{ "_type": "https://in-toto.io/Statement/v1", "subject": [ { "name": "git+https://github.com/LetsFG/LetsFG", "digest": { "gitCommit": "26b1fa823756f164b472c7eab0d22f102044dc35", "gitTree": "f84060a635365d4825d50589adb0fbe12b31859a" } } ], "predicateType": "https://prometheusroot.github.io/omarchy-plugin-check/attestation/security-review/v1", "predicate": { "provider": { "id": "opc", "scannerVersion": "0.1.0", "method": [ "static", "ai" ] }, "plugin": { "id": "io.github.letsfg.flights", "catalogGeneratedAt": "2026-09-30T14:53:56.598Z", "target": "marketplace-verified" }, "timeReviewed": "2026-10-02T10:51:03Z", "verdict": "caution", "summary": "caution: injection, secret, package, supply-chain (17 finding(s) above info)", "criteria": { "checked": [ "no-network", "no-exec", "no-persistence", "no-privilege", "no-obfuscation", "no-secrets" ], "failed": [ "no-network", "no-exec" ], "notChecked": [ "safe-to-run", "reviewed-by-human" ] }, "scope": { "kind": "full", "path": "" }, "findings": [ { "category": "injection", "severity": "low", "confidence": 0.95, "message": "MCP 'letsfg.description' field carries hidden instructions / references to secrets — classic tool poisoning. [CG701/mcp-tool-poisoning]", "locations": [ { "path": ".mcp.json", "startLine": 11 } ] }, { "category": "secret", "severity": "low", "confidence": 0.6, "message": "Reads the CLI's token file ~/.letsfg/config.json and sends the bearer token to letsfg.co. This is the plugin's stated purpose, and the file is read-only to the plugin.", "locations": [ { "path": "Panel.qml", "startLine": 1071 } ] }, { "category": "package", "severity": "low", "confidence": 0.9, "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "locations": [ { "path": "openapi.yaml", "startLine": 32 } ] }, { "category": "supply-chain", "severity": "low", "confidence": 0.6, "message": "guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)", "locations": [ { "path": "sdk/mcp/src/index.ts", "startLine": 29 } ] }, { "category": "supply-chain", "severity": "low", "confidence": 0.6, "message": "guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)", "locations": [ { "path": "sdk/mcp/src/index.ts", "startLine": 30 } ] }, { "category": "injection", "severity": "low", "confidence": 0.8, "message": "Hidden-priority marker of the kind used in MCP tool-poisoning payloads. [CG105/instruction-override]", "locations": [ { "path": "sdk/mcp/src/index.ts", "startLine": 291 } ] }, { "category": "other", "severity": "low", "confidence": 0.9, "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "locations": [ { "path": "sdk/python/letsfg/cli.py", "startLine": 852 } ] }, { "category": "other", "severity": "low", "confidence": 0.9, "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "locations": [ { "path": "sdk/python/letsfg/client.py", "startLine": 1035 } ] }, { "category": "other", "severity": "low", "confidence": 0.9, "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "locations": [ { "path": "sdk/python/letsfg/client.py", "startLine": 1075 } ] }, { "category": "other", "severity": "low", "confidence": 0.9, "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "locations": [ { "path": "sdk/python/letsfg/connectors/auth.py", "startLine": 128 } ] }, { "category": "other", "severity": "low", "confidence": 0.9, "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "locations": [ { "path": "sdk/python/letsfg/local.py", "startLine": 129 } ] }, { "category": "other", "severity": "low", "confidence": 0.9, "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "locations": [ { "path": "sdk/python/letsfg/local.py", "startLine": 148 } ] }, { "category": "other", "severity": "low", "confidence": 0.9, "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "locations": [ { "path": "sdk/python/letsfg/local.py", "startLine": 227 } ] }, { "category": "external-code", "severity": "low", "confidence": 0.9, "message": "Declares 7 runtime dependencies fetched from a package registry at install/build time (not reviewed): pydantic, httpx, airportsdata, requests, typer, rich, click", "locations": [ { "path": "sdk/python/pyproject.toml" } ] }, { "category": "exec", "severity": "low", "confidence": 0.9, "message": "subprocess_popen_with_shell_equals_true: subprocess call with shell=True identified, security issue.", "locations": [ { "path": "tools/build-ranking.py", "startLine": 101 } ] }, { "category": "other", "severity": "low", "confidence": 0.9, "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "locations": [ { "path": "tools/split-comparison.py", "startLine": 71 } ] }, { "category": "other", "severity": "low", "confidence": 0.9, "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "locations": [ { "path": "tools/split-comparison.py", "startLine": 77 } ] } ], "quality": { "score": 95 }, "policy": { "uri": "https://prometheusroot.github.io/omarchy-plugin-check/policy/v1" }, "report": { "schemaVersion": 1, "plugin": { "id": "io.github.letsfg.flights", "name": "LetsFG Flights", "repo": "https://github.com/LetsFG/LetsFG", "listingState": "listed", "marketplace": { "verificationCommit": "26b1fa823756f164b472c7eab0d22f102044dc35", "listingValidatedCommit": "26b1fa823756f164b472c7eab0d22f102044dc35", "upstreamObservedCommit": "3a309f60e2e0a52082728a277f319148fa60bff1", "baselineOutcome": "passed", "verificationStatus": "unverified", "caps": [], "stars": 2075, "catalogGeneratedAt": "2026-09-30T14:53:56.598Z", "manifestPath": "manifest.json", "repositoryLayout": "root-plugin", "author": "LetsFG", "description": "Search hundreds of airlines from the bar. Uses your own LetsFG token; no keys are bundled.", "category": "Productivity", "kind": "Bar widget", "tags": [ "bar", "quickshell" ], "license": "MIT", "installCommand": "omarchy plugin add https://github.com/LetsFG/LetsFG.git --enable" } }, "review": { "commit": "26b1fa823756f164b472c7eab0d22f102044dc35", "scanTarget": "marketplace-verified", "pluginPath": "", "reviewedAt": "2026-10-02T10:51:03Z", "aiModel": "sonnet+fable", "upstreamHeadAtScan": "3a309f60e2e0a52082728a277f319148fa60bff1", "previousCommit": null, "tools": [ { "name": "inventory", "version": null, "status": "ok" }, { "name": "textscan", "version": null, "status": "ok" }, { "name": "extcode", "version": null, "status": "ok" }, { "name": "heckler", "version": "1.0.0", "status": "ok" }, { "name": "ctxsentry", "version": "0.5.0", "status": "ok" }, { "name": "opengrep", "version": "1.30.0", "status": "ok" }, { "name": "yara", "version": "4.5.4", "status": "ok" }, { "name": "malcontent", "version": "1.26.1", "status": "ok" }, { "name": "shellcheck", "version": "0.11.0", "status": "ok" }, { "name": "bandit", "version": "1.9.4", "status": "ok" }, { "name": "eslint", "version": "10.11.0", "status": "ok" }, { "name": "qmllint", "version": "6.4.2", "status": "ok" }, { "name": "gitleaks", "version": "8.30.1", "status": "ok" }, { "name": "guarddog", "version": "3.2.0", "status": "ok" }, { "name": "osv", "version": "2.6.0", "status": "failed" }, { "name": "zizmor", "version": "1.30.1", "status": "ok" }, { "name": "clamav", "version": "1.4.3", "status": "ok" }, { "name": "perf", "version": null, "status": "ok" }, { "name": "quality", "version": null, "status": "ok" } ], "rulesVersion": "r-05e7b1572de1", "scannerVersion": "0.1.0" }, "verdict": { "outcome": "caution", "score": 37, "hardFails": [], "aiEscalation": null, "summary": "caution: score 37; 16 low; uses processExec, network, fileWrite, packageInstall, externalCode", "reasons": [ "score in the caution band", "capabilities: processExec, network, fileWrite, packageInstall", "relies on external code not in the reviewed commit, so safe-to-run is not checked: airportsdata (package, pypi), click (package, pypi), httpx (package, pypi), pydantic (package, pypi), requests (package, pypi), rich (package, pypi) +1 more" ], "criteria": { "checked": [ "no-network", "no-exec", "no-persistence", "no-privilege", "no-obfuscation", "no-secrets" ], "failed": [ "no-network", "no-exec" ], "notChecked": [ "safe-to-run", "reviewed-by-human" ] } }, "whatItDoes": { "oneLiner": "A bar widget with a flight-search panel that calls letsfg.co over XHR using the user's LetsFG token, with an anonymous install ID sent for analytics.", "kinds": [ "bar-widget" ], "entryPoints": [ { "key": "barWidget", "path": "BarWidget.qml" } ], "manifestValid": true, "manifestError": null }, "capabilities": { "processExec": { "level": "low", "evidence": [ "F-9bb31a0a0ba8", "F-613fbd1cd574", "F-2834f7fba7a4" ] }, "network": { "level": "med", "evidence": [ "F-3ec51272b374", "F-3bb1cde4ceae", "F-bebf5503c2b8", "F-6213a2a19e5e", "F-38e0f24cdd7c", "F-34c22b5f6f5c", "F-459e3e20f7cf", "F-85c6a758dd2f", "F-57e2cb2cee6f", "F-15b442a65ebe", "F-b6d605e4bc50", "F-160e83a55e09", "F-2901a310cca6", "F-042fea2a1f78", "F-417619fae0e1", "F-b08348627ccb", "F-71bffd63ddb0", "F-2c8e3f68909e", "F-3c63aa2bc026", "F-d6929d9bcf10", "F-5e11aeb0f27e", "F-91edb1e736ed", "F-f4b9bfada07e", "F-7f1b0535cc86", "F-9228052c8cec", "F-038f69b45752", "F-a80e14dfa0f8", "F-b004b991086a" ] }, "fileWrite": { "level": "low", "evidence": [ "F-fb1b58ee725e", "F-bf29f8791c7c", "F-a9d84b871079" ] }, "persistence": { "level": "none", "evidence": [] }, "privilege": { "level": "none", "evidence": [] }, "packageInstall": { "level": "low", "evidence": [ "F-6586cc326adf" ] }, "bundledBinary": { "level": "none", "evidence": [] }, "clipboard": { "level": "none", "evidence": [] }, "screenCapture": { "level": "none", "evidence": [] }, "hyprlandIpc": { "level": "none", "evidence": [] }, "externalCode": { "level": "low", "evidence": [ "F-33305cc9351a" ], "externals": [ { "name": "airportsdata", "kind": "package", "source": "pypi", "evidence": [ "F-33305cc9351a" ] }, { "name": "click", "kind": "package", "source": "pypi", "evidence": [ "F-33305cc9351a" ] }, { "name": "httpx", "kind": "package", "source": "pypi", "evidence": [ "F-33305cc9351a" ] }, { "name": "pydantic", "kind": "package", "source": "pypi", "evidence": [ "F-33305cc9351a" ] }, { "name": "requests", "kind": "package", "source": "pypi", "evidence": [ "F-33305cc9351a" ] }, { "name": "rich", "kind": "package", "source": "pypi", "evidence": [ "F-33305cc9351a" ] }, { "name": "typer", "kind": "package", "source": "pypi", "evidence": [ "F-33305cc9351a" ] } ] } }, "systemAreas": { "touched": [ "omarchy-shell" ], "evidence": [ { "area": "omarchy-shell", "findings": [ "F-2aceb3996e4d", "F-e62e3ebbdde3", "F-1f74a0e338bd", "F-16f66ec8f83e", "F-6cf73f3f9cf7", "F-3ff72e64efd0" ] } ] }, "network": { "hosts": [ { "host": "basemaps.cartocdn.com", "schemes": [ "https" ], "evidence": [ "F-e2b33e484ab4" ] }, { "host": "booking.flyscoot.com", "schemes": [ "https" ], "evidence": [ "F-b233b59367f3" ] }, { "host": "bookingportal.china-airlines.com", "schemes": [ "https" ], "evidence": [ "F-223afcc575b8" ] }, { "host": "checknfly.co.uk", "schemes": [ "https" ], "evidence": [ "F-bb894d2ba7fa" ] }, { "host": "checkout.stripe.com", "schemes": [ "https" ], "evidence": [ "F-80c48163c0c3" ] }, { "host": "checkout.stripe.com.evil.com", "schemes": [ "https" ], "evidence": [ "F-74bb0cf05caf" ] }, { "host": "context7.com", "schemes": [ "https" ], "evidence": [ "F-dfbc363724eb" ] }, { "host": "github.com", "schemes": [ "https" ], "evidence": [ "F-00f7fe0ebf6e", "F-79169d733f5c", "F-c32ffe17778f", "F-1f7cbee848c0", "F-8fe919aff9f9", "F-30390d6bbf35", "F-3b05523eb152" ] }, { "host": "glama.ai", "schemes": [ "https" ], "evidence": [ "F-e3ca7624bf6d" ] }, { "host": "i.travelapi.com", "schemes": [ "https" ], "evidence": [ "F-21ddc2397c04" ] }, { "host": "images.kiwi.com", "schemes": [ "https" ], "evidence": [ "F-268c7f2ce764" ] }, { "host": "images.pexels.com", "schemes": [ "https" ], "evidence": [ "F-8fd59c87cd6e" ] }, { "host": "letsfg.co", "schemes": [ "https" ], "evidence": [ "F-6a3feea33bf4", "F-e0c1b4687acb", "F-de7124e4e1e7", "F-c315c37e635a", "F-cad11f864e6d", "F-5ca62be49ed1", "F-3858790fdecb", "F-fa7b8109e101", "F-920d49da1f49", "F-61ac33f817c8", "F-23ad1af5b21b", "F-3feafcd98d07", "F-4b8e0350ed94", "F-128a5fe61a40", "F-7d4d8d5e60ba", "F-9e50ba582395", "F-474d3ce00bb5", "F-d5dc6d83b69d" ] }, { "host": "localhost", "schemes": [ "http" ], "evidence": [ "F-c06edb69186b" ] }, { "host": "lucide.dev", "schemes": [ "https" ], "evidence": [ "F-c3ccdbaec617" ] }, { "host": "oversea.csair.com", "schemes": [ "https" ], "evidence": [ "F-042adf30d0a6" ] }, { "host": "pics.avs.io", "schemes": [ "https" ], "evidence": [ "F-24ac49e0179b" ] }, { "host": "q-xx.bstatic.com", "schemes": [ "https" ], "evidence": [ "F-33d5384409df" ] }, { "host": "smithery.ai", "schemes": [ "https" ], "evidence": [ "F-ec9bbdd3a4af" ] }, { "host": "static.modelcontextprotocol.io", "schemes": [ "https" ], "evidence": [ "F-d0e83aa384dd" ] }, { "host": "tickets.vueling.com", "schemes": [ "https" ], "evidence": [ "F-13b483e45193", "F-e16c1d372e1a" ] }, { "host": "upload.wikimedia.org", "schemes": [ "https" ], "evidence": [ "F-5ab3f8706a32" ] }, { "host": "www.delta.com", "schemes": [ "https" ], "evidence": [ "F-80fddcdcd00f" ] }, { "host": "www.despegar.com.mx", "schemes": [ "https" ], "evidence": [ "F-4fa5404280dc", "F-d21d93ca125d" ] }, { "host": "www.flighthub.com", "schemes": [ "https" ], "evidence": [ "F-5067b1b4c444" ] }, { "host": "www.google.com", "schemes": [ "https" ], "evidence": [ "F-81c37b85012c", "F-973709b3fb4b", "F-b4674b0207cd" ] }, { "host": "www.lastminute.com", "schemes": [ "https" ], "evidence": [ "F-f3064451e95d" ] }, { "host": "www.lionair.co.id", "schemes": [ "https" ], "evidence": [ "F-8434130c620a", "F-34c90c7c1dec" ] }, { "host": "www.martigo.pl", "schemes": [ "https" ], "evidence": [ "F-ad4ac2783452", "F-c9e108a0afc0" ] }, { "host": "www.mea.com.lb", "schemes": [ "https" ], "evidence": [ "F-03702aad1616" ] }, { "host": "www.vietjetair.com", "schemes": [ "https" ], "evidence": [ "F-10af199081f2", "F-656f14c5236f" ] } ] }, "dependencies": { "packages": [ { "name": "@types/node", "version": "^25.3.3", "ecosystem": "npm", "direct": true, "pinned": true, "manifestPath": "sdk/js/package.json" }, { "name": "tsup", "version": "^8.0.0", "ecosystem": "npm", "direct": true, "pinned": true, "manifestPath": "sdk/js/package.json" }, { "name": "tsx", "version": "^4.19.0", "ecosystem": "npm", "direct": true, "pinned": true, "manifestPath": "sdk/js/package.json" }, { "name": "typescript", "version": "^5.3.0", "ecosystem": "npm", "direct": true, "pinned": true, "manifestPath": "sdk/js/package.json" }, { "name": "@types/node", "version": "^25.5.0", "ecosystem": "npm", "direct": true, "pinned": true, "manifestPath": "sdk/mcp/package.json" }, { "name": "tsup", "version": "^8.0.0", "ecosystem": "npm", "direct": true, "pinned": true, "manifestPath": "sdk/mcp/package.json" }, { "name": "tsx", "version": "^4.19.0", "ecosystem": "npm", "direct": true, "pinned": true, "manifestPath": "sdk/mcp/package.json" }, { "name": "typescript", "version": "^5.3.0", "ecosystem": "npm", "direct": true, "pinned": true, "manifestPath": "sdk/mcp/package.json" } ], "systemPackages": [], "vulnerabilities": [] }, "secrets": { "count": 27, "items": [ { "findingId": "F-ad63c538d1a3", "kind": "curl-auth-header", "live": null }, { "findingId": "F-885777f4fce4", "kind": "curl-auth-header", "live": null }, { "findingId": "F-e1e24552fd6f", "kind": "curl-auth-header", "live": null }, { "findingId": "F-c7875da9b52f", "kind": "curl-auth-header", "live": null }, { "findingId": "F-1f9546d4adb0", "kind": "generic-api-key", "live": null }, { "findingId": "F-0af0c6ef5062", "kind": "curl-auth-header", "live": null }, { "findingId": "F-afd2d39ebf68", "kind": "curl-auth-header", "live": null }, { "findingId": "F-332e313edf65", "kind": "curl-auth-header", "live": null }, { "findingId": "F-e15cf9eee111", "kind": "curl-auth-header", "live": null }, { "findingId": "F-72e4b69ca387", "kind": "curl-auth-header", "live": null }, { "findingId": "F-a71d1ac93388", "kind": "curl-auth-header", "live": null }, { "findingId": "F-be62626bb4b5", "kind": "curl-auth-header", "live": null }, { "findingId": "F-e1191d8462e5", "kind": "curl-auth-header", "live": null }, { "findingId": "F-8773cdc825c9", "kind": "curl-auth-header", "live": null }, { "findingId": "F-717965ebc5bf", "kind": "curl-auth-header", "live": null }, { "findingId": "F-ec4b4c43d52b", "kind": "curl-auth-header", "live": null }, { "findingId": "F-b27f6612fae0", "kind": "curl-auth-header", "live": null }, { "findingId": "F-0582d853e753", "kind": "curl-auth-header", "live": null }, { "findingId": "F-6a104cc41fc8", "kind": "curl-auth-header", "live": null }, { "findingId": "F-2d3f8b0e1116", "kind": "curl-auth-header", "live": null }, { "findingId": "F-69d0bc94ac28", "kind": "curl-auth-header", "live": null }, { "findingId": "F-8cb4faec02c1", "kind": "curl-auth-header", "live": null }, { "findingId": "F-20c75a004b08", "kind": "curl-auth-header", "live": null }, { "findingId": "F-1a5eba698eb4", "kind": "curl-auth-header", "live": null }, { "findingId": "F-d83ee621582e", "kind": "curl-auth-header", "live": null }, { "findingId": "F-fec97898e7aa", "kind": "curl-auth-header", "live": null }, { "findingId": "F-126a3ccc7d74", "kind": "generic-api-key", "live": null } ] }, "supplyChain": { "scorecard": null, "pinnedDeps": true, "signedCommitRatio": 0.34, "busFactor": 1, "repoAgeDays": 214, "unpinnedRemoteFetches": [] }, "injection": { "hiddenUnicode": { "count": 28, "evidence": [ "F-212c56bcb5da", "F-845cbe4c4501", "F-7679dd2f4a9c", "F-80a199cb29d2", "F-8b0469256876", "F-cb98ba84f4db", "F-17ff2e77c4f4", "F-bfeef605794d", "F-ad67070b54b6", "F-3c1cdb98a60b", "F-ef045ec60ade", "F-cd80c4cff636", "F-92b9d3d1b37f", "F-70da39f2bb11", "F-3ac239a5edd7", "F-81efffa01beb", "F-d53bf93cfe26", "F-7afcbf3ac8ea", "F-c217f7d3a805", "F-c850d4c1606d", "F-9ebd8129be87", "F-a7fa52ccdae7", "F-39073f132e25", "F-cceaf6e1e661", "F-2d4390c018ac", "F-0694381907da", "F-2c244bbe7674", "F-9c13b29a16c5" ] }, "promptInjection": { "count": 2, "evidence": [ "F-88d14336f65f", "F-4a5642ee5738" ] }, "obfuscation": { "count": 0, "evidence": [] } }, "codeQuality": { "loc": { "total": 25185, "byLanguage": [ { "language": "Python", "files": 50, "lines": 8677 }, { "language": "QML", "files": 18, "lines": 4837 }, { "language": "TypeScript", "files": 10, "lines": 4740 }, { "language": "JavaScript", "files": 4, "lines": 4329 }, { "language": "CSS", "files": 2, "lines": 1282 }, { "language": "YAML", "files": 8, "lines": 1069 }, { "language": "Shell", "files": 1, "lines": 95 }, { "language": "Dockerfile", "files": 2, "lines": 80 }, { "language": "TOML", "files": 1, "lines": 76 } ] }, "lint": [ { "tool": "shellcheck", "errors": 0, "warnings": 1 }, { "tool": "eslint", "errors": 0, "warnings": 107 }, { "tool": "qmllint", "errors": 0, "warnings": 4782 }, { "tool": "bandit", "errors": 1, "warnings": 40 } ], "tests": { "present": true, "files": 28 }, "docs": { "readme": true, "changelog": false }, "license": { "spdx": "MIT", "file": true }, "hotspots": [ { "path": "sdk/mcp/src/index.ts", "reason": "r.4c1fa8e9227d; r.7e92b014a22b" }, { "path": "sdk/python/letsfg/local.py", "reason": "r.5705d5a56640" }, { "path": "sdk/python/letsfg/client.py", "reason": "r.5705d5a56640" }, { "path": "tools/split-comparison.py", "reason": "r.5705d5a56640" }, { "path": ".mcp.json", "reason": "r.7e92b014a22b" }, { "path": "openapi.yaml", "reason": "r.0288ce1d8585" }, { "path": "sdk/python/letsfg/cli.py", "reason": "r.5705d5a56640" }, { "path": "sdk/python/letsfg/connectors/auth.py", "reason": "r.5705d5a56640" } ] }, "performance": { "timers": [ { "path": "Panel.qml", "line": 1099, "intervalMs": 260, "repeat": false, "spawnsProcess": false }, { "path": "Panel.qml", "line": 1106, "intervalMs": null, "repeat": false, "spawnsProcess": false }, { "path": "Panel.qml", "line": 1118, "intervalMs": null, "repeat": false, "spawnsProcess": false }, { "path": "Panel.qml", "line": 1139, "intervalMs": null, "repeat": false, "spawnsProcess": false }, { "path": "Panel.qml", "line": 1342, "intervalMs": 1000, "repeat": true, "spawnsProcess": false } ], "estSpawnsPerMin": 0.0, "keepLoaded": true, "largeAssets": [ { "path": "assets/demo.gif", "bytes": 4037616 }, { "path": "assets/demo.mp4", "bytes": 2541044 } ], "polling": [] }, "maintenance": { "lastCommitAt": "2026-08-27T08:23:15Z", "commits90d": 78, "contributors": 12, "openIssues": null, "archived": null, "latestRelease": "v2026.5.88" }, "diffSinceLastReview": null, "findings": [ { "id": "F-9f17e82f0086", "source": "zizmor", "ruleId": "r.ab9fa6693ebd", "severity": "info", "confidence": 0.9, "path": ".github/dependabot.yml", "line": 8, "snippet": "package-ecosystem: github-actions", "message": "insufficient cooldown in Dependabot updates (https://docs.zizmor.sh/audits/#dependabot-cooldown)", "category": "supply-chain", "hardFail": false }, { "id": "F-ead92532f8fc", "source": "zizmor", "ruleId": "r.f629672d34ab", "severity": "info", "confidence": 0.5, "path": ".github/workflows/docs.yml", "line": 18, "snippet": "uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0", "message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)", "category": "supply-chain", "hardFail": false }, { "id": "F-3c48a0e4c63b", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": ".github/workflows/docs.yml", "line": 25, "snippet": "run: pip install mkdocs-material", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-65e0db46241e", "source": "zizmor", "ruleId": "r.39362b74656d", "severity": "info", "confidence": 0.7, "path": ".github/workflows/sdk-tests.yml", "line": 16, "snippet": "test: runs-on: ubuntu-latest steps: - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' - name: Install SDK (no connector", "message": "overly broad permissions (https://docs.zizmor.sh/audits/#excessive-permissions)", "category": "supply-chain", "hardFail": false }, { "id": "F-7fb7c658ac9b", "source": "zizmor", "ruleId": "r.f629672d34ab", "severity": "info", "confidence": 0.5, "path": ".github/workflows/sdk-tests.yml", "line": 19, "snippet": "uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0", "message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)", "category": "supply-chain", "hardFail": false }, { "id": "F-729a154494c2", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": ".github/workflows/sdk-tests.yml", "line": 26, "snippet": "run: pip install pydantic pytest && pip install -e . --no-deps", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-937ebe08c809", "source": "zizmor", "ruleId": "r.f629672d34ab", "severity": "info", "confidence": 0.5, "path": ".github/workflows/test.yml", "line": 32, "snippet": "uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0", "message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)", "category": "supply-chain", "hardFail": false }, { "id": "F-2a5639129623", "source": "zizmor", "ruleId": "r.f629672d34ab", "severity": "info", "confidence": 0.5, "path": ".github/workflows/test.yml", "line": 54, "snippet": "uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: fetch-depth: 0", "message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)", "category": "supply-chain", "hardFail": false }, { "id": "F-471f7aab6ce0", "source": "zizmor", "ruleId": "r.f629672d34ab", "severity": "info", "confidence": 0.5, "path": ".github/workflows/test.yml", "line": 122, "snippet": "uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0", "message": "credential persistence through GitHub Actions artifacts (https://docs.zizmor.sh/audits/#artipacked)", "category": "supply-chain", "hardFail": false }, { "id": "F-b3e72b03fcb0", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": ".github/workflows/test.yml", "line": 128, "snippet": "pip install -e .", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-883c3223440b", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": ".github/workflows/test.yml", "line": 129, "snippet": "pip install pytest", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-88d14336f65f", "source": "ctxsentry", "ruleId": "r.7e92b014a22b", "severity": "low", "confidence": 0.95, "path": ".mcp.json", "line": 11, "snippet": "Flight and hotel search & booking for AI agents. Server-side engine covers hundreds of airlines with per-flight reliability history, plus real bookable hotel ra…", "message": "MCP 'letsfg.description' field carries hidden instructions / references to secrets — classic tool poisoning. [CG701/mcp-tool-poisoning]", "category": "injection", "hardFail": false }, { "id": "F-6a3feea33bf4", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": ".mcp.json", "line": 12, "snippet": "\"homepage\": \"https://letsfg.co\",", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-00f7fe0ebf6e", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": ".mcp.json", "line": 13, "snippet": "\"repository\": \"https://github.com/LetsFG/LetsFG\"", "message": "URL literal: https://github.com", "category": "network", "hardFail": false }, { "id": "F-212c56bcb5da", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "AGENTS.md", "line": 5, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-b1102e4ca325", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 120, "snippet": "curl -X POST https://letsfg.co/api/search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-496cdabd9975", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 126, "snippet": "curl https://letsfg.co/api/results/abc123 -H \"Authorization: Bearer \"", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-c38ee481feb8", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 196, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-61e639556511", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 260, "snippet": "npm install -g letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-1e721257c356", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 347, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/register \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-50cf71cc6a4a", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 360, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-ad63c538d1a3", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "AGENTS.md", "line": 360, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/search \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-c89eeb6efed3", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 966, "snippet": "curl -s -X POST https://letsfg.co/api/agent-access/request", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-f72e6fa1ff33", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 973, "snippet": "curl -s -X POST https://letsfg.co/api/agent-access/verify \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-b40ab6e886a4", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 979, "snippet": "curl -s -X POST https://letsfg.co/api/agent-access/verify \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-b5585876d3e1", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 990, "snippet": "curl -X POST https://letsfg.co/api/search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-211d750c053f", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 997, "snippet": "curl https://letsfg.co/api/results/abc123 -H \"Authorization: Bearer eyJ...\"", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-6144f63abb11", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "AGENTS.md", "line": 1000, "snippet": "curl -X POST https://letsfg.co/api/agent-book \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-3b666a378074", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "CLAUDE.md", "line": 55, "snippet": "| **CLI / SDK** | `pip install letsfg` + `letsfg auth` — wraps PFS with auth and ranking | 8–10 s to first results; longer to `completed`, longer again on a split | Free auth, free search |", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-1d66cd81c07d", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "CLAUDE.md", "line": 152, "snippet": "pip install -e \".[dev]\"", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-122e8bc23c4e", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "CLAUDE.md", "line": 159, "snippet": "npm install npm run build # Compiles TypeScript → dist/", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false, "endLine": 160 }, { "id": "F-e850ca4f4179", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "CLAUDE.md", "line": 167, "snippet": "npm install npm run build # Compiles TypeScript → dist/", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false, "endLine": 168 }, { "id": "F-fec01dbf41dc", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "CONTRIBUTING.md", "line": 52, "snippet": "pip install -e \".[dev]\"", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-c7173e2e79ae", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "CONTRIBUTING.md", "line": 60, "snippet": "npm install npm run build", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false, "endLine": 61 }, { "id": "F-f72c2e87fc79", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "CONTRIBUTING.md", "line": 69, "snippet": "npm install npm run build", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false, "endLine": 70 }, { "id": "F-a64df834b744", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "Dockerfile", "line": 31, "snippet": "RUN npm install -g letsfg-mcp@latest", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-c48e9fe5060c", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "Dockerfile.python", "line": 26, "snippet": "RUN pip install --no-cache-dir playwright && \\", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-e2d4a2be0f5a", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "Dockerfile.python", "line": 38, "snippet": "RUN pip install --no-cache-dir .", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-d0012644f652", "source": "malcontent", "ruleId": "r.9337bfb7564c", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 0, "snippet": "['\"aaaaaaaeeeeeiiiiooooooouuuuyyccnnszzlrszcea\"', '\"abcdefghijklmnopqrstuvwxyz0123456789\"', 'function', 'charAt(', 'join(', 'for']", "message": "charAt/substr operations with long strings [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-432942e641c5", "source": "malcontent", "ruleId": "r.fb014819c620", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 0, "snippet": "['(POLL_TIMEOUT_MS / POLL_INTERVAL_MS)', '(/api/stars/badge)', '(left / TILE_SIZE)', '$complex_math_add', '$complex_math_div', '$complex_math_mul', '$complex_math_sub', '(expiresAt - now)', '(top / TI", "message": "complex math with parseInt or fromCharCode conversions [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-3277b799d893", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 0, "snippet": "['agentRequestUrl', 'agentVerifyUrl']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-f5241232e4ec", "source": "malcontent", "ruleId": "r.247776e64a54", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 0, "snippet": "['curl payload and concluding']", "message": "Invokes curl [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-cacdefbefd5e", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 0, "snippet": "['HTTP', 'POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-f2c5f6f0813c", "source": "malcontent", "ruleId": "r.57128783ca37", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 0, "snippet": "['hostname', 'port']", "message": "connects to an arbitrary hostname:port [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-6a81167fce15", "source": "malcontent", "ruleId": "r.98f4a8002aa3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 0, "snippet": "['compromised or spoofed response must']", "message": "references spoofing [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-cca4435e61cd", "source": "malcontent", "ruleId": "r.8a7ad93c4718", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 0, "snippet": "['API is not a malicious user -- it is a']", "message": "References 'malicious' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-e0c1b4687acb", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "Model.js", "line": 36, "snippet": "var API_ORIGIN = \"https://letsfg.co\"", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-24ac49e0179b", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "Model.js", "line": 171, "snippet": "// https://pics.avs.io/100/100/{IATA}.png", "message": "URL literal: https://pics.avs.io", "category": "network", "hardFail": false }, { "id": "F-268c7f2ce764", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "Model.js", "line": 187, "snippet": "var LOGO_CDN_PRIMARY = \"https://images.kiwi.com/airlines/64/\"", "message": "URL literal: https://images.kiwi.com", "category": "network", "hardFail": false }, { "id": "F-4e47f95bab18", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 199, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-c71f8087bd98", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 234, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-8e574c4d25fc", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 241, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-ef673a64edc1", "source": "eslint", "ruleId": "r.440b465c2d7c", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 362, "snippet": "", "message": "Unsafe Regular Expression", "category": "exec", "hardFail": false }, { "id": "F-74bb0cf05caf", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "Model.js", "line": 403, "snippet": "// The gap is narrow but real: \"https://checkout.stripe.com.evil.com/x\" passes", "message": "URL literal: https://checkout.stripe.com.evil.com", "category": "network", "hardFail": false }, { "id": "F-80c48163c0c3", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "Model.js", "line": 504, "snippet": "if (url.indexOf(\"https://checkout.stripe.com/\") !== 0) {", "message": "URL literal: https://checkout.stripe.com", "category": "network", "hardFail": false }, { "id": "F-4e59dfa91fba", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 670, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-0d4247251709", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 849, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-cf5f325bcbbb", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 854, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-000934c6dee4", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1008, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-b1b1521470a0", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1015, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-70f3702e1d92", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1021, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-69558e688fe7", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1022, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-c255b0f0e902", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1024, "snippet": "", "message": "Function Call Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-60ae0a5001bf", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1025, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-a866b305e84e", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1101, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-edbdd0d1b65d", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1102, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-468eab709b77", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1104, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-ab34fb3d2db1", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1113, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-7facba7641de", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1142, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-2522c77ee314", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1198, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-dc6a1f9025e0", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1199, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-4e57f2f5b22f", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1206, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-7520e138ed3b", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1207, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-993f2df337e5", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1240, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-0916c8db0164", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1272, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-8cc253c4cd04", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1277, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-36a4f6662f67", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1287, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-5512acfcb724", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1288, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-f169ecea47c8", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1292, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-578e92092603", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1293, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-a79be1828e03", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1303, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-43b5ed9a4f30", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1314, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-81b43486c81b", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1320, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-b0ad957b5890", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1328, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-e2b33e484ab4", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "Model.js", "line": 1345, "snippet": "var TILE_HOST = \"https://basemaps.cartocdn.com/rastertiles/voyager/\"", "message": "URL literal: https://basemaps.cartocdn.com", "category": "network", "hardFail": false }, { "id": "F-72378b96ebab", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1430, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-e8ef64e52f5a", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1458, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-3ec51272b374", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "Model.js", "line": 