Open device management
This report summarizes scanner evidence for fleetdm/fleet, a Go project with 7,086 GitHub stars. SynthScan examined 2,696,105 lines of code across 14158 source files, recording 4708 pattern matches distributed across 22 syntactic categories. The legacy adjusted pattern signal is 2.3 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 3910 finding(s).
Are imports declared and package/API names verified? 383 finding(s).
Are wrappers, guards, and repeated structures necessary? 496 finding(s).
Which changes need focused human review? 4708 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 4708 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmd/osquery-perf/agent.go | 521 | COMMENT | |
| LOW | cmd/osquery-perf/agent.go | 561 | // Fleet-signed registration token from a delivered PSSO profile. The PSSO | COMMENT |
| LOW | cmd/osquery-perf/agent.go | 4781 | embeddedBundlePaths = flag.Bool("embedded_bundle_paths", false, "Nest duplicate-bundle paths under their | COMMENT |
| LOW | cmd/osquery-perf/android_agent.go | 21 | "github.com/fleetdm/fleet/v4/cmd/osquery-perf/osquery_perf" | COMMENT |
| LOW | cmd/osquery-perf/android_agent.go | 181 | // physical SIM reports and Fleet stores as no value at all. | COMMENT |
| LOW | cmd/osquery-perf/android_agent.go | 221 | COMMENT | |
| LOW | cmd/osquery-perf/android_agent.go | 281 | // it installs an update, which is why a simulated device can report | COMMENT |
| LOW | cmd/apple-apns-mock/coordinator_test.go | 61 | // waitAnnouncementsHandled blocks until this node's subscription has handled | COMMENT |
| LOW | cmd/apple-apns-mock/handlers.go | 81 | // would otherwise stay alive for the life of the stream. | COMMENT |
| LOW | cmd/govulndb-mirror/transform.go | 21 | // not the binary it produced, so they are not mirrored. | COMMENT |
| LOW | cmd/govulndb-mirror/validate.go | 1 | package main | COMMENT |
| LOW | cmd/govulndb-mirror/main.go | 1 | // Command govulndb-mirror mirrors the Go vulnerability database (https://vuln.go.dev) into the | COMMENT |
| LOW | cmd/maintained-apps/validate/windows.go | 141 | } | COMMENT |
| LOW | cmd/osv-processor/transforms.go | 21 | // CVE-specific modifications: modify vulnerability details for specific CVEs | COMMENT |
| LOW | cmd/osv-processor/sync-and-detect-changes.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | cmd/osv-processor/main.go | 581 | // Only "enterprise_linux" ecosystems are supported; variants like rhel_e4s, rhel_eus, | COMMENT |
| LOW | cmd/fleetctl/fleetctl/gitops.go | 881 | COMMENT | |
| LOW | cmd/fleetctl/fleetctl/gitops_test.go | 681 | // // url: https://hydrant2.example.com | COMMENT |
| LOW | cmd/fleetctl/fleetctl/apply_test.go | 3081 | COMMENT | |
| LOW | cmd/fleetctl/fleetctl/apply_test.go | 3101 | // assert.False(t, ds.InsertMDMAppleBootstrapPackageFuncInvoked) | COMMENT |
| LOW | cmd/fleetctl/fleetctl/apply_test.go | 3121 | // assert.False(t, ds.DeleteMDMAppleBootstrapPackageFuncInvoked) | COMMENT |
| LOW | cmd/fleetctl/fleetctl/apply_deprecated_test.go | 1381 | // name := writeTmpYml(t, fmt.Sprintf(appConfigSpecEnableEndUserAuth, "true")) | COMMENT |
| LOW | cmd/fleetctl/fleetctl/apply_deprecated_test.go | 1401 | // assert.True(t, ds.SaveAppConfigFuncInvoked) | COMMENT |
| LOW | cmd/fleetctl/fleetctl/apply_deprecated_test.go | 1421 | // assert.True(t, ds.SaveTeamFuncInvoked) | COMMENT |
| LOW | …d/fleetctl/fleetctl/templates/new/default.template.yml | 1 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # | COMMENT |
| LOW | …d/fleetctl/fleetctl/templates/new/default.template.yml | 21 | # Read more: | COMMENT |
| LOW | …d/fleetctl/fleetctl/templates/new/default.template.yml | 41 | # • https://fleetdm.com/docs/deploy/single-sign-on-sso | COMMENT |
| LOW | …d/fleetctl/fleetctl/templates/new/default.template.yml | 61 | COMMENT | |
| LOW | …d/fleetctl/fleetctl/templates/new/default.template.yml | 81 | # • https://fleetdm.com/guides/apple-mdm-setup#volume-purchasing-program-vpp | COMMENT |
| LOW | …d/fleetctl/fleetctl/templates/new/default.template.yml | 101 | # macos_migration: | COMMENT |
| LOW | …d/fleetctl/fleetctl/templates/new/default.template.yml | 121 | # from "x86 macs" to "finance department" to "needs new battery". | COMMENT |
| LOW | …plates/new/fleets/personal-mobile-devices.template.yml | 1 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # | COMMENT |
| LOW | …plates/new/fleets/personal-mobile-devices.template.yml | 21 | setup_experience: | COMMENT |
