~95% on SimpleQA (e.g. Qwen3.6-27B on a 3090). Supports all local and cloud LLMs (llama.cpp, Ollama, Google, ...). 10+ search engines - arXiv, PubMed, your private documents. Everything Local & Encrypted.
This report summarizes scanner evidence for LearningCircuit/local-deep-research, a Python project with 9,180 GitHub stars. SynthScan examined 1,635,271 lines of code across 4329 source files, recording 50809 pattern matches distributed across 27 syntactic categories. The legacy adjusted pattern signal is 42.9 (High pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 39804 finding(s).
Are imports declared and package/API names verified? 977 finding(s).
Are wrappers, guards, and repeated structures necessary? 46252 finding(s).
Which changes need focused human review? 50809 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 50809 distinct pattern matches across 27 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-hooks/check-release-gate-needs.py | 99 | def check_local_workflow_refs(errors: list[str]) -> None: | CODE |
| LOW | .pre-commit-hooks/custom-checks.py | 152 | def _format_string_references_exception(self, node): | CODE |
| LOW | .pre-commit-hooks/custom-checks.py | 176 | def _string_concat_references_exception(self, node): | CODE |
| LOW | .pre-commit-hooks/check-bearer-disable.py | 112 | def _classify_js_line_comment( | CODE |
| LOW | .pre-commit-hooks/check-fixture-duplication.py | 78 | def find_module_level_fixture_redefinitions( | CODE |
| LOW | …e-commit-hooks/check-settings-manager-thread-safety.py | 81 | def _check_body_for_unsafe_calls(self, node) -> None: | CODE |
| LOW | …e-commit-hooks/check-settings-manager-thread-safety.py | 117 | def _is_get_settings_manager_call(call_node: ast.Call) -> bool: | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 626 | def _prescan_safe_patch_receivers(self, tree: ast.Module) -> None: | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 696 | def _references_before_import( | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 746 | def _namespace_vocabulary_hit(tree: ast.Module) -> Optional[tuple]: | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 884 | def _prescan_getattr_binding_state(self, tree: ast.Module) -> None: | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 1704 | def _compute_wrapper_import_hint(self) -> str: | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 1813 | def _apply_definite_subject_assignments( | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 1862 | def _pattern_exception_aliases( | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2147 | def _is_literal_dynamic_import(node: ast.AST, module: str) -> bool: | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2239 | def _check_import_from_secure_dir(self, node: ast.ImportFrom) -> None: | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2759 | def _check_exc_info_on_warning(self, node: ast.Call) -> None: | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2812 | def _interpolated_query_names(self, expr: ast.AST) -> List[str]: | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2913 | def _check_search_query_in_log(self, node: ast.Call) -> None: | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2951 | def _check_exception_var_in_log(self, node: ast.Call) -> None: | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 3094 | def _check_expression_for_sensitive_data( | CODE |
| LOW | .pre-commit-hooks/check-service-context-managers.py | 229 | def _check_statements_recursive( | CODE |
| LOW | .pre-commit-hooks/check-session-context-manager.py | 34 | def _check_function_for_pattern(self, func_node) -> None: | CODE |
| LOW | .pre-commit-hooks/check-session-context-manager.py | 62 | def _get_session_var_from_assign(self, assign_node: ast.Assign) -> str: | CODE |
| LOW | .pre-commit-hooks/check-session-context-manager.py | 93 | def _has_session_close_in_finally( | CODE |
| LOW | .pre-commit-hooks/check-settings-key-namespace.py | 91 | def _extract_frozenset_strings(node): | CODE |
| LOW | tests/test_api_settings_validation.py | 16 | def test_temperature_validation(self): | CODE |
| LOW | tests/test_api_settings_validation.py | 48 | def test_provider_name_normalization(self): | CODE |
| LOW | tests/test_api_settings_validation.py | 65 | def test_search_results_validation(self): | CODE |
| LOW | tests/test_api_settings_validation.py | 84 | def test_quick_summary_with_invalid_provider(self, mock_init): | CODE |
| LOW | tests/test_api_settings_validation.py | 96 | def test_quick_summary_with_missing_api_key(self, mock_init): | CODE |
| LOW | tests/test_api_settings_validation.py | 118 | def test_settings_with_circular_references(self): | CODE |
| LOW | tests/test_api_settings_validation.py | 152 | def test_environment_variable_type_conversion(self, monkeypatch): | CODE |
| LOW | tests/test_api_settings_validation.py | 170 | def test_invalid_environment_variable_values(self, monkeypatch): | CODE |
| LOW | tests/test_api_settings_validation.py | 182 | def test_environment_variable_precedence(self, monkeypatch): | CODE |
| LOW | tests/test_api_settings_validation.py | 206 | def test_minimal_configuration(self): | CODE |
| LOW | tests/test_api_settings_validation.py | 219 | def test_common_research_presets(self): | CODE |
| LOW | tests/test_api_settings_validation.py | 303 | def test_legacy_setting_names(self): | CODE |
| LOW | tests/test_context_overflow_detection.py | 58 | def test_context_overflow_detection_no_overflow(self, token_callback): | CODE |
| LOW | tests/test_context_overflow_detection.py | 87 | def test_context_overflow_detection_with_overflow(self, token_callback): | CODE |
| LOW | tests/test_context_overflow_detection.py | 117 | def test_ollama_raw_metrics_capture(self, token_callback): | CODE |
| LOW | tests/test_context_overflow_detection.py | 150 | def test_context_limit_from_research_context(self): | CODE |
| LOW | tests/test_context_overflow_detection.py | 168 | def test_prompt_size_estimation(self, token_callback): | CODE |
| LOW | tests/test_context_overflow_detection.py | 192 | def test_overflow_warning_logged(self, mock_logger, token_callback): | CODE |
| LOW | tests/test_context_overflow_detection.py | 223 | def test_estimated_overflow_for_non_ollama_provider( | CODE |
| LOW | tests/test_context_overflow_detection.py | 259 | def test_provider_confirmed_total_context_overflow( | CODE |
| LOW | tests/test_context_overflow_detection.py | 295 | def test_estimated_total_context_overflow_for_non_ollama( | CODE |
| LOW | tests/test_context_overflow_detection.py | 335 | def test_estimated_total_context_overflow_via_llm_output( | CODE |
| LOW | tests/test_context_overflow_detection.py | 386 | def test_estimated_path_fires_on_subsequent_calls_after_first_truncation( | CODE |
| LOW | tests/test_context_overflow_detection.py | 399 | def llm_output_overflow_response(): | CODE |
| LOW | tests/test_context_overflow_detection.py | 428 | def test_estimated_overflow_skipped_when_context_limit_none( | CODE |
| LOW | tests/test_context_overflow_detection.py | 456 | def test_estimated_overflow_zero_prompt_estimate( | CODE |
| LOW | tests/test_context_overflow_detection.py | 481 | def test_estimated_overflow_without_on_llm_start( | CODE |
| LOW | tests/test_context_overflow_detection.py | 510 | def test_ollama_context_overflow_real(self): | CODE |
| LOW | tests/TESTING_PROPOSAL.md | 263 | def test_create_documents_empty(citation_handler): | CODE |
| LOW | tests/TESTING_PROPOSAL.md | 269 | def test_create_documents_string(citation_handler): | CODE |
| LOW | tests/test_utils.py | 65 | def assert_search_result_format(result: Dict[str, Any]): | CODE |
| LOW | tests/test_utils.py | 115 | def create_test_research_context(query: str = "test query") -> Dict[str, Any]: | CODE |
| LOW | tests/test_utils.py | 160 | def assert_progress_callback_called( | CODE |
| LOW⚡ | tests/test_search_system_factory_high_value.py | 25 | def test_all_entries_are_dicts(self): | CODE |
| 36100 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | docker-compose.gpu.override.yml | 1 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.gpu.override.yml | 3 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.gpu.override.yml | 21 | # ============================================================================ | COMMENT |
| MEDIUM | docker-compose.unraid.yml | 1 | # ============================================================================ | COMMENT |
| MEDIUM | docker-compose.unraid.yml | 3 | # ============================================================================ | COMMENT |
| MEDIUM | docker-compose.unraid.yml | 16 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 1 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 11 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 13 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 15 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 23 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 25 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .file-whitelist.txt | 49 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .file-whitelist.txt | 51 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 65 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 68 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 74 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 76 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 84 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 86 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 96 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .file-whitelist.txt | 98 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .file-whitelist.txt | 118 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .file-whitelist.txt | 121 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | pyproject.toml | 506 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | pyproject.toml | 508 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .grype.yaml | 9 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 11 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 32 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 34 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 88 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 93 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 143 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 166 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 201 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .grype.yaml | 214 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .grype.yaml | 256 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 264 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 306 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 308 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 569 | # ========================================================================== | COMMENT |
| MEDIUM | .grype.yaml | 585 | # ========================================================================== | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 34 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 36 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 46 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 48 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 54 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 59 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 66 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 68 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 78 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 82 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 86 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 89 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 92 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 98 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 103 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 109 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 112 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 118 | # ============================================================================ | COMMENT |
| 7159 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-hooks/check-css-class-prefix.py | 177 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-css-class-prefix.py | 178 | print(f"Error reading {file_path}: {e}", file=sys.stderr) | CODE |
| LOW | .pre-commit-hooks/check-css-class-prefix.py | 331 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-css-class-prefix.py | 332 | print(f"Error reading {file_path}: {e}", file=sys.stderr) | CODE |
| LOW | .pre-commit-hooks/check-css-class-prefix.py | 450 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-css-class-prefix.py | 451 | print(f"Error reading {file_path}: {e}", file=sys.stderr) | CODE |
| LOW | .pre-commit-hooks/check-absolute-module-paths.py | 116 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-absolute-module-paths.py | 117 | print(f"Error reading {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-absolute-module-paths.py | 134 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-absolute-module-paths.py | 135 | print(f"Error parsing {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-absolute-module-paths.py | 149 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-absolute-module-paths.py | 150 | print(f"Error reading {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-env-vars.py | 287 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-env-vars.py | 288 | print(f"Error reading {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-env-vars.py | 305 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-env-vars.py | 306 | print(f"Error parsing {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-pathlib-usage.py | 177 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-pathlib-usage.py | 178 | print(f"Error reading {filepath}: {e}", file=sys.stderr) | CODE |
| LOW | .pre-commit-hooks/check-utcnow-parens.py | 34 | except Exception: | CODE |
| LOW | .pre-commit-hooks/check-double-escaping.py | 130 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-double-escaping.py | 131 | print(f"Error checking {file_path}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-url-security.py | 143 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-url-security.py | 144 | print(f"Error checking {file_path}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-no-src-test-imports.py | 111 | except Exception as e: # pragma: no cover - unreadable file | CODE |
| MEDIUM | .pre-commit-hooks/check-no-src-test-imports.py | 112 | print(f"Error reading {filename}: {e}") | CODE |
| LOW⚡ | .pre-commit-hooks/fix-exception-logging.py | 234 | except Exception: | CODE |
| LOW | .pre-commit-hooks/check-silent-cleanup.py | 187 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-silent-cleanup.py | 188 | print(f"Error reading {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-silent-cleanup.py | 209 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-silent-cleanup.py | 210 | print(f"Error parsing {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/custom-checks.py | 539 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/custom-checks.py | 540 | print(f"Error reading {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/custom-checks.py | 566 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/custom-checks.py | 567 | print(f"Error parsing {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-weak-tests.py | 59 | except Exception: # pragma: no cover - unparse is stable on 3.9+ | CODE |
| LOW | …e-commit-hooks/check-settings-manager-thread-safety.py | 149 | except Exception as e: | CODE |
| MEDIUM | …e-commit-hooks/check-settings-manager-thread-safety.py | 150 | print(f"Error checking {filepath}: {e}", file=sys.stderr) | CODE |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 3252 | except Exception as e: | CODE |
| LOW | .pre-commit-hooks/check-open-encoding.py | 140 | except Exception: | CODE |
| LOW | .pre-commit-hooks/check-safe-requests.py | 99 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-safe-requests.py | 100 | print(f"Error reading {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-safe-requests.py | 117 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-safe-requests.py | 118 | print(f"Error parsing {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-service-context-managers.py | 408 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-service-context-managers.py | 409 | print(f"Error reading {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-service-context-managers.py | 428 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-service-context-managers.py | 429 | print(f"Error parsing {filename}: {e}") | CODE |
| LOW | .pre-commit-hooks/check-deprecated-settings-wrapper.py | 63 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-deprecated-settings-wrapper.py | 64 | print(f"Error checking {filepath}: {e}", file=sys.stderr) | CODE |
| LOW | .pre-commit-hooks/check-session-context-manager.py | 130 | except Exception as e: | CODE |
| MEDIUM | .pre-commit-hooks/check-session-context-manager.py | 131 | print(f"Error checking {filepath}: {e}", file=sys.stderr) | CODE |
| LOW | .pre-commit-hooks/check-settings-key-namespace.py | 205 | except Exception: | CODE |
| LOW | .pre-commit-hooks/check-settings-key-namespace.py | 224 | except Exception: | CODE |
| LOW | .pre-commit-hooks/check-unmarked-sleep.py | 155 | except Exception as exc: | CODE |
| LOW | .pre-commit-hooks/check-loguru-formatting.py | 119 | except Exception as exc: | CODE |
