance":{"lastCommitAt":"2026-08-27T08:23:15Z","commits90d":78,"contributors":12,"openIssues":null,"archived":null,"latestRelease":"v2026.5.88"},"diffSinceLastReview":null,"findings":[{"id":"F-9f17e82f0086","source":"zizmor","ruleId":"r.ab9fa6693ebd","severity":"info","confidence":0.9,"path":".github/dependabot.yml","line":8,"snippet":"package-ecosystem: github-actions","message":"insufficient cooldown in Dependabot updates (https://docs.zizmor.sh/audits/#dependabot-cooldown)","category":"supply-chain","hardFail":false},{"id":"F-ead92532f8fc","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/docs.yml","line":18,"snippet":"uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-3c48a0e4c63b","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":".github/workflows/docs.yml","line":25,"snippet":"run: pip install mkdocs-material","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-65e0db46241e","source":"zizmor","ruleId":"r.39362b74656d","severity":"info","confidence":0.7,"path":".github/workflows/sdk-tests.yml","line":16,"snippet":"test:     runs-on: ubuntu-latest     steps:       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0         with:           python-version: '3.12'       - name: Install SDK (no connector","message":"overly broad permissions (https://docs.zizmor.sh/audits/#excessive-permissions)","category":"supply-chain","hardFail":false},{"id":"F-7fb7c658ac9b","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/sdk-tests.yml","line":19,"snippet":"uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-729a154494c2","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":".github/workflows/sdk-tests.yml","line":26,"snippet":"run: pip install pydantic pytest && pip install -e . --no-deps","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-937ebe08c809","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/test.yml","line":32,"snippet":"uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-2a5639129623","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/test.yml","line":54,"snippet":"uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0         with:           fetch-depth: 0","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-471f7aab6ce0","source":"zizmor","ruleId":"r.f629672d34ab","severity":"info","confidence":0.5,"path":".github/workflows/test.yml","line":122,"snippet":"uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0","message":"credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)","category":"supply-chain","hardFail":false},{"id":"F-b3e72b03fcb0","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":".github/workflows/test.yml","line":128,"snippet":"pip install -e .","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-883c3223440b","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":".github/workflows/test.yml","line":129,"snippet":"pip install pytest","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-88d14336f65f","source":"ctxsentry","ruleId":"r.7e92b014a22b","severity":"low","confidence":0.95,"path":".mcp.json","line":11,"snippet":"Flight and hotel search & booking for AI agents. Server-side engine covers hundreds of airlines with per-flight reliability history, plus real bookable hotel ra…","message":"MCP 'letsfg.description' field carries hidden instructions / references to secrets — classic tool poisoning. [CG701/mcp-tool-poisoning]","category":"injection","hardFail":false},{"id":"F-6a3feea33bf4","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":".mcp.json","line":12,"snippet":"\"homepage\": \"https://letsfg.co\",","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-00f7fe0ebf6e","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":".mcp.json","line":13,"snippet":"\"repository\": \"https://github.com/LetsFG/LetsFG\"","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-212c56bcb5da","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"AGENTS.md","line":5,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-b1102e4ca325","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"AGENTS.md","line":120,"snippet":"curl -X POST https://letsfg.co/api/search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-496cdabd9975","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"AGENTS.md","line":126,"snippet":"curl https://letsfg.co/api/results/abc123 -H \"Authorization: Bearer <your_token>\"","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-c38ee481feb8","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"AGENTS.md","line":196,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-61e639556511","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"AGENTS.md","line":260,"snippet":"npm install -g letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-1e721257c356","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"AGENTS.md","line":347,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/register \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-50cf71cc6a4a","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"AGENTS.md","line":360,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-ad63c538d1a3","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"AGENTS.md","line":360,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/search \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-c89eeb6efed3","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"AGENTS.md","line":966,"snippet":"curl -s -X POST https://letsfg.co/api/agent-access/request","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-f72e6fa1ff33","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"AGENTS.md","line":973,"snippet":"curl -s -X POST https://letsfg.co/api/agent-access/verify \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-b40ab6e886a4","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"AGENTS.md","line":979,"snippet":"curl -s -X POST https://letsfg.co/api/agent-access/verify \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-b5585876d3e1","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"AGENTS.md","line":990,"snippet":"curl -X POST https://letsfg.co/api/search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-211d750c053f","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"AGENTS.md","line":997,"snippet":"curl https://letsfg.co/api/results/abc123 -H \"Authorization: Bearer eyJ...\"","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-6144f63abb11","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"AGENTS.md","line":1000,"snippet":"curl -X POST https://letsfg.co/api/agent-book \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-3b666a378074","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":55,"snippet":"| **CLI / SDK** | `pip install letsfg` + `letsfg auth` — wraps PFS with auth and ranking | 8–10 s to first results; longer to `completed`, longer again on a split | Free auth, free search |","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-1d66cd81c07d","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":152,"snippet":"pip install -e \".[dev]\"","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-122e8bc23c4e","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":159,"snippet":"npm install npm run build    # Compiles TypeScript → dist/","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false,"endLine":160},{"id":"F-e850ca4f4179","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"CLAUDE.md","line":167,"snippet":"npm install npm run build    # Compiles TypeScript → dist/","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false,"endLine":168},{"id":"F-fec01dbf41dc","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"CONTRIBUTING.md","line":52,"snippet":"pip install -e \".[dev]\"","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-c7173e2e79ae","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"CONTRIBUTING.md","line":60,"snippet":"npm install npm run build","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false,"endLine":61},{"id":"F-f72c2e87fc79","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"CONTRIBUTING.md","line":69,"snippet":"npm install npm run build","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false,"endLine":70},{"id":"F-a64df834b744","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"Dockerfile","line":31,"snippet":"RUN npm install -g letsfg-mcp@latest","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-c48e9fe5060c","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"Dockerfile.python","line":26,"snippet":"RUN pip install --no-cache-dir playwright && \\","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-e2d4a2be0f5a","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"Dockerfile.python","line":38,"snippet":"RUN pip install --no-cache-dir .","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-d0012644f652","source":"malcontent","ruleId":"r.9337bfb7564c","severity":"info","confidence":0.6,"path":"Model.js","line":0,"snippet":"['\"aaaaaaaeeeeeiiiiooooooouuuuyyccnnszzlrszcea\"', '\"abcdefghijklmnopqrstuvwxyz0123456789\"', 'function', 'charAt(', 'join(', 'for']","message":"charAt/substr operations with long strings [MEDIUM]","category":"other","hardFail":false},{"id":"F-432942e641c5","source":"malcontent","ruleId":"r.fb014819c620","severity":"info","confidence":0.6,"path":"Model.js","line":0,"snippet":"['(POLL_TIMEOUT_MS / POLL_INTERVAL_MS)', '(/api/stars/badge)', '(left / TILE_SIZE)', '$complex_math_add', '$complex_math_div', '$complex_math_mul', '$complex_math_sub', '(expiresAt - now)', '(top / TI","message":"complex math with parseInt or fromCharCode conversions [MEDIUM]","category":"other","hardFail":false},{"id":"F-3277b799d893","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"Model.js","line":0,"snippet":"['agentRequestUrl', 'agentVerifyUrl']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-f5241232e4ec","source":"malcontent","ruleId":"r.247776e64a54","severity":"info","confidence":0.6,"path":"Model.js","line":0,"snippet":"['curl payload and concluding']","message":"Invokes curl [MEDIUM]","category":"other","hardFail":false},{"id":"F-cacdefbefd5e","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"Model.js","line":0,"snippet":"['HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-f2c5f6f0813c","source":"malcontent","ruleId":"r.57128783ca37","severity":"info","confidence":0.6,"path":"Model.js","line":0,"snippet":"['hostname', 'port']","message":"connects to an arbitrary hostname:port [MEDIUM]","category":"other","hardFail":false},{"id":"F-6a81167fce15","source":"malcontent","ruleId":"r.98f4a8002aa3","severity":"info","confidence":0.6,"path":"Model.js","line":0,"snippet":"['compromised or spoofed response must']","message":"references spoofing [MEDIUM]","category":"other","hardFail":false},{"id":"F-cca4435e61cd","source":"malcontent","ruleId":"r.8a7ad93c4718","severity":"info","confidence":0.6,"path":"Model.js","line":0,"snippet":"['API is not a malicious user -- it is a']","message":"References 'malicious' [MEDIUM]","category":"other","hardFail":false},{"id":"F-e0c1b4687acb","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Model.js","line":36,"snippet":"var API_ORIGIN = \"https://letsfg.co\"","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-24ac49e0179b","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Model.js","line":171,"snippet":"//   https://pics.avs.io/100/100/{IATA}.png","message":"URL literal: https://pics.avs.io","category":"network","hardFail":false},{"id":"F-268c7f2ce764","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Model.js","line":187,"snippet":"var LOGO_CDN_PRIMARY = \"https://images.kiwi.com/airlines/64/\"","message":"URL literal: https://images.kiwi.com","category":"network","hardFail":false},{"id":"F-4e47f95bab18","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":199,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-c71f8087bd98","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":234,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-8e574c4d25fc","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":241,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-ef673a64edc1","source":"eslint","ruleId":"r.440b465c2d7c","severity":"info","confidence":0.6,"path":"Model.js","line":362,"snippet":"","message":"Unsafe Regular Expression","category":"exec","hardFail":false},{"id":"F-74bb0cf05caf","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Model.js","line":403,"snippet":"// The gap is narrow but real: \"https://checkout.stripe.com.evil.com/x\" passes","message":"URL literal: https://checkout.stripe.com.evil.com","category":"network","hardFail":false},{"id":"F-80c48163c0c3","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Model.js","line":504,"snippet":"if (url.indexOf(\"https://checkout.stripe.com/\") !== 0) {","message":"URL literal: https://checkout.stripe.com","category":"network","hardFail":false},{"id":"F-4e59dfa91fba","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":670,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-0d4247251709","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":849,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-cf5f325bcbbb","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":854,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-000934c6dee4","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1008,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-b1b1521470a0","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1015,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-70f3702e1d92","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1021,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-69558e688fe7","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1022,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-c255b0f0e902","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1024,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-60ae0a5001bf","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1025,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-a866b305e84e","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1101,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-edbdd0d1b65d","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1102,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-468eab709b77","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1104,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-ab34fb3d2db1","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1113,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-7facba7641de","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1142,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-2522c77ee314","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1198,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-dc6a1f9025e0","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1199,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-4e57f2f5b22f","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1206,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-7520e138ed3b","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1207,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-993f2df337e5","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1240,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-0916c8db0164","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1272,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-8cc253c4cd04","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1277,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-36a4f6662f67","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1287,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-5512acfcb724","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1288,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-f169ecea47c8","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1292,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-578e92092603","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1293,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-a79be1828e03","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1303,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-43b5ed9a4f30","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1314,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-81b43486c81b","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1320,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-b0ad957b5890","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1328,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-e2b33e484ab4","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Model.js","line":1345,"snippet":"var