| LOW | …plates/new/fleets/personal-mobile-devices.template.yml | 41 | # • https://fleetdm.com/docs/configuration/yaml-files#apple-settings-and-windows-settings | COMMENT |
| LOW | …plates/new/fleets/personal-mobile-devices.template.yml | 61 | # • https://fleetdm.com/docs/configuration/yaml-files#ipados-updates | COMMENT |
| LOW | …plates/new/fleets/personal-mobile-devices.template.yml | 81 | # display_name: "Slack" | COMMENT |
| LOW | …plates/new/fleets/personal-mobile-devices.template.yml | 101 | ########################################################### | COMMENT |
| LOW | …leetctl/templates/new/fleets/workstations.template.yml | 1 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # | COMMENT |
| LOW | …leetctl/templates/new/fleets/workstations.template.yml | 21 | # Configure the macOS setup experience | COMMENT |
| LOW | …leetctl/templates/new/fleets/workstations.template.yml | 41 | # | COMMENT |
| LOW | …leetctl/templates/new/fleets/workstations.template.yml | 61 | # labels_include_any: | COMMENT |
| LOW | …leetctl/templates/new/fleets/workstations.template.yml | 81 | # | COMMENT |
| LOW | …leetctl/templates/new/fleets/workstations.template.yml | 101 | # update_new_hosts: true | COMMENT |
| LOW | …leetctl/templates/new/fleets/workstations.template.yml | 121 | COMMENT | |
| LOW | …leetctl/templates/new/fleets/workstations.template.yml | 141 | # | COMMENT |
| LOW | …leetctl/templates/new/fleets/workstations.template.yml | 161 | ########################################################### | COMMENT |
| LOW | …leetctl/templates/new/fleets/workstations.template.yml | 181 | # labels_include_any: | COMMENT |
| LOW | …/templates/new/.github/workflows/workflow.template.yml | 61 | - name: Apply latest configuration to Fleet | COMMENT |
| LOW | …/templates/new/.github/workflows/workflow.template.yml | 81 | # Apple devices with MDM pointed at Fleet. If this URL changes | COMMENT |
| LOW | cmd/android-amapi-mock/main.go | 1 | // Command android-amapi-mock is a lightweight mock of Google's Android Management API | COMMENT |
| LOW | cmd/android-amapi-mock/main.go | 61 | // unenroll/enroll flip-flop. | COMMENT |
| LOW | cmd/fleet/http_middleware.go | 21 | // batch operations. For package-upload routes it also caps the request body and | COMMENT |
| LOW | cmd/fleet/cron.go | 2721 | return ds.ReconcileMaintainedAppSoftwareNames(ctx) | COMMENT |
| LOW | cmd/fleet/serve_boot_test.go | 121 | // The test does not run in parallel: it swaps the package-global initFatal and | COMMENT |
| LOW | cmd/fleet/redis.go | 81 | // effectively enabled — etag_invalidate. Failures go through initFatal, and nil | COMMENT |
| LOW | cmd/fleet-mcp/config.go | 41 | COMMENT | |
| LOW | cmd/fleet-mcp/main.go | 21 | // by the documented `openssl rand -hex 32` (64 chars). | COMMENT |
| LOW | orbit/cmd/orbit/orbit.go | 1661 | options = append(options, osquery.WithFlags([]string{"--flagfile", flagfilePath})) | COMMENT |
| LOW | orbit/cmd/orbit/orbit.go | 2101 | fallbackCfg fallbackServerOverridesConfig, | COMMENT |
| LOW | orbit/cmd/orbit/orbit.go | 2201 | // trw is the Fleet Desktop token reader and writer (implements token rotation). | COMMENT |
| 1923 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/mdm/test-batch-profiles.sh | 3 | #-------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/mdm/test-batch-profiles.sh | 7 | #-------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/mdm/make_cfg_profiles.sh | 3 | # ---------------------------------------------------- | COMMENT |
| MEDIUM | tools/mdm/make_cfg_profiles.sh | 5 | # ---------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tools/release/publish_release.sh | 683 | # ====================================== | COMMENT |
| MEDIUM⚡ | tools/release/publish_release.sh | 685 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 107 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 109 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 187 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 189 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 323 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 325 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 792 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 794 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 830 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 832 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 986 | # ====================================== | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 988 | # ====================================== | COMMENT |