1502, "snippet": "// I got this wrong once by checking an anonymous curl payload and concluding", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-1c3e55d00b83", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1560, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-b4707531c9c3", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1563, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-b77859c60590", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1653, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-21ddc2397c04", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "Model.js", "line": 1681, "snippet": "\"https://i.travelapi.com/\",", "message": "URL literal: https://i.travelapi.com", "category": "network", "hardFail": false }, { "id": "F-33d5384409df", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "Model.js", "line": 1682, "snippet": "\"https://q-xx.bstatic.com/\",", "message": "URL literal: https://q-xx.bstatic.com", "category": "network", "hardFail": false }, { "id": "F-5f0b8f45d6d5", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1690, "snippet": "", "message": "Function Call Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-7fb01dbd87e1", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1706, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-5b642d1e3eff", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1763, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-28cf9af9233f", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1769, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-a4d6c7dc0c6b", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1779, "snippet": "", "message": "Function Call Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-8fd59c87cd6e", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "Model.js", "line": 1839, "snippet": "\"https://images.pexels.com/\",", "message": "URL literal: https://images.pexels.com", "category": "network", "hardFail": false }, { "id": "F-5ab3f8706a32", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "Model.js", "line": 1840, "snippet": "\"https://upload.wikimedia.org/\",", "message": "URL literal: https://upload.wikimedia.org", "category": "network", "hardFail": false }, { "id": "F-11eaa2ba040b", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1857, "snippet": "", "message": "Function Call Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-ae607ef81a98", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1876, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-ebc000d9bfca", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1877, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-ce7290296358", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1937, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-28144565fc5c", "source": "eslint", "ruleId": "r.440b465c2d7c", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1975, "snippet": "", "message": "Unsafe Regular Expression", "category": "exec", "hardFail": false }, { "id": "F-535eadedaef4", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1987, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-37b3d9646eea", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 1988, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-81d88501f263", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 2105, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-7cc425f0f27f", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 2118, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-4f1ae1c61b8a", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 2121, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-50942c452750", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 2123, "snippet": "", "message": "Function Call Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-41450e520687", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 2144, "snippet": "", "message": "Function Call Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-9219c1f77a08", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 2149, "snippet": "", "message": "Function Call Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-949c64cf3dea", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 2174, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-fc0799fffed5", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 2206, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-7554b26d58c3", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 2212, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-cf51bf4e0e90", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 2214, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-f4c71f267fd0", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "Model.js", "line": 2223, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-00f5bf480144", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "OMARCHY-PLUGIN.md", "line": 37, "snippet": "omarchy plugin add https://github.com/LetsFG/LetsFG.git --enable", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-d34c01fb4c65", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "OMARCHY-PLUGIN.md", "line": 56, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-0b13fc156576", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "OMARCHY-PLUGIN.md", "line": 69, "snippet": "omarchy plugin remove io.github.letsfg.flights", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-5662edb01204", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "OMARCHY-PLUGIN.md", "line": 132, "snippet": "omarchy-shell shell summon \"io.github.letsfg.flights\" '{}'", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-7f5a68349bbf", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "OMARCHY-PLUGIN.md", "line": 133, "snippet": "omarchy-shell shell hide \"io.github.letsfg.flights\"", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-5e275ead6d35", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "OMARCHY-PLUGIN.md", "line": 275, "snippet": "`omarchy-plugin-letsfg/1.0.0`, and `X-LetsFG-Install`, which is 24 random", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-0da5eb5fccf4", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "OMARCHY-PLUGIN.md", "line": 397, "snippet": "documented `omarchy plugin validate` rules — including the rule that", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-7161526219de", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "OMARCHY-PLUGIN.md", "line": 413, "snippet": "pip install PySide6-Essentials", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-886866d8d0b3", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "OMARCHY-PLUGIN.md", "line": 431, "snippet": "omarchy plugin validate \"$PLUGIN_DIR\"", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-32c9f1f385a7", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "Panel.qml", "line": 0, "snippet": "['agentRequestUrl', 'agentVerifyUrl']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-866c49c9302b", "source": "malcontent", "ruleId": "r.8d917b297212", "severity": "info", "confidence": 0.6, "path": "Panel.qml", "line": 0, "snippet": "['application/json', 'POST']", "message": "upload content via HTTP form [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-0c36d7214120", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "Panel.qml", "line": 0, "snippet": "['Content-Type', 'POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-526b926af725", "source": "malcontent", "ruleId": "r.4466daea12b8", "severity": "info", "confidence": 0.6, "path": "Panel.qml", "line": 0, "snippet": "['openUrl']", "message": "requests resources via URL [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-dd6cae699e37", "source": "malcontent", "ruleId": "r.8a7ad93c4718", "severity": "info", "confidence": 0.6, "path": "Panel.qml", "line": 0, "snippet": "['not a malicious user -- it is a']", "message": "References 'malicious' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-2aceb3996e4d", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "Panel.qml", "line": 96, "snippet": "xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-e62e3ebbdde3", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "Panel.qml", "line": 130, "snippet": "xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-fb1b58ee725e", "source": "opengrep", "ruleId": "r.3ddf8e79d32d", "severity": "info", "confidence": 0.9, "path": "Panel.qml", "line": 152, "snippet": "tokenStore.setText(Model.buildTokenConfig(token, expiresAt))", "message": "Writes files from QML (FileView.setText / JsonAdapter writeAdapter).", "category": "filesystem", "hardFail": false }, { "id": "F-1f74a0e338bd", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "Panel.qml", "line": 276, "snippet": "xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-16f66ec8f83e", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "Panel.qml", "line": 345, "snippet": "xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-6cf73f3f9cf7", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "Panel.qml", "line": 736, "snippet": "xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-3ff72e64efd0", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "Panel.qml", "line": 873, "snippet": "xhr.setRequestHeader(\"X-LetsFG-Client\", \"omarchy-plugin-letsfg/1.0.0\")", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-8bb7b4a04fa8", "source": "ai", "ruleId": "r.8a8b5d3460eb", "severity": "info", "confidence": 0.6, "path": "Panel.qml", "line": 1025, "snippet": "An anonymous install id, generated once and kept beside the token.", "message": "Generates a random anonymous install ID and sends it to the server as an analytics header (X-LetsFG-Install). It is disclosed in the code comments.", "category": "network", "hardFail": false }, { "id": "F-bf29f8791c7c", "source": "opengrep", "ruleId": "r.3ddf8e79d32d", "severity": "info", "confidence": 0.9, "path": "Panel.qml", "line": 1046, "snippet": "try { installStore.setText(JSON.stringify({ install_id: id })) } catch (e) { /* analytics only */ }", "message": "Writes files from QML (FileView.setText / JsonAdapter writeAdapter).", "category": "filesystem", "hardFail": false }, { "id": "F-a9d84b871079", "source": "opengrep", "ruleId": "r.3ddf8e79d32d", "severity": "info", "confidence": 0.9, "path": "Panel.qml", "line": 1053, "snippet": "try { installStore.setText(JSON.stringify({ install_id: root.installId })) } catch (e) { /* analytics only */ }", "message": "Writes files from QML (FileView.setText / JsonAdapter writeAdapter).", "category": "filesystem", "hardFail": false }, { "id": "F-4f6fd296140f", "source": "ai", "ruleId": "r.3ced4e1cd7e6", "severity": "low", "confidence": 0.6, "path": "Panel.qml", "line": 1071, "snippet": "path: Quickshell.env(\"HOME\") + \"/.letsfg/config.json\"", "message": "Reads the CLI's token file ~/.letsfg/config.json and sends the bearer token to letsfg.co. This is the plugin's stated purpose, and the file is read-only to the plugin.", "category": "secret", "hardFail": false }, { "id": "F-3bb1cde4ceae", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "Panel.qml", "line": 1277, "snippet": "// tools/validate.sh fails the build if `new XMLHttpRequest()` appears", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-bebf5503c2b8", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "Panel.qml", "line": 1284, "snippet": "var xhr = new XMLHttpRequest()", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-de7124e4e1e7", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "Panel.qml", "line": 2643, "snippet": "onClicked: root.openOffer(\"https://letsfg.co/en/loved-by\")", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-845cbe4c4501", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "README.md", "line": 11, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-f79ca778fd06", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 43, "snippet": "[\"pip](https://pypi.org/project/letsfg/)", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-7679dd2f4a9c", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "README.md", "line": 55, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-13d8080cccc7", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 289, "snippet": "| **Setup** | `pip install letsfg && letsfg auth` | Payment method on file — see below | [letsfg.co/developers](https://letsfg.co/developers) |", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-8cf1b028a120", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 292, "snippet": "- **CLI / SDK (Path 1):** `pip install letsfg` and run `letsfg auth` once — it puts a payment method on file via a zero-amount Stripe setup (no charge, no authorization hold) and gives you a 90-day Bearer token. After that, `letsfg search` calls our server-side engine and applies the open-source ranking algorithm locally. Search is free and unlimited.", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-80a199cb29d2", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "README.md", "line": 403, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-dbf389357e0b", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 406, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-252be324da85", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 426, "snippet": "curl -X POST https://letsfg.co/api/agent-access/request", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-2dc80e202949", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 432, "snippet": "curl -X POST https://letsfg.co/api/agent-access/verify \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-3d487d044c0d", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 437, "snippet": "curl -X POST https://letsfg.co/api/search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-5cce801c9287", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 451, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/register \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-885777f4fce4", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "README.md", "line": 451, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/register \\ -H \"Content-Type: application/json\" \\ -d '{\"agent", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-38980c17f157", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 455, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-8b0469256876", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "README.md", "line": 560, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-2b2732c03a46", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 573, "snippet": "omarchy plugin add https://github.com/LetsFG/LetsFG.git --enable", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-a29625b02460", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 584, "snippet": "omarchy plugin remove io.github.letsfg.flights", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-cf053d156954", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 606, "snippet": "| **Python SDK + CLI** | `pip install letsfg` | SDK + CLI (run `letsfg auth` once for free search) |", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-52b5c4c884ad", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 608, "snippet": "| **JS/TS SDK** | `npm install -g letsfg` | SDK + CLI + open-source ranking engine |", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-e613f47ce820", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "README.md", "line": 612, "snippet": "| **Omarchy plugin** | `omarchy plugin add https://github.com/LetsFG/LetsFG.git --enable` | Flight search in the Omarchy bar ([details](OMARCHY-PLUGIN.md)) |", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-cb98ba84f4db", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "README.md", "line": 781, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-17ff2e77c4f4", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "SKILL.md", "line": 15, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-8e81b4588ceb", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "SKILL.md", "line": 244, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-279fbbff2a59", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "SKILL.md", "line": 323, "snippet": "npm install -g letsfg-mcp", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-e55c885b3041", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "agent-skills-contribution/packages/skills-catalog/skills/(tooling)/letsfg/SKILL.md", "line": 68, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-27791ec126a1", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "agent-skills-contribution/packages/skills-catalog/skills/(tooling)/letsfg/references/mcp-setup.md", "line": 8, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-68b221eb33fe", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "agent-skills-contribution/packages/skills-catalog/skills/(tooling)/letsfg/references/mcp-setup.md", "line": 19, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/register \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-4bb1b537cc2b", "source": "malcontent", "ruleId": "r.5994c88c8e53", "severity": "info", "confidence": 0.6, "path": "assets/demo.gif", "line": 0, "snippet": "['cp B']", "message": "copy files using cp [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-fcb0a20d2b9e", "source": "malcontent", "ruleId": "r.5144ef25665d", "severity": "info", "confidence": 0.6, "path": "assets/demo.gif", "line": 0, "snippet": "['SSH']", "message": "Supports SSH (secure shell) [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-b8998790acf5", "source": "malcontent", "ruleId": "r.fb014819c620", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 0, "snippet": "['(stopover to explore / break the trip)', '(offerPrice - cheapestPrice)', '(googleFlightsPrice * 100)', '(avoid very early/late)', '$complex_math_add', '$complex_math_div', '$complex_math_mul', '$com", "message": "complex math with parseInt or fromCharCode conversions [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-56309192afc3", "source": "malcontent", "ruleId": "r.dbe1faed974e", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 0, "snippet": "['+ parseInt(']", "message": "performs math directly against parsed integers [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-552593a1a233", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 13, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-b4c0679f1759", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 15, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-5b84edd34e32", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 22, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-8fc45664aeed", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 52, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-abc4d9c969b5", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 144, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-c16420c74b97", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 149, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-a1dcad1b4395", "source": "eslint", "ruleId": "r.440b465c2d7c", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 276, "snippet": "", "message": "Unsafe Regular Expression", "category": "exec", "hardFail": false }, { "id": "F-bc97c55a837f", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 811, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-3e70a001d66e", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 814, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-3eaf73360594", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 1000, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-82e2ff61c252", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 1145, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-481ccfe06687", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 1162, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-81047326c2ca", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 1164, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-34d2b1330107", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 1347, "snippet": "", "message": "Variable Assigned to Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-7d6b789c2d9f", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 1874, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-ac9d9a064198", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 2042, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-ce84d50dfdd1", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 2045, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-0ebc01e28a35", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 2046, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-650ef98c8c66", "source": "eslint", "ruleId": "r.21d921614df3", "severity": "info", "confidence": 0.6, "path": "assets/ranking.js", "line": 2047, "snippet": "", "message": "Generic Object Injection Sink", "category": "exec", "hardFail": false }, { "id": "F-dfbc363724eb", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "context7.json", "line": 2, "snippet": "\"$schema\": \"https://context7.com/schema/context7.json\",", "message": "URL literal: https://context7.com", "category": "network", "hardFail": false }, { "id": "F-bfeef605794d", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/agent-guide.