TILE_HOST = \"https://basemaps.cartocdn.com/rastertiles/voyager/\"","message":"URL literal: https://basemaps.cartocdn.com","category":"network","hardFail":false},{"id":"F-72378b96ebab","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1430,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-e8ef64e52f5a","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1458,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-3ec51272b374","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"Model.js","line":1502,"snippet":"// I got this wrong once by checking an anonymous curl payload and concluding","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-1c3e55d00b83","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1560,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-b4707531c9c3","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1563,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-b77859c60590","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1653,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-21ddc2397c04","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Model.js","line":1681,"snippet":"\"https://i.travelapi.com/\",","message":"URL literal: https://i.travelapi.com","category":"network","hardFail":false},{"id":"F-33d5384409df","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Model.js","line":1682,"snippet":"\"https://q-xx.bstatic.com/\",","message":"URL literal: https://q-xx.bstatic.com","category":"network","hardFail":false},{"id":"F-5f0b8f45d6d5","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1690,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-7fb01dbd87e1","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1706,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-5b642d1e3eff","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1763,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-28cf9af9233f","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1769,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-a4d6c7dc0c6b","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1779,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-8fd59c87cd6e","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Model.js","line":1839,"snippet":"\"https://images.pexels.com/\",","message":"URL literal: https://images.pexels.com","category":"network","hardFail":false},{"id":"F-5ab3f8706a32","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Model.js","line":1840,"snippet":"\"https://upload.wikimedia.org/\",","message":"URL literal: https://upload.wikimedia.org","category":"network","hardFail":false},{"id":"F-11eaa2ba040b","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1857,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-ae607ef81a98","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1876,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-ebc000d9bfca","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1877,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-ce7290296358","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1937,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-28144565fc5c","source":"eslint","ruleId":"r.440b465c2d7c","severity":"info","confidence":0.6,"path":"Model.js","line":1975,"snippet":"","message":"Unsafe Regular Expression","category":"exec","hardFail":false},{"id":"F-535eadedaef4","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1987,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-37b3d9646eea","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":1988,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-81d88501f263","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":2105,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-7cc425f0f27f","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":2118,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-4f1ae1c61b8a","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":2121,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-50942c452750","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":2123,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-41450e520687","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":2144,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-9219c1f77a08","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":2149,"snippet":"","message":"Function Call Object Injection Sink","category":"exec","hardFail":false},{"id":"F-949c64cf3dea","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":2174,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-fc0799fffed5","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":2206,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-7554b26d58c3","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":2212,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-cf51bf4e0e90","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":2214,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-f4c71f267fd0","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"Model.js","line":2223,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-00f5bf480144","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"OMARCHY-PLUGIN.md","line":37,"snippet":"omarchy plugin add https://github.com/LetsFG/LetsFG.git --enable","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-d34c01fb4c65","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"OMARCHY-PLUGIN.md","line":56,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-0b13fc156576","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"OMARCHY-PLUGIN.md","line":69,"snippet":"omarchy plugin remove io.github.letsfg.flights","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-5662edb01204","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"OMARCHY-PLUGIN.md","line":132,"snippet":"omarchy-shell shell summon \"io.github.letsfg.flights\" '{}'","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-7f5a68349bbf","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"OMARCHY-PLUGIN.md","line":133,"snippet":"omarchy-shell shell hide \"io.github.letsfg.flights\"","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-5e275ead6d35","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"OMARCHY-PLUGIN.md","line":275,"snippet":"`omarchy-plugin-letsfg/1.0.0`, and `X-LetsFG-Install`, which is 24 random","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-0da5eb5fccf4","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"OMARCHY-PLUGIN.md","line":397,"snippet":"documented `omarchy plugin validate` rules — including the rule that","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-7161526219de","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"OMARCHY-PLUGIN.md","line":413,"snippet":"pip install PySide6-Essentials","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-886866d8d0b3","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"OMARCHY-PLUGIN.md","line":431,"snippet":"omarchy plugin validate \"$PLUGIN_DIR\"","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-32c9f1f385a7","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"Panel.qml","line":0,"snippet":"['agentRequestUrl', 'agentVerifyUrl']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-866c49c9302b","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"Panel.qml","line":0,"snippet":"['application/json', 'POST']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-0c36d7214120","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"Panel.qml","line":0,"snippet":"['Content-Type', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-526b926af725","source":"malcontent","ruleId":"r.4466daea12b8","severity":"info","confidence":0.6,"path":"Panel.qml","line":0,"snippet":"['openUrl']","message":"requests resources via URL [MEDIUM]","category":"other","hardFail":false},{"id":"F-dd6cae699e37","source":"malcontent","ruleId":"r.8a7ad93c4718","severity":"info","confidence":0.6,"path":"Panel.qml","line":0,"snippet":"['not a malicious user -- it is a']","message":"References 'malicious' [MEDIUM]","category":"other","hardFail":false},{"id":"F-2aceb3996e4d","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"Panel.qml","line":96,"snippet":"xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-e62e3ebbdde3","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"Panel.qml","line":130,"snippet":"xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-fb1b58ee725e","source":"opengrep","ruleId":"r.3ddf8e79d32d","severity":"info","confidence":0.9,"path":"Panel.qml","line":152,"snippet":"tokenStore.setText(Model.buildTokenConfig(token, expiresAt))","message":"Writes files from QML (FileView.setText / JsonAdapter writeAdapter).","category":"filesystem","hardFail":false},{"id":"F-1f74a0e338bd","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"Panel.qml","line":276,"snippet":"xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-16f66ec8f83e","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"Panel.qml","line":345,"snippet":"xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-6cf73f3f9cf7","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"Panel.qml","line":736,"snippet":"xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-3ff72e64efd0","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"Panel.qml","line":873,"snippet":"xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-8bb7b4a04fa8","source":"ai","ruleId":"r.8a8b5d3460eb","severity":"info","confidence":0.6,"path":"Panel.qml","line":1025,"snippet":"An anonymous install id, generated once and kept beside the token.","message":"Generates a random anonymous install ID and sends it to the server as an analytics header (X-LetsFG-Install). It is disclosed in the code comments.","category":"network","hardFail":false},{"id":"F-bf29f8791c7c","source":"opengrep","ruleId":"r.3ddf8e79d32d","severity":"info","confidence":0.9,"path":"Panel.qml","line":1046,"snippet":"try { installStore.setText(JSON.stringify({ install_id: id })) } catch (e) { /* analytics only */ }","message":"Writes files from QML (FileView.setText / JsonAdapter writeAdapter).","category":"filesystem","hardFail":false},{"id":"F-a9d84b871079","source":"opengrep","ruleId":"r.3ddf8e79d32d","severity":"info","confidence":0.9,"path":"Panel.qml","line":1053,"snippet":"try { installStore.setText(JSON.stringify({ install_id: root.installId })) } catch (e) { /* analytics only */ }","message":"Writes files from QML (FileView.setText / JsonAdapter writeAdapter).","category":"filesystem","hardFail":false},{"id":"F-4f6fd296140f","source":"ai","ruleId":"r.3ced4e1cd7e6","severity":"low","confidence":0.6,"path":"Panel.qml","line":1071,"snippet":"path: Quickshell.env(\"HOME\") + \"/.letsfg/config.json\"","message":"Reads the CLI's token file ~/.letsfg/config.json and sends the bearer token to letsfg.co. This is the plugin's stated purpose, and the file is read-only to the plugin.","category":"secret","hardFail":false},{"id":"F-3bb1cde4ceae","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"Panel.qml","line":1277,"snippet":"// tools/validate.sh fails the build if `new XMLHttpRequest()` appears","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-bebf5503c2b8","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"Panel.qml","line":1284,"snippet":"var xhr = new XMLHttpRequest()","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-de7124e4e1e7","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"Panel.qml","line":2643,"snippet":"onClicked: root.openOffer(\"https://letsfg.co/en/loved-by\")","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-845cbe4c4501","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"README.md","line":11,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-f79ca778fd06","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"README.md","line":43,"snippet":"[<img src=\"https://img.shields.io/badge/📦_pip_install_letsfg-3776AB?style=for-the-badge&logo=python&logoColor=white\" alt=\"pip install\">](https://pypi.org/project/letsfg/)","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-7679dd2f4a9c","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"README.md","line":55,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-13d8080cccc7","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"README.md","line":289,"snippet":"| **Setup** | `pip install letsfg && letsfg auth` | Payment method on file — see below | [letsfg.co/developers](https://letsfg.co/developers) |","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-8cf1b028a120","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"README.md","line":292,"snippet":"- **CLI / SDK (Path 1):** `pip install letsfg` and run `letsfg auth` once — it puts a payment method on file via a zero-amount Stripe setup (no charge, no authorization hold) and gives you a 90-day Bearer token. After that, `letsfg search` calls our server-side engine and applies the open-source ranking algorithm locally. Search is free and unlimited.","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-80a199cb29d2","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"README.md","line":403,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-dbf389357e0b","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"README.md","line":406,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-252be324da85","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"README.md","line":426,"snippet":"curl -X POST https://letsfg.co/api/agent-access/request","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-2dc80e202949","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"README.md","line":432,"snippet":"curl -X POST https://letsfg.co/api/agent-access/verify \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-3d487d044c0d","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"README.md","line":437,"snippet":"curl -X POST https://letsfg.co/api/search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-5cce801c9287","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"README.md","line":451,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/register \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-885777f4fce4","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"README.md","line":451,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/register \\   -H \"Content-Type: application/json\" \\   -d '{\"agent","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-38980c17f157","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"README.md","line":455,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-8b0469256876","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"README.md","line":560,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-2b2732c03a46","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":573,"snippet":"omarchy plugin add https://github.com/LetsFG/LetsFG.git --enable","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-a29625b02460","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":584,"snippet":"omarchy plugin remove io.github.letsfg.flights","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-cf053d156954","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"README.md","line":606,"snippet":"| **Python SDK + CLI** | `pip install letsfg` | SDK + CLI (run `letsfg auth` once for free search) |","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-52b5c4c884ad","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"README.md","line":608,"snippet":"| **JS/TS SDK** | `npm install -g letsfg` | SDK + CLI + open-source ranking engine |","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-e613f47ce820","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"README.md","line":612,"snippet":"| **Omarchy plugin** | `omarchy plugin add https://github.com/LetsFG/LetsFG.git --enable` | Flight search in the Omarchy bar ([details](OMARCHY-PLUGIN.md)) |","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-cb98ba84f4db","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"README.md","line":781,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-17ff2e77c4f4","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"SKILL.md","line":15,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-8e81b4588ceb","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"SKILL.md","line":244,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-279fbbff2a59","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"SKILL.md","line":323,"snippet":"npm install -g letsfg-mcp","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-e55c885b3041","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"agent-skills-contribution/packages/skills-catalog/skills/(tooling)/letsfg/SKILL.md","line":68,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-27791ec126a1","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"agent-skills-contribution/packages/skills-catalog/skills/(tooling)/letsfg/references/mcp-setup.md","line":8,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-68b221eb33fe","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"agent-skills-contribution/packages/skills-catalog/skills/(tooling)/letsfg/references/mcp-setup.md","line":19,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/register \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-4bb1b537cc2b","source":"malcontent","ruleId":"r.5994c88c8e53","severity":"info","confidence":0.6,"path":"assets/demo.gif","line":0,"snippet":"['cp B']","message":"copy files using cp [MEDIUM]","category":"other","hardFail":false},{"id":"F-fcb0a20d2b9e","source":"malcontent","ruleId":"r.5144ef25665d","severity":"info","confidence":0.6,"path":"assets/demo.gif","line":0,"snippet":"['SSH']","message":"Supports SSH (secure shell) [MEDIUM]","category":"other","hardFail":false},{"id":"F-b8998790acf5","source":"malcontent","ruleId":"r.fb014819c620","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":0,"snippet":"['(stopover to explore / break the trip)', '(offerPrice - cheapestPrice)', '(googleFlightsPrice * 100)', '(avoid very early/late)', '$complex_math_add', '$complex_math_div', '$complex_math_mul', '$com","message":"complex math with parseInt or fromCharCode conversions [MEDIUM]","category":"other","hardFail":false},{"id":"F-56309192afc3","source":"malcontent","ruleId":"r.dbe1faed974e","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":0,"snippet":"['+ parseInt(']","message":"performs math directly against parsed integers [MEDIUM]","category":"other","hardFail":false},{"id":"F-552593a1a233","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":13,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-b4c0679f1759","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":15,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-5b84edd34e32","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":22,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-8fc45664aeed","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":52,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-abc4d9c969b5","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":144,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-c16420c74b97","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":149,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-a1dcad1b4395","source":"eslint","ruleId":"r.440b465c2d7c","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":276,"snippet":"","message":"Unsafe Regular Expression","category":"exec","hardFail":false},{"id":"F-bc97c55a837f","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":811,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-3e70a001d66e","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":814,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-3eaf73360594","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":1000,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-82e2ff61c252","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":1145,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-481ccfe06687","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":1162,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-81047326c2ca","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":1164,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-34d2b1330107","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":1347,"snippet":"","message":"Variable Assigned to Object Injection Sink","category":"exec","hardFail":false},{"id":"F-7d6b789c2d9f","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":1874,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-ac9d9a064198","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":2042,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-ce84d50dfdd1","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":2045,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-0ebc01e28a35","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":2046,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-650ef98c8c66","source":"eslint","ruleId":"r.21d921614df3","severity":"info","confidence":0.6,"path":"assets/ranking.js","line":2047,"snippet":"","message":"Generic Object Injection Sink","category":"exec","hardFail":false},{"id":"F-dfbc363724eb","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"context7.json","line":2,"snippet":"\"$schema\": \"https://context7.com/schema/context7.json\",","message":"URL literal: https://context7.com","category":"network","hardFail":false},{"id":"F-bfeef605794d","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/agent-guide.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-7a96fad015a0","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/agent-guide.md","line":152,"snippet":"curl -X POST https://letsfg.co/api/agent-access/request","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-83ee0e731ac3","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/agent-guide.md","line":157,"snippet":"curl -X POST https://letsfg.co/api/agent-access/verify \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-9e913e95e979","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/agent-guide.md","line":163,"snippet":"curl -X POST https://letsfg.co/api/agent-access/verify \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-8743f8af18e9","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/agent-guide.md","line":169,"snippet":"curl -X POST https://letsfg.co/api/search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-d1278d1c57b3","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/agent-guide.md","line":176,"snippet":"curl https://letsfg.co/api/results/ws_abc123 \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-530178168724","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/agent-guide.md","line":188,"snippet":"curl -X POST https://letsfg.co/api/agent-book \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-ad67070b54b6","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/api-errors.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-2465451fd86d","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-errors.md","line":46,"snippet":"curl https://letsfg.co/developers/api/v1/agents/me \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-e1e24552fd6f","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-errors.md","line":46,"snippet":"curl https://letsfg.co/developers/api/v1/agents/me \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-3c1cdb98a60b","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/api-guide.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-b0747c7129bb","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-guide.md","line":122,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/register \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-c7875da9b52f","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-guide.md","line":122,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/register \\     -H \"Content-Type: application/json\" \\     -d '{\"a","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-17a6c4c4d175","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-guide.md","line":126,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-ef045ec60ade","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/api-onboarding.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-8abdd59f3772","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-onboarding.md","line":23,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/register \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-1f9546d4adb0","source":"gitleaks","ruleId":"r.43cd6c2d96bb","severity":"info","confidence":0.7,"path":"docs/api-onboarding.md","line":33,"snippet":"api_key\": \"RED…REDACTED\"","message":"Possible hard-coded secret (Detected a Generic API Key, potentially exposing access to various services and sensitive operations.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-227369cc7dd0","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-onboarding.md","line":45,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-0af0c6ef5062","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-onboarding.md","line":45,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-0c6b15f3e41f","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-onboarding.md","line":54,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-afd2d39ebf68","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-onboarding.md","line":54,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-818e3f476f08","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-onboarding.md","line":65,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/top-up \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-332e313edf65","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-onboarding.md","line":65,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/top-up \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-12c66a44ec38","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-onboarding.md","line":74,"snippet":"curl https://letsfg.co/developers/api/v1/agents/me \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-e15cf9eee111","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-onboarding.md","line":74,"snippet":"curl https://letsfg.co/developers/api/v1/agents/me \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-b86b06403427","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-onboarding.md","line":92,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/hosted-checkout \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-8bf836bb479d","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-onboarding.md","line":100,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/hosted-checkout/complete \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-bde5032b54cb","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-onboarding.md","line":112,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/billing-portal \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-72e4b69ca387","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-onboarding.md","line":112,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/billing-portal \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-df5fa183f82a","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-onboarding.md","line":121,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/billing-settings \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-a71d1ac93388","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-onboarding.md","line":121,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/billing-settings \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-f3641f175823","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-onboarding.md","line":130,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/rotate-key \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-be62626bb4b5","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-onboarding.md","line":130,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/rotate-key \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-cd80c4cff636","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/api-polling.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-847ee369dd19","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-polling.md","line":31,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/search/async \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-e1191d8462e5","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-polling.md","line":31,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/search/async \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-fe6b24e08efe","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-polling.md","line":61,"snippet":"curl https://letsfg.co/developers/api/v1/flights/results/async_a1b2c3d4e5f6 \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-8773cdc825c9","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-polling.md","line":61,"snippet":"curl https://letsfg.co/developers/api/v1/flights/results/async_a1b2c3d4e5f6 \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-92b9d3d1b37f","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/api-sandbox.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-63cf1cb7d473","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-sandbox.md","line":53,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/sandbox/flights/search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-717965ebc5bf","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-sandbox.md","line":53,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/sandbox/flights/search \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-736d9e7ec2dc","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-sandbox.md","line":104,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/sandbox/flights/multi-search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-ec4b4c43d52b","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-sandbox.md","line":104,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/sandbox/flights/multi-search \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-154d464152be","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-sandbox.md","line":132,"snippet":"curl https://letsfg.co/developers/api/v1/agents/me \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-b27f6612fae0","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-sandbox.md","line":132,"snippet":"curl https://letsfg.co/developers/api/v1/agents/me \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-70da39f2bb11","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/api-search.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-d7d25ceb972f","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-search.md","line":42,"snippet":"curl https://letsfg.co/developers/api/v1/flights/locations/London \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-0582d853e753","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-search.md","line":42,"snippet":"curl https://letsfg.co/developers/api/v1/flights/locations/London \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-948ba0fe4b33","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-search.md","line":74,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-6a104cc41fc8","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-search.md","line":74,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/search \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-971ad07f8db8","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-search.md","line":231,"snippet":"curl https://letsfg.co/developers/api/v1/flights/providers \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-2d3f8b0e1116","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-search.md","line":231,"snippet":"curl https://letsfg.co/developers/api/v1/flights/providers \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-be87c7306bee","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-search.md","line":273,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/parse-query \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-69d0bc94ac28","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-search.md","line":273,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/parse-query \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-9eb708649a98","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/api-search.md","line":293,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/discover \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-8cb4faec02c1","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/api-search.md","line":293,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/discover \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-3ac239a5edd7","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/architecture-guide.