| MEDIUM⚡ | tools/loadtest/metrics/collect-metrics.sh | 31 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tools/loadtest/metrics/collect-metrics.sh | 33 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tools/loadtest/metrics/collect-metrics.sh | 43 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tools/loadtest/metrics/collect-metrics.sh | 45 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tools/loadtest/metrics/collect-metrics.sh | 208 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tools/loadtest/metrics/collect-metrics.sh | 210 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tools/loadtest/metrics/collect-metrics.sh | 217 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tools/loadtest/metrics/collect-metrics.sh | 219 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 161 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 163 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 421 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 423 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 602 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 671 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 691 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 693 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 740 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 751 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 806 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 808 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 845 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 847 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 972 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 980 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 997 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 999 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1049 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1051 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1116 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1124 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1195 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1199 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1282 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1292 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1355 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1362 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1412 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1416 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1530 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1536 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1558 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/loadtest/metrics/collect-metrics.sh | 1581 | # ------------------------------------------------------------------------- | COMMENT |
| 334 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/release/publish_release.sh | 218 | # Check if `grep` supports the `-P` option by using it in a no-op search. | COMMENT |
| LOW | tools/release/publish_release.sh | 285 | # Check if the formatted date matches the expected date format | COMMENT |
| LOW | tools/release/publish_release.sh | 300 | # Check if `ggrep` is available | COMMENT |
| LOW | tools/loadtest/scripts_and_profiles/main.go | 179 | # Check if curl is available | COMMENT |
| LOW | tools/loadtest/scripts_and_profiles/main.go | 259 | # Check if file exists and is not empty | COMMENT |
| LOW | tools/loadtest/scripts_and_profiles/main.go | 270 | # Check if file is executable format (basic check) | COMMENT |
| LOW | tools/loadtest/scripts_and_profiles/main.go | 359 | # Check if extensions.load file exists | COMMENT |
| LOW | tools/software/icons/generate-icons.sh | 5 | # Check if a string is a valid JavaScript identifier | COMMENT |
| LOW | tools/software/icons/generate-icons.sh | 9 | # Check if it matches the pattern: starts with letter/underscore/dollar, followed by letters/digits/underscore/dollar | COMMENT |
| LOW | tools/software/icons/generate-icons.sh | 70 | # Check if import already exists | COMMENT |
| LOW | tools/software/icons/generate-icons.sh | 104 | # Check if we should insert before this first import | COMMENT |
| LOW | tools/software/icons/generate-icons.sh | 167 | # Check if map entry already exists (check for both quoted and unquoted keys) | COMMENT |
| LOW | tools/software/icons/generate-icons.sh | 197 | # Check if this is a map entry (has a colon) | COMMENT |
| LOW | tools/cis/cis-test-runner.py | 2010 | # Check if SSH is reachable. If not (e.g., a previous test | STRING |