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-7a96fad015a0", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/agent-guide.md", "line": 152, "snippet": "curl -X POST https://letsfg.co/api/agent-access/request", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-83ee0e731ac3", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/agent-guide.md", "line": 157, "snippet": "curl -X POST https://letsfg.co/api/agent-access/verify \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-9e913e95e979", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/agent-guide.md", "line": 163, "snippet": "curl -X POST https://letsfg.co/api/agent-access/verify \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-8743f8af18e9", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/agent-guide.md", "line": 169, "snippet": "curl -X POST https://letsfg.co/api/search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-d1278d1c57b3", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/agent-guide.md", "line": 176, "snippet": "curl https://letsfg.co/api/results/ws_abc123 \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-530178168724", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/agent-guide.md", "line": 188, "snippet": "curl -X POST https://letsfg.co/api/agent-book \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-ad67070b54b6", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/api-errors.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-2465451fd86d", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-errors.md", "line": 46, "snippet": "curl https://letsfg.co/developers/api/v1/agents/me \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-e1e24552fd6f", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-errors.md", "line": 46, "snippet": "curl https://letsfg.co/developers/api/v1/agents/me \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-3c1cdb98a60b", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/api-guide.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-b0747c7129bb", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-guide.md", "line": 122, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/register \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-c7875da9b52f", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-guide.md", "line": 122, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/register \\ -H \"Content-Type: application/json\" \\ -d '{\"a", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-17a6c4c4d175", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-guide.md", "line": 126, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-ef045ec60ade", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/api-onboarding.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-8abdd59f3772", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-onboarding.md", "line": 23, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/register \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-1f9546d4adb0", "source": "gitleaks", "ruleId": "r.43cd6c2d96bb", "severity": "info", "confidence": 0.7, "path": "docs/api-onboarding.md", "line": 33, "snippet": "api_key\": \"RED…REDACTED\"", "message": "Possible hard-coded secret (Detected a Generic API Key, potentially exposing access to various services and sensitive operations.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-227369cc7dd0", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-onboarding.md", "line": 45, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-0af0c6ef5062", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-onboarding.md", "line": 45, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-0c6b15f3e41f", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-onboarding.md", "line": 54, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-afd2d39ebf68", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-onboarding.md", "line": 54, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-818e3f476f08", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-onboarding.md", "line": 65, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/top-up \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-332e313edf65", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-onboarding.md", "line": 65, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/top-up \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-12c66a44ec38", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-onboarding.md", "line": 74, "snippet": "curl https://letsfg.co/developers/api/v1/agents/me \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-e15cf9eee111", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-onboarding.md", "line": 74, "snippet": "curl https://letsfg.co/developers/api/v1/agents/me \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-b86b06403427", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-onboarding.md", "line": 92, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/hosted-checkout \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-8bf836bb479d", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-onboarding.md", "line": 100, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/hosted-checkout/complete \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-bde5032b54cb", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-onboarding.md", "line": 112, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/billing-portal \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-72e4b69ca387", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-onboarding.md", "line": 112, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/billing-portal \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-df5fa183f82a", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-onboarding.md", "line": 121, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/billing-settings \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-a71d1ac93388", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-onboarding.md", "line": 121, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/billing-settings \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-f3641f175823", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-onboarding.md", "line": 130, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/rotate-key \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-be62626bb4b5", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-onboarding.md", "line": 130, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/rotate-key \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-cd80c4cff636", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/api-polling.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-847ee369dd19", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-polling.md", "line": 31, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/search/async \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-e1191d8462e5", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-polling.md", "line": 31, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/search/async \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-fe6b24e08efe", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-polling.md", "line": 61, "snippet": "curl https://letsfg.co/developers/api/v1/flights/results/async_a1b2c3d4e5f6 \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-8773cdc825c9", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-polling.md", "line": 61, "snippet": "curl https://letsfg.co/developers/api/v1/flights/results/async_a1b2c3d4e5f6 \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-92b9d3d1b37f", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/api-sandbox.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-63cf1cb7d473", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-sandbox.md", "line": 53, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/sandbox/flights/search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-717965ebc5bf", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-sandbox.md", "line": 53, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/sandbox/flights/search \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-736d9e7ec2dc", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-sandbox.md", "line": 104, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/sandbox/flights/multi-search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-ec4b4c43d52b", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-sandbox.md", "line": 104, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/sandbox/flights/multi-search \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-154d464152be", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-sandbox.md", "line": 132, "snippet": "curl https://letsfg.co/developers/api/v1/agents/me \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-b27f6612fae0", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-sandbox.md", "line": 132, "snippet": "curl https://letsfg.co/developers/api/v1/agents/me \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-70da39f2bb11", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/api-search.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-d7d25ceb972f", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-search.md", "line": 42, "snippet": "curl https://letsfg.co/developers/api/v1/flights/locations/London \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-0582d853e753", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-search.md", "line": 42, "snippet": "curl https://letsfg.co/developers/api/v1/flights/locations/London \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-948ba0fe4b33", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-search.md", "line": 74, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-6a104cc41fc8", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-search.md", "line": 74, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/search \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-971ad07f8db8", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-search.md", "line": 231, "snippet": "curl https://letsfg.co/developers/api/v1/flights/providers \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-2d3f8b0e1116", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-search.md", "line": 231, "snippet": "curl https://letsfg.co/developers/api/v1/flights/providers \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-be87c7306bee", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-search.md", "line": 273, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/parse-query \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-69d0bc94ac28", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-search.md", "line": 273, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/parse-query \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-9eb708649a98", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/api-search.md", "line": 293, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/discover \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-8cb4faec02c1", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/api-search.md", "line": 293, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/discover \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-3ac239a5edd7", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/architecture-guide.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-81efffa01beb", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/cli-reference.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-0710a301704c", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/cli-reference.md", "line": 21, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-1279b7900e86", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/cli-reference.md", "line": 27, "snippet": "npm install -g letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-d53bf93cfe26", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/getting-started.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-cfce7d2ae4b1", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/getting-started.md", "line": 22, "snippet": "| CLI / SDK (Bearer token) | Agents, developers, zero-cost search | `pip install letsfg` then `letsfg auth` | Free | `POST /api/agent-book` |", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-203a27f079c6", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/getting-started.md", "line": 37, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-521b3854d750", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/getting-started.md", "line": 75, "snippet": "curl -X POST https://letsfg.co/api/developers/checkout \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-55e771ef6ff0", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/getting-started.md", "line": 89, "snippet": "curl \"https://letsfg.co/api/developers/payment-verify?token=\"", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-1968e6573b54", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/getting-started.md", "line": 104, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/register \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-fcf954625293", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/getting-started.md", "line": 116, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-20c75a004b08", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/getting-started.md", "line": 116, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/setup-payment \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-36ff2a9cd133", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/getting-started.md", "line": 127, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/top-up \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-1a5eba698eb4", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/getting-started.md", "line": 127, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/top-up \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-e28c092acc9d", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/getting-started.md", "line": 138, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-d83ee621582e", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/getting-started.md", "line": 138, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/flights/search \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-3eae6a835771", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/getting-started.md", "line": 147, "snippet": "curl https://letsfg.co/developers/api/v1/agents/me \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-fec97898e7aa", "source": "gitleaks", "ruleId": "r.869a596fd8dd", "severity": "info", "confidence": 0.85, "path": "docs/getting-started.md", "line": 147, "snippet": "curl https://letsfg.co/developers/api/v1/agents/me \\ -H \"X-API-Key: RED…REDACTED\"", "message": "Possible hard-coded secret (Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-12abbd9450c6", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/hotels.md", "line": 56, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/hotels/destinations -H \"X-API-Key: $LETSFG_API_KEY\" -H 'Content-Type: application/json' -d '{\"text\": \"Warsaw\"}'", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-4340a4faabba", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/hotels.md", "line": 59, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/hotels/search -H \"X-API-Key: $LETSFG_API_KEY\" -H 'Content-Type: application/json' -d '{\"city_id\": 148614, \"city_name\": \"Warsaw, Poland\",", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-7afcbf3ac8ea", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/index.md", "line": 6, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-bfb98421aa27", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/index.md", "line": 22, "snippet": "
$ pip install letsfg
", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-c217f7d3a805", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/openapi.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-becf812bc37e", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/openapi.md", "line": 53, "snippet": "curl https://letsfg.co/developers/api/openapi.json | jq '.info, .servers'", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-f5d508d88d63", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/openapi.md", "line": 59, "snippet": "curl https://letsfg.co/developers/api/openapi.json | jq '.paths | keys'", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-c850d4c1606d", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/packages.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-c8915129827c", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/packages.md", "line": 22, "snippet": "| **Python SDK + CLI** | `pip install letsfg` | SDK + CLI, server-side search via letsfg.co | Free Bearer token (`letsfg auth`) or Developer API key |", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-62946118c018", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/packages.md", "line": 23, "snippet": "| **JS/TS SDK + CLI** | `npm install -g letsfg` | SDK + `letsfg` CLI command | Free Bearer token or Developer API key |", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-58bda730f345", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/packages.md", "line": 33, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-476dbc4fabdb", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/packages.md", "line": 58, "snippet": "npm install -g letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-9ebd8129be87", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/quickstart-claude.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-32fb66ecc493", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/quickstart-claude.md", "line": 31, "snippet": "curl -s -X POST https://letsfg.co/developers/api/v1/agents/register \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-fe9e196e2ae3", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/quickstart-claude.md", "line": 86, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-740221045797", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/quickstart-claude.md", "line": 138, "snippet": "**\"Cannot start Python\"** -> install the prerequisites first: `pip install letsfg` and `letsfg auth`", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-a7fa52ccdae7", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/quickstart-cursor.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-0676c1be0f1e", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/quickstart-cursor.md", "line": 29, "snippet": "curl -s -X POST https://letsfg.co/developers/api/v1/agents/register \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-664467c214b8", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/quickstart-cursor.md", "line": 77, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-63587b64142e", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/quickstart-cursor.md", "line": 136, "snippet": "**\"Cannot start Python\"** -> install the prerequisites first: `pip install letsfg` and `letsfg auth`", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-39073f132e25", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/quickstart-windsurf.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-5d5d2120def9", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/quickstart-windsurf.md", "line": 29, "snippet": "curl -s -X POST https://letsfg.co/developers/api/v1/agents/register \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-afe4d69ccb3a", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/quickstart-windsurf.md", "line": 77, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-6c7bb81e9144", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/quickstart-windsurf.md", "line": 131, "snippet": "**\"Cannot start Python\"** -> install the prerequisites first: `pip install letsfg` and `letsfg auth`", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-995b50b9f739", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "docs/self-hosting.md", "line": 15, "snippet": "pip install fastapi uvicorn httpx", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-b10681651de5", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "docs/self-hosting.md", "line": 68, "snippet": "curl -X POST http://localhost:8000/search \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-cceaf6e1e661", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "docs/tutorials.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-e3ca7624bf6d", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "glama.json", "line": 2, "snippet": "\"$schema\": \"https://glama.ai/mcp/schemas/server.json\",", "message": "URL literal: https://glama.ai", "category": "network", "hardFail": false }, { "id": "F-37cac1617868", "source": "malcontent", "ruleId": "r.ab20f9a3cb41", "severity": "info", "confidence": 0.6, "path": "lighthouserc.js", "line": 0, "snippet": "['startServerCommand:']", "message": "executes a command [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-c06edb69186b", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "lighthouserc.js", "line": 6, "snippet": "'http://localhost:3000/en/flights/gdn-bcn/',", "message": "URL literal: http://localhost", "category": "network", "hardFail": false }, { "id": "F-c315c37e635a", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "mkdocs.yml", "line": 2, "snippet": "site_url: https://letsfg.co/developers/docs", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-79169d733f5c", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "mkdocs.yml", "line": 6, "snippet": "repo_url: https://github.com/LetsFG/LetsFG", "message": "URL literal: https://github.com", "category": "network", "hardFail": false }, { "id": "F-e4d73b1dedc5", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "models/flights.py", "line": 0, "snippet": "['agents']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-6213a2a19e5e", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "openapi.yaml", "line": 24, "snippet": "curl -X POST https://letsfg.co/api/agent-access/request", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-cad11f864e6d", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "openapi.yaml", "line": 24, "snippet": "curl -X POST https://letsfg.co/api/agent-access/request", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-38e0f24cdd7c", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "openapi.yaml", "line": 26, "snippet": "curl -X POST https://letsfg.co/api/agent-access/verify -d '{\"setup_session_id\":\"cs_...\"}'", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-6586cc326adf", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "low", "confidence": 0.9, "path": "openapi.yaml", "line": 32, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-9ea6bcd3e972", "source": "malcontent", "ruleId": "r.aa1ee1048d6a", "severity": "info", "confidence": 0.6, "path": "preview/run.py", "line": 0, "snippet": "['os.chmod(']", "message": "Detects writing executable files or changing file permissions to executable [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-001f6196a6d2", "source": "malcontent", "ruleId": "r.8a2d19128690", "severity": "info", "confidence": 0.6, "path": "preview/run.py", "line": 0, "snippet": "['/home/.letsfg']", "message": "possible hidden file path [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-496b8265f5da", "source": "malcontent", "ruleId": "r.d5d304b1ed90", "severity": "info", "confidence": 0.6, "path": "preview/run.py", "line": 0, "snippet": "['/Users/...']", "message": "references path within /Users [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-a7b7530d300a", "source": "malcontent", "ruleId": "r.bd0dc86cbeb5", "severity": "info", "confidence": 0.6, "path": "preview/run.py", "line": 0, "snippet": "['chmod']", "message": "modifies file permissions [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-cf20bc292f06", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "sdk/js/README.md", "line": 15, "snippet": "| **Setup** | `npm install letsfg` then `letsfg auth` | [letsfg.co/developers](https://letsfg.co/developers) |", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-a45563656aea", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "sdk/js/README.md", "line": 22, "snippet": "npm install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-d422f083867d", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "sdk/js/README.md", "line": 109, "snippet": "- **Python SDK + CLI**: `pip install letsfg` — [PyPI](https://pypi.org/project/letsfg/)", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-f8227de7ebb8", "source": "malcontent", "ruleId": "r.23a5406365c9", "severity": "info", "confidence": 0.6, "path": "sdk/js/package-lock.json", "line": 0, "snippet": "['https://', 'darwin', 'linux']", "message": "references multiple operating systems [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-f9279ddacfdd", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/js/package.json", "line": 0, "snippet": "['agents']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-c32ffe17778f", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/js/package.json", "line": 44, "snippet": "\"url\": \"https://github.com/LetsFG/LetsFG.git\"", "message": "URL literal: https://github.com", "category": "network", "hardFail": false }, { "id": "F-5ca62be49ed1", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/js/package.json", "line": 46, "snippet": "\"homepage\": \"https://letsfg.co\",", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-b7e69b4a228e", "source": "malcontent", "ruleId": "r.e764edde6b0e", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/auth.test.ts", "line": 0, "snippet": "['./auth']", "message": "references and possibly executes relative path [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-ff77964d1072", "source": "guarddog", "ruleId": "r.4c1fa8e9227d", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/auth.test.ts", "line": 18, "snippet": "HOME: process.env.HOME, LETSFG_BEARER_TOKEN: process.env.LETSFG_BEARER_TOKEN, }; process.env.APPDATA = scratchDir;", "message": "guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)", "category": "supply-chain", "hardFail": false }, { "id": "F-555e002994b0", "source": "guarddog", "ruleId": "r.4c1fa8e9227d", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/auth.test.ts", "line": 22, "snippet": "process.env.HOME = scratchDir; delete process.env.LETSFG_BEARER_TOKEN; });", "message": "guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)", "category": "supply-chain", "hardFail": false }, { "id": "F-880eabfda2fa", "source": "guarddog", "ruleId": "r.4c1fa8e9227d", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/auth.test.ts", "line": 40, "snippet": "it('returns LETSFG_BEARER_TOKEN env var immediately, without touching the config file', async () => { process.env.LETSFG_BEARER_TOKEN = 'env-token-123'; const { getBearerToken } = await import('./auth.js'); assert.equal(getBearerToken...", "message": "guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)", "category": "supply-chain", "hardFail": false }, { "id": "F-61b95fe4dde6", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/auth.ts", "line": 0, "snippet": "['agents']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-d6285e3a928d", "source": "malcontent", "ruleId": "r.8d917b297212", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/auth.ts", "line": 0, "snippet": "['application/json', 'POST']", "message": "upload content via HTTP form [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-2acebe3582a3", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/auth.ts", "line": 0, "snippet": "['Content-Type', 'HTTP', 'POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-3858790fdecb", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/js/src/auth.ts", "line": 21, "snippet": "const BASE_URL = process.env.LETSFG_BASE_URL || 'https://letsfg.co';", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-1662afa63da0", "source": "guarddog", "ruleId": "r.5c819494668e", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/auth.ts", "line": 82, "snippet": "...ing, payload: Record): Promise<{ status: number; data: Record }> { const resp = await fetch(`${BASE_URL}${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'User-Agent': 'LetsFG-js/0....", "message": "guarddog capability-network-download: Detects downloading files from network", "category": "supply-chain", "hardFail": false }, { "id": "F-33116ca19ca9", "source": "guarddog", "ruleId": "r.1f10de1c8364", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/auth.ts", "line": 82, "snippet": "...ing, payload: Record): Promise<{ status: number; data: Record }> { const resp = await fetch(`${BASE_URL}${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'User-Agent': 'LetsFG-js/0....", "message": "guarddog capability-network-outbound: Detects network request capabilities (HTTP, sockets, etc.)", "category": "supply-chain", "hardFail": false }, { "id": "F-34c22b5f6f5c", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/js/src/auth.ts", "line": 82, "snippet": "const resp = await fetch(`${BASE_URL}${path}`, {", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-aa299273383a", "source": "guarddog", "ruleId": "r.63048118ddaf", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/auth.ts", "line": 136, "snippet": "const cmd = platform() === 'win32' ? `start \"\" \"${url}\"` : platform() === 'darwin' ? `open \"${url}\"` : `xdg-open \"${url}\"`; exec(cmd, () => { /* best effort, ignore failures */ }); }).catch(() => { /* best effort */ }); }", "message": "guarddog capability-process-spawn: Detects process execution and spawning", "category": "supply-chain", "hardFail": false }, { "id": "F-81112e8cb5a9", "source": "malcontent", "ruleId": "r.fb014819c620", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/cli.ts", "line": 0, "snippet": "['$complex_math_add', '$complex_math_mul', '$complex_math_sub', '(zero-dependency)', '$f_parseInt', '(i + 1)', '1990-04', '2026-03', '2026-07', '[i + 1]', '$math1', '$math2', '90-day', '03-03', '04-01", "message": "complex math with parseInt or fromCharCode conversions [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-2ac1ee51c823", "source": "malcontent", "ruleId": "r.e764edde6b0e", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/cli.ts", "line": 0, "snippet": "['./index', './auth']", "message": "references and possibly executes relative path [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-a9cd03a05423", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/cli.ts", "line": 0, "snippet": "['agent_name', 'agent_id', 'agents']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-fa7b8109e101", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/js/src/cli.ts", "line": 407, "snippet": "--base-url API URL (default: https://letsfg.co)", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-20d6fdee8c62", "source": "malcontent", "ruleId": "r.e764edde6b0e", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/index.test.ts", "line": 0, "snippet": "['./index']", "message": "references and possibly executes relative path [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-7ae8e9d853aa", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/index.test.ts", "line": 0, "snippet": "['agent_id']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-5aca17129d3a", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/js/src/index.test.ts", "line": 49, "snippet": "// sets User-Agent: LetsFG-js/0.1.0. register() builds its own bare fetch()", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-7e2acc54675e", "source": "malcontent", "ruleId": "r.e764edde6b0e", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/index.ts", "line": 0, "snippet": "['./offer-details', './trip-purpose', './ranking']", "message": "references and possibly executes relative path [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-510510a57330", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/index.ts", "line": 0, "snippet": "['agent_name', 'agentName', 'agents']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-7d241e4e9893", "source": "malcontent", "ruleId": "r.8d917b297212", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/index.ts", "line": 0, "snippet": "['application/json', 'POST', 'post']", "message": "upload content via HTTP form [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-4f015bf04564", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/index.ts", "line": 0, "snippet": "['Content-Type', 'POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-a209045f23b8", "source": "malcontent", "ruleId": "r.e781ba3939e1", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/index.ts", "line": 0, "snippet": "['return !!']", "message": "gets very excited [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-459e3e20f7cf", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/js/src/index.ts", "line": 5, "snippet": "* or prepaid Developer API. Zero external JS dependencies. Uses native fetch (Node 18+).", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-920d49da1f49", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/js/src/index.ts", "line": 313, "snippet": "const DEFAULT_BASE_URL = 'https://letsfg.co';", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-85c6a758dd2f", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/js/src/index.ts", "line": 760, "snippet": "const resp = await fetch(`${url}/developers/api/v1/agents/register`, {", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-57e2cb2cee6f", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/js/src/index.ts", "line": 823, "snippet": "const resp = await fetch(`${this.baseUrl}${path}`, {", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-ee61832a9c22", "source": "malcontent", "ruleId": "r.fb014819c620", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/ranking.ts", "line": 0, "snippet": "['(stopover to explore / break the trip)', '(for runner-up explanations)', '(offerPrice - cheapestPrice)', '(ticket + fee + ancillaries)', '(avoid very early/late)', '$complex_math_add', '$complex_mat", "message": "complex math with parseInt or fromCharCode conversions [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-584c6b468ca4", "source": "malcontent", "ruleId": "r.dbe1faed974e", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/ranking.ts", "line": 0, "snippet": "['+ parseInt(']", "message": "performs math directly against parsed integers [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-dd7ef634148c", "source": "malcontent", "ruleId": "r.e764edde6b0e", "severity": "info", "confidence": 0.6, "path": "sdk/js/src/ranking.ts", "line": 0, "snippet": "['./offer-details', './trip-purpose']", "message": "references and possibly executes relative path [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-9c9098e48a78", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/README.md", "line": 41, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-ba9987d63495", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/README.md", "line": 257, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-fa14ca4a3f13", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/README.md", "line": 264, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/register \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-c18e4579aa9b", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/README.md", "line": 393, "snippet": "- **JavaScript/TypeScript SDK + CLI**: `npm install letsfg` — [npm](https://www.npmjs.com/package/letsfg)", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-2d650b82778a", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/README.md", "line": 394, "snippet": "- **Python SDK + CLI**: `pip install letsfg` — [PyPI](https://pypi.org/project/letsfg/)", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-7e5fce18256b", "source": "malcontent", "ruleId": "r.23a5406365c9", "severity": "info", "confidence": 0.6, "path": "sdk/mcp/package-lock.json", "line": 0, "snippet": "['https://', 'darwin', 'linux']", "message": "references multiple operating systems [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-e56fbbdb5603", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/mcp/package.json", "line": 0, "snippet": "['agent']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-1f7cbee848c0", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/mcp/package.json", "line": 38, "snippet": "\"url\": \"https://github.com/LetsFG/LetsFG.git\"", "message": "URL literal: https://github.com", "category": "network", "hardFail": false }, { "id": "F-88ee263a60dc", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/mcp/src/index.test.ts", "line": 0, "snippet": "['agent']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-86e36735fb7f", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "sdk/mcp/src/index.test.ts", "line": 0, "snippet": "['POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-cb2cc96ee3b2", "source": "opengrep", "ruleId": "r.a14bd956ca70", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/src/index.test.ts", "line": 7, "snippet": "import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process';", "message": "JavaScript spawns processes (child_process).", "category": "exec", "hardFail": false }, { "id": "F-6a9d6a2c45a3", "source": "guarddog", "ruleId": "r.5c819494668e", "severity": "info", "confidence": 0.6, "path": "sdk/mcp/src/index.test.ts", "line": 85, "snippet": "// headers, and they are the two that carry a real search. it('every fetch() sends headers built by letsfgHeaders()', () => { const fetches = [...code.matchAll(/fetch\\(([\\s\\S]*?)