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-81efffa01beb","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/cli-reference.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-0710a301704c","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/cli-reference.md","line":21,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-1279b7900e86","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/cli-reference.md","line":27,"snippet":"npm install -g letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-d53bf93cfe26","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/getting-started.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-cfce7d2ae4b1","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/getting-started.md","line":22,"snippet":"| CLI / SDK (Bearer token) | Agents, developers, zero-cost search | `pip install letsfg` then `letsfg auth` | Free | `POST /api/agent-book` |","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-203a27f079c6","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/getting-started.md","line":37,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-521b3854d750","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/getting-started.md","line":75,"snippet":"curl -X POST https://letsfg.co/api/developers/checkout \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-55e771ef6ff0","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/getting-started.md","line":89,"snippet":"curl \"https://letsfg.co/api/developers/payment-verify?token=<payment_token>\"","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-1968e6573b54","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/getting-started.md","line":104,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/register \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-fcf954625293","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/getting-started.md","line":116,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-20c75a004b08","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/getting-started.md","line":116,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-36ff2a9cd133","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/getting-started.md","line":127,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/top-up \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-1a5eba698eb4","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/getting-started.md","line":127,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/top-up \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-e28c092acc9d","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/getting-started.md","line":138,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-d83ee621582e","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/getting-started.md","line":138,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/flights/search \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-3eae6a835771","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/getting-started.md","line":147,"snippet":"curl https://letsfg.co/developers/api/v1/agents/me \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-fec97898e7aa","source":"gitleaks","ruleId":"r.869a596fd8dd","severity":"info","confidence":0.85,"path":"docs/getting-started.md","line":147,"snippet":"curl https://letsfg.co/developers/api/v1/agents/me \\   -H \"X-API-Key: RED…REDACTED\"","message":"Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-12abbd9450c6","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/hotels.md","line":56,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/hotels/destinations   -H \"X-API-Key: $LETSFG_API_KEY\" -H 'Content-Type: application/json'   -d '{\"text\": \"Warsaw\"}'","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-4340a4faabba","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/hotels.md","line":59,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/hotels/search   -H \"X-API-Key: $LETSFG_API_KEY\" -H 'Content-Type: application/json'   -d '{\"city_id\": 148614, \"city_name\": \"Warsaw, Poland\",","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-7afcbf3ac8ea","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/index.md","line":6,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-bfb98421aa27","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/index.md","line":22,"snippet":"<div class=\"docs-command\"><span class=\"docs-command-prompt\">$</span> pip install letsfg</div>","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-c217f7d3a805","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/openapi.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-becf812bc37e","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/openapi.md","line":53,"snippet":"curl https://letsfg.co/developers/api/openapi.json | jq '.info, .servers'","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-f5d508d88d63","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/openapi.md","line":59,"snippet":"curl https://letsfg.co/developers/api/openapi.json | jq '.paths | keys'","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-c850d4c1606d","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/packages.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-c8915129827c","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/packages.md","line":22,"snippet":"| **Python SDK + CLI** | `pip install letsfg` | SDK + CLI, server-side search via letsfg.co | Free Bearer token (`letsfg auth`) or Developer API key |","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-62946118c018","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/packages.md","line":23,"snippet":"| **JS/TS SDK + CLI** | `npm install -g letsfg` | SDK + `letsfg` CLI command | Free Bearer token or Developer API key |","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-58bda730f345","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/packages.md","line":33,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-476dbc4fabdb","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/packages.md","line":58,"snippet":"npm install -g letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-9ebd8129be87","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/quickstart-claude.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-32fb66ecc493","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/quickstart-claude.md","line":31,"snippet":"curl -s -X POST https://letsfg.co/developers/api/v1/agents/register \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-fe9e196e2ae3","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/quickstart-claude.md","line":86,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-740221045797","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/quickstart-claude.md","line":138,"snippet":"**\"Cannot start Python\"** -> install the prerequisites first: `pip install letsfg` and `letsfg auth`","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-a7fa52ccdae7","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/quickstart-cursor.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-0676c1be0f1e","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/quickstart-cursor.md","line":29,"snippet":"curl -s -X POST https://letsfg.co/developers/api/v1/agents/register \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-664467c214b8","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/quickstart-cursor.md","line":77,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-63587b64142e","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/quickstart-cursor.md","line":136,"snippet":"**\"Cannot start Python\"** -> install the prerequisites first: `pip install letsfg` and `letsfg auth`","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-39073f132e25","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/quickstart-windsurf.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-5d5d2120def9","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/quickstart-windsurf.md","line":29,"snippet":"curl -s -X POST https://letsfg.co/developers/api/v1/agents/register \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-afe4d69ccb3a","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/quickstart-windsurf.md","line":77,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-6c7bb81e9144","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/quickstart-windsurf.md","line":131,"snippet":"**\"Cannot start Python\"** -> install the prerequisites first: `pip install letsfg` and `letsfg auth`","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-995b50b9f739","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"docs/self-hosting.md","line":15,"snippet":"pip install fastapi uvicorn httpx","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-b10681651de5","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"docs/self-hosting.md","line":68,"snippet":"curl -X POST http://localhost:8000/search \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-cceaf6e1e661","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"docs/tutorials.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-e3ca7624bf6d","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"glama.json","line":2,"snippet":"\"$schema\": \"https://glama.ai/mcp/schemas/server.json\",","message":"URL literal: https://glama.ai","category":"network","hardFail":false},{"id":"F-37cac1617868","source":"malcontent","ruleId":"r.ab20f9a3cb41","severity":"info","confidence":0.6,"path":"lighthouserc.js","line":0,"snippet":"['startServerCommand:']","message":"executes a command [MEDIUM]","category":"other","hardFail":false},{"id":"F-c06edb69186b","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"lighthouserc.js","line":6,"snippet":"'http://localhost:3000/en/flights/gdn-bcn/',","message":"URL literal: http://localhost","category":"network","hardFail":false},{"id":"F-c315c37e635a","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"mkdocs.yml","line":2,"snippet":"site_url: https://letsfg.co/developers/docs","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-79169d733f5c","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"mkdocs.yml","line":6,"snippet":"repo_url: https://github.com/LetsFG/LetsFG","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-e4d73b1dedc5","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"models/flights.py","line":0,"snippet":"['agents']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-6213a2a19e5e","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"openapi.yaml","line":24,"snippet":"curl -X POST https://letsfg.co/api/agent-access/request","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-cad11f864e6d","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"openapi.yaml","line":24,"snippet":"curl -X POST https://letsfg.co/api/agent-access/request","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-38e0f24cdd7c","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"openapi.yaml","line":26,"snippet":"curl -X POST https://letsfg.co/api/agent-access/verify -d '{\"setup_session_id\":\"cs_...\"}'","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-6586cc326adf","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"low","confidence":0.9,"path":"openapi.yaml","line":32,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-9ea6bcd3e972","source":"malcontent","ruleId":"r.aa1ee1048d6a","severity":"info","confidence":0.6,"path":"preview/run.py","line":0,"snippet":"['os.chmod(']","message":"Detects writing executable files or changing file permissions to executable [MEDIUM]","category":"other","hardFail":false},{"id":"F-001f6196a6d2","source":"malcontent","ruleId":"r.8a2d19128690","severity":"info","confidence":0.6,"path":"preview/run.py","line":0,"snippet":"['/home/.letsfg']","message":"possible hidden file path [MEDIUM]","category":"other","hardFail":false},{"id":"F-496b8265f5da","source":"malcontent","ruleId":"r.d5d304b1ed90","severity":"info","confidence":0.6,"path":"preview/run.py","line":0,"snippet":"['/Users/...']","message":"references path within /Users [MEDIUM]","category":"other","hardFail":false},{"id":"F-a7b7530d300a","source":"malcontent","ruleId":"r.bd0dc86cbeb5","severity":"info","confidence":0.6,"path":"preview/run.py","line":0,"snippet":"['chmod']","message":"modifies file permissions [MEDIUM]","category":"other","hardFail":false},{"id":"F-cf20bc292f06","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"sdk/js/README.md","line":15,"snippet":"| **Setup** | `npm install letsfg` then `letsfg auth` | [letsfg.co/developers](https://letsfg.co/developers) |","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-a45563656aea","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"sdk/js/README.md","line":22,"snippet":"npm install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-d422f083867d","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"sdk/js/README.md","line":109,"snippet":"- **Python SDK + CLI**: `pip install letsfg` — [PyPI](https://pypi.org/project/letsfg/)","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-f8227de7ebb8","source":"malcontent","ruleId":"r.23a5406365c9","severity":"info","confidence":0.6,"path":"sdk/js/package-lock.json","line":0,"snippet":"['https://', 'darwin', 'linux']","message":"references multiple operating systems [MEDIUM]","category":"other","hardFail":false},{"id":"F-f9279ddacfdd","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/js/package.json","line":0,"snippet":"['agents']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-c32ffe17778f","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/js/package.json","line":44,"snippet":"\"url\": \"https://github.com/LetsFG/LetsFG.git\"","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-5ca62be49ed1","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/js/package.json","line":46,"snippet":"\"homepage\": \"https://letsfg.co\",","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-b7e69b4a228e","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"sdk/js/src/auth.test.ts","line":0,"snippet":"['./auth']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-ff77964d1072","source":"guarddog","ruleId":"r.4c1fa8e9227d","severity":"info","confidence":0.6,"path":"sdk/js/src/auth.test.ts","line":18,"snippet":"HOME: process.env.HOME,     LETSFG_BEARER_TOKEN: process.env.LETSFG_BEARER_TOKEN,   };   process.env.APPDATA = scratchDir;","message":"guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)","category":"supply-chain","hardFail":false},{"id":"F-555e002994b0","source":"guarddog","ruleId":"r.4c1fa8e9227d","severity":"info","confidence":0.6,"path":"sdk/js/src/auth.test.ts","line":22,"snippet":"process.env.HOME = scratchDir;   delete process.env.LETSFG_BEARER_TOKEN; });","message":"guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)","category":"supply-chain","hardFail":false},{"id":"F-880eabfda2fa","source":"guarddog","ruleId":"r.4c1fa8e9227d","severity":"info","confidence":0.6,"path":"sdk/js/src/auth.test.ts","line":40,"snippet":"it('returns LETSFG_BEARER_TOKEN env var immediately, without touching the config file', async () => {     process.env.LETSFG_BEARER_TOKEN = 'env-token-123';     const { getBearerToken } = await import('./auth.js');     