| LOW | tools/cis/cis-test-runner.py | 2031 | # Check if the agent is installed and the host is in Fleet | STRING |
| LOW | tools/cis/cis-test-runner.py | 2128 | # Check if the host is already MDM-enrolled; if so, skip | STRING |
| LOW | ee/server/service/embedded_scripts/linux_lock.sh | 58 | # Set flag to reboot after creating lock files | COMMENT |
| LOW | ee/server/service/embedded_scripts/linux_unlock.sh | 49 | # Check if we switched to text mode during lock and restore GUI if needed | COMMENT |
| LOW⚡ | ee/maintained-apps/script-diff.sh | 5 | # Check if file path is provided | COMMENT |
| LOW⚡ | ee/maintained-apps/script-diff.sh | 13 | # Check if file exists | COMMENT |
| LOW⚡ | ee/maintained-apps/script-diff.sh | 19 | # Check if we're in a git repository | COMMENT |
| LOW | ee/maintained-apps/ingesters/homebrew/scripts.go | 1110 | # Check if the app was running before installation | COMMENT |
| LOW | ee/maintained-apps/outputs/forecast/darwin.json | 21 | "ae290788": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/kap/darwin.json | 21 | "d22aa20b": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/usage-app/darwin.json | 21 | "e070d417": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/texshop/darwin.json | 21 | "8da3bb6e": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/devtoys/darwin.json | 21 | "58a81a86": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/openrefine/darwin.json | 20 | "258ae699": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/t3-code/darwin.json | 21 | "96b55242": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/i1profiler/darwin.json | 21 | "f3fdabef": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/beyond-compare/darwin.json | 21 | "f454ffc6": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/netspot/darwin.json | 21 | "4483993c": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/pd/darwin.json | 21 | "921dbea0": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/cryptomator/darwin.json | 21 | "52c4f35b": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/bricklink-studio/darwin.json | 21 | "e06a2564": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/smoothscroll/darwin.json | 20 | "051b70dc": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/default-folder-x/darwin.json | 21 | "7c6b5c32": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/ok-json/darwin.json | 20 | "5f4e50e8": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/knime/darwin.json | 21 | "63a7bd9a": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/neofinder/darwin.json | 21 | "26dc1bea": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/granola/darwin.json | 20 | "212b6a3e": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/command-tab-plus/darwin.json | 20 | "6549db18": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/glyphs/darwin.json | 20 | "673b758b": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/nextcloud/darwin.json | 21 | "86f0f2ac": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | …intained-apps/outputs/microsoft-powerpoint/darwin.json | 20 | "5a1bc8d8": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/windowkeys/darwin.json | 20 | "bdb7008e": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/spokenly/darwin.json | 21 | "d24fe105": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/markedit/darwin.json | 21 | "b7ef05b4": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/beeper/darwin.json | 20 | "3d6a41e1": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/qlmarkdown/darwin.json | 21 | "38d4c3d8": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/scrivener/darwin.json | 20 | "02b4a5c8": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/meetingbar/darwin.json | 21 | "e4fec1fe": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/emclient/darwin.json | 21 | "635a31ff": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | …maintained-apps/outputs/github-copilot-app/darwin.json | 20 | "10257e14": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/chime/darwin.json | 21 | "ae30b295": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/microsoft-teams/darwin.json | 21 | "ffa1e5a1": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/kaleidoscope/darwin.json | 21 | "d77843ce": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/onionshare/darwin.json | 21 | "cf6df640": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/homebrew-app/darwin.json | 20 | "9ad8b52e": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| LOW | ee/maintained-apps/outputs/4k-stogram/darwin.json | 20 | "e9a77143": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\ | CODE |