| LOW | .pre-commit-hooks/check-golden-master-settings.py | 45 | except Exception: | CODE |
| LOW | .pre-commit-hooks/check-silent-exceptions.py | 84 | except Exception as exc: | CODE |
| LOW | tests/test_context_overflow_detection.py | 548 | except Exception as e: | CODE |
| MEDIUM | tests/conftest.py | 534 | def _get_json(self, force=False, silent=False): | CODE |
| LOW⚡ | tests/conftest.py | 460 | except Exception: # pragma: no cover - starlette always importable here | CODE |
| 2170 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .pre-commit-hooks/check-absolute-module-paths.py | 131 | except SyntaxError: | CODE |
| HIGH | .pre-commit-hooks/check-env-vars.py | 302 | except SyntaxError: | CODE |
| HIGH | .pre-commit-hooks/actionlint-self-repository.py | 82 | except yaml.YAMLError: | CODE |
| HIGH | .pre-commit-hooks/check-silent-cleanup.py | 207 | except SyntaxError: | CODE |
| HIGH | .pre-commit-hooks/custom-checks.py | 563 | except SyntaxError: | CODE |
| HIGH | .pre-commit-hooks/check-safe-requests.py | 114 | except SyntaxError: | CODE |
| HIGH | .pre-commit-hooks/check-service-context-managers.py | 425 | except SyntaxError: | CODE |
| HIGH | .pre-commit-hooks/check-settings-key-namespace.py | 133 | except OSError: | CODE |
| HIGH | tests/conftest.py | 49 | except ImportError: | CODE |
| HIGH | tests/conftest.py | 347 | except (ImportError, AttributeError): | CODE |
| HIGH | tests/conftest.py | 366 | except (ImportError, AttributeError): | CODE |
| HIGH | tests/conftest.py | 460 | except Exception: # pragma: no cover - starlette always importable here | CODE |
| HIGH | tests/conftest.py | 466 | except Exception: # pragma: no cover - httpx always importable here | CODE |
| HIGH | tests/conftest.py | 79 | except ImportError: | CODE |
| HIGH | tests/conftest.py | 99 | except ImportError: | CODE |
| HIGH | tests/conftest.py | 118 | except ImportError: | CODE |
| HIGH | tests/conftest.py | 120 | except Exception: | CODE |
| HIGH | tests/conftest.py | 149 | except ImportError: | CODE |
| HIGH | tests/conftest.py | 157 | except ImportError: | CODE |
| HIGH | tests/conftest.py | 177 | except (ImportError, AttributeError): | CODE |
| HIGH | tests/conftest.py | 844 | except Exception: | CODE |
| HIGH | tests/conftest.py | 92 | except Exception: | CODE |
| HIGH | tests/test_url_utils_simple.py | 36 | except ValueError: | CODE |
| HIGH | tests/run_all_tests.py | 297 | except Exception: | CODE |
| HIGH | tests/settings/env_vars/test_env_var_usage.py | 211 | except Exception: | CODE |
| HIGH | tests/database/test_post_login_settings_atomicity.py | 67 | except Exception: | CODE |
| HIGH | tests/database/test_encryption_threads.py | 147 | except Exception: | CODE |
| HIGH | tests/database/test_encrypted_db_manager.py | 1504 | except Exception: | CODE |
| HIGH | tests/database/backup/test_backup_service.py | 5845 | except Exception: | CODE |
| HIGH | …s/advanced_search_system/test_list_content_coercion.py | 291 | except ValueError: | CODE |
| HIGH | tests/advanced_search_system/filters/conftest.py | 34 | except ImportError: | CODE |
| HIGH | …ts/advanced_search_system/tools/_fetch_sink_support.py | 168 | except ValueError: | CODE |
| HIGH | tests/llm/test_llm_cancellation.py | 66 | except ResearchTerminatedException: | CODE |
| HIGH | tests/llm/test_llm_cancellation.py | 102 | except ResearchTerminatedException: | CODE |
| HIGH | tests/llm/test_llm_cancellation.py | 135 | except ResearchTerminatedException: | CODE |
| HIGH | tests/llm/test_llm_cancellation.py | 214 | except ResearchTerminatedException: | CODE |
| HIGH | tests/llm/test_llm_cancellation.py | 269 | except ResearchTerminatedException: | CODE |
| HIGH | tests/llm/test_llm_cancellation.py | 306 | except ResearchTerminatedException: | CODE |
| HIGH | tests/llm/test_llm_cancellation.py | 347 | except ResearchTerminatedException: | CODE |
| HIGH | tests/llm/test_llm_cancellation.py | 389 | except ResearchTerminatedException: | CODE |
| HIGH | tests/llm/test_llm_cancellation.py | 433 | except ResearchTerminatedException: | CODE |
| HIGH | tests/llm/test_llm_cancellation.py | 464 | except ResearchTerminatedException: | CODE |
| HIGH | tests/llm/test_llm_cancellation.py | 491 | except ResearchTerminatedException: | CODE |
| HIGH | tests/embeddings/test_embeddings_config_behavior.py | 246 | except Exception: | CODE |
| HIGH | tests/embeddings/test_embeddings_config.py | 189 | except Exception: | CODE |
| HIGH | tests/chat/conftest.py | 243 | except Exception: | CODE |
| HIGH | tests/chat/conftest.py | 502 | except Exception: | CODE |
| HIGH | tests/chat/test_chat_fuzz.py | 245 | except ValueError: | CODE |
| HIGH | tests/content_fetcher/test_security.py | 379 | except (TypeError, AttributeError): | CODE |
| HIGH | tests/config/test_thread_settings_high_value.py | 58 | except ValueError: | CODE |
| HIGH | tests/security/test_path_validator_security.py | 233 | except ValueError: | CODE |
| HIGH | tests/security/test_credential_leak_phase3.py | 119 | except Exception: | CODE |
| HIGH | tests/security/test_credential_leak_phase3.py | 125 | except Exception: | CODE |
| HIGH | tests/security/test_credential_leak_followup.py | 338 | except Exception: | CODE |
| HIGH | tests/security/test_credential_leak_followup.py | 118 | except requests.exceptions.RequestException: | CODE |
| HIGH | tests/security/test_egress_policy.py | 1168 | except Exception: | CODE |
| HIGH | tests/security/test_egress_policy.py | 1212 | except Exception: | CODE |
| HIGH | tests/security/test_egress_policy.py | 1228 | except Exception: | CODE |
| HIGH | tests/security/test_egress_policy.py | 1496 | except Exception: | CODE |
| HIGH | tests/security/test_db_adjacent_backup_posture.py | 148 | except (FileNotFoundError, PermissionError): | CODE |
| 177 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_report_generator_edge_cases.py | 0 | create a report generator with mocked dependencies. | STRING |
| HIGH | tests/report/test_report_structure_parsing.py | 0 | create a report generator with mocked dependencies. | STRING |
| HIGH | tests/report/test_report_section_generation.py | 0 | create a report generator with mocked dependencies. | STRING |
| HIGH | tests/vector_stores/test_no_plaintext_property.py | 0 | every on-disk file under ``root`` that contains ``needle`` (raw bytes). | STRING |
| HIGH | …sts/vector_stores/test_no_plaintext_production_path.py | 0 | every on-disk file under ``root`` that contains ``needle`` (raw bytes). | STRING |
| HIGH | tests/vector_stores/test_cross_tenant_isolation.py | 0 | every on-disk file under ``root`` that contains ``needle`` (raw bytes). | STRING |
| HIGH | tests/research_library/test_document_full_lifecycle.py | 0 | every on-disk file under ``root`` that contains ``needle`` (raw bytes). | STRING |
| HIGH | tests/metrics/test_token_counter_high_value.py | 0 | create a tokencountingcallback with sensible defaults. | STRING |
| HIGH | tests/metrics/test_token_counter_logic.py | 0 | create a tokencountingcallback with sensible defaults. | STRING |
| HIGH | tests/metrics/test_token_counter_coverage.py | 0 | create a tokencountingcallback with sensible defaults. | STRING |
| HIGH | tests/database/test_change_password_validation.py | 0 | a databasemanager writing to an isolated data directory. | STRING |
| HIGH | tests/security/test_login_cached_connection_password.py | 0 | a databasemanager writing to an isolated data directory. | STRING |
| HIGH | …s/security/test_change_password_evicts_stale_engine.py | 0 | a databasemanager writing to an isolated data directory. | STRING |
| HIGH | …ecurity/test_login_cached_connection_password_extra.py | 0 | a databasemanager writing to an isolated data directory. | STRING |
| HIGH | …ity/test_login_cached_connection_password_lifecycle.py | 0 | a databasemanager writing to an isolated data directory. | STRING |
| HIGH | …dvanced_search_system/strategies/test_base_strategy.py | 0 | concrete implementation for testing abstract class. | STRING |
| HIGH | tests/news/test_rating_system_behavior.py | 0 | concrete implementation for testing abstract class. | STRING |
| HIGH | tests/news/test_base_recommender_behavior.py | 0 | concrete implementation for testing abstract class. | STRING |
| HIGH | tests/citation_handlers/test_base_citation_handler.py | 0 | concrete implementation for testing abstract class. | STRING |
| HIGH | tests/news/test_preference_manager_behavior.py | 0 | concrete implementation for testing abstract class. | STRING |
| HIGH | tests/benchmarks/evaluators/test_base.py | 0 | concrete implementation for testing abstract class. | STRING |
| HIGH | tests/news/test_preference_manager_extended.py | 0 | concrete implementation for testing abstract class. | STRING |
| HIGH | tests/llm/test_openai_base.py | 0 | supply a provider_key on the abstract base for these direct tests. openaicompatibleprovider intentionally declares no `` | STRING |
| HIGH | tests/llm/providers/test_openai_base.py | 0 | supply a provider_key on the abstract base for these direct tests. openaicompatibleprovider intentionally declares no `` | STRING |
| HIGH | tests/llm_providers/test_openai_base.py | 0 | supply a provider_key on the abstract base for these direct tests. openaicompatibleprovider intentionally declares no `` | STRING |
| HIGH | tests/llm/providers/test_openai_base_deep_coverage.py | 0 | supply a provider_key on the abstract base for these direct tests. openaicompatibleprovider intentionally declares no `` | STRING |
| HIGH | tests/llm/providers/test_openai_base.py | 0 | raises valueerror when no model name is provided (no silent default). | STRING |
| HIGH | tests/llm/providers/test_openai_base_deep_coverage.py | 0 | raises valueerror when no model name is provided (no silent default). | STRING |
| HIGH | tests/llm_providers/test_openai_base.py | 0 | raises valueerror when no model name is provided (no silent default). | STRING |
| HIGH | …_providers/implementations/test_orcarouter_provider.py | 0 | raises valueerror when no model name is provided (no silent default). | STRING |
| HIGH | …sts/llm_providers/implementations/test_xai_provider.py | 0 | raises valueerror when no model name is provided (no silent default). | STRING |
| HIGH | …/llm_providers/implementations/test_openai_provider.py | 0 | raises valueerror when no model name is provided (no silent default). | STRING |
| HIGH | …lm_providers/implementations/test_requesty_provider.py | 0 | raises valueerror when no model name is provided (no silent default). | STRING |
| HIGH | …m_providers/implementations/test_anthropic_provider.py | 0 | raises valueerror when no model name is provided (no silent default). | STRING |
| HIGH | …/llm_providers/implementations/test_google_provider.py | 0 | raises valueerror when no model name is provided (no silent default). | STRING |
| HIGH | …s/llm_providers/implementations/test_ionos_provider.py | 0 | raises valueerror when no model name is provided (no silent default). | STRING |
| HIGH | …_providers/implementations/test_openrouter_provider.py | 0 | raises valueerror when no model name is provided (no silent default). | STRING |
| HIGH | tests/security/test_api_v1_boundary_fastapi.py | 0 | a testclient with its own, monotonically assigned peer address. | STRING |
| HIGH | tests/security/test_research_password_gate_fastapi.py | 0 | a testclient with its own, monotonically assigned peer address. | STRING |
| HIGH | …/security/test_followup_and_settings_guards_fastapi.py | 0 | a testclient with its own, monotonically assigned peer address. | STRING |
| HIGH | tests/security/test_api_v1_boundary_fastapi.py | 0 | a csrf token bound to this client's session (middleware-enforced). | STRING |
| HIGH | tests/security/test_research_password_gate_fastapi.py | 0 | a csrf token bound to this client's session (middleware-enforced). | STRING |
| HIGH | …/security/test_followup_and_settings_guards_fastapi.py | 0 | a csrf token bound to this client's session (middleware-enforced). | STRING |
| HIGH | tests/security/test_db_connection_temp_store_posture.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | …curity/test_db_connection_planted_journal_artifacts.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | …sts/security/test_db_connection_wal_rollback_attack.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | tests/security/test_db_connection_symlink_toctou.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | tests/security/test_db_connection_path_and_accessors.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | …s/security/test_db_connection_change_password_edges.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | tests/security/test_db_connection_verifier_memory.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | tests/security/test_db_connection_umask_perms.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | …ecurity/test_db_connection_close_and_salt_lifecycle.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | …sts/security/test_db_connection_readonly_hostile_fs.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | tests/security/test_db_connection_wal_hygiene.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | tests/security/test_db_connection_integrity_swap.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | tests/security/test_db_connection_hostile_passwords.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | tests/security/test_db_connection_legacy_salt.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | tests/security/test_db_connection_session_lifetime.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | tests/security/test_db_connection_tamper_resilience.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| HIGH | tests/security/test_db_connection_create_safety.py | 0 | a databasemanager writing to an isolated data directory. same self-contained pattern as the round-1 files, with the sanc | STRING |
| 164 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .pre-commit-hooks/check-service-context-managers.py | 195 | # Create a fake function body from module-level statements | COMMENT |
| MEDIUM | tests/conftest.py | 744 | # Create a test client (FastAPI or legacy Flask) | COMMENT |
| MEDIUM | tests/conftest.py | 1080 | # Create a mock module | COMMENT |
| MEDIUM | tests/test_openai_api_key_usage.py | 110 | # Create a mock LLM instance | COMMENT |
| MEDIUM | tests/test_reexport_modules.py | 80 | # Create a fake config.config_files module | COMMENT |
| MEDIUM⚡ | tests/test_report_generator.py | 425 | # Define a structure with multiple sections | COMMENT |
| MEDIUM | tests/test_report_generator.py | 473 | # Define a structure with 5 sections | COMMENT |
| MEDIUM | tests/test_settings_manager.py | 226 | session = SessionLocal() # Create a new session instance for this test | CODE |
| MEDIUM | tests/test_settings_manager.py | 262 | # Create a new session for this test | COMMENT |
| MEDIUM | tests/test_search_engines_enhanced.py | 159 | # Create a mock paper object | COMMENT |
| MEDIUM | tests/test_search_engines_enhanced.py | 274 | # Create a minimal settings snapshot for the factory | COMMENT |
| MEDIUM | tests/test_api_key_configuration.py | 158 | # Create a mock LLM instance | COMMENT |
| MEDIUM | tests/test_api_key_configuration.py | 181 | # Create a mock LLM instance | COMMENT |
| MEDIUM | tests/test_api_key_configuration.py | 216 | # Create a mock LLM instance | COMMENT |
| MEDIUM | tests/test_api_key_configuration.py | 239 | # Create a mock LLM instance with invoke method | COMMENT |
| MEDIUM | tests/test_search_system.py | 41 | # Create a mock strategy class and instance | COMMENT |
| MEDIUM | tests/test_search_system.py | 64 | # Create the search system (will use default source-based strategy) | COMMENT |
| MEDIUM | tests/test_search_system.py | 67 | # Create a mock progress callback | COMMENT |
| MEDIUM | tests/test_search_system.py | 196 | # Create a mock callback | COMMENT |
| MEDIUM | tests/test_search_system.py | 255 | # Create a mock strategy class and instance | COMMENT |
| MEDIUM | tests/test_search_system.py | 310 | # Create the search system (uses source-based strategy by default) | COMMENT |
| MEDIUM | tests/metrics/test_query_utils.py | 15 | # Create a model for SQLAlchemy column testing | COMMENT |
| MEDIUM⚡ | tests/settings/test_generate_config_docs.py | 347 | # Create a minimal project structure with a bad JSON file | COMMENT |
| MEDIUM | tests/database/test_database_init.py | 223 | # Create a research record | COMMENT |
| MEDIUM | tests/database/test_database_init.py | 268 | # Create a benchmark run with results | COMMENT |
| MEDIUM | tests/database/test_benchmark_models.py | 100 | # Create a benchmark run first | COMMENT |
| MEDIUM | tests/database/test_benchmark_models.py | 210 | # Create a benchmark run | COMMENT |
| MEDIUM | tests/database/test_benchmark_models.py | 273 | # Create a run | COMMENT |
| MEDIUM | tests/database/test_benchmark_models.py | 399 | # Create a completed run | COMMENT |
| MEDIUM⚡ | tests/database/test_sqlcipher_integration.py | 1309 | # Create main database | COMMENT |
| MEDIUM | tests/database/test_sqlcipher_integration.py | 960 | # Create a regular (unencrypted) SQLite database | COMMENT |
| MEDIUM | tests/database/test_sqlcipher_integration.py | 2490 | # Create main database | COMMENT |
| MEDIUM | tests/database/test_sqlcipher_integration.py | 2852 | # Create main database | COMMENT |
| MEDIUM | tests/database/test_sqlcipher_integration.py | 3160 | # Create main database | COMMENT |
| MEDIUM | tests/database/test_sqlcipher_integration.py | 4249 | # Create an encrypted database first | COMMENT |
| MEDIUM | tests/database/test_sqlcipher_integration.py | 4311 | # Create an encrypted database with a table | COMMENT |