assert.equal(getBearerToken...","message":"guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)","category":"supply-chain","hardFail":false},{"id":"F-61b95fe4dde6","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/js/src/auth.ts","line":0,"snippet":"['agents']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-d6285e3a928d","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"sdk/js/src/auth.ts","line":0,"snippet":"['application/json', 'POST']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-2acebe3582a3","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"sdk/js/src/auth.ts","line":0,"snippet":"['Content-Type', 'HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-3858790fdecb","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/js/src/auth.ts","line":21,"snippet":"const BASE_URL = process.env.LETSFG_BASE_URL || 'https://letsfg.co';","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-1662afa63da0","source":"guarddog","ruleId":"r.5c819494668e","severity":"info","confidence":0.6,"path":"sdk/js/src/auth.ts","line":82,"snippet":"...ing, payload: Record<string, unknown>): Promise<{ status: number; data: Record<string, unknown> }> {   const resp = await fetch(`${BASE_URL}${path}`, {     method: 'POST',     headers: { 'Content-Type': 'application/json', 'User-Agent': 'LetsFG-js/0....","message":"guarddog capability-network-download: Detects downloading files from network","category":"supply-chain","hardFail":false},{"id":"F-33116ca19ca9","source":"guarddog","ruleId":"r.1f10de1c8364","severity":"info","confidence":0.6,"path":"sdk/js/src/auth.ts","line":82,"snippet":"...ing, payload: Record<string, unknown>): Promise<{ status: number; data: Record<string, unknown> }> {   const resp = await fetch(`${BASE_URL}${path}`, {     method: 'POST',     headers: { 'Content-Type': 'application/json', 'User-Agent': 'LetsFG-js/0....","message":"guarddog capability-network-outbound: Detects network request capabilities (HTTP, sockets, etc.)","category":"supply-chain","hardFail":false},{"id":"F-34c22b5f6f5c","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/js/src/auth.ts","line":82,"snippet":"const resp = await fetch(`${BASE_URL}${path}`, {","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-aa299273383a","source":"guarddog","ruleId":"r.63048118ddaf","severity":"info","confidence":0.6,"path":"sdk/js/src/auth.ts","line":136,"snippet":"const cmd = platform() === 'win32' ? `start \"\" \"${url}\"` : platform() === 'darwin' ? `open \"${url}\"` : `xdg-open \"${url}\"`;     exec(cmd, () => { /* best effort, ignore failures */ });   }).catch(() => { /* best effort */ }); }","message":"guarddog capability-process-spawn: Detects process execution and spawning","category":"supply-chain","hardFail":false},{"id":"F-81112e8cb5a9","source":"malcontent","ruleId":"r.fb014819c620","severity":"info","confidence":0.6,"path":"sdk/js/src/cli.ts","line":0,"snippet":"['$complex_math_add', '$complex_math_mul', '$complex_math_sub', '(zero-dependency)', '$f_parseInt', '(i + 1)', '1990-04', '2026-03', '2026-07', '[i + 1]', '$math1', '$math2', '90-day', '03-03', '04-01","message":"complex math with parseInt or fromCharCode conversions [MEDIUM]","category":"other","hardFail":false},{"id":"F-2ac1ee51c823","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"sdk/js/src/cli.ts","line":0,"snippet":"['./index', './auth']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-a9cd03a05423","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/js/src/cli.ts","line":0,"snippet":"['agent_name', 'agent_id', 'agents']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-fa7b8109e101","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/js/src/cli.ts","line":407,"snippet":"--base-url          API URL (default: https://letsfg.co)","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-20d6fdee8c62","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"sdk/js/src/index.test.ts","line":0,"snippet":"['./index']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-7ae8e9d853aa","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/js/src/index.test.ts","line":0,"snippet":"['agent_id']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-5aca17129d3a","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/js/src/index.test.ts","line":49,"snippet":"// sets User-Agent: LetsFG-js/0.1.0. register() builds its own bare fetch()","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-7e2acc54675e","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"sdk/js/src/index.ts","line":0,"snippet":"['./offer-details', './trip-purpose', './ranking']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-510510a57330","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/js/src/index.ts","line":0,"snippet":"['agent_name', 'agentName', 'agents']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-7d241e4e9893","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"sdk/js/src/index.ts","line":0,"snippet":"['application/json', 'POST', 'post']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-4f015bf04564","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"sdk/js/src/index.ts","line":0,"snippet":"['Content-Type', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-a209045f23b8","source":"malcontent","ruleId":"r.e781ba3939e1","severity":"info","confidence":0.6,"path":"sdk/js/src/index.ts","line":0,"snippet":"['return !!']","message":"gets very excited [MEDIUM]","category":"other","hardFail":false},{"id":"F-459e3e20f7cf","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/js/src/index.ts","line":5,"snippet":"* or prepaid Developer API. Zero external JS dependencies. Uses native fetch (Node 18+).","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-920d49da1f49","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/js/src/index.ts","line":313,"snippet":"const DEFAULT_BASE_URL = 'https://letsfg.co';","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-85c6a758dd2f","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/js/src/index.ts","line":760,"snippet":"const resp = await fetch(`${url}/developers/api/v1/agents/register`, {","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-57e2cb2cee6f","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/js/src/index.ts","line":823,"snippet":"const resp = await fetch(`${this.baseUrl}${path}`, {","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-ee61832a9c22","source":"malcontent","ruleId":"r.fb014819c620","severity":"info","confidence":0.6,"path":"sdk/js/src/ranking.ts","line":0,"snippet":"['(stopover to explore / break the trip)', '(for runner-up explanations)', '(offerPrice - cheapestPrice)', '(ticket + fee + ancillaries)', '(avoid very early/late)', '$complex_math_add', '$complex_mat","message":"complex math with parseInt or fromCharCode conversions [MEDIUM]","category":"other","hardFail":false},{"id":"F-584c6b468ca4","source":"malcontent","ruleId":"r.dbe1faed974e","severity":"info","confidence":0.6,"path":"sdk/js/src/ranking.ts","line":0,"snippet":"['+ parseInt(']","message":"performs math directly against parsed integers [MEDIUM]","category":"other","hardFail":false},{"id":"F-dd7ef634148c","source":"malcontent","ruleId":"r.e764edde6b0e","severity":"info","confidence":0.6,"path":"sdk/js/src/ranking.ts","line":0,"snippet":"['./offer-details', './trip-purpose']","message":"references and possibly executes relative path [MEDIUM]","category":"other","hardFail":false},{"id":"F-9c9098e48a78","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"sdk/mcp/README.md","line":41,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-ba9987d63495","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"sdk/mcp/README.md","line":257,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-fa14ca4a3f13","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"sdk/mcp/README.md","line":264,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/register \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-c18e4579aa9b","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"sdk/mcp/README.md","line":393,"snippet":"- **JavaScript/TypeScript SDK + CLI**: `npm install letsfg` — [npm](https://www.npmjs.com/package/letsfg)","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-2d650b82778a","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"sdk/mcp/README.md","line":394,"snippet":"- **Python SDK + CLI**: `pip install letsfg` — [PyPI](https://pypi.org/project/letsfg/)","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-7e5fce18256b","source":"malcontent","ruleId":"r.23a5406365c9","severity":"info","confidence":0.6,"path":"sdk/mcp/package-lock.json","line":0,"snippet":"['https://', 'darwin', 'linux']","message":"references multiple operating systems [MEDIUM]","category":"other","hardFail":false},{"id":"F-e56fbbdb5603","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/mcp/package.json","line":0,"snippet":"['agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-1f7cbee848c0","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/mcp/package.json","line":38,"snippet":"\"url\": \"https://github.com/LetsFG/LetsFG.git\"","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-88ee263a60dc","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/mcp/src/index.test.ts","line":0,"snippet":"['agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-86e36735fb7f","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"sdk/mcp/src/index.test.ts","line":0,"snippet":"['POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-cb2cc96ee3b2","source":"opengrep","ruleId":"r.a14bd956ca70","severity":"info","confidence":0.9,"path":"sdk/mcp/src/index.test.ts","line":7,"snippet":"import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process';","message":"JavaScript spawns processes (child_process).","category":"exec","hardFail":false},{"id":"F-6a9d6a2c45a3","source":"guarddog","ruleId":"r.5c819494668e","severity":"info","confidence":0.6,"path":"sdk/mcp/src/index.test.ts","line":85,"snippet":"// headers, and they are the two that carry a real search.   it('every fetch() sends headers built by letsfgHeaders()', () => {     const fetches = [...code.matchAll(/fetch\\(([\\s\\S]*?)\\n\\s*\\}\\);/g)]....","message":"guarddog capability-network-download: Detects downloading files from network","category":"supply-chain","hardFail":false},{"id":"F-62b5b12f1caf","source":"guarddog","ruleId":"r.1f10de1c8364","severity":"info","confidence":0.6,"path":"sdk/mcp/src/index.test.ts","line":85,"snippet":"// headers, and they are the two that carry a real search.   it('every fetch() sends headers built by letsfgHeaders()', () => {     const fetches = [...code.matchAll(/fetch\\(([\\s\\S]*?)\\n\\s*\\}\\);/g)]....","message":"guarddog capability-network-outbound: Detects network request capabilities (HTTP, sockets, etc.)","category":"supply-chain","hardFail":false},{"id":"F-80ec3cecb775","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/mcp/src/index.test.ts","line":85,"snippet":"it('every fetch() sends headers built by letsfgHeaders()', () => {","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-a532c6fdfb02","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/mcp/src/index.test.ts","line":90,"snippet":"`a fetch() builds its own headers instead of calling letsfgHeaders():\\n${call.slice(0, 200)}`);","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-28c306f49f9f","source":"guarddog","ruleId":"r.63048118ddaf","severity":"info","confidence":0.6,"path":"sdk/mcp/src/index.test.ts","line":108,"snippet":"// break any allowlist keyed on the `letsfg-mcp/` substring.     const ua = /const USER_AGENT = `([^`]+)`/.exec(code)?.[1];     assert.ok(ua, 'USER_AGENT must be defined in one place');     assert.match(ua!, /^Mozilla\\/5\\.0 \\(compatibl...","message":"guarddog capability-process-spawn: Detects process execution and spawning","category":"supply-chain","hardFail":false},{"id":"F-b14cb8f9ddff","source":"malcontent","ruleId":"r.49d5f573ce86","severity":"info","confidence":0.6,"path":"sdk/mcp/src/index.ts","line":0,"snippet":"['DOCTYPE html']","message":"Contains HTML content [MEDIUM]","category":"other","hardFail":false},{"id":"F-1b2485f862cd","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/mcp/src/index.ts","line":0,"snippet":"['agent_profile', 'get_agent', 'agents']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-6278afb37422","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"sdk/mcp/src/index.ts","line":0,"snippet":"['application/json', 'POST']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-534a5b108af8","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"sdk/mcp/src/index.ts","line":0,"snippet":"['Content-Type', 'HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-61ac33f817c8","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/mcp/src/index.ts","line":28,"snippet":"const BASE_URL = (process.env.LETSFG_BASE_URL || 'https://letsfg.co').replace(/\\/$/, '');","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-16ddd92e0e0d","source":"guarddog","ruleId":"r.4c1fa8e9227d","severity":"low","confidence":0.6,"path":"sdk/mcp/src/index.ts","line":29,"snippet":"const BASE_URL = (process.env.LETSFG_BASE_URL || 'https://letsfg.co').replace(/\\/$/, ''); const BEARER_TOKEN = process.env.LETSFG_BEARER_TOKEN || ''; const API_KEY = process.env.LETSFG_API_KEY || ''; const VERSION = '1.3.1';","message":"guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)","category":"supply-chain","hardFail":false},{"id":"F-b03f8fcce13e","source":"guarddog","ruleId":"r.4c1fa8e9227d","severity":"low","confidence":0.6,"path":"sdk/mcp/src/index.ts","line":30,"snippet":"const BEARER_TOKEN = process.env.LETSFG_BEARER_TOKEN || ''; const API_KEY = process.env.LETSFG_API_KEY || ''; const VERSION = '1.3.1';","message":"guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)","category":"supply-chain","hardFail":false},{"id":"F-8fe919aff9f9","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/mcp/src/index.ts","line":46,"snippet":"const USER_AGENT = `Mozilla/5.0 (compatible; letsfg-mcp/${VERSION}; +https://github.com/LetsFG/LetsFG)`;","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-15b442a65ebe","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/mcp/src/index.ts","line":151,"snippet":"const resp = await fetch(`${BASE_URL}/api/search`, {","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-b6d605e4bc50","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/mcp/src/index.ts","line":170,"snippet":"const pollResp = await fetch(`${BASE_URL}/api/results/${search_id}`, {","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-160e83a55e09","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/mcp/src/index.ts","line":215,"snippet":"const resp = await fetch(`${BASE_URL}${path}`, {","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-4a5642ee5738","source":"ctxsentry","ruleId":"r.7e92b014a22b","severity":"low","confidence":0.8,"path":"sdk/mcp/src/index.ts","line":291,"snippet":"description: 'Complete workflow guide: authenticate -> search -> book, pricing, passenger rules, error handling, and search tips. Read this before using any tools.',","message":"Hidden-priority marker of the kind used in MCP tool-poisoning payloads. [CG105/instruction-override]","category":"injection","hardFail":false},{"id":"F-2901a310cca6","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/mcp/src/index.ts","line":825,"snippet":"const resp = await fetch(`${BASE_URL}/api/agent-access/request`, {","message":"HTTP request from QML/JS (XMLHttpRequest / fetch).","category":"network","hardFail":false},{"id":"F-0ed319fc5aa8","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"sdk/python/README.md","line":15,"snippet":"| **Setup** | `pip install letsfg && letsfg auth` | [letsfg.co/developers](https://letsfg.co/developers) |","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-9ff01e26b91e","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"sdk/python/README.md","line":22,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-51b84cff02fe","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"sdk/python/README.md","line":398,"snippet":"- **JS/TS SDK**: `npm install letsfg` — [npm](https://www.npmjs.com/package/letsfg)","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-c3e6c34ad481","source":"malcontent","ruleId":"r.2e10e45c9dd6","severity":"info","confidence":0.6,"path":"sdk/python/examples/quickstart.py","line":0,"snippet":"['pip