| 997 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmd/osquery-perf/android_agent.go | 590 | // Step 1: Register with mock AMAPI proxy (retry with backoff) | COMMENT |
| LOW | cmd/osquery-perf/android_agent.go | 604 | // Step 2: Send ENROLLMENT PubSub to Fleet (retry with backoff) | COMMENT |
| LOW | cmd/osquery-perf/android_agent.go | 633 | // Step 3: Periodic status reports + command ack + certificate verification loop | COMMENT |
| LOW | cmd/osquery-perf/software-library/README.md | 110 | ### Step 1: Initialize database from software.sql | COMMENT |
| LOW | cmd/osquery-perf/software-library/README.md | 118 | ### Step 2: Export server data | COMMENT |
| LOW | cmd/osquery-perf/software-library/README.md | 160 | ### Step 3: Import server data | COMMENT |
| LOW | cmd/osquery-perf/software-library/README.md | 174 | ### Step 4: Generate software.sql | COMMENT |
| LOW | cmd/osquery-perf/software-library/README.md | 185 | ### Step 5: Verify | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 858 | // Step 1: Create a CA and a team with a certificate template referencing it via GitOps. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 923 | // Step 2: Run gitops removing the CA but WITHOUT the team file. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 954 | // Step 3: Run gitops removing BOTH the CA and the certificate template. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 2528 | // Step 1: Apply a manual label with hosts. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 2557 | // Step 2: Re-apply the same label without the hosts key. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 2584 | // Step 3: Re-apply with empty hosts to clear membership. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 5616 | // Step 1: Apply a full global config with policies, agent_options, controls, and reports. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 5677 | // Step 2: Apply a minimal global config that omits policies, agent_options, reports, labels. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 5873 | // Step 1: Apply a full fleet config with policies, agent_options, controls, features, reports, and software. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 5943 | // Step 2: Apply a minimal fleet config that omits policies, agent_options, controls, reports, software, settings. | COMMENT |
| LOW | orbit/pkg/luks/snapd_fde.go | 71 | // Step 1: generate a recovery key. snapd answers synchronously with the key | COMMENT |
| LOW | orbit/pkg/luks/snapd_fde.go | 86 | // Step 2: enroll the generated key under the Fleet-owned name (a name-only | COMMENT |
| LOW | orbit/pkg/luks/snapd_fde.go | 115 | // Step 3: validate the freshly enrolled key before escrowing it, mirroring | COMMENT |
| LOW | tools/ci/helm-values/logger-pubsub.yaml | 25 | # WARNING: This may cause database corruption if more than one migration is attempted at a time | COMMENT |
| LOW | tools/ci/helm-values/enable-mysql-tls.yaml | 25 | # WARNING: This may cause database corruption if more than one migration is attempted at a time | COMMENT |
| LOW | tools/ci/helm-values/disable-fleet-tls.yaml | 25 | # WARNING: This may cause database corruption if more than one migration is attempted at a time | COMMENT |
| LOW | tools/ci/helm-values/logger-firehose-sts.yaml | 25 | # WARNING: This may cause database corruption if more than one migration is attempted at a time | COMMENT |
| LOW | tools/ci/helm-values/logger-firehose-accesssid.yaml | 25 | # WARNING: This may cause database corruption if more than one migration is attempted at a time | COMMENT |
| LOW | tools/ci/helm-values/custom-annotations.yaml | 28 | # WARNING: This may cause database corruption if more than one migration is attempted at a time | COMMENT |
| LOW | tools/ci/helm-values/enable-cloudsql-proxy.yaml | 25 | # WARNING: This may cause database corruption if more than one migration is attempted at a time | COMMENT |
| LOW⚡ | tools/github-manage/pkg/ghapi/workflows.go | 462 | // Step 1: Add to drafting | COMMENT |
| LOW⚡ | tools/github-manage/pkg/ghapi/workflows.go | 470 | // Step 2: Add :product | COMMENT |
| LOW⚡ | tools/github-manage/pkg/ghapi/workflows.go | 474 | // Step 3: Set status to confirm and celebrate | COMMENT |
| LOW⚡ | tools/github-manage/pkg/ghapi/workflows.go | 482 | // Step 4: Remove :release | COMMENT |
| LOW | tools/cis/cis-test-runner.py | 1262 | # Step 1: remove profile → query should poll to False | COMMENT |