| MEDIUM | tests/database/test_orm_conversions.py | 80 | # Create a research entry first with UUID | COMMENT |
| MEDIUM⚡ | tests/database/test_alembic_migrations.py | 525 | # Create a corrupted alembic_version table | COMMENT |
| MEDIUM⚡ | tests/database/test_alembic_migrations.py | 3712 | # Create an engine with invalid credentials in URL | COMMENT |
| MEDIUM⚡ | tests/database/test_alembic_migrations.py | 4114 | # Create a mock migrations directory structure | COMMENT |
| MEDIUM⚡ | tests/database/test_alembic_migrations.py | 4119 | # Create a world-writable migration file | COMMENT |
| MEDIUM | tests/database/test_alembic_migrations.py | 318 | # Create a few more tables to simulate existing database | COMMENT |
| MEDIUM | tests/database/test_alembic_migrations.py | 1144 | # Create a conflicting table structure | COMMENT |
| MEDIUM | tests/database/test_alembic_migrations.py | 2287 | # Create a partial state - some tables but not all | COMMENT |
| MEDIUM | tests/database/test_alembic_migrations.py | 2789 | # Create a very long string | COMMENT |
| MEDIUM | tests/database/test_alembic_migrations.py | 3676 | # Create a read-only directory scenario | COMMENT |
| MEDIUM | tests/database/test_alembic_migrations.py | 3883 | # Create a scenario that will cause a migration error | COMMENT |
| MEDIUM | tests/database/test_alembic_migrations.py | 4057 | # Create a mock symlinked path scenario | COMMENT |
| MEDIUM | tests/database/test_alembic_migrations.py | 4140 | # Create a mock migrations directory with secure files | COMMENT |
| MEDIUM | tests/database/test_alembic_migrations.py | 4164 | # Create a mock migrations directory (permissions don't matter) | COMMENT |
| MEDIUM⚡ | tests/database/test_alembic_migrations.py | 4531 | # Create a fresh Alembic database | STRING |
| MEDIUM⚡ | tests/database/test_alembic_migrations.py | 4536 | # Create a pre-Alembic database and upgrade it | STRING |
| MEDIUM | tests/database/test_auth_db.py | 90 | # Create the file | COMMENT |
| MEDIUM | tests/database/test_auth_db.py | 153 | # Create the file so init is skipped | COMMENT |
| MEDIUM | tests/database/test_auth_db.py | 362 | # Create an engine | COMMENT |
| MEDIUM | tests/database/test_auth_db.py | 390 | # Create an engine | COMMENT |
| MEDIUM | tests/database/test_encrypted_db_manager.py | 106 | # Create the database file | COMMENT |
| MEDIUM | tests/database/test_encrypted_db_manager.py | 919 | # Create a plain SQLite database (no encryption needed for this test) | COMMENT |
| MEDIUM⚡ | tests/database/backup/test_backup_service.py | 2296 | # Create a fake database file | COMMENT |
| MEDIUM⚡ | tests/database/backup/test_backup_service.py | 2304 | # Create a backup directory with a double quote in the path | COMMENT |
| 267 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.gpu.override.yml | 1 | # ============================================================================ | COMMENT |
| LOW | docker-compose.unraid.yml | 1 | # ============================================================================ | COMMENT |
| LOW | .pre-commit-config.yaml | 581 | language: script | COMMENT |
| LOW | .hadolint.yaml | 1 | # Hadolint configuration file | COMMENT |
| LOW | .hadolint.yaml | 21 | # caching. npm ci, npm run build, and pdm install have different change | COMMENT |
| LOW | .file-whitelist.txt | 1 | # ============================================================================ | COMMENT |
| LOW | pyproject.toml | 121 | # Pinned to the 0.136.x line: fastapi 0.138 breaks app.include_router | COMMENT |
| LOW | pyproject.toml | 141 | # ``test_production_app_wraps_every_sync_api_route`` (BOTH the | COMMENT |
| LOW | pyproject.toml | 161 | # app.include_router (318 routes -> ~22). That was a misdiagnosis: | COMMENT |
| LOW | pyproject.toml | 501 | "local_deep_research.utilities.*", | COMMENT |
| LOW | pyproject.toml | 521 | # Categories are intentionally lean — the auto-generated PR list already | COMMENT |
| LOW | .grype.yaml | 1 | # Grype vulnerability ignore file | COMMENT |
| LOW | .grype.yaml | 21 | # fixability only, not by severity. | COMMENT |
| LOW | .grype.yaml | 141 | reason: "Heap overflow in Media. Playwright 1.58 bundles pre-fix Chromium. Headless scraping only." | COMMENT |
| LOW | .grype.yaml | 201 | # -------------------------------------------------------------------------- | COMMENT |
| LOW | .grype.yaml | 261 | # NOT hide unknown, so an explicit entry is needed (empirically confirmed: | COMMENT |
| LOW | .grype.yaml | 421 | - vulnerability: CVE-2026-7010 | COMMENT |
| LOW | .grype.yaml | 561 | reason: "High vuln in nltk 3.9.3 (Zip Slip in downloader). Transitive dep; project never calls nltk.download(). No f | COMMENT |
| LOW | .gitleaks.toml | 121 | regexes = ['''^alice123$'''] | COMMENT |
| LOW | .gitleaks.toml | 381 | # scope is set by the CLI (--source / --log-opts); to EXCLUDE paths, add them | COMMENT |
| LOW | docker-compose.yml | 1 | # ============================================================================ | COMMENT |
| LOW | docker-compose.yml | 41 | # Only use environment variables if you want to enforce specific settings | COMMENT |
| LOW | docker-compose.yml | 61 | # Example - to expose on port 8080 instead of 5000: | COMMENT |
| LOW | docker-compose.yml | 81 | COMMENT | |
| LOW | docker-compose.yml | 101 | # Get your API key from https://openrouter.ai/ | COMMENT |
| LOW | docker-compose.yml | 121 | # The extra_hosts setting above enables this on Linux. | COMMENT |
| LOW | docker-compose.yml | 141 | soft: -1 | COMMENT |
| LOW | docker-compose.yml | 181 | condition: service_started | COMMENT |
| LOW | eslint.config.js | 241 | "chai-friendly/no-unused-expressions": "error", | COMMENT |
| LOW | bearer.yml | 1 | # Bearer SAST Scanner Configuration | COMMENT |
| LOW | bearer.yml | 21 | COMMENT | |
| LOW | bearer.yml | 41 | # - validate_config_path(): Validates config file paths | COMMENT |
| LOW | bearer.yml | 61 | # SAFE TO SKIP: Same rationale as python_lang_insecure_random above. | COMMENT |
| LOW | bearer.yml | 81 | # - escapeHtml() inline fallbacks in component files | COMMENT |
| LOW | bearer.yml | 101 | # Observable timing alerts (javascript_lang_observable_timing) | COMMENT |
| LOW | community_benchmark_results/benchmark_template.yaml | 61 | test_details: | COMMENT |
| LOW | .pre-commit-hooks/check-research-id-type.py | 41 | ), | COMMENT |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 141 | # own empty-result warning, undoes the fix for that engine. | COMMENT |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 161 | # ``query.split()`` reproduces the query modulo whitespace. This matcher | COMMENT |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 181 | # physical line carrying the logging call's method name, and be followed by a | COMMENT |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 261 | COMMENT | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 281 | # assignment/augmented/annotated target, ``del``, walrus, loop/ | COMMENT |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 301 | # the module object anywhere (``f(requests)``, ``x = requests``, | COMMENT |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 441 | # construct. A binding under one of these fields can only ADD an alias, | COMMENT |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 461 | # stays ordered); | COMMENT |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 581 | # _NAME_DOMAIN_BASELINES. Flattened module-level final state, | COMMENT |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2961 | # logger.debug() is fine — not visible in production | COMMENT |
| LOW | .pre-commit-hooks/check-email-domains.py | 281 | # (``a中`` / ``中a`` round-trip through IDNA to ``xn--`` A-labels), so it | COMMENT |
| LOW | .pre-commit-hooks/check-email-domains.py | 341 | + _FINAL_GUARD | COMMENT |
| LOW | .pre-commit-hooks/check-email-domains.py | 381 | # (``テストをご確認ください``) is prose, not a longer domain. Keep the | COMMENT |
| LOW | .pre-commit-hooks/check-email-domains.py | 421 | # transliteration), where they open nothing. An opening apostrophe or | COMMENT |
| LOW | .pre-commit-hooks/check-email-domains.py | 441 | # assertions joined by ordinary alternation, each internally fixed-width. | COMMENT |
| LOW | .pre-commit-hooks/check-email-domains.py | 501 | return spans | COMMENT |
| LOW | .pre-commit-hooks/check-email-domains.py | 521 | URI_USERINFO_RE = re.compile( | COMMENT |
| LOW | .pre-commit-hooks/check-email-domains.py | 541 | # still breaks the asset boundary. | COMMENT |
| LOW | .pre-commit-hooks/check-email-domains.py | 581 | # escape sequence, not an identity: ``"\n@router.get"`` in a Python string, | COMMENT |
| LOW | tests/conftest.py | 161 | # | COMMENT |
| LOW | tests/conftest.py | 321 | # That clear was inconsistent with the rest of the teardown: the credential | COMMENT |
| LOW | tests/test_advertised_but_dead_sweep.py | 1 | # allow: no-sut-import - this is a guardian test. It compares what the | COMMENT |
| LOW | tests/test_advertised_but_dead_sweep.py | 61 | COMMENT | |
| 1100 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-hooks/check-css-class-prefix.py | 136 | CODE | |
| LOW | .pre-commit-hooks/check-css-class-prefix.py | 183 | CODE | |
| LOW | .pre-commit-hooks/check-css-class-prefix.py | 337 | CODE | |
| LOW | .pre-commit-hooks/check-css-class-prefix.py | 456 | CODE | |
| LOW | .pre-commit-hooks/check-absolute-module-paths.py | 141 | CODE | |
| LOW | .pre-commit-hooks/check-absolute-module-paths.py | 188 | CODE | |
| LOW | .pre-commit-hooks/check-absolute-module-paths.py | 155 | CODE | |
| LOW | .pre-commit-hooks/check-env-vars.py | 115 | CODE | |
| LOW | .pre-commit-hooks/check-env-vars.py | 194 | CODE | |
| LOW | .pre-commit-hooks/check-env-vars.py | 236 | CODE | |
| LOW | .pre-commit-hooks/actionlint-self-repository.py | 29 | CODE | |
| LOW | .pre-commit-hooks/check-release-gate-needs.py | 99 | CODE | |
| LOW | .pre-commit-hooks/check-release-gate-needs.py | 136 | CODE | |
| LOW | .pre-commit-hooks/check-double-escaping.py | 30 | CODE | |
| LOW | .pre-commit-hooks/check-per-user-isolation.py | 213 | CODE | |
| LOW | .pre-commit-hooks/check-per-user-isolation.py | 289 | CODE | |
| LOW | .pre-commit-hooks/check-per-user-isolation.py | 462 | CODE | |
| LOW | .pre-commit-hooks/check-per-user-isolation.py | 542 | CODE | |
| LOW | .pre-commit-hooks/check-per-user-isolation.py | 663 | CODE | |
| LOW | .pre-commit-hooks/fix-exception-logging.py | 200 | CODE | |
| LOW | .pre-commit-hooks/check-layer-imports.py | 55 | CODE | |
| LOW | .pre-commit-hooks/check-silent-cleanup.py | 70 | CODE | |
| LOW | .pre-commit-hooks/custom-checks.py | 473 | CODE | |
| LOW | .pre-commit-hooks/custom-checks.py | 64 | CODE | |
| LOW | .pre-commit-hooks/custom-checks.py | 203 | CODE | |
| LOW | .pre-commit-hooks/custom-checks.py | 303 | CODE | |
| LOW | .pre-commit-hooks/check-url-for-targets.py | 268 | CODE | |
| LOW | .pre-commit-hooks/check-url-for-targets.py | 376 | CODE | |
| LOW | .pre-commit-hooks/check-external-resources.py | 57 | CODE | |
| LOW | .pre-commit-hooks/check-no-flask.py | 58 | CODE | |
| LOW | .pre-commit-hooks/check-no-flask.py | 70 | CODE | |
| LOW | .pre-commit-hooks/check-bearer-disable.py | 82 | CODE | |
| LOW | .pre-commit-hooks/check-bearer-disable.py | 126 | CODE | |
| LOW | …e-commit-hooks/check-settings-manager-thread-safety.py | 55 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 520 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 626 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 696 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 746 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 884 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 1533 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 1610 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 1754 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 1813 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 1862 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2020 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2171 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2239 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2418 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2534 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2600 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2812 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 3094 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 907 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 1003 | CODE | |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 1081 | CODE | |
| LOW | .pre-commit-hooks/check-service-context-managers.py | 117 | CODE | |
| LOW | .pre-commit-hooks/check-service-context-managers.py | 229 | CODE | |
| LOW | .pre-commit-hooks/check-session-context-manager.py | 34 | CODE | |
| LOW | .pre-commit-hooks/check-session-context-manager.py | 93 | CODE | |
| LOW | .pre-commit-hooks/check-settings-key-namespace.py | 54 | CODE | |
| 945 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | .gitleaks.toml | 212 | # RAG routes and services use db_password variable names (not actual secrets) | COMMENT |
| MEDIUM⚡ | .gitleaks.toml | 215 | # RAG service factory passes db_password variable names (not actual secrets) | COMMENT |
| MEDIUM⚡ | .gitleaks.toml | 218 | # the RAG factory (not actual secrets) | COMMENT |
| MEDIUM | docker-compose.yml | 235 | # digest are the meaningful guardrails. See #3874. | COMMENT |
| MEDIUM | .pre-commit-hooks/check-service-context-managers.py | 373 | # Variable is passed to another function (dependency injection) - receiver responsible | COMMENT |
| MEDIUM | tests/test_context_overflow_detection.py | 520 | # Create LLM with small context window | COMMENT |
| MEDIUM | tests/test_migration_decision_records.py | 199 | # The removed working tables lagged these 17 mainline-added RAG-upload | COMMENT |
| MEDIUM | tests/test_relative_imports_resolve.py | 171 | # unfinished scaffolding, not a live user-facing regression, and | COMMENT |
| MEDIUM | tests/vector_stores/test_legacy_cleanup_no_plaintext.py | 135 | # Symlink it under the RAG cache root — os.walk will skip it silently. | COMMENT |
| MEDIUM | tests/vector_stores/test_legacy_cleanup_no_plaintext.py | 161 | # A symlink to it under the RAG cache root. | COMMENT |
| MEDIUM | tests/vector_stores/test_legacy_cleanup_no_plaintext.py | 197 | # EVERY file under the RAG cache — nothing plaintext left on disk. | COMMENT |
| MEDIUM | …sts/vector_stores/test_no_plaintext_production_path.py | 306 | # Real service, only the embedding model faked (no network/model load). | COMMENT |
| MEDIUM⚡ | tests/vector_stores/test_faiss_store.py | 385 | # (embedding model/config changed) must fail closed on apply()'s | COMMENT |
| MEDIUM⚡ | tests/vector_stores/test_facade.py | 318 | # index_prepared() — bulk path used by parallel RAG indexing (PR #5235) | COMMENT |
| MEDIUM⚡ | tests/vector_stores/test_legacy_rekey_orchestrator.py | 210 | # test needs -- point the RAG cache root at tmp_path so it runs | COMMENT |
| MEDIUM | tests/settings/test_settings_take_effect.py | 320 | # Unrestricted context window => compute_max_tokens applies no 80% cap, | COMMENT |
| MEDIUM | tests/database/test_alembic_migrations.py | 6171 | # 0018: restoring 'mcp'/'agentic' strategy references would recreate | COMMENT |
| MEDIUM | tests/database/test_sqlalchemy_enum_lifecycle.py | 20 | # RAG document listing formats its bound query in a log f-string. | COMMENT |
| MEDIUM | …/advanced_search_system/tools/test_library_resolver.py | 44 | """Regression for #5381: RAG citations are emitted as | STRING |
| MEDIUM⚡ | tests/advanced_search_system/tools/test_fetch_modes.py | 343 | # The library RAG engine and the collection engine emit | COMMENT |
| MEDIUM⚡ | tests/followup/test_followup_context_contracts.py | 583 | # 4. Multi-turn context window bounds | COMMENT |
| MEDIUM | tests/embeddings/test_openai_embeddings.py | 890 | """The headline regression for #4195: a Nomic embedding model | STRING |
| MEDIUM | tests/deletion/test_cascade_integration.py | 315 | # Add RAG index | COMMENT |
| MEDIUM⚡ | tests/deletion/test_cascade_integration.py | 409 | # Step 2: Delete RAG index | COMMENT |
| MEDIUM⚡ | tests/deletion/test_collection_deletion.py | 250 | # Verify RAG index exists | COMMENT |
| MEDIUM⚡ | tests/deletion/test_collection_deletion.py | 258 | # Manually delete RAG index (should be done by service) | COMMENT |
| MEDIUM⚡ | tests/deletion/test_collection_deletion.py | 266 | # Verify RAG index is deleted | COMMENT |
| MEDIUM | tests/deletion/test_collection_deletion.py | 290 | # Delete RAG index | COMMENT |
| MEDIUM | tests/security/test_db_connection_many_users.py | 107 | # The phase-2 RAG index re-key re-enters through vector-store imports | COMMENT |
| MEDIUM⚡ | tests/security/test_egress_run_classification.py | 294 | # A RAG run over a collection embeds, so a cloud embedder is an exposing | COMMENT |
| MEDIUM⚡ | tests/security/test_egress_run_classification.py | 295 | # sink for the sensitive source -> refused even with a local LLM. The RAG | COMMENT |
| MEDIUM | tests/security/test_egress_pep_coverage.py | 282 | # `both` is retired (ADR-0007): it coerces to ADAPTIVE, and the RAG gate | COMMENT |
| MEDIUM | tests/security/test_password_redaction_invariant.py | 73 | # Phase-2 RAG re-key: rekey_user_indexes(username, db_password) holds the | COMMENT |
| MEDIUM | tests/js/pages/note-detail.test.js | 43 | // renderWikiLinkPlaceholder early-return — no DOM scaffold needed. | COMMENT |