\\n\\s*\\}\\);/g)]....", "message": "guarddog capability-network-download: Detects downloading files from network", "category": "supply-chain", "hardFail": false }, { "id": "F-62b5b12f1caf", "source": "guarddog", "ruleId": "r.1f10de1c8364", "severity": "info", "confidence": 0.6, "path": "sdk/mcp/src/index.test.ts", "line": 85, "snippet": "// headers, and they are the two that carry a real search. it('every fetch() sends headers built by letsfgHeaders()', () => { const fetches = [...code.matchAll(/fetch\\(([\\s\\S]*?)\\n\\s*\\}\\);/g)]....", "message": "guarddog capability-network-outbound: Detects network request capabilities (HTTP, sockets, etc.)", "category": "supply-chain", "hardFail": false }, { "id": "F-80ec3cecb775", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/src/index.test.ts", "line": 85, "snippet": "it('every fetch() sends headers built by letsfgHeaders()', () => {", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-a532c6fdfb02", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/src/index.test.ts", "line": 90, "snippet": "`a fetch() builds its own headers instead of calling letsfgHeaders():\\n${call.slice(0, 200)}`);", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-28c306f49f9f", "source": "guarddog", "ruleId": "r.63048118ddaf", "severity": "info", "confidence": 0.6, "path": "sdk/mcp/src/index.test.ts", "line": 108, "snippet": "// break any allowlist keyed on the `letsfg-mcp/` substring. const ua = /const USER_AGENT = `([^`]+)`/.exec(code)?.[1]; assert.ok(ua, 'USER_AGENT must be defined in one place'); assert.match(ua!, /^Mozilla\\/5\\.0 \\(compatibl...", "message": "guarddog capability-process-spawn: Detects process execution and spawning", "category": "supply-chain", "hardFail": false }, { "id": "F-b14cb8f9ddff", "source": "malcontent", "ruleId": "r.49d5f573ce86", "severity": "info", "confidence": 0.6, "path": "sdk/mcp/src/index.ts", "line": 0, "snippet": "['DOCTYPE html']", "message": "Contains HTML content [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-1b2485f862cd", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/mcp/src/index.ts", "line": 0, "snippet": "['agent_profile', 'get_agent', 'agents']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-6278afb37422", "source": "malcontent", "ruleId": "r.8d917b297212", "severity": "info", "confidence": 0.6, "path": "sdk/mcp/src/index.ts", "line": 0, "snippet": "['application/json', 'POST']", "message": "upload content via HTTP form [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-534a5b108af8", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "sdk/mcp/src/index.ts", "line": 0, "snippet": "['Content-Type', 'HTTP', 'POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-61ac33f817c8", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/mcp/src/index.ts", "line": 28, "snippet": "const BASE_URL = (process.env.LETSFG_BASE_URL || 'https://letsfg.co').replace(/\\/$/, '');", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-16ddd92e0e0d", "source": "guarddog", "ruleId": "r.4c1fa8e9227d", "severity": "low", "confidence": 0.6, "path": "sdk/mcp/src/index.ts", "line": 29, "snippet": "const BASE_URL = (process.env.LETSFG_BASE_URL || 'https://letsfg.co').replace(/\\/$/, ''); const BEARER_TOKEN = process.env.LETSFG_BEARER_TOKEN || ''; const API_KEY = process.env.LETSFG_API_KEY || ''; const VERSION = '1.3.1';", "message": "guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)", "category": "supply-chain", "hardFail": false }, { "id": "F-b03f8fcce13e", "source": "guarddog", "ruleId": "r.4c1fa8e9227d", "severity": "low", "confidence": 0.6, "path": "sdk/mcp/src/index.ts", "line": 30, "snippet": "const BEARER_TOKEN = process.env.LETSFG_BEARER_TOKEN || ''; const API_KEY = process.env.LETSFG_API_KEY || ''; const VERSION = '1.3.1';", "message": "guarddog threat-runtime-environment-read: Detects reading of environment variables (credential access, often contains secrets)", "category": "supply-chain", "hardFail": false }, { "id": "F-8fe919aff9f9", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/mcp/src/index.ts", "line": 46, "snippet": "const USER_AGENT = `Mozilla/5.0 (compatible; letsfg-mcp/${VERSION}; +https://github.com/LetsFG/LetsFG)`;", "message": "URL literal: https://github.com", "category": "network", "hardFail": false }, { "id": "F-15b442a65ebe", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/src/index.ts", "line": 151, "snippet": "const resp = await fetch(`${BASE_URL}/api/search`, {", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-b6d605e4bc50", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/src/index.ts", "line": 170, "snippet": "const pollResp = await fetch(`${BASE_URL}/api/results/${search_id}`, {", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-160e83a55e09", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/src/index.ts", "line": 215, "snippet": "const resp = await fetch(`${BASE_URL}${path}`, {", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-4a5642ee5738", "source": "ctxsentry", "ruleId": "r.7e92b014a22b", "severity": "low", "confidence": 0.8, "path": "sdk/mcp/src/index.ts", "line": 291, "snippet": "description: 'Complete workflow guide: authenticate -> search -> book, pricing, passenger rules, error handling, and search tips. Read this before using any tools.',", "message": "Hidden-priority marker of the kind used in MCP tool-poisoning payloads. [CG105/instruction-override]", "category": "injection", "hardFail": false }, { "id": "F-2901a310cca6", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/mcp/src/index.ts", "line": 825, "snippet": "const resp = await fetch(`${BASE_URL}/api/agent-access/request`, {", "message": "HTTP request from QML/JS (XMLHttpRequest / fetch).", "category": "network", "hardFail": false }, { "id": "F-0ed319fc5aa8", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "sdk/python/README.md", "line": 15, "snippet": "| **Setup** | `pip install letsfg && letsfg auth` | [letsfg.co/developers](https://letsfg.co/developers) |", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-9ff01e26b91e", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "sdk/python/README.md", "line": 22, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-51b84cff02fe", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "sdk/python/README.md", "line": 398, "snippet": "- **JS/TS SDK**: `npm install letsfg` — [npm](https://www.npmjs.com/package/letsfg)", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-c3e6c34ad481", "source": "malcontent", "ruleId": "r.2e10e45c9dd6", "severity": "info", "confidence": 0.6, "path": "sdk/python/examples/quickstart.py", "line": 0, "snippet": "['pip install letsfg']", "message": "Installs software using pip from python [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-f4e17ebe5533", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "sdk/python/examples/quickstart.py", "line": 8, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-7b394402ed43", "source": "malcontent", "ruleId": "r.1ede94bd4987", "severity": "info", "confidence": 0.6, "path": "sdk/python/google_checkout_live_sweep.py", "line": 0, "snippet": "['cookies']", "message": "may access cookies [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-bb894d2ba7fa", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_japan_longhaul.json", "line": 8, "snippet": "\"resolved_booking_url\": \"https://checknfly.co.uk/flights/passenger_details?sid=4c8278d3-6258-4c32-a675-53b00d648834%5Eab35cd12-4be1-4fab-b9a3-1d4d16b0c475\",", "message": "URL literal: https://checknfly.co.uk", "category": "network", "hardFail": false }, { "id": "F-223afcc575b8", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_japan_longhaul.json", "line": 50, "snippet": "\"resolved_booking_url\": \"https://bookingportal.china-airlines.com/eRetailPortal/Booking.svc/Booking/Search\",", "message": "URL literal: https://bookingportal.china-airlines.com", "category": "network", "hardFail": false }, { "id": "F-f3064451e95d", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_japan_longhaul.json", "line": 100, "snippet": "\"resolved_booking_url\": \"https://www.lastminute.com/msr/route/gfs?Adult=1&PointOfSaleCountry=FR&DisplayedPrice=744.79&DisplayedPriceCurrency=EUR&UserLanguage=fr&UserCurrency=EUR&TripType=RoundTrip&Sli", "message": "URL literal: https://www.lastminute.com", "category": "network", "hardFail": false }, { "id": "F-042adf30d0a6", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_japan_longhaul.json", "line": 134, "snippet": "\"resolved_booking_url\": \"https://oversea.csair.com/tk/eu/en/book/flights?ref=googleflights&p=100&m=1&t=FRA-HND-20260624-20260628&rc=GGSS01&utm_source=googleflights_eu&utm_medium=metasearch\",", "message": "URL literal: https://oversea.csair.com", "category": "network", "hardFail": false }, { "id": "F-5067b1b4c444", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_japan_longhaul.json", "line": 176, "snippet": "\"resolved_booking_url\": \"https://www.flighthub.com/checkout/gdeeplink?Adult=1&PointOfSaleCountry=PL&DisplayedPrice=1822.72&DisplayedPriceCurrency=USD&UserLanguage=en&TripType=RoundTrip&Slice1=1,2&Slic", "message": "URL literal: https://www.flighthub.com", "category": "network", "hardFail": false }, { "id": "F-81c37b85012c", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_longhaul_london_us.json", "line": 8, "snippet": "\"resolved_booking_url\": \"https://www.google.com/travel/flights/booking?tfs=CBwQAho_EgoyMDI2LTA2LTI0Ih8KA0xIUhIKMjAyNi0wNi0yNBoDTEFYKgJWUzIDMTQxagcIARIDTEhScgcIARIDTEFYGj4SCjIwMjYtMDYtMjgiHgoDTEFYEgoyM", "message": "URL literal: https://www.google.com", "category": "network", "hardFail": false }, { "id": "F-13b483e45193", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results.json", "line": 8, "snippet": "\"resolved_booking_url\": \"https://tickets.vueling.com/booking/selectFlight\",", "message": "URL literal: https://tickets.vueling.com", "category": "network", "hardFail": false }, { "id": "F-10af199081f2", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results.json", "line": 112, "snippet": "\"resolved_booking_url\": \"https://www.vietjetair.com/en/select-flight\",", "message": "URL literal: https://www.vietjetair.com", "category": "network", "hardFail": false }, { "id": "F-973709b3fb4b", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results.json", "line": 146, "snippet": "\"resolved_booking_url\": \"https://www.google.com/travel/flights/booking?tfs=CBwQAho_EgoyMDI2LTA2LTE4Ih8KA0xIUhIKMjAyNi0wNi0xOBoDSkZLKgJCQTIDMTc1agcIARIDTEhScgcIARIDSkZLGj8SCjIwMjYtMDYtMjIiHwoDSkZLEgoyM", "message": "URL literal: https://www.google.com", "category": "network", "hardFail": false }, { "id": "F-8434130c620a", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results.json", "line": 205, "snippet": "\"resolved_booking_url\": \"https://www.lionair.co.id/\",", "message": "URL literal: https://www.lionair.co.id", "category": "network", "hardFail": false }, { "id": "F-4fa5404280dc", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results.json", "line": 239, "snippet": "\"resolved_booking_url\": \"https://www.despegar.com.mx/shop/flights/results/generate?Adult=1&PointOfSaleCountry=MX&DisplayedPrice=2305&DisplayedPriceCurrency=MXN&UserLanguage=en&TripType=RoundTrip&Slice", "message": "URL literal: https://www.despegar.com.mx", "category": "network", "hardFail": false }, { "id": "F-ad4ac2783452", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results.json", "line": 281, "snippet": "\"resolved_booking_url\": \"https://www.martigo.pl/service/flight?Adult=1&Child=0&Infant=0&PointOfSaleCountry=IT&DisplayedPrice=357.51&DisplayedPriceCurrency=EUR&UserLanguage=pl&UserCurrency=PLN&TripType", "message": "URL literal: https://www.martigo.pl", "category": "network", "hardFail": false }, { "id": "F-e16c1d372e1a", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results_v2.json", "line": 8, "snippet": "\"resolved_booking_url\": \"https://tickets.vueling.com/booking/selectFlight\",", "message": "URL literal: https://tickets.vueling.com", "category": "network", "hardFail": false }, { "id": "F-656f14c5236f", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results_v2.json", "line": 112, "snippet": "\"resolved_booking_url\": \"https://www.vietjetair.com/en/select-flight\",", "message": "URL literal: https://www.vietjetair.com", "category": "network", "hardFail": false }, { "id": "F-b4674b0207cd", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results_v2.json", "line": 146, "snippet": "\"resolved_booking_url\": \"https://www.google.com/travel/flights/booking?tfs=CBwQAho_EgoyMDI2LTA2LTE4Ih8KA0xIUhIKMjAyNi0wNi0xOBoDSkZLKgJCQTIDMTc1agcIARIDTEhScgcIARIDSkZLGj8SCjIwMjYtMDYtMjIiHwoDSkZLEgoyM", "message": "URL literal: https://www.google.com", "category": "network", "hardFail": false }, { "id": "F-34c90c7c1dec", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results_v2.json", "line": 205, "snippet": "\"resolved_booking_url\": \"https://www.lionair.co.id/\",", "message": "URL literal: https://www.lionair.co.id", "category": "network", "hardFail": false }, { "id": "F-d21d93ca125d", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results_v2.json", "line": 239, "snippet": "\"resolved_booking_url\": \"https://www.despegar.com.mx/shop/flights/results/generate?Adult=1&PointOfSaleCountry=MX&DisplayedPrice=2305&DisplayedPriceCurrency=MXN&UserLanguage=en&TripType=RoundTrip&Slice", "message": "URL literal: https://www.despegar.com.mx", "category": "network", "hardFail": false }, { "id": "F-c9e108a0afc0", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results_v2.json", "line": 281, "snippet": "\"resolved_booking_url\": \"https://www.martigo.pl/service/flight?Adult=1&Child=0&Infant=0&PointOfSaleCountry=IT&DisplayedPrice=357.51&DisplayedPriceCurrency=EUR&UserLanguage=pl&UserCurrency=PLN&TripType", "message": "URL literal: https://www.martigo.pl", "category": "network", "hardFail": false }, { "id": "F-03702aad1616", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results_v2.json", "line": 323, "snippet": "\"resolved_booking_url\": \"https://www.mea.com.lb/english/plan-and-book/book-a-trip?AFT=v6EPPNv7FsdCuvALZaD8P4w&A=1&C=0&I=0&CC=E&F=BEY&T=CDG&D=2026-06-25&R=2026-06-29&RT=1&TS=2026-05-18+18:01:12&CUR=USD", "message": "URL literal: https://www.mea.com.lb", "category": "network", "hardFail": false }, { "id": "F-b233b59367f3", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results_v2.json", "line": 494, "snippet": "\"resolved_booking_url\": \"https://booking.flyscoot.com/book/flight/return/SIN/2026-06-24/BKK/BKK/2026-06-28/SIN?adult=1&child=0&infant=0&orgToken=VEUtiuQY/mW09sQ6I0betQ%3D%3D&utm_source=GoogleFlights&u", "message": "URL literal: https://booking.flyscoot.com", "category": "network", "hardFail": false }, { "id": "F-80fddcdcd00f", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/google_checkout_live_sweep_results_v2.json", "line": 528, "snippet": "\"resolved_booking_url\": \"https://www.delta.com/flight-search/search?cabin=BASIC-ECONOMY&paxCount=1&price=576.79&tripType=roundTrip&exitCountry=US¤cyCd=USD&fareBasis=TAWQA0BQ:UAVGA0BQ&vendorRedir", "message": "URL literal: https://www.delta.com", "category": "network", "hardFail": false }, { "id": "F-f45c38f4c950", "source": "malcontent", "ruleId": "r.a9a12e273465", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/cli.py", "line": 0, "snippet": "['from rich import print as rprint']", "message": "aliases core python library to an alternate name [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-0104d76438dc", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/cli.py", "line": 0, "snippet": "['agent_name', 'agent_id', 'agents']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-a062f2ff24c8", "source": "malcontent", "ruleId": "r.8d917b297212", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/cli.py", "line": 0, "snippet": "['application/json', 'POST']", "message": "upload content via HTTP form [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-dbb27915de52", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/cli.py", "line": 0, "snippet": "['Content-Type', 'HTTP', 'POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-8edce1ec5016", "source": "malcontent", "ruleId": "r.4466daea12b8", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/cli.py", "line": 0, "snippet": "['urllib.request']", "message": "requests resources via URL [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-d8b6a19a9367", "source": "bandit", "ruleId": "r.48aa54c4f265", "severity": "info", "confidence": 0.9, "path": "sdk/python/letsfg/cli.py", "line": 137, "snippet": "136 return result 137 except Exception: 138 pass 139 return []", "message": "try_except_pass: Try, Except, Pass detected.", "category": "other", "hardFail": false }, { "id": "F-23ad1af5b21b", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/letsfg/cli.py", "line": 498, "snippet": "print(f\" Poll after payment: GET https://letsfg.co/api/developers/payment-verify?token={pt}\")", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-2d4390c018ac", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "sdk/python/letsfg/cli.py", "line": 799, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-ca51ec2b6d55", "source": "guarddog", "ruleId": "r.1f10de1c8364", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/cli.py", "line": 841, "snippet": "req = urllib.request.Request( endpoint, data=body,", "message": "guarddog capability-network-outbound: Detects network request capabilities (HTTP, sockets, etc.)", "category": "supply-chain", "hardFail": false }, { "id": "F-042fea2a1f78", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/python/letsfg/cli.py", "line": 841, "snippet": "req = urllib.request.Request(", "message": "HTTP client in Python.", "category": "network", "hardFail": false }, { "id": "F-417619fae0e1", "source": "bandit", "ruleId": "r.5705d5a56640", "severity": "low", "confidence": 0.9, "path": "sdk/python/letsfg/cli.py", "line": 852, "snippet": "851 try: 852 with urllib.request.urlopen(req, timeout=30) as resp: 853 result = json.loads(resp.read().decode())", "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "category": "other", "hardFail": false }, { "id": "F-9a9d36801849", "source": "guarddog", "ruleId": "r.5c819494668e", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/cli.py", "line": 852, "snippet": "try: with urllib.request.urlopen(req, timeout=30) as resp: result = json.loads(resp.read().decode()) except urllib.error.HTTPError as e:", "message": "guarddog capability-network-download: Detects downloading files from network", "category": "supply-chain", "hardFail": false }, { "id": "F-b08348627ccb", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/python/letsfg/cli.py", "line": 852, "snippet": "with urllib.request.urlopen(req, timeout=30) as resp:", "message": "HTTP client in Python.", "category": "network", "hardFail": false }, { "id": "F-dcb21d6b4ec5", "source": "guarddog", "ruleId": "r.5860ef5c399e", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/cli.py", "line": 853, "snippet": "with urllib.request.urlopen(req, timeout=30) as resp: result = json.loads(resp.read().decode()) except urllib.error.HTTPError as e: try:", "message": "guarddog capability-filesystem-read: Detects filesystem read capabilities", "category": "supply-chain", "hardFail": false }, { "id": "F-ba6cf09e1a8b", "source": "malcontent", "ruleId": "r.bd0dc86cbeb5", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/client.py", "line": 0, "snippet": "['chmod']", "message": "modifies file permissions [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-0b96072c6109", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/client.py", "line": 0, "snippet": "['agent_name', 'agent_id', 'agents']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-171ac18e323c", "source": "malcontent", "ruleId": "r.8d917b297212", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/client.py", "line": 0, "snippet": "['application/json', 'POST', 'post']", "message": "upload content via HTTP form [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-ccd0dba05606", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/client.py", "line": 0, "snippet": "['Content-Type', 'HTTP', 'POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-bdd762167047", "source": "malcontent", "ruleId": "r.4466daea12b8", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/client.py", "line": 0, "snippet": "['urllib.request']", "message": "requests resources via URL [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-3feafcd98d07", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/letsfg/client.py", "line": 56, "snippet": "DEFAULT_BASE_URL = \"https://letsfg.co/developers\"", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-7a68cebeb364", "source": "bandit", "ruleId": "r.48aa54c4f265", "severity": "info", "confidence": 0.9, "path": "sdk/python/letsfg/client.py", "line": 98, "snippet": "97 p.chmod(0o600) 98 except Exception: 99 pass 100 except Exception as e:", "message": "try_except_pass: Try, Except, Pass detected.", "category": "other", "hardFail": false }, { "id": "F-28b7e26eee43", "source": "bandit", "ruleId": "r.ff001a266bfa", "severity": "info", "confidence": 0.7, "path": "sdk/python/letsfg/client.py", "line": 920, "snippet": "919 920 def setup_payment(self, token: str = \"tok_visa\") -> dict: 921 \"\"\" 922 Set up a payment method using a payment token. 923 924 Args: 925 token: Payment token (default: \"tok_visa\" for testing). 926 927 Returns: 928 Dict with status and payment_method_id. 929 \"\"\" 930 self._require_api_key() 931 return self.…", "message": "hardcoded_password_default: Possible hardcoded password: 'tok_visa'", "category": "other", "hardFail": false }, { "id": "F-71bffd63ddb0", "source": "bandit", "ruleId": "r.5705d5a56640", "severity": "low", "confidence": 0.9, "path": "sdk/python/letsfg/client.py", "line": 1035, "snippet": "1034 try: 1035 with urlopen(req, timeout=30) as resp: 1036 return json.loads(resp.read().decode())", "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "category": "other", "hardFail": false }, { "id": "F-2c8e3f68909e", "source": "bandit", "ruleId": "r.5705d5a56640", "severity": "low", "confidence": 0.9, "path": "sdk/python/letsfg/client.py", "line": 1075, "snippet": "1074 try: 1075 with urlopen(req, timeout=timeout or self.timeout) as resp: 1076 return json.loads(resp.read().decode())", "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "category": "other", "hardFail": false }, { "id": "F-7a17b59b695e", "source": "malcontent", "ruleId": "r.bd0dc86cbeb5", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/connectors/auth.py", "line": 0, "snippet": "['chmod']", "message": "modifies file permissions [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-8c5cb87a7eb8", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/connectors/auth.py", "line": 0, "snippet": "['agents']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-49dc78ec7c26", "source": "malcontent", "ruleId": "r.8d917b297212", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/connectors/auth.py", "line": 0, "snippet": "['application/json', 'POST', 'post']", "message": "upload content via HTTP form [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-7d87e2661977", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/connectors/auth.py", "line": 0, "snippet": "['Content-Type', 'HTTP', 'POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-d8baa324f34f", "source": "malcontent", "ruleId": "r.4466daea12b8", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/connectors/auth.py", "line": 0, "snippet": "['urllib.request']", "message": "requests resources via URL [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-4b8e0350ed94", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/letsfg/connectors/auth.py", "line": 10, "snippet": "1. POST https://letsfg.co/api/agent-access/request", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-73cc764a90cb", "source": "bandit", "ruleId": "r.48aa54c4f265", "severity": "info", "confidence": 0.9, "path": "sdk/python/letsfg/connectors/auth.py", "line": 80, "snippet": "79 p.chmod(0o600) 80 except Exception: 81 pass 82", "message": "try_except_pass: Try, Except, Pass detected.", "category": "other", "hardFail": false }, { "id": "F-3c63aa2bc026", "source": "bandit", "ruleId": "r.5705d5a56640", "severity": "low", "confidence": 0.9, "path": "sdk/python/letsfg/connectors/auth.py", "line": 128, "snippet": "127 try: 128 with urlopen(req, timeout=timeout) as resp: 129 return resp.status, json.loads(resp.read())", "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "category": "other", "hardFail": false }, { "id": "F-8a057261b647", "source": "bandit", "ruleId": "r.48aa54c4f265", "severity": "info", "confidence": 0.9, "path": "sdk/python/letsfg/connectors/auth.py", "line": 220, "snippet": "219 webbrowser.open(setup_url) 220 except Exception: 221 pass 222 print(\" Step 2 — press Enter once you've finished.\")", "message": "try_except_pass: Try, Except, Pass detected.", "category": "other", "hardFail": false }, { "id": "F-2b7c1b97607b", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/local.py", "line": 0, "snippet": "['agent']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-9b2d12e1a709", "source": "malcontent", "ruleId": "r.8d917b297212", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/local.py", "line": 0, "snippet": "['application/json', 'POST']", "message": "upload content via HTTP form [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-182e4708b86f", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/local.py", "line": 0, "snippet": "['Content-Type', 'HTTP', 'POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-f978ecbd219e", "source": "malcontent", "ruleId": "r.4466daea12b8", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/local.py", "line": 0, "snippet": "['urllib.request']", "message": "requests resources via URL [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-128a5fe61a40", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/letsfg/local.py", "line": 25, "snippet": "_BASE_URL = os.environ.get(\"LETSFG_BASE_URL\", \"https://letsfg.co\")", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-d6929d9bcf10", "source": "bandit", "ruleId": "r.5705d5a56640", "severity": "low", "confidence": 0.9, "path": "sdk/python/letsfg/local.py", "line": 129, "snippet": "128 try: 129 with urlopen(req, timeout=30) as resp: 130 result = json.loads(resp.read())", "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "category": "other", "hardFail": false }, { "id": "F-5e11aeb0f27e", "source": "bandit", "ruleId": "r.5705d5a56640", "severity": "low", "confidence": 0.9, "path": "sdk/python/letsfg/local.py", "line": 148, "snippet": "147 ) 148 with urlopen(poll_req, timeout=15) as resp: 149 return json.loads(resp.read())", "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "category": "other", "hardFail": false }, { "id": "F-91edb1e736ed", "source": "bandit", "ruleId": "r.5705d5a56640", "severity": "low", "confidence": 0.9, "path": "sdk/python/letsfg/local.py", "line": 227, "snippet": "226 try: 227 with urlopen(req, timeout=60) as resp: 228 return json.loads(resp.read())", "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "category": "other", "hardFail": false }, { "id": "F-93706dc4cf18", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/models.py", "line": 0, "snippet": "['agent_name', 'agent_id']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-dabc04768b94", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/models/__init__.py", "line": 0, "snippet": "['agent_name', 'agent_id']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-26e065f26660", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/models/flights.py", "line": 0, "snippet": "['agents']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-2bca3a760239", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "sdk/python/letsfg/models/flights.py", "line": 0, "snippet": "['POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-7d4d8d5e60ba", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/letsfg/models/flights.py", "line": 415, "snippet": "https://letsfg.co/book/{id}", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-33305cc9351a", "source": "extcode", "ruleId": "r.66259759e39a", "severity": "low", "confidence": 0.9, "path": "sdk/python/pyproject.toml", "line": 0, "snippet": "", "message": "Declares 7 runtime dependencies fetched from a package registry at install/build time (not reviewed): pydantic, httpx, airportsdata, requests, typer, rich, click", "category": "external-code", "hardFail": false }, { "id": "F-9e50ba582395", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/pyproject.toml", "line": 53, "snippet": "Homepage = \"https://letsfg.co\"", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-30390d6bbf35", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "sdk/python/pyproject.toml", "line": 55, "snippet": "Repository = \"https://github.com/LetsFG/LetsFG\"", "message": "URL literal: https://github.com", "category": "network", "hardFail": false }, { "id": "F-b25fe33c05ef", "source": "malcontent", "ruleId": "r.11d4044d9aba", "severity": "info", "confidence": 0.6, "path": "sdk/python/tests/test_booking_holdings_booking_urls.py", "line": 0, "snippet": "['https://www.momondo.com/booking?token=abc123', 'https://www.momondo.com/booking?token=second', 'https://www.momondo.com/booking?token=first', 'import']", "message": "contains hardcoded endpoint with a question mark [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-1989471f2b6d", "source": "malcontent", "ruleId": "r.11d4044d9aba", "severity": "info", "confidence": 0.6, "path": "sdk/python/tests/test_checkout_engine_configs.py", "line": 0, "snippet": "['https://play.google.com/store/apps/details?id=com', 'https://www.momondo.com/book/flight?demo=403', 'https://www.momondo.com/book/flight?demo=1', 'import', '.get(']", "message": "contains hardcoded endpoint with a question mark [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-32e34af2d6cf", "source": "malcontent", "ruleId": "r.49d5f573ce86", "severity": "info", "confidence": 0.6, "path": "sdk/python/tests/test_checkout_engine_configs.py", "line": 0, "snippet": "['']", "message": "Contains HTML content [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-137765e1a419", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_currency_rates.py", "line": 56, "snippet": "with patch(\"letsfg.connectors.currency.httpx.AsyncClient\", return_value=client):", "message": "HTTP client in Python.", "category": "network", "hardFail": false }, { "id": "F-e1499a9a3db9", "source": "malcontent", "ruleId": "r.11d4044d9aba", "severity": "info", "confidence": 0.6, "path": "sdk/python/tests/test_public_offer_masking.py", "line": 0, "snippet": "['https://www.ryanair.com/book?token=abc', 'import']", "message": "contains hardcoded endpoint with a question mark [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-55a79fefe373", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "sdk/python/tests/test_skyscanner_connector.py", "line": 0, "snippet": "['radar_uses_agent', 'agents']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-4bbbad1e68e3", "source": "malcontent", "ruleId": "r.11d4044d9aba", "severity": "info", "confidence": 0.6, "path": "sdk/python/tests/test_starlink_flights.py", "line": 0, "snippet": "['https://www.starlinkflights.com/search?q=UA', 'import']", "message": "contains hardcoded endpoint with a question mark [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-1a7ee1fc6fdb", "source": "malcontent", "ruleId": "r.49d5f573ce86", "severity": "info", "confidence": 0.6, "path": "sdk/python/tests/test_starlink_flights.py", "line": 0, "snippet": "['']", "message": "Contains HTML content [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-22acab1b7c8b", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 71, "snippet": "70 def test_build_search_url_encodes_query(): 71 assert build_search_url(\"UA 1234\") == \"https://www.starlinkflights.com/search?q=UA+1234\" 72", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-169a8c66b652", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 82, "snippet": "81 82 assert parsed.query == \"UA1234\" 83 assert parsed.total == 2", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-dafc4f47bebc", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 83, "snippet": "82 assert parsed.query == \"UA1234\" 83 assert parsed.total == 2 84 assert parsed.query_type == \"all\"", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-c93dc138d8eb", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 84, "snippet": "83 assert parsed.total == 2 84 assert parsed.query_type == \"all\" 85 assert len(parsed.results) == 2", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-8bbb6512b45f", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 85, "snippet": "84 assert parsed.query_type == \"all\" 85 assert len(parsed.results) == 2 86", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-be5a8658a324", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 88, "snippet": "87 route_result = parsed.results[1] 88 assert route_result.result_type == \"route\" 89 assert route_result.title == \"UA1234: GEG \\u2192 DEN\"", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-fc3c90866f11", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 89, "snippet": "88 assert route_result.result_type == \"route\" 89 assert route_result.title == \"UA1234: GEG \\u2192 DEN\" 90 assert route_result.has_starlink is True", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-fba04b2f9855", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 90, "snippet": "89 assert route_result.title == \"UA1234: GEG \\u2192 DEN\" 90 assert route_result.has_starlink is True 91 assert route_result.confidence == 0.51", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-a0762e49542c", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 91, "snippet": "90 assert route_result.has_starlink is True 91 assert route_result.confidence == 0.51 92 assert route_result.data[\"flight_number\"] == \"UA1234\"", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-08cedf4002e5", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 92, "snippet": "91 assert route_result.confidence == 0.51 92 assert route_result.data[\"flight_number\"] == \"UA1234\" 93 assert route_result.data[\"starlink_likelihood\"] == 51", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-d30c1213554f", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 93, "snippet": "92 assert route_result.data[\"flight_number\"] == \"UA1234\" 93 assert route_result.data[\"starlink_likelihood\"] == 51 94 assert route_result.data[\"airline\"][\"equipped_count\"] == 505", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-f667174adef2", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 94, "snippet": "93 assert route_result.data[\"starlink_likelihood\"] == 51 94 assert route_result.data[\"airline\"][\"equipped_count\"] == 505 95", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-f0930bf23865", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 102, "snippet": "101 102 assert selected is not None 103 assert selected.result_id == 764736", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-7701254d32ac", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 103, "snippet": "102 assert selected is not None 103 assert selected.result_id == 764736 104 assert selected.data[\"origin_iata\"] == \"GEG\"", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-5da2514bfc70", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 104, "snippet": "103 assert selected.result_id == 764736 104 assert