install letsfg']","message":"Installs software using pip from python [MEDIUM]","category":"other","hardFail":false},{"id":"F-f4e17ebe5533","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"sdk/python/examples/quickstart.py","line":8,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-7b394402ed43","source":"malcontent","ruleId":"r.1ede94bd4987","severity":"info","confidence":0.6,"path":"sdk/python/google_checkout_live_sweep.py","line":0,"snippet":"['cookies']","message":"may access cookies [MEDIUM]","category":"other","hardFail":false},{"id":"F-bb894d2ba7fa","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_japan_longhaul.json","line":8,"snippet":"\"resolved_booking_url\": \"https://checknfly.co.uk/flights/passenger_details?sid=4c8278d3-6258-4c32-a675-53b00d648834%5Eab35cd12-4be1-4fab-b9a3-1d4d16b0c475\",","message":"URL literal: https://checknfly.co.uk","category":"network","hardFail":false},{"id":"F-223afcc575b8","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_japan_longhaul.json","line":50,"snippet":"\"resolved_booking_url\": \"https://bookingportal.china-airlines.com/eRetailPortal/Booking.svc/Booking/Search\",","message":"URL literal: https://bookingportal.china-airlines.com","category":"network","hardFail":false},{"id":"F-f3064451e95d","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_japan_longhaul.json","line":100,"snippet":"\"resolved_booking_url\": \"https://www.lastminute.com/msr/route/gfs?Adult=1&PointOfSaleCountry=FR&DisplayedPrice=744.79&DisplayedPriceCurrency=EUR&UserLanguage=fr&UserCurrency=EUR&TripType=RoundTrip&Sli","message":"URL literal: https://www.lastminute.com","category":"network","hardFail":false},{"id":"F-042adf30d0a6","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_japan_longhaul.json","line":134,"snippet":"\"resolved_booking_url\": \"https://oversea.csair.com/tk/eu/en/book/flights?ref=googleflights&p=100&m=1&t=FRA-HND-20260624-20260628&rc=GGSS01&utm_source=googleflights_eu&utm_medium=metasearch\",","message":"URL literal: https://oversea.csair.com","category":"network","hardFail":false},{"id":"F-5067b1b4c444","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_japan_longhaul.json","line":176,"snippet":"\"resolved_booking_url\": \"https://www.flighthub.com/checkout/gdeeplink?Adult=1&PointOfSaleCountry=PL&DisplayedPrice=1822.72&DisplayedPriceCurrency=USD&UserLanguage=en&TripType=RoundTrip&Slice1=1,2&Slic","message":"URL literal: https://www.flighthub.com","category":"network","hardFail":false},{"id":"F-81c37b85012c","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_longhaul_london_us.json","line":8,"snippet":"\"resolved_booking_url\": \"https://www.google.com/travel/flights/booking?tfs=CBwQAho_EgoyMDI2LTA2LTI0Ih8KA0xIUhIKMjAyNi0wNi0yNBoDTEFYKgJWUzIDMTQxagcIARIDTEhScgcIARIDTEFYGj4SCjIwMjYtMDYtMjgiHgoDTEFYEgoyM","message":"URL literal: https://www.google.com","category":"network","hardFail":false},{"id":"F-13b483e45193","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results.json","line":8,"snippet":"\"resolved_booking_url\": \"https://tickets.vueling.com/booking/selectFlight\",","message":"URL literal: https://tickets.vueling.com","category":"network","hardFail":false},{"id":"F-10af199081f2","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results.json","line":112,"snippet":"\"resolved_booking_url\": \"https://www.vietjetair.com/en/select-flight\",","message":"URL literal: https://www.vietjetair.com","category":"network","hardFail":false},{"id":"F-973709b3fb4b","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results.json","line":146,"snippet":"\"resolved_booking_url\": \"https://www.google.com/travel/flights/booking?tfs=CBwQAho_EgoyMDI2LTA2LTE4Ih8KA0xIUhIKMjAyNi0wNi0xOBoDSkZLKgJCQTIDMTc1agcIARIDTEhScgcIARIDSkZLGj8SCjIwMjYtMDYtMjIiHwoDSkZLEgoyM","message":"URL literal: https://www.google.com","category":"network","hardFail":false},{"id":"F-8434130c620a","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results.json","line":205,"snippet":"\"resolved_booking_url\": \"https://www.lionair.co.id/\",","message":"URL literal: https://www.lionair.co.id","category":"network","hardFail":false},{"id":"F-4fa5404280dc","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results.json","line":239,"snippet":"\"resolved_booking_url\": \"https://www.despegar.com.mx/shop/flights/results/generate?Adult=1&PointOfSaleCountry=MX&DisplayedPrice=2305&DisplayedPriceCurrency=MXN&UserLanguage=en&TripType=RoundTrip&Slice","message":"URL literal: https://www.despegar.com.mx","category":"network","hardFail":false},{"id":"F-ad4ac2783452","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results.json","line":281,"snippet":"\"resolved_booking_url\": \"https://www.martigo.pl/service/flight?Adult=1&Child=0&Infant=0&PointOfSaleCountry=IT&DisplayedPrice=357.51&DisplayedPriceCurrency=EUR&UserLanguage=pl&UserCurrency=PLN&TripType","message":"URL literal: https://www.martigo.pl","category":"network","hardFail":false},{"id":"F-e16c1d372e1a","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results_v2.json","line":8,"snippet":"\"resolved_booking_url\": \"https://tickets.vueling.com/booking/selectFlight\",","message":"URL literal: https://tickets.vueling.com","category":"network","hardFail":false},{"id":"F-656f14c5236f","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results_v2.json","line":112,"snippet":"\"resolved_booking_url\": \"https://www.vietjetair.com/en/select-flight\",","message":"URL literal: https://www.vietjetair.com","category":"network","hardFail":false},{"id":"F-b4674b0207cd","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results_v2.json","line":146,"snippet":"\"resolved_booking_url\": \"https://www.google.com/travel/flights/booking?tfs=CBwQAho_EgoyMDI2LTA2LTE4Ih8KA0xIUhIKMjAyNi0wNi0xOBoDSkZLKgJCQTIDMTc1agcIARIDTEhScgcIARIDSkZLGj8SCjIwMjYtMDYtMjIiHwoDSkZLEgoyM","message":"URL literal: https://www.google.com","category":"network","hardFail":false},{"id":"F-34c90c7c1dec","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results_v2.json","line":205,"snippet":"\"resolved_booking_url\": \"https://www.lionair.co.id/\",","message":"URL literal: https://www.lionair.co.id","category":"network","hardFail":false},{"id":"F-d21d93ca125d","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results_v2.json","line":239,"snippet":"\"resolved_booking_url\": \"https://www.despegar.com.mx/shop/flights/results/generate?Adult=1&PointOfSaleCountry=MX&DisplayedPrice=2305&DisplayedPriceCurrency=MXN&UserLanguage=en&TripType=RoundTrip&Slice","message":"URL literal: https://www.despegar.com.mx","category":"network","hardFail":false},{"id":"F-c9e108a0afc0","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results_v2.json","line":281,"snippet":"\"resolved_booking_url\": \"https://www.martigo.pl/service/flight?Adult=1&Child=0&Infant=0&PointOfSaleCountry=IT&DisplayedPrice=357.51&DisplayedPriceCurrency=EUR&UserLanguage=pl&UserCurrency=PLN&TripType","message":"URL literal: https://www.martigo.pl","category":"network","hardFail":false},{"id":"F-03702aad1616","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results_v2.json","line":323,"snippet":"\"resolved_booking_url\": \"https://www.mea.com.lb/english/plan-and-book/book-a-trip?AFT=v6EPPNv7FsdCuvALZaD8P4w&A=1&C=0&I=0&CC=E&F=BEY&T=CDG&D=2026-06-25&R=2026-06-29&RT=1&TS=2026-05-18+18:01:12&CUR=USD","message":"URL literal: https://www.mea.com.lb","category":"network","hardFail":false},{"id":"F-b233b59367f3","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results_v2.json","line":494,"snippet":"\"resolved_booking_url\": \"https://booking.flyscoot.com/book/flight/return/SIN/2026-06-24/BKK/BKK/2026-06-28/SIN?adult=1&child=0&infant=0&orgToken=VEUtiuQY/mW09sQ6I0betQ%3D%3D&utm_source=GoogleFlights&u","message":"URL literal: https://booking.flyscoot.com","category":"network","hardFail":false},{"id":"F-80fddcdcd00f","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/google_checkout_live_sweep_results_v2.json","line":528,"snippet":"\"resolved_booking_url\": \"https://www.delta.com/flight-search/search?cabin=BASIC-ECONOMY&paxCount=1&price=576.79&tripType=roundTrip&exitCountry=US&currencyCd=USD&fareBasis=TAWQA0BQ:UAVGA0BQ&vendorRedir","message":"URL literal: https://www.delta.com","category":"network","hardFail":false},{"id":"F-f45c38f4c950","source":"malcontent","ruleId":"r.a9a12e273465","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/cli.py","line":0,"snippet":"['from rich import print as rprint']","message":"aliases core python library to an alternate name [MEDIUM]","category":"other","hardFail":false},{"id":"F-0104d76438dc","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/cli.py","line":0,"snippet":"['agent_name', 'agent_id', 'agents']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-a062f2ff24c8","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/cli.py","line":0,"snippet":"['application/json', 'POST']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-dbb27915de52","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/cli.py","line":0,"snippet":"['Content-Type', 'HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-8edce1ec5016","source":"malcontent","ruleId":"r.4466daea12b8","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/cli.py","line":0,"snippet":"['urllib.request']","message":"requests resources via URL [MEDIUM]","category":"other","hardFail":false},{"id":"F-d8b6a19a9367","source":"bandit","ruleId":"r.48aa54c4f265","severity":"info","confidence":0.9,"path":"sdk/python/letsfg/cli.py","line":137,"snippet":"136             return result 137     except Exception: 138         pass 139     return []","message":"try_except_pass: Try, Except, Pass detected.","category":"other","hardFail":false},{"id":"F-23ad1af5b21b","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/letsfg/cli.py","line":498,"snippet":"print(f\"       Poll after payment: GET https://letsfg.co/api/developers/payment-verify?token={pt}\")","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-2d4390c018ac","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"sdk/python/letsfg/cli.py","line":799,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-ca51ec2b6d55","source":"guarddog","ruleId":"r.1f10de1c8364","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/cli.py","line":841,"snippet":"req = urllib.request.Request(         endpoint,         data=body,","message":"guarddog capability-network-outbound: Detects network request capabilities (HTTP, sockets, etc.)","category":"supply-chain","hardFail":false},{"id":"F-042fea2a1f78","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/python/letsfg/cli.py","line":841,"snippet":"req = urllib.request.Request(","message":"HTTP client in Python.","category":"network","hardFail":false},{"id":"F-417619fae0e1","source":"bandit","ruleId":"r.5705d5a56640","severity":"low","confidence":0.9,"path":"sdk/python/letsfg/cli.py","line":852,"snippet":"851     try: 852         with urllib.request.urlopen(req, timeout=30) as resp: 853             result = json.loads(resp.read().decode())","message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","category":"other","hardFail":false},{"id":"F-9a9d36801849","source":"guarddog","ruleId":"r.5c819494668e","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/cli.py","line":852,"snippet":"try:         with urllib.request.urlopen(req, timeout=30) as resp:             result = json.loads(resp.read().decode())     except urllib.error.HTTPError as e:","message":"guarddog capability-network-download: Detects downloading files from network","category":"supply-chain","hardFail":false},{"id":"F-b08348627ccb","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/python/letsfg/cli.py","line":852,"snippet":"with urllib.request.urlopen(req, timeout=30) as resp:","message":"HTTP client in Python.","category":"network","hardFail":false},{"id":"F-dcb21d6b4ec5","source":"guarddog","ruleId":"r.5860ef5c399e","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/cli.py","line":853,"snippet":"with urllib.request.urlopen(req, timeout=30) as resp:             result = json.loads(resp.read().decode())     except urllib.error.HTTPError as e:         try:","message":"guarddog capability-filesystem-read: Detects filesystem read capabilities","category":"supply-chain","hardFail":false},{"id":"F-ba6cf09e1a8b","source":"malcontent","ruleId":"r.bd0dc86cbeb5","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/client.py","line":0,"snippet":"['chmod']","message":"modifies file permissions [MEDIUM]","category":"other","hardFail":false},{"id":"F-0b96072c6109","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/client.py","line":0,"snippet":"['agent_name', 'agent_id', 'agents']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-171ac18e323c","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/client.py","line":0,"snippet":"['application/json', 'POST', 'post']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-ccd0dba05606","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/client.py","line":0,"snippet":"['Content-Type', 'HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-bdd762167047","source":"malcontent","ruleId":"r.4466daea12b8","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/client.py","line":0,"snippet":"['urllib.request']","message":"requests resources via URL [MEDIUM]","category":"other","hardFail":false},{"id":"F-3feafcd98d07","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/letsfg/client.py","line":56,"snippet":"DEFAULT_BASE_URL = \"https://letsfg.co/developers\"","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-7a68cebeb364","source":"bandit","ruleId":"r.48aa54c4f265","severity":"info","confidence":0.9,"path":"sdk/python/letsfg/client.py","line":98,"snippet":"97             p.chmod(0o600) 98         except Exception: 99             pass 100     except Exception as e:","message":"try_except_pass: Try, Except, Pass detected.","category":"other","hardFail":false},{"id":"F-28b7e26eee43","source":"bandit","ruleId":"r.ff001a266bfa","severity":"info","confidence":0.7,"path":"sdk/python/letsfg/client.py","line":920,"snippet":"919  920     def setup_payment(self, token: str = \"tok_visa\") -> dict: 921         \"\"\" 922         Set up a payment method using a payment token. 923  924         Args: 925             token: Payment token (default: \"tok_visa\" for testing). 926  927         Returns: 928             Dict with status and payment_method_id. 929         \"\"\" 930         self._require_api_key() 931         return self.