| MEDIUM | tests/js/pages/note-detail-ai-handlers.test.js | 157 | // The remaining list-style handlers share the same scaffold; lock each one's | COMMENT |
| MEDIUM⚡ | …ts/research_library/test_deletion_cascade_contracts.py | 671 | # Both collections were handed to the RAG purge, not just one. | COMMENT |
| MEDIUM⚡ | …ts/research_library/test_deletion_cascade_contracts.py | 981 | # RAG index -- the same shape -- IS deleted by the same service. Without | COMMENT |
| MEDIUM | …ts/research_library/test_deletion_cascade_contracts.py | 881 | # its RAG index record | COMMENT |
| MEDIUM | tests/research_library/test_document_full_lifecycle.py | 335 | # Phase 3: delete the document from RAG. Search must return | COMMENT |
| MEDIUM | tests/research_library/test_document_full_lifecycle.py | 371 | # The Document row itself must still exist (this is a RAG-removal, | COMMENT |
| MEDIUM | tests/research_library/zotero/test_sync_service.py | 638 | ) # spy: collection isn't RAG-indexed, so only assert calls | CODE |
| MEDIUM | …h_library/routes/test_rag_routes_coverage_main_port.py | 1820 | q.first.return_value = None # No RAG index | CODE |
| MEDIUM | …h_library/routes/test_rag_routes_coverage_main_port.py | 1914 | q.first.return_value = None # No RAG index | CODE |
| MEDIUM | …earch_library/routes/test_rag_routes_gaps_main_port.py | 1097 | # parameter directly, not read back off the RAG service object. | COMMENT |
| MEDIUM | …earch_library/routes/test_rag_routes_gaps_main_port.py | 1229 | # parameter directly, not read back off the RAG service object. | COMMENT |
| MEDIUM | …arch_library/services/test_library_rag_service_info.py | 47 | # Collection found, but no RAG index | COMMENT |
| MEDIUM | …arch_library/services/test_library_rag_service_info.py | 75 | # RAG index found | COMMENT |
| MEDIUM | …arch_library/services/test_library_rag_service_info.py | 119 | # No RAG index | COMMENT |
| MEDIUM⚡ | …rch_library/services/test_download_service_3827_fix.py | 995 | # Change 3 (continued): RAG indexing of research downloads has been RETIRED from | COMMENT |
| MEDIUM⚡ | …rch_library/services/test_download_service_3827_fix.py | 998 | # assert the inline RAG block is gone: generate_rag no longer drives any RAG | COMMENT |
| MEDIUM | …_library/services/test_issue_6559_rag_indexing_lock.py | 1 | """Exhaustive tests for Issue #6559: RAG Indexing Lock Across Embedding Round-Trip. | STRING |
| MEDIUM | tests/web/test_startup_import_weight.py | 97 | # scheduler -> RAG service -> splitter chain, so a regression in | STRING |
| MEDIUM | …sts/web/routers/test_rag_reindex_commit_then_unlink.py | 83 | # otherwise the "collection has no embedding model yet" arm would fire | COMMENT |
| MEDIUM | …sts/web/routers/test_rag_reindex_commit_then_unlink.py | 187 | # parameter directly (not read back off the RAG service object) -- | COMMENT |
| MEDIUM | …s/web/routers/test_unified_search_ranking_precision.py | 102 | # queries: collections, then current RAG index names), once to enrich | COMMENT |
| MEDIUM | tests/web/routers/test_unified_search_routes_port.py | 273 | # and the current RAG index names (.filter().all()). | COMMENT |
| MEDIUM⚡ | tests/web/dependencies/test_json_body_contract.py | 216 | # The front end branches on these key sets: `success` drives the chat, RAG | COMMENT |
| MEDIUM | tests/web/templates/test_url_for_shim.py | 55 | # Library / RAG | COMMENT |
| MEDIUM | tests/web/routes/test_research_routes_policy.py | 599 | # Strategy aliases ("langgraph_agent", "mcp", "agentic") must also | COMMENT |
| MEDIUM⚡ | tests/text_optimization/test_citation_formatter.py | 1891 | # /library/document/<uuid> from RAG / library sources). The three | COMMENT |
| 163 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-hooks/check-nosemgrep-annotations.py | 36 | CODE | |
| LOW | .pre-commit-hooks/check-target-blank-rel.py | 19 | CODE | |
| LOW | .pre-commit-hooks/check-no-flask.py | 29 | CODE | |
| LOW | .pre-commit-hooks/check-bearer-disable.py | 30 | CODE | |
| LOW | .pre-commit-hooks/check-journal-quality-readonly.py | 15 | CODE | |
| LOW | .pre-commit-hooks/check-author-identity.py | 26 | CODE | |
| LOW | .pre-commit-hooks/check-fastapi-default-parameters.py | 11 | CODE | |
| LOW | .pre-commit-hooks/check-email-domains.py | 77 | CODE | |
| LOW | tests/conftest.py | 563 | CODE | |
| LOW | tests/migration_evidence_nodes.py | 11 | CODE | |
| LOW | tests/test_advertised_but_dead_sweep.py | 37 | CODE | |
| LOW | tests/test_cli_and_mcp_entrypoints.py | 33 | CODE | |
| LOW | tests/test_known_defect_pattern_sweep.py | 42 | CODE | |
| LOW | tests/settings/test_settings_take_effect.py | 23 | CODE | |
| LOW | tests/database/test_schema_index_completeness.py | 13 | CODE | |
| LOW | tests/database/test_journal_migrations_encrypted.py | 14 | CODE | |
| LOW | tests/database/test_model_constraint_contracts.py | 30 | CODE | |
| LOW | tests/database/test_research_strategy_fk_regression.py | 14 | CODE | |
| LOW | tests/database/test_fk_targets_resolve.py | 9 | CODE | |
| LOW | …sts/database/test_journal_rebuild_data_preservation.py | 20 | CODE | |
| LOW | …sts/database/backup/test_backup_windows_attach_path.py | 16 | CODE | |
| LOW | tests/advanced_search_system/filters/conftest.py | 12 | CODE | |
| LOW | …vanced_search_system/tools/test_fetch_success_sinks.py | 8 | CODE | |
| LOW | …/advanced_search_system/tools/test_library_resolver.py | 12 | CODE | |
| LOW | …ts/advanced_search_system/tools/_fetch_sink_support.py | 8 | CODE | |
| LOW | tests/advanced_search_system/tools/test_fetch_modes.py | 8 | CODE | |
| LOW | …dvanced_search_system/tools/test_fetch_library_sink.py | 11 | CODE | |
| LOW | …advanced_search_system/tools/test_fetch_error_sinks.py | 8 | CODE | |
| LOW | tests/connected/conftest.py | 23 | CODE | |
| LOW | tests/connected/test_cleanup_probe_attribution.py | 12 | CODE | |
| LOW | tests/connected/test_queue_submission_persistence.py | 1 | CODE | |
| LOW | tests/connected/test_queue_atomic_claim.py | 1 | CODE | |
| LOW | tests/connected/test_research_submission_policy.py | 1 | CODE | |
| LOW | tests/connected/test_auth_database_lifecycle.py | 1 | CODE | |
| LOW | tests/connected/test_library_document_conversion.py | 1 | CODE | |
| LOW | tests/connected/test_queue_claim_reclaim.py | 1 | CODE | |
| LOW | tests/connected/queue_test_support.py | 1 | CODE | |
| LOW | tests/content_fetcher/test_lazy_content_fetcher.py | 16 | CODE | |
| LOW | tests/security/test_file_whitelist_content.py | 20 | CODE | |
| LOW | tests/security/test_api_v1_boundary_fastapi.py | 90 | CODE | |
| LOW | tests/security/test_collection_agent_enabled.py | 14 | CODE | |
| LOW | tests/security/test_egress_threadpool_propagation.py | 27 | CODE | |
| LOW | tests/security/test_egress_guidance.py | 4 | CODE | |
| LOW | tests/security/conftest.py | 5 | CODE | |
| LOW | …ts/security/test_egress_pep_llm_embeddings_callsite.py | 26 | CODE | |
| LOW | tests/security/test_egress_policy.py | 3 | CODE | |
| LOW | tests/security/test_egress_pep_factory_callsite.py | 19 | CODE | |
| LOW | tests/security/test_injection_and_template_safety.py | 31 | CODE | |
| LOW | …sts/security/test_notification_host_alias_fragments.py | 17 | CODE | |
| LOW | tests/security/test_egress_notifications_callsite.py | 20 | CODE | |
| LOW | tests/security/test_csrf_coverage.py | 43 | CODE | |
| LOW | tests/security/test_socket_teardown_severs.py | 63 | CODE | |
| LOW | tests/security/test_architecture_fences.py | 30 | CODE | |
| LOW | tests/security/test_sqlcipher_key_lifecycle.py | 55 | CODE | |
| LOW | tests/security/test_egress_langgraph_tool_filter.py | 33 | CODE | |
| LOW | tests/security/test_eml_attachments_not_partitioned.py | 15 | CODE | |
| LOW | tests/security/test_legacy_office_conversion_bounds.py | 18 | CODE | |
| LOW | tests/security/test_auth_credential_lifetime_fastapi.py | 42 | CODE | |
| LOW | tests/security/test_downloader_error_url_redaction.py | 67 | CODE | |
| LOW | tests/security/test_research_password_gate_fastapi.py | 52 | CODE | |
| 655 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/mock_modules.py | 16 | Create a mock module with specified attributes. Args: module_name: Name of the module to create | STRING |
| HIGH | examples/optimization/run_gemini_benchmark.py | 87 | Run benchmarks with Gemini Flash via OpenRouter. Args: examples: Number of examples to evaluate for ea | STRING |
| HIGH | examples/benchmarks/run_browsecomp.py | 62 | Run BrowseComp benchmark with proper decryption using canary field. Args: num_examples: Number of exam | STRING |
| HIGH | src/local_deep_research/database/sqlcipher_utils.py | 46 | Get the salt for a database file. For new databases (v2+): reads from the .salt file alongside the database. | STRING |
| HIGH | src/local_deep_research/database/sqlcipher_utils.py | 111 | Create and store a new random salt for a database. This should be called when creating a new database. The | STRING |
| HIGH | src/local_deep_research/database/sqlcipher_utils.py | 803 | Run ``callable_``, retrying on SQLite ``database is locked`` errors. Only retries ``OperationalError`` whose messag | STRING |
| HIGH | src/local_deep_research/database/sqlcipher_utils.py | 927 | Create a properly configured SQLCipher connection. Implements the full PRAGMA sequence with proper error clean | STRING |
| HIGH | src/local_deep_research/database/session_context.py | 111 | Context manager that ensures proper database session with encryption. Now uses thread-local sessions for better | STRING |
| HIGH | src/local_deep_research/database/library_init.py | 305 | Get the ID of a source type by name. Args: username: User to query for type_name: Name of sour | STRING |
| HIGH | src/local_deep_research/database/encrypted_db.py | 670 | Create a properly initialized SQLCipher connection. Follows the canonical SQLCipher initialization order: set k | STRING |
| HIGH | …ced_search_system/filters/journal_reputation_filter.py | 728 | Analyze journal reputation via 1 SearXNG search + 1 LLM call. This is Tier 4 — the last-resort scoring path. On | STRING |
| HIGH | …ced_search_system/filters/followup_relevance_filter.py | 27 | Filter search results by relevance to the follow-up query. Args: results: List of source d | STRING |
| HIGH | src/local_deep_research/llm/providers/openai_base.py | 48 | Factory function for OpenAI-compatible LLMs. Args: model_name: Name of the model to use | STRING |
| HIGH | src/local_deep_research/llm/providers/base.py | 82 | Create and return a LangChain chat model instance. Subclasses MUST override this method. The returned LLM is BA | STRING |
| HIGH | …_deep_research/llm/providers/implementations/openai.py | 42 | Factory function for OpenAI LLMs. Args: model_name: Name of the model to use temperatur | STRING |
| HIGH | …ep_research/llm/providers/implementations/anthropic.py | 43 | Factory function for Anthropic LLMs. Args: model_name: Name of the model to use tempera | STRING |
| HIGH | …_deep_research/llm/providers/implementations/ollama.py | 106 | Factory function for Ollama LLMs. Args: model_name: Name of the model to use temperatur | STRING |
| HIGH | src/local_deep_research/embeddings/embeddings_config.py | 132 | Get embeddings instance based on provider and model. Args: provider: Embedding provider to use (if Non | STRING |
| HIGH | src/local_deep_research/embeddings/providers/base.py | 41 | Create an embeddings instance for this provider. Args: model: Name of the embedding model | STRING |
| HIGH | …esearch/embeddings/providers/implementations/openai.py | 52 | Create OpenAI embeddings instance. Args: model: Model name (defaults to text-embedding-3-s | STRING |
| HIGH | …esearch/embeddings/splitters/text_splitter_registry.py | 64 | Get text splitter based on type. Args: splitter_type: Type of splitter ('recursive', 'token', 'sentenc | STRING |
| HIGH | src/local_deep_research/chat/service.py | 255 | Add a durable message (query/followup/response) to a chat session. Content is required and stored inli | STRING |
| HIGH | src/local_deep_research/chat/service.py | 455 | Get a chat session by ID. Args: session_id: ID of the session Returns: | STRING |
| HIGH | src/local_deep_research/chat/service.py | 823 | Archive a chat session. Refuses to archive while a research is still in_progress for the sessi | STRING |
| HIGH | src/local_deep_research/chat/service.py | 966 | Permanently delete one chat attempt (research + its messages + steps). An "attempt" is the user message that tr | STRING |
| HIGH | src/local_deep_research/chat/service.py | 1184 | Return the original user message content for a chat research. Used by the retry route to re-submit the same que | STRING |
| HIGH | src/local_deep_research/config/paths.py | 136 | Get the database filename for a specific user. Args: username: The username to generate a filename for | STRING |
| HIGH | src/local_deep_research/config/thread_settings.py | 85 | Get setting from context only - no database access from threads. Args: key: Setting key to retrieve | STRING |
| HIGH | src/local_deep_research/security/safe_requests.py | 284 | Make a safe HTTP GET request with SSRF protection. Args: url: URL to request params: URL param | STRING |
| HIGH | src/local_deep_research/security/safe_requests.py | 493 | Make a safe HTTP POST request with SSRF protection. Args: url: URL to request data: Data to se | STRING |
| HIGH | src/local_deep_research/security/safe_requests.py | 984 | `safe_get` plus exponential-backoff retry on transient errors. Retries on: * ``requests.ConnectionError`` | STRING |
| HIGH | …local_deep_research/security/notification_validator.py | 1448 | Strict validation that raises an exception on invalid URLs. Args: url: Service URL to vali | STRING |
| HIGH | src/local_deep_research/security/directory_creation.py | 38 | Create a directory through the audited security chokepoint. Rejects null bytes and raw ``..`` traversal, resolves t | STRING |
| HIGH | src/local_deep_research/security/url_builder.py | 44 | Build a base URL from application settings with intelligent fallbacks. This function handles the common patter | STRING |
| HIGH | src/local_deep_research/security/url_builder.py | 98 | Build a complete URL from base URL and path. Args: base_url: Base URL (e.g., "https://myapp.com") | STRING |
| HIGH | src/local_deep_research/security/url_builder.py | 136 | Validate a constructed URL. Args: url: URL to validate allowed_schemes: List of allowed scheme | STRING |
| HIGH | src/local_deep_research/security/path_validator.py | 95 | Validate and sanitize a user-provided path. Args: user_input: The user-provided path strin | STRING |
| HIGH | src/local_deep_research/security/path_validator.py | 187 | Validate a user-provided absolute filesystem path for local indexing. This is for features like local | STRING |
| HIGH | src/local_deep_research/security/path_validator.py | 310 | Re-sanitize a validated path for static analyzer recognition. This method takes an already-validated P | STRING |
| HIGH | src/local_deep_research/security/path_validator.py | 351 | Validate a model file path specifically. Args: model_path: Path to the model file | STRING |
| HIGH | src/local_deep_research/security/path_validator.py | 402 | Validate a path within the data directory. Args: file_path: Path relative to data root | STRING |
| HIGH | src/local_deep_research/security/path_validator.py | 431 | Validate a configuration file path. Args: config_path: Path to config file con | STRING |
| HIGH | src/local_deep_research/security/module_whitelist.py | 185 | Safely import a class from a module, validating against both whitelists. This function provides secure dynamic | STRING |
| HIGH | src/local_deep_research/security/filename_sanitizer.py | 29 | Sanitize an uploaded filename for safe filesystem storage. Args: filename: Raw filename from the upload. | STRING |
| HIGH | src/local_deep_research/security/url_validator.py | 328 | Validate that a callback URL is well-formed and safe for HTTP/HTTPS use. This is stricter than is_safe | STRING |
| HIGH | src/local_deep_research/security/network_utils.py | 11 | Check if hostname is a private/local IP address. Recognizes: - Localhost values (127.0.0.1, localhost, [::1], 0 | STRING |
| HIGH | …_research/security/file_integrity/integrity_manager.py | 159 | Create or update integrity record for a file. Args: file_path: Path to file to record | STRING |
| HIGH | …deep_research/security/file_integrity/base_verifier.py | 67 | Calculate SHA256 checksum of file. Can be overridden by subclasses for different algorithms. | STRING |
| HIGH | …arch/research_library/deletion/utils/cascade_helper.py | 726 | Delete RAGIndex records (and their vectors) for a collection. Vector cleanup is provider-aware, decide | STRING |
| HIGH | …local_deep_research/research_library/utils/__init__.py | 710 | Get absolute path using settings manager for library root. Uses PathValidator to prevent path traversal attack | STRING |
| HIGH | …research/research_library/services/download_service.py | 579 | Queue all downloadable PDFs from a research session. Args: research_id: The research sessi | STRING |
| HIGH | src/local_deep_research/exporters/odt_exporter.py | 106 | Convert markdown content to ODT using Pandoc. The conversion runs entirely in memory: markdown is piped to | STRING |
| HIGH | src/local_deep_research/exporters/quarto_exporter.py | 59 | Convert markdown content to Quarto format. Args: markdown_content: The markdown text to convert | STRING |
| HIGH | src/local_deep_research/exporters/ris_exporter.py | 50 | Extract references from markdown and convert to RIS format. Args: markdown_content: The markdown te | STRING |