selected.data[\"origin_iata\"] == \"GEG\" 105 assert select_route_result(parsed, \"UA9999\") is None", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-4e9302166311", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 105, "snippet": "104 assert selected.data[\"origin_iata\"] == \"GEG\" 105 assert select_route_result(parsed, \"UA9999\") is None 106", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-aef4292589c2", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 112, "snippet": "111 112 assert selected is not None 113", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-83b4d2621f12", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 116, "snippet": "115 116 assert summary.flight_number == \"UA1234\" 117 assert summary.origin_iata == \"GEG\"", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-e1eaccda58eb", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 117, "snippet": "116 assert summary.flight_number == \"UA1234\" 117 assert summary.origin_iata == \"GEG\" 118 assert summary.destination_iata == \"DEN\"", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-883b9181ea5a", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 118, "snippet": "117 assert summary.origin_iata == \"GEG\" 118 assert summary.destination_iata == \"DEN\" 119 assert summary.starlink_likelihood == 51.0", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-de7682fe5184", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 119, "snippet": "118 assert summary.destination_iata == \"DEN\" 119 assert summary.starlink_likelihood == 51.0 120 assert summary.probability_source == \"fleet_ratio\"", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-5bf97c75fcb7", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 120, "snippet": "119 assert summary.starlink_likelihood == 51.0 120 assert summary.probability_source == \"fleet_ratio\" 121 assert summary.typical_aircraft == \"B39M\"", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-702d81b50f28", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 121, "snippet": "120 assert summary.probability_source == \"fleet_ratio\" 121 assert summary.typical_aircraft == \"B39M\" 122 assert summary.airline_name == \"United Airlines\"", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-78b6ebd20e2f", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 122, "snippet": "121 assert summary.typical_aircraft == \"B39M\" 122 assert summary.airline_name == \"United Airlines\" 123 assert summary.airline_iata == \"UA\"", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-5f1104bacbaf", "source": "bandit", "ruleId": "r.e306f0b3256a", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_starlink_flights.py", "line": 123, "snippet": "122 assert summary.airline_name == \"United Airlines\" 123 assert summary.airline_iata == \"UA\" 124", "message": "assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.", "category": "other", "hardFail": false }, { "id": "F-108506aabcb2", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "sdk/python/tests/test_wizzair_connector.py", "line": 42, "snippet": "with patch(\"curl_cffi.requests.Session\", return_value=session):", "message": "HTTP client in Python.", "category": "network", "hardFail": false }, { "id": "F-d0e83aa384dd", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "server.json", "line": 2, "snippet": "\"$schema\": \"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json\",", "message": "URL literal: https://static.modelcontextprotocol.io", "category": "network", "hardFail": false }, { "id": "F-474d3ce00bb5", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "server.json", "line": 6, "snippet": "\"websiteUrl\": \"https://letsfg.co\",", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-3b05523eb152", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "server.json", "line": 8, "snippet": "\"url\": \"https://github.com/LetsFG/LetsFG\",", "message": "URL literal: https://github.com", "category": "network", "hardFail": false }, { "id": "F-0694381907da", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "skills/flight-search/SKILL.md", "line": 25, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-b22111119337", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "skills/flight-search/SKILL.md", "line": 87, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-2c244bbe7674", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "skills/flight-search/references/api-reference.md", "line": 10, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-9c13b29a16c5", "source": "heckler", "ruleId": "r.55af1ab00fbc", "severity": "info", "confidence": 1.0, "path": "skills/flight-search/references/mcp-setup.md", "line": 3, "snippet": "", "message": "Variation Selector 16 (U+FE0F)", "category": "obfuscation", "hardFail": false }, { "id": "F-ada5b700605a", "source": "opengrep", "ruleId": "r.0288ce1d8585", "severity": "info", "confidence": 0.9, "path": "skills/flight-search/references/mcp-setup.md", "line": 19, "snippet": "pip install letsfg", "message": "Installs language packages at runtime (pip/npm/cargo/go/gem/bun).", "category": "package", "hardFail": false }, { "id": "F-5a9684a44337", "source": "opengrep", "ruleId": "r.ffe891943e29", "severity": "info", "confidence": 0.9, "path": "skills/flight-search/references/mcp-setup.md", "line": 30, "snippet": "curl -X POST https://letsfg.co/developers/api/v1/agents/register \\", "message": "Network client invoked from a script or Process command (curl/wget/nc/...).", "category": "network", "hardFail": false }, { "id": "F-ec9bbdd3a4af", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "smithery.yaml", "line": 5, "snippet": "# https://smithery.ai/docs/publishing", "message": "URL literal: https://smithery.ai", "category": "network", "hardFail": false }, { "id": "F-629ea4c076bb", "source": "malcontent", "ruleId": "r.0b0a2ab1d6bb", "severity": "info", "confidence": 0.6, "path": "test/model-test.js", "line": 0, "snippet": "['/etc/passwd']", "message": "Detects access to sensitive files (credentials, configs, keys) [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-d25dc87154e7", "source": "malcontent", "ruleId": "r.9c06986c69f4", "severity": "info", "confidence": 0.6, "path": "test/model-test.js", "line": 0, "snippet": "['$zw_between']", "message": "Detects unicode homoglyphs and uncommon characters used for obfuscation [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-4c17298b2e18", "source": "malcontent", "ruleId": "r.fb014819c620", "severity": "info", "confidence": 0.6, "path": "test/model-test.js", "line": 0, "snippet": "['(checks - failures)', '(99 * 1024 * 1024)', '$complex_math_div', '$complex_math_mul', '$complex_math_sub', '$f_fromCharCode', '(2026-08-23)', 'airlines/64', 'voyager/10', '194-offer', '256-offer', '", "message": "complex math with parseInt or fromCharCode conversions [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-4a89ceafe128", "source": "malcontent", "ruleId": "r.11d4044d9aba", "severity": "info", "confidence": 0.6, "path": "test/model-test.js", "line": 0, "snippet": "['https://www.ryanair.com/x?y=1&z=2', 'require']", "message": "contains hardcoded endpoint with a question mark [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-a14722e85a02", "source": "malcontent", "ruleId": "r.49d5f573ce86", "severity": "info", "confidence": 0.6, "path": "test/model-test.js", "line": 0, "snippet": "['DOCTYPE html', '']", "message": "Contains HTML content [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-f70dda86b6b5", "source": "malcontent", "ruleId": "r.c8f2cb7996f8", "severity": "info", "confidence": 0.6, "path": "test/model-test.js", "line": 0, "snippet": "['lt with fromCharCode so no e', 'String.fromCharCode(10) + \"']", "message": "assembles strings from UTF-16 code units [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-0e9895bf590b", "source": "malcontent", "ruleId": "r.4f51c4fad003", "severity": "info", "confidence": 0.6, "path": "test/model-test.js", "line": 0, "snippet": "['/root']", "message": "path reference within /root [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-40e70e1eb296", "source": "malcontent", "ruleId": "r.3e359da84e56", "severity": "info", "confidence": 0.6, "path": "test/model-test.js", "line": 0, "snippet": "['agent']", "message": "references an 'agent' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-bcb0079a661e", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "test/model-test.js", "line": 0, "snippet": "['HTTP', 'POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-126a3ccc7d74", "source": "gitleaks", "ruleId": "r.43cd6c2d96bb", "severity": "info", "confidence": 0.7, "path": "test/model-test.js", "line": 79, "snippet": "token: \"RED…REDACTED\"", "message": "Possible hard-coded secret (Detected a Generic API Key, potentially exposing access to various services and sensitive operations.); value redacted, liveness not verified.", "category": "secret", "hardFail": false }, { "id": "F-c3ccdbaec617", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "tools/build-icons.py", "line": 16, "snippet": "Icons: Lucide (https://lucide.dev), ISC licence -- see assets/icons/LICENSE.", "message": "URL literal: https://lucide.dev", "category": "network", "hardFail": false }, { "id": "F-0da5c9ecab6c", "source": "malcontent", "ruleId": "r.a5934ed7d04a", "severity": "info", "confidence": 0.6, "path": "tools/build-ranking.py", "line": 0, "snippet": "['subprocess.run(cmd, capture_output=True, text=True, shell=(os.name == \"nt\"))']", "message": "execute external program [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-9bb31a0a0ba8", "source": "bandit", "ruleId": "r.42a10ce62220", "severity": "info", "confidence": 0.9, "path": "tools/build-ranking.py", "line": 23, "snippet": "22 import re 23 import subprocess 24 import sys", "message": "blacklist: Consider possible security implications associated with the subprocess module.", "category": "exec", "hardFail": false }, { "id": "F-613fbd1cd574", "source": "bandit", "ruleId": "r.b10a0fff101b", "severity": "low", "confidence": 0.9, "path": "tools/build-ranking.py", "line": 101, "snippet": "100 \"--outDir\", tmp_dir] 101 proc = subprocess.run(cmd, capture_output=True, text=True, shell=(os.name == \"nt\")) 102 tmp_js = os.path.join(tmp_dir, \"bundle.js\")", "message": "subprocess_popen_with_shell_equals_true: subprocess call with shell=True identified, security issue.", "category": "exec", "hardFail": false }, { "id": "F-2834f7fba7a4", "source": "opengrep", "ruleId": "r.797dc6b4e8ec", "severity": "info", "confidence": 0.9, "path": "tools/build-ranking.py", "line": 101, "snippet": "proc = subprocess.run(cmd, capture_output=True, text=True, shell=(os.name == \"nt\"))", "message": "Python spawns processes.", "category": "exec", "hardFail": false }, { "id": "F-b17f2e5c3f7e", "source": "malcontent", "ruleId": "r.8a7ad93c4718", "severity": "info", "confidence": 0.6, "path": "tools/check-search-invariant.py", "line": 0, "snippet": "['is not a malicious user']", "message": "References 'malicious' [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-7b257667a54f", "source": "malcontent", "ruleId": "r.8d917b297212", "severity": "info", "confidence": 0.6, "path": "tools/split-comparison.py", "line": 0, "snippet": "['application/json', 'POST', 'post']", "message": "upload content via HTTP form [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-6c9f752c40da", "source": "malcontent", "ruleId": "r.7f5b9be716d8", "severity": "info", "confidence": 0.6, "path": "tools/split-comparison.py", "line": 0, "snippet": "['Content-Type', 'HTTP', 'POST', 'http']", "message": "submits content to websites [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-20da215bad30", "source": "malcontent", "ruleId": "r.4466daea12b8", "severity": "info", "confidence": 0.6, "path": "tools/split-comparison.py", "line": 0, "snippet": "['urllib.request']", "message": "requests resources via URL [MEDIUM]", "category": "other", "hardFail": false }, { "id": "F-d5dc6d83b69d", "source": "textscan", "ruleId": "r.4dc275665c39", "severity": "info", "confidence": 1.0, "path": "tools/split-comparison.py", "line": 32, "snippet": "BASE = os.environ.get(\"LETSFG_BASE_URL\", \"https://letsfg.co\").rstrip(\"/\")", "message": "URL literal: https://letsfg.co", "category": "network", "hardFail": false }, { "id": "F-f4b9bfada07e", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "tools/split-comparison.py", "line": 68, "snippet": "req = urllib.request.Request(", "message": "HTTP client in Python.", "category": "network", "hardFail": false }, { "id": "F-7f1b0535cc86", "source": "bandit", "ruleId": "r.5705d5a56640", "severity": "low", "confidence": 0.9, "path": "tools/split-comparison.py", "line": 71, "snippet": "70 headers=headers(json_body=True), method=\"POST\") 71 with urllib.request.urlopen(req, timeout=60) as r: 72 return json.loads(r.read())", "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "category": "other", "hardFail": false }, { "id": "F-9228052c8cec", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "tools/split-comparison.py", "line": 71, "snippet": "with urllib.request.urlopen(req, timeout=60) as r:", "message": "HTTP client in Python.", "category": "network", "hardFail": false }, { "id": "F-038f69b45752", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "tools/split-comparison.py", "line": 76, "snippet": "req = urllib.request.Request(f\"{BASE}{path}\", headers=headers(), method=\"GET\")", "message": "HTTP client in Python.", "category": "network", "hardFail": false }, { "id": "F-a80e14dfa0f8", "source": "bandit", "ruleId": "r.5705d5a56640", "severity": "low", "confidence": 0.9, "path": "tools/split-comparison.py", "line": 77, "snippet": "76 req = urllib.request.Request(f\"{BASE}{path}\", headers=headers(), method=\"GET\") 77 with urllib.request.urlopen(req, timeout=30) as r: 78 return json.loads(r.read())", "message": "blacklist: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.", "category": "other", "hardFail": false }, { "id": "F-b004b991086a", "source": "opengrep", "ruleId": "r.19d4b7994e75", "severity": "info", "confidence": 0.9, "path": "tools/split-comparison.py", "line": 77, "snippet": "with urllib.request.urlopen(req, timeout=30) as r:", "message": "HTTP client in Python.", "category": "network", "hardFail": false }, { "id": "F-1efa8834323d", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "tools/validate.sh", "line": 3, "snippet": "# `omarchy plugin validate` so they can be checked without an Omarchy box.", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false }, { "id": "F-895e2f89c159", "source": "opengrep", "ruleId": "r.5e2eff489ad3", "severity": "info", "confidence": 0.9, "path": "tools/validate.sh", "line": 6, "snippet": "# omarchy plugin validate \"$PLUGIN_DIR\"", "message": "Calls Omarchy commands or touches Omarchy shell state.", "category": "other", "hardFail": false } ], "ai": { "pass1": { "status": "ok", "output": { "summary": "Bar widget and panel only. Panel.qml uses XHR to letsfg.co and spawns no processes. It reads ~/.letsfg/config.json for the token and writes its own state files. Scanner hits are in SDK/tools files the shell doesn't load. Panel.qml and Model.js were only grepped.", "whatItDoes": { "oneLiner": "A bar widget with a flight-search panel that calls letsfg.co over XHR using the user's LetsFG token, with an anonymous install ID sent for analytics." }, "additionalFindings": [ { "severity": "low", "path": "Panel.qml", "line": 1071, "message": "Reads the CLI's token file ~/.letsfg/config.json and sends the bearer token to letsfg.co. This is the plugin's stated purpose, and the file is read-only to the plugin.", "category": "secret", "snippet": "path: Quickshell.env(\"HOME\") + \"/.letsfg/config.json\"" }, { "severity": "info", "path": "Panel.qml", "line": 1025, "message": "Generates a random anonymous install ID and sends it to the server as an analytics header (X-LetsFG-Install). It is disclosed in the code comments.", "category": "network", "snippet": "An anonymous install id, generated once and kept beside the token." } ], "escalate": false, "escalateReason": "", "injectionObserved": false, "injectionNotes": "", "canaryObserved": false }, "turns": 6, "costUsd": 0.1414684 }, "pass2": [ { "findingId": "F-88d14336f65f", "verdict": "likely-fp", "reason": "Truncated marketing description for the MCP server; visible text shows no hidden instructions or secret references, only 'ONE credenti...' (credential) product copy." }, { "findingId": "F-4f6fd296140f", "verdict": "confirmed", "reason": "Snippet shows the panel reading ~/.letsfg/config.json (token file); reading a credential file is the reported behaviour, albeit expected for the plugin." }, { "findingId": "F-6586cc326adf", "verdict": "likely-fp", "reason": "'pip install letsfg' appears inside an OpenAPI description markdown code block (documentation), not executed at runtime." }, { "findingId": "F-16ddd92e0e0d", "verdict": "confirmed", "reason": "Reads LETSFG_BEARER_TOKEN from process.env; benign expected config read." }, { "findingId": "F-b03f8fcce13e", "verdict": "confirmed", "reason": "Reads LETSFG_API_KEY from process.env; benign expected config read." }, { "findingId": "F-4a5642ee5738", "verdict": "likely-fp", "reason": "Resource description 'Read this before using any tools' is ordinary guide guidance, not a hidden priority/override marker." }, { "findingId": "F-417619fae0e1", "verdict": "unsure", "reason": "urlopen on a Request object; URL construction not visible in snippet." }, { "findingId": "F-71bffd63ddb0", "verdict": "unsure", "reason": "urlopen on a Request object; URL construction not visible in snippet." }, { "findingId": "F-2c8e3f68909e", "verdict": "unsure", "reason": "urlopen on a Request object; URL construction not visible in snippet." }, { "findingId": "F-3c63aa2bc026", "verdict": "unsure", "reason": "urlopen on a Request object; URL construction not visible in snippet." }, { "findingId": "F-d6929d9bcf10", "verdict": "unsure", "reason": "urlopen on a Request object; URL construction not visible in snippet." }, { "findingId": "F-5e11aeb0f27e", "verdict": "unsure", "reason": "urlopen on a Request object; URL construction not visible in snippet." }, { "findingId": "F-91edb1e736ed", "verdict": "unsure", "reason": "urlopen on a Request object; URL construction not visible in snippet." }, { "findingId": "F-613fbd1cd574", "verdict": "confirmed", "reason": "subprocess.run with shell=True on Windows, though args are a fixed list for tsc in a build tool; low risk." }, { "findingId": "F-7f1b0535cc86", "verdict": "likely-fp", "reason": "URL is f\"{BASE}{path}\" with a constant BASE to the API host; no file:/custom scheme possible." }, { "findingId": "F-a80e14dfa0f8", "verdict": "likely-fp", "reason": "URL is f\"{BASE}{path}\" with a constant BASE to the API host; no file:/custom scheme possible." } ], "guard": { "canaryOk": true, "positiveControlOk": null, "disallowedToolUse": false, "schemaValid": true, "failures": [] } } } } }