…","message":"hardcoded_password_default: Possible hardcoded password: 'tok_visa'","category":"other","hardFail":false},{"id":"F-71bffd63ddb0","source":"bandit","ruleId":"r.5705d5a56640","severity":"low","confidence":0.9,"path":"sdk/python/letsfg/client.py","line":1035,"snippet":"1034         try: 1035             with urlopen(req, timeout=30) as resp: 1036                 return json.loads(resp.read().decode())","message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","category":"other","hardFail":false},{"id":"F-2c8e3f68909e","source":"bandit","ruleId":"r.5705d5a56640","severity":"low","confidence":0.9,"path":"sdk/python/letsfg/client.py","line":1075,"snippet":"1074         try: 1075             with urlopen(req, timeout=timeout or self.timeout) as resp: 1076                 return json.loads(resp.read().decode())","message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","category":"other","hardFail":false},{"id":"F-7a17b59b695e","source":"malcontent","ruleId":"r.bd0dc86cbeb5","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/connectors/auth.py","line":0,"snippet":"['chmod']","message":"modifies file permissions [MEDIUM]","category":"other","hardFail":false},{"id":"F-8c5cb87a7eb8","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/connectors/auth.py","line":0,"snippet":"['agents']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-49dc78ec7c26","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/connectors/auth.py","line":0,"snippet":"['application/json', 'POST', 'post']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-7d87e2661977","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/connectors/auth.py","line":0,"snippet":"['Content-Type', 'HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-d8baa324f34f","source":"malcontent","ruleId":"r.4466daea12b8","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/connectors/auth.py","line":0,"snippet":"['urllib.request']","message":"requests resources via URL [MEDIUM]","category":"other","hardFail":false},{"id":"F-4b8e0350ed94","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/letsfg/connectors/auth.py","line":10,"snippet":"1. POST https://letsfg.co/api/agent-access/request","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-73cc764a90cb","source":"bandit","ruleId":"r.48aa54c4f265","severity":"info","confidence":0.9,"path":"sdk/python/letsfg/connectors/auth.py","line":80,"snippet":"79         p.chmod(0o600) 80     except Exception: 81         pass 82","message":"try_except_pass: Try, Except, Pass detected.","category":"other","hardFail":false},{"id":"F-3c63aa2bc026","source":"bandit","ruleId":"r.5705d5a56640","severity":"low","confidence":0.9,"path":"sdk/python/letsfg/connectors/auth.py","line":128,"snippet":"127     try: 128         with urlopen(req, timeout=timeout) as resp: 129             return resp.status, json.loads(resp.read())","message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","category":"other","hardFail":false},{"id":"F-8a057261b647","source":"bandit","ruleId":"r.48aa54c4f265","severity":"info","confidence":0.9,"path":"sdk/python/letsfg/connectors/auth.py","line":220,"snippet":"219             webbrowser.open(setup_url) 220         except Exception: 221             pass 222     print(\"  Step 2 — press Enter once you've finished.\")","message":"try_except_pass: Try, Except, Pass detected.","category":"other","hardFail":false},{"id":"F-2b7c1b97607b","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/local.py","line":0,"snippet":"['agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-9b2d12e1a709","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/local.py","line":0,"snippet":"['application/json', 'POST']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-182e4708b86f","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/local.py","line":0,"snippet":"['Content-Type', 'HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-f978ecbd219e","source":"malcontent","ruleId":"r.4466daea12b8","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/local.py","line":0,"snippet":"['urllib.request']","message":"requests resources via URL [MEDIUM]","category":"other","hardFail":false},{"id":"F-128a5fe61a40","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/letsfg/local.py","line":25,"snippet":"_BASE_URL = os.environ.get(\"LETSFG_BASE_URL\", \"https://letsfg.co\")","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-d6929d9bcf10","source":"bandit","ruleId":"r.5705d5a56640","severity":"low","confidence":0.9,"path":"sdk/python/letsfg/local.py","line":129,"snippet":"128     try: 129         with urlopen(req, timeout=30) as resp: 130             result = json.loads(resp.read())","message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","category":"other","hardFail":false},{"id":"F-5e11aeb0f27e","source":"bandit","ruleId":"r.5705d5a56640","severity":"low","confidence":0.9,"path":"sdk/python/letsfg/local.py","line":148,"snippet":"147         ) 148         with urlopen(poll_req, timeout=15) as resp: 149             return json.loads(resp.read())","message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","category":"other","hardFail":false},{"id":"F-91edb1e736ed","source":"bandit","ruleId":"r.5705d5a56640","severity":"low","confidence":0.9,"path":"sdk/python/letsfg/local.py","line":227,"snippet":"226     try: 227         with urlopen(req, timeout=60) as resp: 228             return json.loads(resp.read())","message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","category":"other","hardFail":false},{"id":"F-93706dc4cf18","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/models.py","line":0,"snippet":"['agent_name', 'agent_id']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-dabc04768b94","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/models/__init__.py","line":0,"snippet":"['agent_name', 'agent_id']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-26e065f26660","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/models/flights.py","line":0,"snippet":"['agents']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-2bca3a760239","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"sdk/python/letsfg/models/flights.py","line":0,"snippet":"['POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-7d4d8d5e60ba","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/letsfg/models/flights.py","line":415,"snippet":"https://letsfg.co/book/{id}","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-33305cc9351a","source":"extcode","ruleId":"r.66259759e39a","severity":"low","confidence":0.9,"path":"sdk/python/pyproject.toml","line":0,"snippet":"","message":"Declares 7 runtime dependencies fetched from a package registry at install/build time (not reviewed): pydantic, httpx, airportsdata, requests, typer, rich, click","category":"external-code","hardFail":false},{"id":"F-9e50ba582395","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/pyproject.toml","line":53,"snippet":"Homepage = \"https://letsfg.co\"","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-30390d6bbf35","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"sdk/python/pyproject.toml","line":55,"snippet":"Repository = \"https://github.com/LetsFG/LetsFG\"","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-b25fe33c05ef","source":"malcontent","ruleId":"r.11d4044d9aba","severity":"info","confidence":0.6,"path":"sdk/python/tests/test_booking_holdings_booking_urls.py","line":0,"snippet":"['https://www.momondo.com/booking?token=abc123', 'https://www.momondo.com/booking?token=second', 'https://www.momondo.com/booking?token=first', 'import']","message":"contains hardcoded endpoint with a question mark [MEDIUM]","category":"other","hardFail":false},{"id":"F-1989471f2b6d","source":"malcontent","ruleId":"r.11d4044d9aba","severity":"info","confidence":0.6,"path":"sdk/python/tests/test_checkout_engine_configs.py","line":0,"snippet":"['https://play.google.com/store/apps/details?id=com', 'https://www.momondo.com/book/flight?demo=403', 'https://www.momondo.com/book/flight?demo=1', 'import', '.get(']","message":"contains hardcoded endpoint with a question mark [MEDIUM]","category":"other","hardFail":false},{"id":"F-32e34af2d6cf","source":"malcontent","ruleId":"r.49d5f573ce86","severity":"info","confidence":0.6,"path":"sdk/python/tests/test_checkout_engine_configs.py","line":0,"snippet":"['<html>']","message":"Contains HTML content [MEDIUM]","category":"other","hardFail":false},{"id":"F-137765e1a419","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_currency_rates.py","line":56,"snippet":"with patch(\"letsfg.connectors.currency.httpx.AsyncClient\", return_value=client):","message":"HTTP client in Python.","category":"network","hardFail":false},{"id":"F-e1499a9a3db9","source":"malcontent","ruleId":"r.11d4044d9aba","severity":"info","confidence":0.6,"path":"sdk/python/tests/test_public_offer_masking.py","line":0,"snippet":"['https://www.ryanair.com/book?token=abc', 'import']","message":"contains hardcoded endpoint with a question mark [MEDIUM]","category":"other","hardFail":false},{"id":"F-55a79fefe373","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"sdk/python/tests/test_skyscanner_connector.py","line":0,"snippet":"['radar_uses_agent', 'agents']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-4bbbad1e68e3","source":"malcontent","ruleId":"r.11d4044d9aba","severity":"info","confidence":0.6,"path":"sdk/python/tests/test_starlink_flights.py","line":0,"snippet":"['https://www.starlinkflights.com/search?q=UA', 'import']","message":"contains hardcoded endpoint with a question mark [MEDIUM]","category":"other","hardFail":false},{"id":"F-1a7ee1fc6fdb","source":"malcontent","ruleId":"r.49d5f573ce86","severity":"info","confidence":0.6,"path":"sdk/python/tests/test_starlink_flights.py","line":0,"snippet":"['<html>']","message":"Contains HTML content [MEDIUM]","category":"other","hardFail":false},{"id":"F-22acab1b7c8b","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":71,"snippet":"70 def test_build_search_url_encodes_query(): 71     assert build_search_url(\"UA 1234\") == \"https://www.starlinkflights.com/search?q=UA+1234\" 72","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-169a8c66b652","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":82,"snippet":"81  82     assert parsed.query == \"UA1234\" 83     assert parsed.total == 2","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-dafc4f47bebc","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":83,"snippet":"82     assert parsed.query == \"UA1234\" 83     assert parsed.total == 2 84     assert parsed.query_type == \"all\"","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-c93dc138d8eb","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":84,"snippet":"83     assert parsed.total == 2 84     assert parsed.query_type == \"all\" 85     assert len(parsed.results) == 2","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-8bbb6512b45f","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":85,"snippet":"84     assert parsed.query_type == \"all\" 85     assert len(parsed.results) == 2 86","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-be5a8658a324","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":88,"snippet":"87     route_result = parsed.results[1] 88     assert route_result.result_type == \"route\" 89     assert route_result.title == \"UA1234: GEG \\u2192 DEN\"","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-fc3c90866f11","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":89,"snippet":"88     assert route_result.result_type == \"route\" 89     assert route_result.title == \"UA1234: GEG \\u2192 DEN\" 90     assert route_result.has_starlink is True","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-fba04b2f9855","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":90,"snippet":"89     assert route_result.title == \"UA1234: GEG \\u2192 DEN\" 90     assert route_result.has_starlink is True 91     assert route_result.confidence == 0.51","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-a0762e49542c","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":91,"snippet":"90     assert route_result.has_starlink is True 91     assert route_result.confidence == 0.51 92     assert route_result.data[\"flight_number\"] == \"UA1234\"","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-08cedf4002e5","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":92,"snippet":"91     assert route_result.confidence == 0.51 92     assert route_result.data[\"flight_number\"] == \"UA1234\" 93     assert route_result.data[\"starlink_likelihood\"] == 51","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-d30c1213554f","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":93,"snippet":"92     assert route_result.data[\"flight_number\"] == \"UA1234\" 93     assert route_result.data[\"starlink_likelihood\"] == 51 94     assert route_result.data[\"airline\"][\"equipped_count\"] == 505","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-f667174adef2","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":94,"snippet":"93     assert route_result.data[\"starlink_likelihood\"] == 51 94     assert route_result.data[\"airline\"][\"equipped_count\"] == 505 95","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-f0930bf23865","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":102,"snippet":"101  102     assert selected is not None 103     assert selected.result_id == 764736","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-7701254d32ac","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":103,"snippet":"102     assert selected is not None 103     assert selected.result_id == 764736 104     assert selected.data[\"origin_iata\"] == \"GEG\"","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-5da2514bfc70","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":104,"snippet":"103     assert selected.result_id == 764736 104     assert selected.data[\"origin_iata\"] == \"GEG\" 105     assert select_route_result(parsed, \"UA9999\") is None","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-4e9302166311","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":105,"snippet":"104     assert selected.data[\"origin_iata\"] == \"GEG\" 105     assert select_route_result(parsed, \"UA9999\") is None 106","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-aef4292589c2","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":112,"snippet":"111  112     assert selected is not None 113","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-83b4d2621f12","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":116,"snippet":"115  116     assert summary.flight_number == \"UA1234\" 117     assert summary.origin_iata == \"GEG\"","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-e1eaccda58eb","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":117,"snippet":"116     assert summary.flight_number == \"UA1234\" 117     assert summary.origin_iata == \"GEG\" 118     assert summary.destination_iata == \"DEN\"","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-883b9181ea5a","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":118,"snippet":"117     assert summary.origin_iata == \"GEG\" 118     assert summary.destination_iata == \"DEN\" 119     assert summary.starlink_likelihood == 51.0","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-de7682fe5184","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":119,"snippet":"118     assert summary.destination_iata == \"DEN\" 119     assert summary.starlink_likelihood == 51.0 120     assert summary.probability_source == \"fleet_ratio\"","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-5bf97c75fcb7","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":120,"snippet":"119     assert summary.starlink_likelihood == 51.0 120     assert summary.probability_source == \"fleet_ratio\" 121     assert summary.typical_aircraft == \"B39M\"","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-702d81b50f28","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":121,"snippet":"120     assert summary.probability_source == \"fleet_ratio\" 121     assert summary.typical_aircraft == \"B39M\" 122     assert summary.airline_name == \"United Airlines\"","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-78b6ebd20e2f","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":122,"snippet":"121     assert summary.typical_aircraft == \"B39M\" 122     assert summary.airline_name == \"United Airlines\" 123     assert summary.airline_iata == \"UA\"","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-5f1104bacbaf","source":"bandit","ruleId":"r.e306f0b3256a","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_starlink_flights.py","line":123,"snippet":"122     assert summary.airline_name == \"United Airlines\" 123     assert summary.airline_iata == \"UA\" 124","message":"assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.","category":"other","hardFail":false},{"id":"F-108506aabcb2","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"sdk/python/tests/test_wizzair_connector.py","line":42,"snippet":"with patch(\"curl_cffi.requests.Session\", return_value=session):","message":"HTTP client in Python.","category":"network","hardFail":false},{"id":"F-d0e83aa384dd","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"server.json","line":2,"snippet":"\"$schema\": \"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json\",","message":"URL literal: https://static.modelcontextprotocol.io","category":"network","hardFail":false},{"id":"F-474d3ce00bb5","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"server.json","line":6,"snippet":"\"websiteUrl\": \"https://letsfg.co\",","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-3b05523eb152","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"server.json","line":8,"snippet":"\"url\": \"https://github.com/LetsFG/LetsFG\",","message":"URL