| HIGH | src/local_deep_research/exporters/latex_exporter.py | 49 | Convert markdown content to LaTeX. Args: markdown_content: The markdown text to convert | STRING |
| HIGH | src/local_deep_research/exporters/pdf_exporter.py | 53 | Convert markdown content to PDF using existing PDFService. Args: markdown_content: The markdown tex | STRING |
| HIGH | src/local_deep_research/web/routers/library.py | 148 | Get authenticated user password from session store. Args: username: The username to get password for | STRING |
| HIGH | …l_deep_research/web/services/pdf_extraction_service.py | 35 | Extract text and metadata from PDF in a single pass. This method opens the PDF only once and extracts | STRING |
| HIGH | …c/local_deep_research/web/services/resource_service.py | 112 | Delete a resource from the database Args: resource_id (int): The ID of the resource to delete | STRING |
| HIGH | src/local_deep_research/storage/factory.py | 20 | Get a report storage instance that always uses database with optional file backup. Args: session: Database | STRING |
| 43 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-hooks/check-env-vars.py | 246 | # Check if the left side is a system var | COMMENT |
| LOW | .pre-commit-hooks/check-image-pinning.sh | 61 | # Check if any image lines lack @sha256 | COMMENT |
| LOW | .pre-commit-hooks/check-url-security.py | 29 | # Check if the file imports or includes URL validation | COMMENT |
| LOW | .pre-commit-hooks/check-url-security.py | 82 | # Check if it's preceded by validation | COMMENT |
| LOW | .pre-commit-hooks/fix-exception-logging.py | 210 | # Check if the variable is still used anywhere in nearby lines | COMMENT |
| LOW | .pre-commit-hooks/check-silent-cleanup.py | 48 | # Check if the handler is "except Exception:" or bare "except:" | COMMENT |
| LOW | .pre-commit-hooks/check-silent-cleanup.py | 55 | # Check if handler body is *only* `pass` (no logging, no raise) | COMMENT |
| LOW | .pre-commit-hooks/custom-checks.py | 304 | # Check if this class inherits from Base (SQLAlchemy model) | COMMENT |
| LOW | .pre-commit-hooks/custom-checks.py | 441 | # Check if line has allowed patterns first | COMMENT |
| LOW | .pre-commit-hooks/custom-checks.py | 499 | # Check if this file is allowed to use datetime.now() | COMMENT |
| LOW | .pre-commit-hooks/custom-checks.py | 518 | # Check if it's already using UTC | COMMENT |
| LOW | .pre-commit-hooks/check-external-resources.py | 73 | # Check if line contains external patterns | COMMENT |
| LOW | .pre-commit-hooks/check-external-resources.py | 76 | # Check if it's an allowed exception | COMMENT |
| LOW | .pre-commit-hooks/check-pdm-lock.sh | 2 | # Check if pdm.lock is in sync with pyproject.toml | COMMENT |
| LOW | .pre-commit-hooks/check-sensitive-logging.py | 2718 | # Check if it's a logger call | COMMENT |
| LOW | .pre-commit-hooks/check-service-context-managers.py | 89 | # Check if it's a service class | COMMENT |
| LOW | .pre-commit-hooks/check-service-context-managers.py | 93 | # Check if it's a function returning a resource | COMMENT |
| LOW | .pre-commit-hooks/check-service-context-managers.py | 359 | # Check if this is a safe instantiation | COMMENT |
| LOW | .pre-commit-hooks/check-session-context-manager.py | 38 | # Check if this is a session assignment | COMMENT |
| LOW | .pre-commit-hooks/check-session-context-manager.py | 50 | # Check if finally has session.close() | COMMENT |
| LOW | .pre-commit-hooks/check-session-context-manager.py | 104 | # Check if it's our session variable | COMMENT |
| LOW | .pre-commit-hooks/check-unmarked-sleep.py | 89 | # Check if enclosing function or class has @pytest.mark.slow | COMMENT |
| LOW | .pre-commit-hooks/check-golden-master-settings.py | 34 | # Check if regeneration changed the file | COMMENT |
| LOW | tests/test_context_overflow_detection.py | 538 | # Check if overflow was detected | COMMENT |
| LOW | tests/run_followup_tests.sh | 13 | # Check if server is running | COMMENT |
| LOW | tests/test_openai_api_key_e2e.py | 84 | # Check if API key exists in settings or environment | COMMENT |
| LOW⚡ | tests/test_database_initialization.py | 130 | # Check if settings table is queryable | COMMENT |
| LOW⚡ | tests/test_citation_handler.py | 61 | # Check if the correct number of documents was created | COMMENT |
| LOW | tests/test_citation_handler.py | 86 | # Check if indexes were correctly offset | COMMENT |
| LOW | tests/test_citation_handler.py | 106 | # Check if sources are correctly formatted with citation numbers | COMMENT |
| LOW | tests/test_citation_handler.py | 119 | # Check if LLM was called with the correct prompt | COMMENT |
| LOW | tests/test_citation_handler.py | 123 | # Check if prompt contains expected elements | COMMENT |
| LOW | tests/run_all_tests.py | 449 | # Check if we're in a headless environment (CI) | COMMENT |
| LOW | tests/test_search_system.py | 117 | # Check if the correct strategy type was created | COMMENT |
| LOW | tests/metrics/test_research_metrics_extended.py | 378 | # Check if current is better than baseline | COMMENT |
| LOW | tests/metrics/test_token_counter_extended.py | 151 | # Set usage_metadata to None to force response_metadata path | COMMENT |
| LOW | tests/settings/env_vars/test_env_var_usage.py | 159 | # Check if file is allowed to use os.environ | COMMENT |
| LOW⚡ | tests/database/test_sqlcipher_integration.py | 805 | # Check if it changed (it shouldn't for an already-initialized DB) | COMMENT |
| LOW⚡ | tests/database/test_sqlcipher_integration.py | 2329 | # Check if encryption is actually applied | COMMENT |
| LOW | tests/database/test_sqlcipher_integration.py | 4208 | # Check if salt was actually applied | COMMENT |
| LOW | tests/database/test_alembic_migrations.py | 2462 | # Check if 'key' has unique constraint | COMMENT |
| LOW | tests/database/test_no_raw_sql.py | 68 | # Check if it's in a comment or docstring | COMMENT |
| LOW | tests/database/test_no_raw_sql.py | 77 | # Check if it's an allowed pattern | COMMENT |
| LOW | tests/database/test_no_raw_sql.py | 144 | # Check if file has database operations | COMMENT |
| LOW | tests/database/test_no_raw_sql.py | 155 | # Check if it has ORM imports | COMMENT |
| LOW | tests/database/test_schema_stability.py | 150 | # Check if there are new tables that might be renames | COMMENT |
| LOW | tests/deletion/test_document_deletion.py | 209 | # Check if document is in any collection | COMMENT |
| LOW | tests/test_llm/test_llm_benchmarks.py | 24 | # Check if we have a predefined answer | COMMENT |
| LOW | …i_tests_with_login/pytest_tests/test_start_research.py | 70 | # Check if model appears in logs | COMMENT |
| LOW | tests/infrastructure_tests/test_urls_js.py | 137 | # Check if the URL exists in backend (with some flexibility for parameter names) | COMMENT |
| LOW | tests/infrastructure_tests/test_urls_js.py | 393 | # Check if this is an allowed duplicate | COMMENT |
| LOW | tests/accessibility_tests/test_accessibility_backend.py | 87 | # Check if there are any fieldsets | COMMENT |
| LOW | tests/security/test_xss_prevention.py | 305 | # Check if CSP header is present (it's a good security practice) | COMMENT |
| LOW | tests/security/test_repo_guardrails.py | 163 | # Check if this pattern matches a binary extension | COMMENT |
| LOW | tests/exporters/test_odt_exporter.py | 6 | # Check if pandoc is available (required by pypandoc) | COMMENT |
| LOW⚡ | tests/web/routers/test_state_changing_flows.py | 276 | # Check if rate limiting is enabled in this config | COMMENT |
| LOW⚡ | tests/web/auth/test_auth_coverage.py | 621 | # Set last_access to 2 hours ago (would expire normal session) | COMMENT |
| LOW⚡ | tests/strategies/test_strategy_imports.py | 64 | # Check if at least some strategies are exported | COMMENT |
| LOW | tests/journal_quality/conftest.py | 16 | # Check if DB file exists without triggering auto-download | COMMENT |
| LOW⚡ | …sts/search_engines/test_search_engine_stackexchange.py | 271 | # Set backoff to a past time so we don't actually wait | COMMENT |
| 243 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | tests/security/test_research_terminate_cross_user.py | 81 | ctx.__enter__.return_value.query.return_value.filter_by.assert_called_once_with( | CODE |
| CRITICAL⚡ | tests/security/test_file_integrity_manager_coverage.py | 908 | session.query.return_value.filter_by.return_value.order_by.return_value.limit.assert_called() | CODE |
| CRITICAL | tests/js/deletion/delete-modules.test.js | 325 | const deleteCall = window.api.fetchWithErrorHandling.mock.calls.find( | CODE |
| CRITICAL | tests/js/components/settings-dashboard-runtime.test.js | 299 | expect(window.ui.showMessage.mock.calls.flat().join(' ')).not.toContain('[REDACTED]'); | CODE |
| CRITICAL⚡ | tests/js/components/context-overflow-runtime.test.js | 370 | expect(latency.config.options.plugins.tooltip.callbacks.label({ | CODE |
| CRITICAL⚡ | tests/js/components/context-overflow-runtime.test.js | 373 | expect(latency.config.options.scales.y.ticks.callback(1500)).toBe('1.5s'); | CODE |
| CRITICAL⚡ | tests/js/components/context-overflow-runtime.test.js | 374 | expect(latency.config.options.scales.y.ticks.callback(900)).toBe('900ms'); | CODE |
| CRITICAL | tests/js/components/context-overflow-runtime.test.js | 405 | expect(phase.config.options.plugins.tooltip.callbacks.label({ | CODE |
| CRITICAL | …/js/components/settings-save-validation-errors.test.js | 66 | const [message, level] = window.ui.showMessage.mock.calls.at(-1); | CODE |
| CRITICAL | …sts/js/components/details-rich-metrics-runtime.test.js | 310 | expect(barChart.config.options.scales.y.ticks.callback(12345)).toBe('12,345'); | CODE |
| CRITICAL | …sts/js/components/details-rich-metrics-runtime.test.js | 342 | expect(searchChart.config.options.scales.y.ticks.callback(12345)).toBe('12,345'); | CODE |
| CRITICAL | …sts/js/components/details-rich-metrics-runtime.test.js | 349 | expect(cumulativeChart.config.options.plugins.tooltip.callbacks.label({ | CODE |
| CRITICAL | …/js/components/settings-redacted-baseline-sync.test.js | 262 | expect(window.ui.showMessage.mock.calls.flat().join(' ')).not.toContain(SECRET_URL); | CODE |
| CRITICAL | …/js/components/settings-redacted-baseline-sync.test.js | 263 | expect(window.ui.showMessage.mock.calls.flat().join(' ')).not.toContain(REDACTED); | CODE |
| CRITICAL | tests/js/components/settings-submit-runtime.test.js | 531 | expect(window.ui.showMessage.mock.calls.flat().join(' ')) | CODE |
| CRITICAL | tests/js/pages/note-detail-accept-link.test.js | 177 | const infoCalls = window.ui.showMessage.mock.calls.filter(c => c[1] === 'info'); | CODE |
| CRITICAL | tests/research_library/zotero/test_client.py | 420 | assert client.session.get.call_args.kwargs.get("allow_redirects") is False | CODE |
| CRITICAL | …s/research_library/routes/test_rag_indexing_helpers.py | 197 | db.query.return_value.filter_by.return_value.update.assert_called_once() | CODE |
| CRITICAL | …_library/services/test_library_rag_service_rollback.py | 180 | session.query.return_value.filter_by.return_value.delete.assert_called_once() | CODE |
| CRITICAL | …web/routers/test_settings_routes_rate_limiting_port.py | 230 | session.query.return_value.filter_by.return_value.delete.assert_called_once() | CODE |
| CRITICAL⚡ | …web/routers/test_settings_routes_rate_limiting_port.py | 259 | session.query.return_value.filter.return_value.delete.assert_called_once() | CODE |
| CRITICAL | …web/routers/test_settings_routes_rate_limiting_port.py | 270 | session.query.return_value.filter.return_value.delete.assert_called_once() | CODE |
| CRITICAL | tests/strategies/test_langgraph_agent_strategy.py | 5287 | strategy.citation_handler.analyze_followup.call_args.kwargs.get( | CODE |
| CRITICAL | tests/news/test_rating_storage_extended.py | 529 | mock_query.filter_by.return_value.order_by.return_value.limit.assert_called_with( | CODE |
| CRITICAL⚡ | tests/news/test_folder_manager_behavior.py | 298 | session.query.return_value.filter_by.return_value.update.assert_called() | CODE |
| CRITICAL⚡ | tests/news/test_folder_manager_behavior.py | 307 | session.query.return_value.filter_by.return_value.update.assert_called() | CODE |
| CRITICAL | tests/news/test_folder_manager_extended.py | 293 | mock_session.query.return_value.filter_by.return_value.update.assert_called_once_with( | CODE |
| CRITICAL | tests/news/test_folder_manager_extended.py | 309 | mock_session.query.return_value.filter_by.return_value.update.assert_called_once_with( | CODE |
| CRITICAL | tests/news/rating_system/test_storage.py | 373 | mock_query.order_by.return_value.limit.return_value.offset.assert_called_once_with( | CODE |
| CRITICAL | .github/workflows/welcome-first-time.yml | 59 | const opts = github.rest.issues.listForRepo.endpoint.merge({ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | README.md | 52 | # Step 1: Pull and run Ollama | COMMENT |
| LOW⚡ | README.md | 56 | # Step 2: Pull and run SearXNG for optimal search results | COMMENT |
| LOW⚡ | README.md | 59 | # Step 3: Pull and run Local Deep Research | COMMENT |
| LOW⚡ | docker-compose.yml | 91 | # WARNING: This will disable UI configuration for these settings! | COMMENT |
| LOW⚡ | tests/test_openai_api_key_e2e.py | 64 | # Step 1: Authenticate | COMMENT |
| LOW⚡ | tests/test_openai_api_key_e2e.py | 71 | # Step 2: Configure settings | COMMENT |
| LOW⚡ | tests/test_openai_api_key_e2e.py | 109 | # Step 3: Test LLM initialization | COMMENT |
| LOW⚡ | tests/test_openai_api_key_e2e.py | 120 | # Step 4: Test simple LLM call | COMMENT |
| LOW⚡ | tests/test_openai_api_key_e2e.py | 143 | # Step 5: Test research functionality | COMMENT |
| LOW⚡ | tests/vector_stores/test_full_migration_lifecycle.py | 227 | # Step 1: a REALISTIC LEGACY index directly at the SHARED (NOT | COMMENT |
| LOW⚡ | tests/vector_stores/test_full_migration_lifecycle.py | 310 | # Step 3: trigger the per-user relocation. In production this is | COMMENT |
| LOW⚡ | tests/vector_stores/test_full_migration_lifecycle.py | 391 | # Step 4: SEARCH through the real VectorIndex facade (via the | COMMENT |
| LOW⚡ | tests/vector_stores/test_full_migration_lifecycle.py | 402 | # Step 5: a NEW document indexed normally MERGES into the relocated + | COMMENT |
| LOW⚡ | tests/database/test_alembic_migrations.py | 4627 | # Step 1: Migrate to 0001 only | STRING |
| LOW⚡ | tests/database/test_alembic_migrations.py | 4631 | # Step 2: Insert data | STRING |
| LOW⚡ | tests/database/test_alembic_migrations.py | 4658 | # Step 3: Upgrade to head (0005) | STRING |
| LOW⚡ | tests/database/test_alembic_migrations.py | 4662 | # Step 4: Verify data survived | STRING |
| LOW | tests/database/test_alembic_migrations.py | 4675 | # Step 5: Verify new columns exist | STRING |
| LOW | tests/database/test_alembic_migrations.py | 4707 | # Step 6: Another run_migrations should be no-op | STRING |
| LOW⚡ | tests/deletion/test_cascade_integration.py | 241 | # Step 1: Delete chunks (no FK, manual cleanup required) | COMMENT |
| LOW⚡ | tests/deletion/test_cascade_integration.py | 247 | # Step 2: Delete document (CASCADE handles blob and collection links) | COMMENT |
| LOW⚡ | tests/deletion/test_cascade_integration.py | 404 | # Step 1: Delete chunks (no FK, manual cleanup) | COMMENT |
| LOW⚡ | tests/deletion/test_cascade_integration.py | 409 | # Step 2: Delete RAG index | COMMENT |
| LOW⚡ | tests/deletion/test_cascade_integration.py | 414 | # Step 3: Delete collection (CASCADE handles folders, links) | COMMENT |
| LOW⚡ | tests/chat/test_chat_e2e_flows.py | 19 | # Step 1: Create session | COMMENT |
| LOW | tests/chat/test_chat_e2e_flows.py | 30 | # Step 2: Send a message | COMMENT |
| LOW | tests/chat/test_chat_e2e_flows.py | 44 | # Step 3: Get messages | COMMENT |
| LOW | …curity/test_db_connection_rekey_kills_held_sessions.py | 161 | # Step 1: close. The session survives via creator-closure reconnect | COMMENT |
| LOW | …curity/test_db_connection_rekey_kills_held_sessions.py | 174 | # Step 2: rekey. The resurrecting connection now derives the OLD key | COMMENT |
| LOW⚡ | tests/security/test_csrf_e2e_flow.py | 20 | # Step 1: stamp the session and fetch a CSRF token for registration. | COMMENT |
| LOW⚡ | tests/security/test_csrf_e2e_flow.py | 26 | # Step 2: Register (auto-logs in the user). | COMMENT |
| LOW⚡ | tests/security/test_csrf_e2e_flow.py | 44 | # Step 3: Get the post-login API CSRF token. | COMMENT |
| LOW⚡ | tests/security/test_csrf_e2e_flow.py | 47 | # Step 4: POST a browser-facing endpoint WITH the token — must pass | COMMENT |
| LOW | tests/security/test_csrf_e2e_flow.py | 61 | # Step 5: POST the same endpoint WITHOUT a token — CSRF rejection (403). | COMMENT |
| LOW | …ts/security/test_db_connection_change_password_race.py | 972 | # Step 5: the parked OLD-key open tries to publish after the rekey. | COMMENT |
| LOW | …s/security/test_settings_secret_redaction_isolation.py | 1106 | # Step 1: submit both items with ONLY api_key visible (masked). If | COMMENT |
| LOW⚡ | tests/security/test_noncollection_agent_enabled.py | 649 | # Step 1: Add API key only. agent_enabled is still False by default. | COMMENT |
| LOW⚡ | tests/security/test_noncollection_agent_enabled.py | 656 | # Step 2: Explicitly enable for agent. | COMMENT |
| LOW⚡ | tests/security/test_noncollection_agent_enabled.py | 676 | # Step 1: Add API key. Defaults agent_enabled=True. | COMMENT |
| LOW⚡ | tests/security/test_noncollection_agent_enabled.py | 683 | # Step 2: Toggle off. | COMMENT |
| LOW | tests/research_library/zotero/test_sync_service.py | 1950 | # Step 1: first contact — byte-identical, so the item adopts the upload. | COMMENT |
| LOW | tests/research_library/zotero/test_sync_service.py | 1965 | # Step 2: the PDF is replaced in Zotero — content now differs. | COMMENT |
| LOW | …arch_library/services/test_index_documents_parallel.py | 825 | # Step 1: pre-create wrapper A and put it in the dict as canonical. | COMMENT |
| LOW⚡ | …rch_library/services/test_multi_model_switch_revert.py | 207 | # Step 1: index under model A. | COMMENT |
| LOW⚡ | …rch_library/services/test_multi_model_switch_revert.py | 255 | # Step 2: switch to model B, force-reindex the SAME document/collection. | COMMENT |
| LOW⚡ | …rch_library/services/test_multi_model_switch_revert.py | 361 | # Step 4: revert for real via the WRITE-path resolution | COMMENT |
| LOW⚡ | tests/web/test_long_integration_flows.py | 526 | # Step 2: B writes its own marker. | COMMENT |
| LOW⚡ | tests/web/test_long_integration_flows.py | 534 | # Step 3: both read back — each must see only its own marker. | COMMENT |
| LOW⚡ | tests/web/test_long_integration_flows.py | 540 | # Step 4: A creates a collection; B immediately lists collections | COMMENT |
| LOW | tests/web/test_long_integration_flows.py | 513 | # Step 1: A writes, B has not written yet -> B must still see its | COMMENT |
| LOW | tests/web/test_long_integration_flows.py | 556 | # Step 5: B creates its own collection; A must not see it either. | COMMENT |
| LOW | tests/web/test_long_integration_flows.py | 571 | # Step 6: cross-user direct-object access on the collection | COMMENT |
| LOW⚡ | tests/ui_tests/test_research_diagnosis.js | 75 | // Step 1: Authenticate | COMMENT |
| LOW⚡ | tests/ui_tests/test_research_diagnosis.js | 80 | // Step 2: Go to home page | COMMENT |
| LOW⚡ | tests/ui_tests/test_research_diagnosis.js | 86 | // Step 3: Check what's on the page | COMMENT |
| LOW | tests/ui_tests/test_research_diagnosis.js | 151 | // Step 4: Fill the form | COMMENT |
| LOW | tests/ui_tests/test_research_diagnosis.js | 190 | // Step 5: Check JavaScript state | COMMENT |
| LOW | tests/ui_tests/test_research_diagnosis.js | 235 | // Step 6: Submit the form | COMMENT |
| LOW | tests/ui_tests/test_research_diagnosis.js | 279 | // Step 7: Summary | COMMENT |
| LOW | …ts/ui_tests/NO_CI_executes_research_followup_simple.js | 41 | // Step 1: Login | COMMENT |
| 111 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .pre-commit-hooks/recommend-pr-description-update.py | 64 | The ``currentBranch`` key is a single object (or null) — not an array. | STRING |
| HIGH | tests/settings/test_settings_manager_contracts.py | 558 | "the stored value is null; InMemorySettingsManager._get_typed" | CODE |
| HIGH⚡ | tests/config/test_thread_settings_high_value.py | 128 | # embeddings.openai.dimensions defaults to JSON null, then | COMMENT |
| HIGH | tests/security/test_api_v1_boundary_fastapi.py | 1046 | """``{"model_name": null}`` / ``{"search_tool": null}`` were 200 | STRING |
| HIGH | tests/security/test_notes_chat_followup_cross_user.py | 657 | # route reports as HTTP 200 ``{"success": false, "title": null}`` -- the | COMMENT |
| HIGH | tests/security/test_pandoc_conversion_bounds.py | 16 | to /dev/null, an output-size ceiling checked before the output is read, | STRING |
| HIGH⚡ | tests/security/test_client_side_xss_sinks.py | 367 | + "const escapeHtml = window.escapeHtml || esc;\n" | CODE |
| HIGH⚡ | tests/security/test_client_side_xss_sinks.py | 368 | + "const escapeAttr = window.escapeHtmlAttribute || escapeHtml;\n" | CODE |
| HIGH⚡ | tests/security/test_client_side_xss_sinks.py | 374 | external = "const esc = window.escapeHtml || somethingElse;\n" | CODE |
| HIGH | tests/security/test_client_side_xss_sinks.py | 657 | assert "(window.escapeHtml || escapeHtmlFallback)(markdown)" in body | CODE |
| HIGH⚡ | tests/security/test_client_side_xss_sinks.py | 379 | """``x || escapeHtmlFallback`` is only as good as the fallback.""" | STRING |
| HIGH | tests/security/test_client_side_xss_sinks.py | 345 | """Follow ``a = window.x || b`` chains to the binding that escapes. | STRING |
| HIGH | …ts/security/test_research_service_isolation_fastapi.py | 800 | "semi;colon && rm -rf /", | CODE |
| HIGH⚡ | …earch_library/routes/test_rag_routes_gaps_main_port.py | 1697 | # {"agent_enabled": null} -> stored True (available), serialized True. | COMMENT |
| HIGH | tests/ci/test_workflow_artifact_names.py | 53 | and ``a || b`` picks the first non-empty operand. Anything else, such as | STRING |
| HIGH | tests/ci/test_semgrep_workflow.py | 259 | # not model raises instead of evaluating to null, because on GitHub such a | COMMENT |
| HIGH | tests/ci/test_semgrep_workflow.py | 264 | # null, as on GitHub. && and || short-circuit as on GitHub: an operand they | COMMENT |
| HIGH⚡ | tests/ci/test_semgrep_workflow.py | 741 | assert _evaluate("false || true", context) is True | CODE |
| HIGH⚡ | tests/ci/test_semgrep_workflow.py | 742 | assert _evaluate("true && false", context) is False | CODE |
| HIGH⚡ | tests/ci/test_semgrep_workflow.py | 751 | assert _evaluate("true || github.actor", context) is True | CODE |
| HIGH⚡ | tests/ci/test_semgrep_workflow.py | 752 | assert _evaluate("false && github.actor", context) is False | CODE |
| HIGH | tests/ci/test_semgrep_workflow.py | 466 | ("deleted-fork PR (head.repo null)", _pr_context(None), False), | CODE |
| HIGH | tests/ci/test_semgrep_workflow.py | 763 | "false && nothing.here", | CODE |
| HIGH | tests/web/test_auth_session_lifecycle.py | 227 | # cleared session with `session=null; expires=Thu, 01 Jan 1970 ...`. | COMMENT |
| HIGH | tests/web/test_save_research_sources_hostile_values.py | 348 | """``{"name": null}`` is the ordinary JSON shape for a missing author | STRING |
| HIGH | tests/web/routers/test_settings_lock_enforcement.py | 242 | ``message || error || detail`` -- so this is a contract drift worth | STRING |
| HIGH | tests/web/routers/test_rag_hostile_input.py | 42 | ``{"name": null}``) reached ``.strip()`` untouched and raised | STRING |
| HIGH⚡ | tests/web/routers/test_search_favorites.py | 175 | """``{"favorites": null}`` must not be stored as a null row.""" | STRING |
| HIGH | tests/web/routers/test_search_favorites.py | 21 | * **every 400 on PUT** (``favorites`` absent, null, or not a list; a | STRING |
| HIGH | tests/web/routers/test_settings_news_hostile_input.py | 168 | # A body that names no destination -- absent, null, non-dict, or blank | COMMENT |
| HIGH | …/test_settings_routes_save_validation_coverage_port.py | 28 | explicit ``{"value": null}`` on ``embeddings.openai.chunk_size``) and #5979 | STRING |
| HIGH⚡ | tests/web/warning_checks/test_hardware.py | 319 | config_file.write_text('{"port": null}', encoding="utf-8") | CODE |
| HIGH | tests/theme_tests/test_accent_ink_contrast.py | 128 | undefined, a ``var()`` cycle, translucent, or a value ``_parse_color`` | STRING |
| HIGH | tests/notes/test_note_ai_service.py | 275 | '{"added": null, "removed": "a paragraph about X", ' | CODE |
| HIGH | tests/notes/test_note_ai_service.py | 276 | '"modified": ["real change", null], "summary": null}' | CODE |
| HIGH | tests/notes/test_note_ai_service.py | 897 | '{"entities": null, "concepts": "not a list", ' | CODE |
| HIGH | tests/notes/test_note_ai_service.py | 1206 | '["real claim", 123, null, " ", {"x": 1}, "second claim"]' | CODE |
| HIGH | tests/notes/test_note_ai_service.py | 1194 | ``isinstance(c, str) and c.strip()`` — non-string items (int, null, | STRING |
| HIGH | tests/notes/test_note_ai_service.py | 2348 | (id: null) — it must be skipped, not returned.""" | STRING |
| HIGH | tests/news/test_library_sweep.py | 889 | research orphan (research_id set, text not null, NO default-library link) | STRING |
| HIGH⚡ | tests/news/test_topic_generator_coverage.py | 113 | result = self._run_with_llm_content('[123, "Valid", null, true]') | CODE |
| HIGH | …s/benchmarks/web_api/test_benchmark_export_metadata.py | 220 | """A row with all new columns NULL must serialize as JSON null, not | STRING |
| HIGH | src/local_deep_research/settings/manager.py | 249 | # A shipped optional default may legitimately be null; the equality | COMMENT |
| HIGH | src/local_deep_research/config/thread_settings.py | 25 | # (e.g. embeddings.openai.dimensions, which defaults to JSON null) into the | COMMENT |
| HIGH | src/local_deep_research/security/url_validator.py | 546 | if (!url || typeof url !== 'string') { | CODE |
| HIGH | src/local_deep_research/security/url_validator.py | 577 | if (trustedDomains.length > 0 && parsed.hostname) { | CODE |
| HIGH | src/local_deep_research/security/url_validator.py | 598 | if (!url) return null; | CODE |
| HIGH | src/local_deep_research/security/url_validator.py | 602 | return null; | CODE |
| HIGH | src/local_deep_research/security/url_validator.py | 618 | return null; | CODE |
| HIGH | …search/research_library/downloaders/playwright_html.py | 56 | if (window.navigator && window.navigator.serviceWorker) { | CODE |
| HIGH | …search/research_library/downloaders/playwright_html.py | 63 | get() { return undefined; }, | CODE |
| HIGH | …rch/research_library/notes/services/note_ai_service.py | 1573 | # drops a section (null). | COMMENT |
| HIGH | …rch/research_library/notes/services/note_ai_service.py | 347 | the key is present-but-null, not the default) or a bare string for a key | STRING |
| HIGH | src/local_deep_research/web/fastapi_app.py | 1208 | _DELETED_COOKIE_PREFIX = _SESSION_COOKIE_NAME + b"=null;" | CODE |
| HIGH⚡ | src/local_deep_research/web/fastapi_app.py | 1185 | `session=null; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; ...` | STRING |
| HIGH⚡ | src/local_deep_research/web/fastapi_app.py | 1190 | other non-remember-me cookie, downgrades it to `session=null; path=/; | STRING |
| HIGH⚡ | src/local_deep_research/web/fastapi_app.py | 1195 | client. `session=null;` is the exact, fixed marker Starlette emits for | STRING |
| HIGH | src/local_deep_research/web/routers/rag.py | 4412 | # alone only catches FALSY bodies (null, [], ""), letting a truthy | COMMENT |
| HIGH | src/local_deep_research/web/routers/api_v1.py | 192 | # scalars/dicts/lists/null, never a live callable, so this is the same | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_api_settings_e2e.py | 80 | """Test detailed_research with comprehensive settings. | STRING |
| MEDIUM | tests/test_openai_api_key_e2e.py | 247 | # diagnose=False: this e2e harness passes args.api_key and | STRING |
| MEDIUM | tests/run_all_tests.py | 598 | # Legacy comprehensive testing - runs some tests multiple times (< 15min) | COMMENT |
| MEDIUM | tests/vector_stores/test_legacy_rekey_quarantine.py | 48 | # Route session.query(Model) by class name so the test is robust to import | COMMENT |
| MEDIUM⚡ | tests/settings/test_settings_take_effect.py | 836 | # 8. Positive control for the whole harness | COMMENT |
| MEDIUM⚡ | tests/settings/test_settings_take_effect.py | 839 | # the harness can tell the difference — i.e. if it would FAIL when the value | COMMENT |
| MEDIUM | tests/settings/test_settings_take_effect.py | 609 | # This is the harness that can actually catch "the setting never reached the | COMMENT |
| MEDIUM | tests/settings/test_settings_manager_contracts.py | 474 | # ---- agreeing: the positive controls for the census harness ------- | COMMENT |
| MEDIUM | tests/database/test_sqlcipher_utils.py | 1265 | # robust if that min_value is ever raised. | COMMENT |
| MEDIUM | …earch_system/filters/test_followup_relevance_filter.py | 349 | assert call_args.count("A") < 200 # Definitely truncated from original | CODE |
| MEDIUM⚡ | …ts/advanced_search_system/tools/_fetch_sink_support.py | 80 | # Sink harness — real Loguru sinks, patched external seams. | COMMENT |
| MEDIUM | …ts/advanced_search_system/tools/_fetch_sink_support.py | 123 | # logging by default; re-enable it for the harness and restore that | COMMENT |
| MEDIUM | …_system/strategies/test_topic_organization_strategy.py | 822 | """Format topic findings creates comprehensive output.""" | STRING |
| LOW | …ed_search_system/questions/test_browsecomp_question.py | 692 | # Should not raise, just return False | COMMENT |
| MEDIUM | …_system/questions/test_flexible_browsecomp_question.py | 257 | assert call_args.count("A") < 500 # Definitely truncated from original | CODE |
| MEDIUM | tests/infrastructure_tests/test_urls_js.py | 54 | # More robust extraction pattern that handles multiline and comments | COMMENT |
| LOW | tests/content_fetcher/test_html_content_extraction.py | 155 | # Should not crash, just return minimal/empty output | COMMENT |
| MEDIUM⚡ | tests/security/test_realtime_channel_isolation.py | 78 | # Real-user harness (same recipe as tests/security/test_two_user_attack_ | COMMENT |
| MEDIUM⚡ | tests/security/test_socket_ownership_edges_fastapi.py | 99 | # Shared harness | COMMENT |
| LOW⚡ | tests/security/test_safe_requests_hook.py | 224 | # Should not raise, just return True (let other tools handle syntax) | COMMENT |
| MEDIUM⚡ | tests/security/test_news_scheduler_isolation_fastapi.py | 82 | # Two-real-user harness | COMMENT |
| MEDIUM⚡ | tests/security/test_url_validator_extended.py | 96 | # is_safe_url -- comprehensive scheme / option / pattern tests | COMMENT |
| MEDIUM⚡ | …ts/security/test_research_service_isolation_fastapi.py | 117 | # Two-real-user harness (real registration, real encrypted per-user DBs) | COMMENT |
| MEDIUM⚡ | …ts/security/test_research_service_isolation_fastapi.py | 246 | # Real-worker harness | COMMENT |
| MEDIUM | tests/security/test_safe_requests_retries.py | 186 | # 30s band absorbs clock jitter and test-harness latency. | COMMENT |
| LOW | tests/research_library/test_utils.py | 459 | # Should not raise an error, just return False | COMMENT |
| MEDIUM⚡ | …ts/research_library/test_deletion_cascade_contracts.py | 982 | # this the refusal above could be a broken harness. | COMMENT |
| MEDIUM | …ts/research_library/test_deletion_cascade_contracts.py | 712 | # the survival above is the guard working, not a broken harness. | COMMENT |
| MEDIUM⚡ | tests/research_library/test_zotero_sync_contracts.py | 88 | # Multi-user on-disk database harness | COMMENT |
| LOW | …esearch_library/downloaders/test_biorxiv_downloader.py | 70 | # Should not raise, just return False | COMMENT |
| MEDIUM | …rch_library/services/test_download_service_3827_fix.py | 651 | # Route session.query(...) by model so the call order is robust to the | COMMENT |
| MEDIUM | …arch_library/services/test_index_finalize_self_heal.py | 132 | # needs real key material; stub it (as the canonical harness does) so | COMMENT |
| MEDIUM⚡ | …sts/web/routers/test_settings_persistence_contracts.py | 150 | # HTTP harness | COMMENT |
| MEDIUM⚡ | …sts/web/routers/test_settings_persistence_contracts.py | 1028 | # of this file that keeps working when the HTTP harness cannot run. | COMMENT |
| MEDIUM⚡ | tests/web/routers/test_settings_lock_enforcement.py | 83 | # HTTP harness | COMMENT |
| MEDIUM⚡ | …sts/web/routers/test_rag_reindex_commit_then_unlink.py | 368 | # (#5765 R5) -- reusing the same ``_reindex_recorder``/RUNNERS harness above, | COMMENT |
| MEDIUM⚡ | tests/web/routers/test_rag_indexing_pipeline.py | 128 | # Real-components harness (the embedding backend is the only fake) | COMMENT |
| MEDIUM | tests/web/routers/test_rag_indexing_pipeline.py | 163 | # this the harness would silently diverge from production on exactly | COMMENT |
| MEDIUM | …web/routers/test_research_history_and_status_guards.py | 123 | # query() call (not a positional index) so the guard stays robust if | COMMENT |
| LOW⚡ | tests/web/routes/test_settings_policy_validators.py | 36 | # Should simply return (not raise) for any well-formed input. | COMMENT |
| MEDIUM⚡ | …b/services/test_research_service_coverage_main_port.py | 53 | # Local harness (kept in this module on purpose — see the porting brief) | COMMENT |
| MEDIUM⚡ | tests/web/services/test_research_service_execution.py | 166 | assert state[0] == 5 # the harness's own baseline emission | CODE |
| MEDIUM | tests/error_handling/test_error_categorization.py | 311 | """Tests for comprehensive error analysis.""" | STRING |
| MEDIUM | tests/ui_tests/run_api_key_test.sh | 38 | # Run the comprehensive test | COMMENT |
| MEDIUM | tests/ui_tests/test_register_full_flow.js | 350 | // Uses AuthHelper for robust CI-compatible registration with proper timeouts | COMMENT |
| MEDIUM | tests/ui_tests/test_register_full_flow.js | 372 | // Use AuthHelper which has robust CI-compatible registration logic | COMMENT |
| MEDIUM | tests/ui_tests/test_checkbox_settings.js | 342 | // Toggle checkbox using robust method | COMMENT |
| MEDIUM | tests/ui_tests/test_checkbox_settings.js | 384 | // Toggle using robust method | COMMENT |
| MEDIUM | tests/ui_tests/test_checkbox_settings.js | 485 | // Toggle the checkbox using robust method | COMMENT |
| MEDIUM | tests/ui_tests/test_research_submit.js | 88 | // Submit the form with robust retry logic | COMMENT |
| MEDIUM | tests/notes/test_note_stress.py | 1453 | # in this test harness; force the capture to None so update_note | COMMENT |
| MEDIUM⚡ | tests/notes/test_post_review_bugfixes.py | 74 | # Route-call harness (only the two route tests need it) | COMMENT |
| LOW⚡ | tests/news/test_card_factory_extended.py | 774 | # This should not raise, just return None | COMMENT |
| MEDIUM⚡ | tests/news/test_news_service_contracts.py | 411 | # Shared database harness (real on-disk SQLite) | COMMENT |
| LOW | …citation_handlers/test_precision_extraction_handler.py | 817 | # Should just return the LLM response without extraction modifications | COMMENT |
| MEDIUM⚡ | tests/document_loaders/test_loader_registry_coverage.py | 314 | # get_loader_for_path - comprehensive coverage | COMMENT |