literal: https://github.com","category":"network","hardFail":false},{"id":"F-0694381907da","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"skills/flight-search/SKILL.md","line":25,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-b22111119337","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"skills/flight-search/SKILL.md","line":87,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-2c244bbe7674","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"skills/flight-search/references/api-reference.md","line":10,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-9c13b29a16c5","source":"heckler","ruleId":"r.55af1ab00fbc","severity":"info","confidence":1.0,"path":"skills/flight-search/references/mcp-setup.md","line":3,"snippet":"","message":"Variation Selector 16 (U+FE0F)","category":"obfuscation","hardFail":false},{"id":"F-ada5b700605a","source":"opengrep","ruleId":"r.0288ce1d8585","severity":"info","confidence":0.9,"path":"skills/flight-search/references/mcp-setup.md","line":19,"snippet":"pip install letsfg","message":"Installs language packages at runtime (pip/npm/cargo/go/gem/bun).","category":"package","hardFail":false},{"id":"F-5a9684a44337","source":"opengrep","ruleId":"r.ffe891943e29","severity":"info","confidence":0.9,"path":"skills/flight-search/references/mcp-setup.md","line":30,"snippet":"curl -X POST https://letsfg.co/developers/api/v1/agents/register \\","message":"Network client invoked from a script or Process command (curl/wget/nc/...).","category":"network","hardFail":false},{"id":"F-ec9bbdd3a4af","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"smithery.yaml","line":5,"snippet":"# https://smithery.ai/docs/publishing","message":"URL literal: https://smithery.ai","category":"network","hardFail":false},{"id":"F-629ea4c076bb","source":"malcontent","ruleId":"r.0b0a2ab1d6bb","severity":"info","confidence":0.6,"path":"test/model-test.js","line":0,"snippet":"['/etc/passwd']","message":"Detects access to sensitive files (credentials, configs, keys) [MEDIUM]","category":"other","hardFail":false},{"id":"F-d25dc87154e7","source":"malcontent","ruleId":"r.9c06986c69f4","severity":"info","confidence":0.6,"path":"test/model-test.js","line":0,"snippet":"['$zw_between']","message":"Detects unicode homoglyphs and uncommon characters used for obfuscation [MEDIUM]","category":"other","hardFail":false},{"id":"F-4c17298b2e18","source":"malcontent","ruleId":"r.fb014819c620","severity":"info","confidence":0.6,"path":"test/model-test.js","line":0,"snippet":"['(checks - failures)', '(99 * 1024 * 1024)', '$complex_math_div', '$complex_math_mul', '$complex_math_sub', '$f_fromCharCode', '(2026-08-23)', 'airlines/64', 'voyager/10', '194-offer', '256-offer', '","message":"complex math with parseInt or fromCharCode conversions [MEDIUM]","category":"other","hardFail":false},{"id":"F-4a89ceafe128","source":"malcontent","ruleId":"r.11d4044d9aba","severity":"info","confidence":0.6,"path":"test/model-test.js","line":0,"snippet":"['https://www.ryanair.com/x?y=1&z=2', 'require']","message":"contains hardcoded endpoint with a question mark [MEDIUM]","category":"other","hardFail":false},{"id":"F-a14722e85a02","source":"malcontent","ruleId":"r.49d5f573ce86","severity":"info","confidence":0.6,"path":"test/model-test.js","line":0,"snippet":"['DOCTYPE html', '<html>']","message":"Contains HTML content [MEDIUM]","category":"other","hardFail":false},{"id":"F-f70dda86b6b5","source":"malcontent","ruleId":"r.c8f2cb7996f8","severity":"info","confidence":0.6,"path":"test/model-test.js","line":0,"snippet":"['lt with fromCharCode so no e', 'String.fromCharCode(10) + \"']","message":"assembles strings from UTF-16 code units [MEDIUM]","category":"other","hardFail":false},{"id":"F-0e9895bf590b","source":"malcontent","ruleId":"r.4f51c4fad003","severity":"info","confidence":0.6,"path":"test/model-test.js","line":0,"snippet":"['/root']","message":"path reference within /root [MEDIUM]","category":"other","hardFail":false},{"id":"F-40e70e1eb296","source":"malcontent","ruleId":"r.3e359da84e56","severity":"info","confidence":0.6,"path":"test/model-test.js","line":0,"snippet":"['agent']","message":"references an 'agent' [MEDIUM]","category":"other","hardFail":false},{"id":"F-bcb0079a661e","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"test/model-test.js","line":0,"snippet":"['HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-126a3ccc7d74","source":"gitleaks","ruleId":"r.43cd6c2d96bb","severity":"info","confidence":0.7,"path":"test/model-test.js","line":79,"snippet":"token: \"RED…REDACTED\"","message":"Possible hard-coded secret (Detected a Generic API Key, potentially exposing access to various services and sensitive operations.); value redacted, liveness not verified.","category":"secret","hardFail":false},{"id":"F-c3ccdbaec617","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"tools/build-icons.py","line":16,"snippet":"Icons: Lucide (https://lucide.dev), ISC licence -- see assets/icons/LICENSE.","message":"URL literal: https://lucide.dev","category":"network","hardFail":false},{"id":"F-0da5c9ecab6c","source":"malcontent","ruleId":"r.a5934ed7d04a","severity":"info","confidence":0.6,"path":"tools/build-ranking.py","line":0,"snippet":"['subprocess.run(cmd, capture_output=True, text=True, shell=(os.name == \"nt\"))']","message":"execute external program [MEDIUM]","category":"other","hardFail":false},{"id":"F-9bb31a0a0ba8","source":"bandit","ruleId":"r.42a10ce62220","severity":"info","confidence":0.9,"path":"tools/build-ranking.py","line":23,"snippet":"22 import re 23 import subprocess 24 import sys","message":"blacklist: Consider possible security implications associated with the subprocess module.","category":"exec","hardFail":false},{"id":"F-613fbd1cd574","source":"bandit","ruleId":"r.b10a0fff101b","severity":"low","confidence":0.9,"path":"tools/build-ranking.py","line":101,"snippet":"100            \"--outDir\", tmp_dir] 101     proc = subprocess.run(cmd, capture_output=True, text=True, shell=(os.name == \"nt\")) 102     tmp_js = os.path.join(tmp_dir, \"bundle.js\")","message":"subprocess_popen_with_shell_equals_true: subprocess call with shell=True identified, security issue.","category":"exec","hardFail":false},{"id":"F-2834f7fba7a4","source":"opengrep","ruleId":"r.797dc6b4e8ec","severity":"info","confidence":0.9,"path":"tools/build-ranking.py","line":101,"snippet":"proc = subprocess.run(cmd, capture_output=True, text=True, shell=(os.name == \"nt\"))","message":"Python spawns processes.","category":"exec","hardFail":false},{"id":"F-b17f2e5c3f7e","source":"malcontent","ruleId":"r.8a7ad93c4718","severity":"info","confidence":0.6,"path":"tools/check-search-invariant.py","line":0,"snippet":"['is not a malicious user']","message":"References 'malicious' [MEDIUM]","category":"other","hardFail":false},{"id":"F-7b257667a54f","source":"malcontent","ruleId":"r.8d917b297212","severity":"info","confidence":0.6,"path":"tools/split-comparison.py","line":0,"snippet":"['application/json', 'POST', 'post']","message":"upload content via HTTP form [MEDIUM]","category":"other","hardFail":false},{"id":"F-6c9f752c40da","source":"malcontent","ruleId":"r.7f5b9be716d8","severity":"info","confidence":0.6,"path":"tools/split-comparison.py","line":0,"snippet":"['Content-Type', 'HTTP', 'POST', 'http']","message":"submits content to websites [MEDIUM]","category":"other","hardFail":false},{"id":"F-20da215bad30","source":"malcontent","ruleId":"r.4466daea12b8","severity":"info","confidence":0.6,"path":"tools/split-comparison.py","line":0,"snippet":"['urllib.request']","message":"requests resources via URL [MEDIUM]","category":"other","hardFail":false},{"id":"F-d5dc6d83b69d","source":"textscan","ruleId":"r.4dc275665c39","severity":"info","confidence":1.0,"path":"tools/split-comparison.py","line":32,"snippet":"BASE = os.environ.get(\"LETSFG_BASE_URL\", \"https://letsfg.co\").rstrip(\"/\")","message":"URL literal: https://letsfg.co","category":"network","hardFail":false},{"id":"F-f4b9bfada07e","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"tools/split-comparison.py","line":68,"snippet":"req = urllib.request.Request(","message":"HTTP client in Python.","category":"network","hardFail":false},{"id":"F-7f1b0535cc86","source":"bandit","ruleId":"r.5705d5a56640","severity":"low","confidence":0.9,"path":"tools/split-comparison.py","line":71,"snippet":"70         headers=headers(json_body=True), method=\"POST\") 71     with urllib.request.urlopen(req, timeout=60) as r: 72         return json.loads(r.read())","message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","category":"other","hardFail":false},{"id":"F-9228052c8cec","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"tools/split-comparison.py","line":71,"snippet":"with urllib.request.urlopen(req, timeout=60) as r:","message":"HTTP client in Python.","category":"network","hardFail":false},{"id":"F-038f69b45752","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"tools/split-comparison.py","line":76,"snippet":"req = urllib.request.Request(f\"{BASE}{path}\", headers=headers(), method=\"GET\")","message":"HTTP client in Python.","category":"network","hardFail":false},{"id":"F-a80e14dfa0f8","source":"bandit","ruleId":"r.5705d5a56640","severity":"low","confidence":0.9,"path":"tools/split-comparison.py","line":77,"snippet":"76     req = urllib.request.Request(f\"{BASE}{path}\", headers=headers(), method=\"GET\") 77     with urllib.request.urlopen(req, timeout=30) as r: 78         return json.loads(r.read())","message":"blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.","category":"other","hardFail":false},{"id":"F-b004b991086a","source":"opengrep","ruleId":"r.19d4b7994e75","severity":"info","confidence":0.9,"path":"tools/split-comparison.py","line":77,"snippet":"with urllib.request.urlopen(req, timeout=30) as r:","message":"HTTP client in Python.","category":"network","hardFail":false},{"id":"F-1efa8834323d","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"tools/validate.sh","line":3,"snippet":"# `omarchy plugin validate` so they can be checked without an Omarchy box.","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false},{"id":"F-895e2f89c159","source":"opengrep","ruleId":"r.5e2eff489ad3","severity":"info","confidence":0.9,"path":"tools/validate.sh","line":6,"snippet":"#   omarchy plugin validate \"$PLUGIN_DIR\"","message":"Calls Omarchy commands or touches Omarchy shell state.","category":"other","hardFail":false}],"ai":{"pass1":{"status":"ok","output":{"summary":"Bar widget and panel only. Panel.qml uses XHR to letsfg.co and spawns no processes. It reads ~/.letsfg/config.json for the token and writes its own state files. Scanner hits are in SDK/tools files the shell doesn't load. Panel.qml and Model.js were only grepped.","whatItDoes":{"oneLiner":"A bar widget with a flight-search panel that calls letsfg.co over XHR using the user's LetsFG token, with an anonymous install ID sent for analytics."},"additionalFindings":[{"severity":"low","path":"Panel.qml","line":1071,"message":"Reads the CLI's token file ~/.letsfg/config.json and sends the bearer token to letsfg.co. This is the plugin's stated purpose, and the file is read-only to the plugin.","category":"secret","snippet":"path: Quickshell.env(\"HOME\") + \"/.letsfg/config.json\""},{"severity":"info","path":"Panel.qml","line":1025,"message":"Generates a random anonymous install ID and sends it to the server as an analytics header (X-LetsFG-Install). It is disclosed in the code comments.","category":"network","snippet":"An anonymous install id, generated once and kept beside the token."}],"escalate":false,"escalateReason":"","injectionObserved":false,"injectionNotes":"","canaryObserved":false},"turns":6,"costUsd":0.1414684},"pass2":[{"findingId":"F-88d14336f65f","verdict":"likely-fp","reason":"Truncated marketing description for the MCP server; visible text shows no hidden instructions or secret references, only 'ONE credenti...' (credential) product copy."},{"findingId":"F-4f6fd296140f","verdict":"confirmed","reason":"Snippet shows the panel reading ~/.letsfg/config.json (token file); reading a credential file is the reported behaviour, albeit expected for the plugin."},{"findingId":"F-6586cc326adf","verdict":"likely-fp","reason":"'pip install letsfg' appears inside an OpenAPI description markdown code block (documentation), not executed at runtime."},{"findingId":"F-16ddd92e0e0d","verdict":"confirmed","reason":"Reads LETSFG_BEARER_TOKEN from process.env; benign expected config read."},{"findingId":"F-b03f8fcce13e","verdict":"confirmed","reason":"Reads LETSFG_API_KEY from process.env; benign expected config read."},{"findingId":"F-4a5642ee5738","verdict":"likely-fp","reason":"Resource description 'Read this before using any tools' is ordinary guide guidance, not a hidden priority/override marker."},{"findingId":"F-417619fae0e1","verdict":"unsure","reason":"urlopen on a Request object; URL construction not visible in snippet."},{"findingId":"F-71bffd63ddb0","verdict":"unsure","reason":"urlopen on a Request object; URL construction not visible in snippet."},{"findingId":"F-2c8e3f68909e","verdict":"unsure","reason":"urlopen on a Request object; URL construction not visible in snippet."},{"findingId":"F-3c63aa2bc026","verdict":"unsure","reason":"urlopen on a Request object; URL construction not visible in snippet."},{"findingId":"F-d6929d9bcf10","verdict":"unsure","reason":"urlopen on a Request object; URL construction not visible in snippet."},{"findingId":"F-5e11aeb0f27e","verdict":"unsure","reason":"urlopen on a Request object; URL construction not visible in snippet."},{"findingId":"F-91edb1e736ed","verdict":"unsure","reason":"urlopen on a Request object; URL construction not visible in snippet."},{"findingId":"F-613fbd1cd574","verdict":"confirmed","reason":"subprocess.run with shell=True on Windows, though args are a fixed list for tsc in a build tool; low risk."},{"findingId":"F-7f1b0535cc86","verdict":"likely-fp","reason":"URL is f\"{BASE}{path}\" with a constant BASE to the API host; no file:/custom scheme possible."},{"findingId":"F-a80e14dfa0f8","verdict":"likely-fp","reason":"URL is f\"{BASE}{path}\" with a constant BASE to the API host; no file:/custom scheme possible."}],"guard":{"canaryOk":true,"positiveControlOk":null,"disallowedToolUse":false,"schemaValid":true,"failures":[]}}}}}],"listing":{"id":"io.github.letsfg.flights","name":"LetsFG Flights","ini":"LF","accent":"amber","author":"LetsFG","desc":"Search hundreds of airlines from the bar. Uses your own LetsFG token; no keys are bundled.","cat":"Productivity","kind":"Bar widget","tags":["bar","quickshell"],"repo":"https://github.com/LetsFG/LetsFG","verif":"unverified","listed":"2026-08-25T15:29:12Z","updated":"2026-10-14T22:10:55Z","img":{"thumb":"6-letsfg-letsfg-card.webp","full":"6-letsfg-letsfg-detail.webp","w":1475,"h":1190},"gallery":["https://raw.githubusercontent.com/LetsFG/LetsFG/f01e291f23e44b712bc0ea207dbf8a6144c110bc/assets/banner.png","https://raw.githubusercontent.com/LetsFG/LetsFG/f01e291f23e44b712bc0ea207dbf8a6144c110bc/assets/sponsor-evomi.png","https://raw.githubusercontent.com/LetsFG/LetsFG/f01e291f23e44b712bc0ea207dbf8a6144c110bc/preview.png"],"gh":{"stars":2169,"vel30":148,"lastCommit":"2026-10-17T17:49:03Z","c90":139,"contrib":5,"bus":1,"rel180":6,"lastRelease":"v2026.5.103","issues":5,"respH":12.6,"archived":false,"branch":"main"},"mkt":{"views":7437,"copies":510,"hearts":25},"rank":1,"score":85.68,"fac":[22.0,13.4,10.6,11.0,6.4,8.0,4.3,8.5,1.5],"verdict":{"combined":"caution","basis":"trusted","providers":{"marketplace":"caution","opc":"caution"},"commit":"26b1fa823756f164b472c7eab0d22f102044dc35","tree":"f84060a635365d4825d50589adb0fbe12b31859a","criteria":{"checked":["no-network","no-exec","no-persistence","no-privilege","no-obfuscation","no-secrets"],"failed":["no-network","no-exec"]},"risk":37},"report":true,"license":"MIT","version":"1.1.0"},"activity":{"weeks":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,6,8,5,12,13,15,16,3,9,5,8]}}