| MEDIUM | tests/pdf_tests/test_file_validator.py | 242 | """Tests for validate_upload comprehensive method.""" | STRING |
| MEDIUM | tests/health_check/test_endpoints_health.py | 67 | """Run comprehensive health check and print summary""" | STRING |
| LOW⚡ | …ch_engines/rate_limiting/test_tracker_quality_stats.py | 512 | # Should not raise, just return early | COMMENT |
| MEDIUM | …web_search_engines/engines/test_search_engine_sofya.py | 530 | # distinct class objects; only `.value` (or `.name`) is robust. | COMMENT |
| 49 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .gitleaks.toml | 278 | '''your-api-key-here''', | STRING |
| HIGH⚡ | docker-compose.yml | 95 | # - LDR_LLM_OPENAI_API_KEY=<your-api-key> # Lock OpenAI API key | COMMENT |
| HIGH⚡ | docker-compose.yml | 96 | # - LDR_LLM_ANTHROPIC_API_KEY=<your-api-key> # Lock Anthropic API key | COMMENT |
| HIGH⚡ | docker-compose.yml | 106 | # - LDR_LLM_OPENAI_ENDPOINT_API_KEY=<your-api-key> | COMMENT |
| HIGH⚡ | docker-compose.yml | 115 | # - LDR_LLM_OPENAI_ENDPOINT_API_KEY=<your-api-key> | COMMENT |
| HIGH | changelog.d/4988.bugfix.md | 3 | Also added the hyphenated placeholder variants (`your-api-key-here`, `your-openai-key-here`, etc.) that the project's ow | CODE |
| HIGH | changelog.d/6289.bugfix.md | 11 | An unfilled placeholder (`your-api-key-here`, `<your_api_key>`, | CODE |
| HIGH | tests/test_openai_api_key_e2e.py | 18 | export LDR_LLM_OPENAI_API_KEY=your_api_key | STRING |
| HIGH⚡ | …research_library/downloaders/test_openalex_coverage.py | 691 | "<your_api_key>", | CODE |
| HIGH⚡ | …research_library/downloaders/test_openalex_coverage.py | 692 | "your-api-key-here", | CODE |
| HIGH⚡ | tests/search_engines/test_base_helpers.py | 155 | "YOUR_API_KEY", | CODE |
| HIGH⚡ | tests/search_engines/test_base_helpers.py | 156 | "your_api_key", | CODE |
| HIGH⚡ | tests/search_engines/test_base_helpers.py | 157 | "your-api-key", | CODE |
| HIGH⚡ | tests/search_engines/test_base_helpers.py | 164 | "your-api-key-here", | CODE |
| HIGH⚡ | tests/search_engines/test_base_helpers.py | 196 | "<your_api_key>", | CODE |
| HIGH | tests/search_engines/test_base_helpers.py | 336 | "your_api_key", | CODE |
| HIGH | tests/search_engines/test_base_helpers.py | 347 | "your-api-key", # without -here suffix | CODE |
| HIGH⚡ | tests/utilities/test_openalex_enrichment.py | 371 | "your_api_key", | CODE |
| HIGH⚡ | tests/utilities/test_openalex_enrichment.py | 372 | "your-api-key-here", | CODE |
| HIGH⚡ | tests/utilities/test_openalex_enrichment.py | 374 | "<your_api_key>", | CODE |
| HIGH | tests/utilities/test_openalex_enrichment.py | 454 | ["${OPENALEX_API_KEY}", "your-api-key-here", "False", " ", True], | CODE |
| HIGH⚡ | …_search_engines/engines/test_search_engine_openalex.py | 126 | "your-api-key-here", | CODE |
| HIGH⚡ | …_search_engines/engines/test_search_engine_openalex.py | 128 | "<your_api_key>", | CODE |
| HIGH⚡ | …_search_engines/engines/test_search_engine_openalex.py | 129 | "your_api_key", | CODE |
| HIGH | docs/faq.md | 384 | export LDR_LLM_OPENAI_ENDPOINT_API_KEY="<your-api-key>" | CODE |
| HIGH | docs/faq.md | 395 | - LDR_LLM_OPENAI_ENDPOINT_API_KEY=<your-api-key> | CODE |
| HIGH | docs/docker-compose-guide.md | 140 | - LDR_LLM_OPENAI_ENDPOINT_API_KEY=<your-api-key> | CODE |
| HIGH | docs/troubleshooting-openai-api-key.md | 19 | export OPENAI_API_KEY=sk-your-api-key | CODE |
| HIGH | docs/troubleshooting-openai-api-key.md | 42 | export OPENAI_API_KEY=sk-your-api-key | CODE |
| HIGH | docs/troubleshooting-openai-api-key.md | 54 | settings_manager.set_setting("llm.openai.api_key", "sk-your-api-key") | CODE |
| HIGH | docs/troubleshooting-openai-api-key.md | 74 | -H "Authorization: Bearer YOUR_API_KEY" | CODE |
| HIGH | docs/troubleshooting-openai-api-key.md | 218 | settings_manager.set_setting("llm.openai.api_key", "your-api-key") | CODE |
| HIGH | docs/env_configuration.md | 142 | export LDR_LLM_OPENAI_ENDPOINT_API_KEY="<your-api-key>" | CODE |
| HIGH | docs/env_configuration.md | 156 | - LDR_LLM_OPENAI_ENDPOINT_API_KEY=<your-api-key> | CODE |
| HIGH | docs/env_configuration.md | 172 | export LDR_LLM_OPENAI_ENDPOINT_API_KEY="<your-api-key>" | CODE |
| HIGH | docs/env_configuration.md | 182 | -e LDR_LLM_OPENAI_API_KEY=your-api-key-here \ | CODE |
| HIGH | docs/env_configuration.md | 220 | export LDR_LLM_ANTHROPIC_API_KEY=your-api-key-here | CODE |
| HIGH | docs/env_configuration.md | 223 | set LDR_LLM_ANTHROPIC_API_KEY=your-api-key-here | CODE |
| HIGH | examples/optimization/README.md | 47 | python update_llm_config.py --model "google/gemini-2.0-flash" --provider "openai_endpoint" --endpoint "https://openrou | CODE |
| HIGH | examples/optimization/README.md | 52 | python run_gemini_benchmark.py --api-key "your-api-key" --examples 10 | CODE |
| HIGH | examples/optimization/update_llm_config.py | 14 | pdm run python examples/optimization/update_llm_config.py --model "google/gemini-2.0-flash" --provider "openai_endpo | STRING |
| HIGH | examples/benchmarks/run_gemini_benchmark.py | 13 | pdm run python examples/benchmarks/run_gemini_benchmark.py --api-key YOUR_API_KEY | STRING |
| HIGH | …c/local_deep_research/utilities/openalex_enrichment.py | 67 | ``your-api-key-here``, ``<your_api_key>``, ``${OPENALEX_API_KEY}``, … | STRING |
| HIGH | src/local_deep_research/api/research_functions.py | 240 | api_key="your-api-key-here" | STRING |
| HIGH⚡ | …deep_research/web_search_engines/search_engine_base.py | 59 | "your_api_key", | CODE |
| HIGH⚡ | …deep_research/web_search_engines/search_engine_base.py | 67 | "your-api-key-here", | CODE |
| HIGH⚡ | …deep_research/web_search_engines/search_engine_base.py | 77 | "your-api-key", # without -here suffix | CODE |
| HIGH | …deep_research/web_search_engines/search_engine_base.py | 96 | - Angle-bracket templates: ``<...>`` (e.g. ``<your_api_key>``) | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_openai_api_key_e2e.py | 64 | # Step 1: Authenticate | COMMENT |
| LOW⚡ | tests/test_openai_api_key_e2e.py | 71 | # Step 2: Configure settings | COMMENT |
| LOW⚡ | tests/test_openai_api_key_e2e.py | 109 | # Step 3: Test LLM initialization | COMMENT |
| LOW⚡ | tests/test_openai_api_key_e2e.py | 120 | # Step 4: Test simple LLM call | COMMENT |
| LOW⚡ | tests/test_openai_api_key_e2e.py | 143 | # Step 5: Test research functionality | COMMENT |
| LOW⚡ | tests/vector_stores/test_full_migration_lifecycle.py | 227 | # Step 1: a REALISTIC LEGACY index directly at the SHARED (NOT | COMMENT |
| LOW⚡ | tests/vector_stores/test_full_migration_lifecycle.py | 310 | # Step 3: trigger the per-user relocation. In production this is | COMMENT |
| LOW⚡ | tests/vector_stores/test_full_migration_lifecycle.py | 391 | # Step 4: SEARCH through the real VectorIndex facade (via the | COMMENT |
| LOW⚡ | tests/vector_stores/test_full_migration_lifecycle.py | 402 | # Step 5: a NEW document indexed normally MERGES into the relocated + | COMMENT |
| LOW⚡ | tests/database/test_alembic_migrations.py | 4627 | # Step 1: Migrate to 0001 only | STRING |
| LOW⚡ | tests/database/test_alembic_migrations.py | 4631 | # Step 2: Insert data | STRING |
| LOW⚡ | tests/database/test_alembic_migrations.py | 4658 | # Step 3: Upgrade to head (0005) | STRING |
| LOW⚡ | tests/database/test_alembic_migrations.py | 4662 | # Step 4: Verify data survived | STRING |
| LOW | tests/database/test_alembic_migrations.py | 4675 | # Step 5: Verify new columns exist | STRING |
| LOW | tests/database/test_alembic_migrations.py | 4707 | # Step 6: Another run_migrations should be no-op | STRING |
| LOW⚡ | tests/deletion/test_cascade_integration.py | 241 | # Step 1: Delete chunks (no FK, manual cleanup required) | COMMENT |
| LOW⚡ | tests/deletion/test_cascade_integration.py | 247 | # Step 2: Delete document (CASCADE handles blob and collection links) | COMMENT |
| LOW⚡ | tests/deletion/test_cascade_integration.py | 404 | # Step 1: Delete chunks (no FK, manual cleanup) | COMMENT |
| LOW⚡ | tests/deletion/test_cascade_integration.py | 409 | # Step 2: Delete RAG index | COMMENT |
| LOW⚡ | tests/deletion/test_cascade_integration.py | 414 | # Step 3: Delete collection (CASCADE handles folders, links) | COMMENT |
| LOW⚡ | tests/chat/test_chat_e2e_flows.py | 19 | # Step 1: Create session | COMMENT |
| LOW | tests/chat/test_chat_e2e_flows.py | 30 | # Step 2: Send a message | COMMENT |
| LOW | tests/chat/test_chat_e2e_flows.py | 44 | # Step 3: Get messages | COMMENT |
| LOW | …curity/test_db_connection_rekey_kills_held_sessions.py | 161 | # Step 1: close. The session survives via creator-closure reconnect | COMMENT |
| LOW | …curity/test_db_connection_rekey_kills_held_sessions.py | 174 | # Step 2: rekey. The resurrecting connection now derives the OLD key | COMMENT |
| LOW⚡ | tests/security/test_csrf_e2e_flow.py | 20 | # Step 1: stamp the session and fetch a CSRF token for registration. | COMMENT |
| LOW⚡ | tests/security/test_csrf_e2e_flow.py | 26 | # Step 2: Register (auto-logs in the user). | COMMENT |
| LOW⚡ | tests/security/test_csrf_e2e_flow.py | 44 | # Step 3: Get the post-login API CSRF token. | COMMENT |
| LOW⚡ | tests/security/test_csrf_e2e_flow.py | 47 | # Step 4: POST a browser-facing endpoint WITH the token — must pass | COMMENT |
| LOW | tests/security/test_csrf_e2e_flow.py | 61 | # Step 5: POST the same endpoint WITHOUT a token — CSRF rejection (403). | COMMENT |
| LOW | …ts/security/test_db_connection_change_password_race.py | 972 | # Step 5: the parked OLD-key open tries to publish after the rekey. | COMMENT |
| LOW | …s/security/test_settings_secret_redaction_isolation.py | 1106 | # Step 1: submit both items with ONLY api_key visible (masked). If | COMMENT |
| LOW⚡ | tests/security/test_noncollection_agent_enabled.py | 649 | # Step 1: Add API key only. agent_enabled is still False by default. | COMMENT |
| LOW⚡ | tests/security/test_noncollection_agent_enabled.py | 656 | # Step 2: Explicitly enable for agent. | COMMENT |
| LOW⚡ | tests/security/test_noncollection_agent_enabled.py | 676 | # Step 1: Add API key. Defaults agent_enabled=True. | COMMENT |
| LOW⚡ | tests/security/test_noncollection_agent_enabled.py | 683 | # Step 2: Toggle off. | COMMENT |
| LOW | tests/research_library/zotero/test_sync_service.py | 1950 | # Step 1: first contact — byte-identical, so the item adopts the upload. | COMMENT |
| LOW | tests/research_library/zotero/test_sync_service.py | 1965 | # Step 2: the PDF is replaced in Zotero — content now differs. | COMMENT |
| LOW | …arch_library/services/test_index_documents_parallel.py | 825 | # Step 1: pre-create wrapper A and put it in the dict as canonical. | COMMENT |
| LOW⚡ | …rch_library/services/test_multi_model_switch_revert.py | 207 | # Step 1: index under model A. | COMMENT |
| LOW⚡ | …rch_library/services/test_multi_model_switch_revert.py | 255 | # Step 2: switch to model B, force-reindex the SAME document/collection. | COMMENT |
| LOW⚡ | …rch_library/services/test_multi_model_switch_revert.py | 361 | # Step 4: revert for real via the WRITE-path resolution | COMMENT |
| LOW⚡ | tests/web/test_long_integration_flows.py | 526 | # Step 2: B writes its own marker. | COMMENT |
| LOW⚡ | tests/web/test_long_integration_flows.py | 534 | # Step 3: both read back — each must see only its own marker. | COMMENT |
| LOW⚡ | tests/web/test_long_integration_flows.py | 540 | # Step 4: A creates a collection; B immediately lists collections | COMMENT |
| LOW | tests/web/test_long_integration_flows.py | 513 | # Step 1: A writes, B has not written yet -> B must still see its | COMMENT |
| LOW | tests/web/test_long_integration_flows.py | 556 | # Step 5: B creates its own collection; A must not see it either. | COMMENT |
| LOW | tests/web/test_long_integration_flows.py | 571 | # Step 6: cross-user direct-object access on the collection | COMMENT |
| LOW⚡ | tests/ui_tests/test_research_diagnosis.js | 75 | // Step 1: Authenticate | COMMENT |
| LOW⚡ | tests/ui_tests/test_research_diagnosis.js | 80 | // Step 2: Go to home page | COMMENT |
| LOW⚡ | tests/ui_tests/test_research_diagnosis.js | 86 | // Step 3: Check what's on the page | COMMENT |
| LOW | tests/ui_tests/test_research_diagnosis.js | 151 | // Step 4: Fill the form | COMMENT |
| LOW | tests/ui_tests/test_research_diagnosis.js | 190 | // Step 5: Check JavaScript state | COMMENT |
| LOW | tests/ui_tests/test_research_diagnosis.js | 235 | // Step 6: Submit the form | COMMENT |
| LOW | tests/ui_tests/test_research_diagnosis.js | 279 | // Step 7: Summary | COMMENT |
| LOW | …ts/ui_tests/NO_CI_executes_research_followup_simple.js | 41 | // Step 1: Login | COMMENT |
| LOW⚡ | …ts/ui_tests/NO_CI_executes_research_followup_simple.js | 55 | // Step 2: Navigate to parent research | COMMENT |
| LOW⚡ | …ts/ui_tests/NO_CI_executes_research_followup_simple.js | 65 | // Step 3: Test direct API call for follow-up | COMMENT |
| LOW⚡ | …sts/ui_tests/NO_CI_executes_research_fixed_research.js | 27 | // Step 1: Authenticate | COMMENT |
| LOW⚡ | …sts/ui_tests/NO_CI_executes_research_fixed_research.js | 32 | // Step 2: Navigate to home | COMMENT |
| 91 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_advertised_but_dead_sweep.py | 832 | fake_key, fake_env = "made.up.setting", "TOTALLY_NOT_READ_ANYWHERE" | CODE |
| LOW⚡ | tests/test_advertised_but_dead_sweep.py | 833 | assert fake_env != _derived_env_var(fake_key) | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 209 | fake_key = "sk-" + "a1b2c3d4e5f6g7h8i9j0" # 20+ chars: real key shape | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 210 | err = Exception(f"Error: 429 quota exceeded, key {fake_key}") | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 217 | assert fake_key not in str(exc_info.value) | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 264 | fake_key = "sk-" + "a1b2c3d4e5f6g7h8i9j0" | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 265 | err = Exception(f"Error: 429 quota exceeded, key {fake_key}") | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 328 | fake_key = "sk-" + "z9y8x7w6v5u4t3s2r1q0" | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 332 | raise Exception(f"Error: 429 quota exceeded, key {fake_key}") | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 403 | fake_key = "sk-" + "z9y8x7w6v5u4t3s2r1q0" | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 405 | side_effect=Exception(f"429 quota, auth Bearer {fake_key}") | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 410 | assert fake_key not in str(results[0]) | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 416 | fake_key = "sk-" + "m1n2o3p4q5r6s7t8u9v0" | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 418 | side_effect=Exception(f"429 quota, auth Bearer {fake_key}") | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 424 | assert fake_key not in str(exc_info.value) | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 735 | fake_key = self.FAKE_KEY | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 742 | raise RuntimeError(f"Error: 429 cleanup, key {fake_key}") | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 757 | fake_key = self.FAKE_KEY | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 764 | raise RuntimeError(f"Error: 429 cleanup, key {fake_key}") | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 773 | assert fake_key not in str(exc_info.value) | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 783 | fake_key = self.FAKE_KEY | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 790 | raise RuntimeError(f"Error: 429 cleanup, key {fake_key}") | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 814 | fake_key = self.FAKE_KEY | CODE |
| LOW⚡ | tests/test_llm_rate_limiting.py | 821 | raise RuntimeError(f"Error: 429 cleanup, key {fake_key}") | CODE |
| LOW | tests/test_llm_rate_limiting.py | 277 | assert fake_key not in str(exc_info.value) | CODE |
| LOW | tests/test_llm_rate_limiting.py | 343 | assert fake_key not in str(exc_info.value) | CODE |
| LOW | tests/test_llm_rate_limiting.py | 833 | assert fake_key not in str(raised) | CODE |
| LOW | tests/test_search_engines_enhanced.py | 167 | Mock(name="John Doe"), | CODE |
| LOW⚡ | tests/mock_fixtures.py | 122 | "authors": [{"name": "John Doe"}, {"name": "Jane Smith"}], | CODE |
| LOW | …sts/vector_stores/test_legacy_cleanup_edge_failures.py | 70 | pkl_path.write_bytes(b"placeholder") | CODE |
| LOW | …sts/vector_stores/test_legacy_cleanup_edge_failures.py | 230 | faiss_path.write_bytes(b"placeholder") | CODE |
| LOW⚡ | tests/database/test_credential_store_behavior.py | 340 | special_user = "user@example.com" | CODE |
| LOW | tests/database/backup/test_backup_service.py | 3277 | "user@example.com", # Email format | CODE |
| LOW⚡ | …/advanced_search_system/evidence/test_base_evidence.py | 120 | metadata = {"author": "John Doe", "publication": "Science Journal"} | CODE |
| LOW⚡ | …/advanced_search_system/evidence/test_base_evidence.py | 129 | assert evidence.metadata["author"] == "John Doe" | CODE |
| LOW | …ystem/questions/followup/test_llm_followup_question.py | 240 | assert "placeholder" in docstring.lower() or "NOTE" in docstring | CODE |
| LOW | tests/security/test_flask_secret_key_gate.py | 318 | Deliberately avoids the words "example"/"placeholder" in the comment: | STRING |
| LOW⚡ | tests/security/test_csrf_protection.py | 188 | "csrf_token": "invalid-fake-token-12345", | CODE |
| LOW | tests/js/utils/form-validation.test.js | 293 | expect(emailLike('user@example.com')).toBeNull(); | CODE |
| LOW | …/research_library/downloaders/test_arxiv_downloader.py | 361 | assert "John Doe" in metadata | CODE |
| LOW | …esearch_library/downloaders/test_metadata_extractor.py | 80 | "author": {"name": "Jane Doe"}, | CODE |
| LOW | …esearch_library/downloaders/test_metadata_extractor.py | 90 | assert "Jane Doe" in result | CODE |
| LOW⚡ | …rary/downloaders/test_html_downloader_deep_coverage.py | 426 | <meta name="author" content="John Doe"> | CODE |
| LOW⚡ | …rary/downloaders/test_html_downloader_deep_coverage.py | 435 | assert meta["author"] == "John Doe" | STRING |
| LOW⚡ | …ibrary/downloaders/test_metadata_extractor_expanded.py | 157 | item = {"headline": "Story", "author": "Jane Doe"} | CODE |
| LOW⚡ | …ibrary/downloaders/test_metadata_extractor_expanded.py | 160 | assert "Jane Doe" in text | CODE |
| LOW⚡ | tests/strategies/test_langgraph_agent_strategy.py | 7641 | shared = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. " * 8 | CODE |
| LOW⚡ | tests/strategies/test_langgraph_agent_strategy.py | 7641 | shared = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. " * 8 | CODE |
| LOW | tests/search_engines/conftest.py | 138 | "authors": ["John Doe", "Jane Smith"], | CODE |
| LOW | …sts/search_engines/test_search_engine_stackexchange.py | 345 | "display_name": "John Doe", | CODE |
| LOW | …sts/search_engines/test_search_engine_stackexchange.py | 375 | assert previews[0]["author"] == "John Doe" | CODE |
| LOW⚡ | tests/search_engines/test_search_engine_retriever.py | 184 | "author": "John Doe", | CODE |
| LOW⚡ | tests/search_engines/test_search_engine_retriever.py | 194 | assert result["author"] == "John Doe" | CODE |
| LOW | tests/search_engines/test_search_engine_paperless.py | 307 | "correspondent_name": "Acme Corp", | CODE |
| LOW | tests/search_engines/test_search_engine_paperless.py | 321 | assert preview["author"] == "Acme Corp" | CODE |
| LOW⚡ | tests/search_engines/test_base_helpers.py | 115 | assert BaseSearchEngine._is_valid_api_key("placeholder") is False | CODE |
| LOW⚡ | tests/search_engines/test_base_helpers.py | 145 | "placeholder", | CODE |
| LOW⚡ | tests/search_engines/test_base_helpers.py | 150 | "placeholder", | CODE |
| LOW | tests/search_engines/test_base_helpers.py | 334 | "placeholder", | CODE |
| LOW | tests/search_engines/test_search_engine_arxiv.py | 108 | mock_result.authors = [Mock(name="John Doe"), Mock(name="Jane Smith")] | CODE |
| 62 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/security/test_cross_user_settings.py | 52 | def _set_provider_secret(user: AuthenticatedUser, secret: str) -> None: | CODE |
| LOW | tests/web/routers/test_post_login_worker_dispatch.py | 55 | def _set_unique_peer(client: TestClient) -> None: | CODE |
| LOW | src/local_deep_research/__init__.py | 15 | __all__ = [ | CODE |
| LOW | src/local_deep_research/vector_stores/__init__.py | 16 | __all__ = [ | CODE |
| LOW | src/local_deep_research/metrics/__init__.py | 6 | __all__ = [ | CODE |
| LOW | src/local_deep_research/metrics/pricing/__init__.py | 12 | __all__ = ["CostCalculator", "PricingCache", "PricingFetcher"] | CODE |
| LOW | src/local_deep_research/settings/env_settings.py | 385 | __all__ = [ | CODE |
| LOW | src/local_deep_research/settings/__init__.py | 18 | __all__ = [ | CODE |
| LOW | src/local_deep_research/settings/env_registry.py | 147 | __all__ = [ | CODE |
| LOW | src/local_deep_research/settings/manager.py | 1678 | def update_db_version(self, commit: bool = True) -> None: | CODE |
| LOW | …cal_deep_research/settings/env_definitions/__init__.py | 27 | __all__ = [ | CODE |
| LOW | src/local_deep_research/database/sqlcipher_utils.py | 257 | def set_sqlcipher_key_from_hex(cursor_or_conn: Any, hex_key: str) -> None: | CODE |
| LOW | src/local_deep_research/database/models/__init__.py | 114 | __all__ = [ | CODE |
| LOW | src/local_deep_research/database/models/base.py | 14 | __all__ = ["Base"] | CODE |
| LOW | src/local_deep_research/database/backup/__init__.py | 12 | __all__ = [ | CODE |
| LOW | …local_deep_research/advanced_search_system/__init__.py | 7 | __all__ = [] | CODE |
| LOW | …research/advanced_search_system/candidates/__init__.py | 5 | __all__ = ["Candidate"] | CODE |
| LOW | …ep_research/advanced_search_system/filters/__init__.py | 8 | __all__ = ["CrossEngineFilter"] | CODE |
| LOW | …esearch/advanced_search_system/tools/fetch/__init__.py | 780 | __all__ = [ | CODE |
| LOW | …p_research/advanced_search_system/evidence/__init__.py | 6 | __all__ = [ | CODE |
| LOW | …esearch/advanced_search_system/constraints/__init__.py | 6 | __all__ = ["Constraint", "ConstraintAnalyzer", "ConstraintType"] | CODE |
| LOW | …earch/advanced_search_system/summarization/__init__.py | 11 | __all__ = [ | CODE |
| LOW | …research/advanced_search_system/strategies/__init__.py | 7 | __all__ = [ | CODE |
| LOW | …earch_system/strategies/topic_organization_strategy.py | 209 | def set_progress_callback(self, callback) -> None: | CODE |
| LOW | …advanced_search_system/strategies/followup/__init__.py | 10 | __all__ = ["EnhancedContextualFollowUpStrategy"] | CODE |
| LOW | …vanced_search_system/candidate_exploration/__init__.py | 15 | __all__ = [ | CODE |
| LOW | …search/advanced_search_system/repositories/__init__.py | 7 | __all__ = ["FindingsRepository"] | CODE |
| LOW | …deep_research/advanced_search_system/findings/topic.py | 41 | def update_lead_source(self, new_lead: Dict[str, Any]) -> None: | CODE |
| LOW | …deep_research/advanced_search_system/findings/topic.py | 100 | def set_parent_child(self, parent_id: str, child_id: str) -> None: | CODE |
| LOW | …_research/advanced_search_system/questions/__init__.py | 10 | __all__ = [ | CODE |
| LOW | …/advanced_search_system/questions/followup/__init__.py | 11 | __all__ = [ | CODE |
| LOW | src/local_deep_research/llm/__init__.py | 12 | __all__ = [ | CODE |
| LOW | src/local_deep_research/llm/providers/__init__.py | 10 | __all__ = [ | CODE |
| LOW | src/local_deep_research/embeddings/__init__.py | 29 | __all__ = [ | CODE |
| LOW | …c/local_deep_research/embeddings/providers/__init__.py | 5 | __all__ = ["BaseEmbeddingProvider"] | CODE |
| LOW | …earch/embeddings/providers/implementations/__init__.py | 7 | __all__ = [ | CODE |
| LOW | …c/local_deep_research/embeddings/splitters/__init__.py | 9 | __all__ = ["get_text_splitter", "VALID_SPLITTER_TYPES"] | CODE |
| LOW | src/local_deep_research/chat/__init__.py | 18 | __all__ = [ | CODE |
| LOW | src/local_deep_research/content_fetcher/__init__.py | 19 | __all__ = ["ContentFetcher", "URLClassifier", "URLType"] | CODE |
| LOW | src/local_deep_research/security/__init__.py | 79 | __all__ = [ | CODE |
| LOW | src/local_deep_research/security/egress/audit_hook.py | 73 | def set_active_context(ctx) -> None: | CODE |
| LOW | src/local_deep_research/security/egress/__init__.py | 42 | __all__ = [ | CODE |
| LOW | …ocal_deep_research/security/file_integrity/__init__.py | 37 | __all__ = [ | CODE |
| LOW | …_research/security/file_integrity/integrity_manager.py | 346 | def update_checksum(self, file_path: Path) -> None: | CODE |
| LOW | …research/security/file_integrity/verifiers/__init__.py | 5 | __all__ = ["FAISSIndexVerifier"] | CODE |
| LOW | src/local_deep_research/research_library/__init__.py | 15 | __all__ = [ | CODE |
| LOW | …al_deep_research/research_library/deletion/__init__.py | 21 | __all__ = [ | CODE |
| LOW | …p_research/research_library/deletion/utils/__init__.py | 5 | __all__ = ["CascadeHelper"] | CODE |
| LOW | …esearch/research_library/deletion/services/__init__.py | 7 | __all__ = [ | CODE |
| LOW | …deep_research/research_library/downloaders/__init__.py | 19 | __all__ = [ | CODE |
| LOW | …ch/research_library/downloaders/extraction/__init__.py | 21 | __all__ = [ | CODE |
| LOW | …ocal_deep_research/research_library/zotero/__init__.py | 20 | __all__ = [ | CODE |
| LOW | …_deep_research/research_library/zotero/sync_service.py | 447 | def _set_progress(self, **fields) -> None: | CODE |
| LOW | …ocal_deep_research/research_library/search/__init__.py | 10 | __all__ = ["ResearchHistoryIndexer"] | CODE |
| LOW | …_research/research_library/search/services/__init__.py | 6 | __all__ = ["ResearchHistoryIndexer", "auto_convert_research"] | CODE |
| LOW | …local_deep_research/research_library/notes/__init__.py | 18 | __all__ = ["NoteService", "NoteAIService"] | CODE |
| LOW | …p_research/research_library/notes/services/__init__.py | 16 | __all__ = ["NoteService", "NoteAIService", "get_note_source_type_id"] | CODE |
| LOW | src/local_deep_research/exporters/__init__.py | 45 | __all__ = [ | CODE |
| LOW⚡ | src/local_deep_research/web/fastapi_app.py | 1994 | def _setup_rate_limiting(app: FastAPI) -> None: | CODE |
| LOW⚡ | src/local_deep_research/web/fastapi_app.py | 2196 | def _setup_template_globals() -> None: | CODE |
| 48 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/vector_stores/test_faiss_store.py | 31 | CODE | |
| LOW | tests/security/test_ooxml_decompression_caps.py | 7174 | CODE | |
| LOW | …web/routers/test_settings_routes_deep_coverage_port.py | 41 | CODE | |
| LOW | …eb/routers/test_settings_routes_deep_coverage2_port.py | 30 | CODE | |
| LOW | …outers/test_settings_routes_corrupted_coverage_port.py | 25 | CODE | |
| LOW | tests/web/routers/test_settings_routes_coverage_port.py | 44 | CODE | |
| LOW | …/test_settings_routes_save_validation_coverage_port.py | 49 | CODE | |
| LOW | tests/web/services/test_settings_manager_extended.py | 25 | CODE | |
| LOW | tests/web/services/test_settings_manager.py | 21 | CODE | |
| LOW | tests/web/services/test_research_execution_boundary.py | 280 | CODE | |
| LOW | tests/news/test_folder_manager_behavior.py | 20 | CODE | |
| LOW | tests/web_search_engines/engines/test_arxiv_coverage.py | 48 | CODE | |
| LOW | …s/web_search_engines/engines/test_guardian_coverage.py | 50 | CODE | |
| LOW | …mples/benchmarks/browsecomp/run_browsecomp_fixed_v2.py | 81 | CODE | |
| LOW | src/local_deep_research/search_system.py | 74 | CODE | |
| LOW | …search_system/strategies/focused_iteration_strategy.py | 59 | CODE | |
| LOW | …earch_system/strategies/topic_organization_strategy.py | 29 | CODE | |
| LOW | …nced_search_system/strategies/source_based_strategy.py | 66 | CODE | |
| LOW | …d_search_system/strategies/langgraph_agent_strategy.py | 1732 | CODE | |
| LOW | src/local_deep_research/config/llm_config.py | 81 | CODE | |
| LOW | …earch/research_library/services/library_rag_service.py | 327 | CODE | |
| LOW | …_research/research_library/services/library_service.py | 269 | CODE | |
| LOW | src/local_deep_research/news/api.py | 1106 | CODE | |
| LOW | …/local_deep_research/benchmarks/benchmark_functions.py | 25 | CODE | |
| LOW | …/local_deep_research/benchmarks/benchmark_functions.py | 112 | CODE | |
| LOW | …/local_deep_research/benchmarks/benchmark_functions.py | 199 | CODE | |
| LOW | src/local_deep_research/benchmarks/runners.py | 41 | CODE | |
| LOW | src/local_deep_research/benchmarks/optimization/api.py | 15 | CODE | |
| LOW | …p_research/benchmarks/optimization/optuna_optimizer.py | 1068 | CODE | |
| LOW | …p_research/benchmarks/optimization/optuna_optimizer.py | 98 | CODE | |
| LOW | src/local_deep_research/api/benchmark_functions.py | 21 | CODE | |
| LOW | src/local_deep_research/api/benchmark_functions.py | 75 | CODE | |
| LOW | src/local_deep_research/api/benchmark_functions.py | 129 | CODE | |
| LOW | src/local_deep_research/api/research_functions.py | 36 | CODE | |
| LOW | src/local_deep_research/api/research_functions.py | 191 | CODE | |
| LOW | src/local_deep_research/api/research_functions.py | 376 | CODE | |
| LOW | …p_research/web_search_engines/search_engine_factory.py | 991 | CODE | |
| LOW | …deep_research/web_search_engines/search_engine_base.py | 447 | CODE | |
| LOW | …web_search_engines/engines/search_engine_google_pse.py | 25 | CODE | |
| LOW | …/web_search_engines/engines/search_engine_scaleserp.py | 22 | CODE | |
| LOW | …search/web_search_engines/engines/search_engine_ddg.py | 21 | CODE | |
| LOW | …rch/web_search_engines/engines/search_engine_mojeek.py | 38 | CODE | |
| LOW | …ch/web_search_engines/engines/search_engine_serpapi.py | 26 | CODE | |
| LOW | …rch/web_search_engines/engines/search_engine_tavily.py | 31 | CODE | |
| LOW | …search/web_search_engines/engines/search_engine_exa.py | 22 | CODE | |
| LOW | …rch/web_search_engines/engines/search_engine_pubmed.py | 32 | CODE | |
| LOW | …_search_engines/engines/search_engine_stackexchange.py | 57 | CODE | |
| LOW | …rch/web_search_engines/engines/search_engine_zenodo.py | 34 | CODE | |
| LOW | …rch/web_search_engines/engines/search_engine_serper.py | 28 | CODE | |
| LOW | …ch/web_search_engines/engines/search_engine_searxng.py | 158 | CODE | |
| LOW | …h/web_search_engines/engines/search_engine_guardian.py | 22 | CODE | |
| LOW | …arch/web_search_engines/engines/search_engine_brave.py | 29 | CODE | |
| LOW | …arch/web_search_engines/engines/search_engine_arxiv.py | 75 | CODE | |
| LOW | …h/web_search_engines/engines/search_engine_tinyfish.py | 28 | CODE | |
| LOW | …eep_research/web_search_engines/engines/full_search.py | 122 | CODE | |
| LOW | …h/web_search_engines/engines/search_engine_openalex.py | 60 | CODE | |
| LOW | …rch/web_search_engines/engines/search_engine_github.py | 33 | CODE | |
| LOW | …h/web_search_engines/engines/search_engine_nasa_ads.py | 26 | CODE | |
| LOW | …arch/web_search_engines/engines/search_engine_sofya.py | 48 | CODE | |
| LOW | …/web_search_engines/engines/search_engine_gutenberg.py | 32 | CODE | |
| 4 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/metrics/test_link_analytics_computation.py | 128 | CODE | |
| MEDIUM | …earch_library/routes/test_rag_routes_deep_main_port.py | 231 | CODE | |
| MEDIUM | tests/web/routers/test_context_overflow_port.py | 101 | CODE | |
| MEDIUM | …sts/web/routers/test_research_route_error_envelopes.py | 70 | CODE | |
| MEDIUM | …sts/web/routers/test_metrics_endpoint_edge_branches.py | 72 | CODE | |
| MEDIUM | tests/web/routers/test_history_branch_recovery.py | 78 | CODE | |
| MEDIUM | tests/web/routers/test_search_favorites.py | 90 | CODE | |
| MEDIUM | tests/web/queue/test_queue_manager.py | 35 | CODE | |
| MEDIUM | tests/utilities/test_arxiv_fetch_api.py | 161 | CODE | |
| MEDIUM | …rch_engines/engines/test_embedding_manager_coverage.py | 345 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/ui_tests/test_streaming_realtime_ci.js | 192 | 'handler is supposed to return False when request.session has no username.' | CODE |
| HIGH | tests/ui_tests/test_lib/test_results.js | 203 | print() { | CODE |
| HIGH | …cal_deep_research/web/static/js/components/settings.js | 3428 | * @return True if the content is valid. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_migration_shelved_coverage_ratchet.py | 242 | def helper(value=stop({reason!r}, allow_module_level=True)): | CODE |
| LOW | tests/test_migration_shelved_coverage_ratchet.py | 279 | def helper(value=stop({reason!r}, allow_module_level=True)): | CODE |
| LOW | tests/test_migration_decision_records.py | 750 | def helper(value=stop("removed in the migration", allow_module_level=True)): | CODE |
| LOW⚡ | tests/security/test_sensitive_logging_hook.py | 503 | "def helper(requests):\n" | CODE |
| LOW⚡ | tests/security/test_sensitive_logging_hook.py | 701 | "def helper():\n" | CODE |
| LOW⚡ | tests/security/test_sensitive_logging_hook.py | 863 | "def helper(log_obj):\n" | CODE |
| LOW⚡ | tests/security/test_sensitive_logging_hook.py | 934 | "def helper(session):\n" | CODE |
| LOW | tests/security/test_llm_object_not_logged.py | 449 | # A nested `def helper(): print(llm)` is ordinary code that | COMMENT |
| LOW | tests/security/test_llm_object_not_logged.py | 621 | " def helper():\n" | CODE |
| LOW | tests/security/test_env_vars_hook.py | 120 | def process_data(data): | CODE |
| LOW | tests/web/test_startup_ordering_contracts.py | 256 | def helper(): | CODE |
| LOW | tests/web/test_csrf_lifecycle_contracts.py | 150 | def helper(request: Request, token: str): | CODE |
| LOW⚡ | tests/utilities/test_thread_context.py | 221 | def my_function(): | CODE |
| LOW | tests/utilities/test_db_utils.py | 237 | def my_function(): | CODE |
| LOW⚡ | tests/hooks/test_check_fastapi_default_parameters.py | 105 | "def helper(path=Path('.'), value=Depends('local')):\n" | CODE |
| LOW⚡ | tests/hooks/test_check_weak_tests.py | 150 | "def helper():\n assert True\n", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_programmatic_custom_llm_retriever.py | 76 | # Using gemma3n:e4b as requested | COMMENT |
| HIGH | .github/workflows/release.yml | 790 | # 1. AI-generated narrative (model = vars.AI_MODEL). Fed the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | …tation_handlers/test_forced_answer_citation_handler.py | 90 | content = "I cannot provide a specific answer based on the sources." | CODE |
| MEDIUM | examples/optimization/example_quick_optimization.py | 35 | This is just for demonstration purposes. | STRING |
| MEDIUM | examples/optimization/example_quick_optimization.py | 274 | "\nNote: This is a simulation for demonstration purposes only. Real optimization" | CODE |
| MEDIUM | examples/optimization/multi_benchmark_simulation.py | 176 | """Simulates Optuna optimizer for demonstration purposes.""" | STRING |
| MEDIUM | examples/optimization/multi_benchmark_simulation.py | 406 | print("\nNote: This is a simulation for demonstration purposes only.") | CODE |
| MEDIUM | .github/workflows/codeql.yml | 61 | # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | docker-compose.gpu.override.yml | 11 | # Usage: | COMMENT |
| LOW | tests/ui_tests/run_legacy_pkl_migration.sh | 17 | # Usage: | COMMENT |
| LOW | scripts/dev/restart_server.sh | 4 | # Usage: | COMMENT |
| LOW | .github/scripts/combine-ai-reviews.sh | 13 | # Usage: | COMMENT |