| LOW | tools/cis/cis-test-runner.py | 1282 | # Step 2: re-install profile → query should poll to True | COMMENT |
| LOW | tools/cis/cis-test-runner.py | 1382 | # Step 1: Push enable profile, poll: enable passes + disable fails | COMMENT |
| LOW | tools/cis/cis-test-runner.py | 1405 | # Step 2: Push disable profile, poll: disable passes + enable fails | COMMENT |
| LOW⚡ | tools/dibble/pkg/command/wizard.go | 29 | // Step 1: resolve config (URL + token), prompting only for what's missing. | COMMENT |
| LOW⚡ | tools/dibble/pkg/command/wizard.go | 39 | // Step 2: ping. Fail fast so the user knows their config is wrong before | COMMENT |
| LOW | tools/dibble/pkg/command/wizard.go | 72 | // Step 3: theme picker. | COMMENT |
| LOW | tools/dibble/pkg/command/wizard.go | 90 | // Step 4: persist final config (URL, token, theme, insecure) if we | COMMENT |
| LOW | tools/dibble/pkg/command/wizard.go | 111 | // Step 5: entity multi-select. | COMMENT |
| LOW | tools/dibble/pkg/command/wizard.go | 162 | // Step 6: counts. | COMMENT |
| LOW | tools/dibble/pkg/command/wizard.go | 185 | // Step 7: run. | COMMENT |
| LOW | …ontend/pages/admin/OrgSettingsPage/cards/Info/Info.tsx | 261 | // Step 1: org_info PATCH. Errors here surface as an org-info | COMMENT |
| LOW | …ained-apps/outputs/omnissa-horizon-client/windows.json | 21 | "c624ea6f": "# Locates Omnissa Horizon Client's uninstaller from the registry and runs it\n# silently.\n#\n# Omnissa | CODE |
| LOW | ee/cis/prompt.md | 40 | ### Step 0: If this is a new OS version, scaffold and register it first | COMMENT |
| LOW | ee/cis/prompt.md | 56 | ### Step 1: Extract the changelog | COMMENT |
| LOW | ee/cis/prompt.md | 73 | ### Step 2: Read affected sections | COMMENT |
| LOW | ee/cis/prompt.md | 89 | ### Step 3: Generate policy YAML | COMMENT |
| LOW | ee/cis/prompt.md | 107 | ### Step 4: Generate test artifacts | COMMENT |
| LOW | ee/cis/prompt.md | 124 | ### Step 5: Generate MDM profiles | COMMENT |
| LOW⚡ | ee/cis/prompt.md | 137 | ### Step 6: Update README.md | COMMENT |
| LOW⚡ | ee/cis/prompt.md | 143 | ### Step 7: Handle removals | COMMENT |
| LOW⚡ | ee/cis/prompt.md | 149 | ### Step 8: Validate | COMMENT |
| LOW | …ticles/enrolling-linux-devices-for-fleet-management.md | 19 | ### Step 1 - Verify the prerequisites | COMMENT |
| LOW | …ticles/enrolling-linux-devices-for-fleet-management.md | 35 | ### Step 2 - Create the agent package | COMMENT |
| LOW | …ticles/enrolling-linux-devices-for-fleet-management.md | 64 | ### Step 3 - Install the agent package | COMMENT |
| LOW | articles/build-configuration-profiles-with-ai.md | 15 | ## Step 1: Put the schema where the agent can read it | COMMENT |
| LOW | articles/build-configuration-profiles-with-ai.md | 98 | ## Step 2: Write down the rules the agent can't infer | COMMENT |
| LOW | articles/build-configuration-profiles-with-ai.md | 114 | ## Step 3: Ground the agent in real references | COMMENT |
| 403 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | CHANGELOG.md | 1084 | - Showed the end user's IdP full name (e.g. "Jane Doe's device") on the My device page header and browser tab when avail | CODE |
| LOW | cmd/fleetctl/fleetctl/gitops_test.go | 266 | ImpersonatedUserEmail: "admin@example.com", | CODE |
| LOW | cmd/fleetctl/fleetctl/preview.go | 326 | email = "admin@example.com" | CODE |
| LOW | orbit/pkg/packaging/windows_templates_test.go | 146 | opt.EndUserEmail = "user@example.com" | CODE |
| LOW | orbit/pkg/profiles/profiles_darwin_test.go | 232 | {"happy path", withFleetdConfigAndEnrollment, "user@example.com", nil}, | CODE |
| LOW | orbit/pkg/profiles/profiles_darwin_test.go | 251 | require.Equal(t, "user@example.com", gotContent) | CODE |
| LOW | orbit/pkg/profiles/profiles_darwin_test.go | 581 | require.Equal(t, *e, fleet.MDMCustomEnrollmentProfileItem{EndUserEmail: "user@example.com"}) | CODE |
| LOW | orbit/pkg/profiles/profiles_darwin_test.go | 590 | require.Equal(t, "user@example.com", v) | CODE |
| LOW | tools/upgrade/fleet_test.go | 138 | token, err := client.Setup("admin@example.com", "Admin", "password123#", "Fleet Test") | CODE |
| LOW | tools/migration-cleanup/main_test.go | 17 | runGit(t, dir, "config", "user.email", "test@test.com") | CODE |
| LOW | …ls/hangar/frontend/src/components/tabs/FleetctlTab.tsx | 855 | placeholder="admin@example.com" | CODE |
| LOW | tools/dibble/pkg/seed/activities.go | 111 | return tag + "user@example.com" | CODE |
| LOW | tools/dibble/pkg/seed/activities.go | 113 | return tag + "user@example.com" | CODE |
| LOW | frontend/__mocks__/hostMock.ts | 273 | idp_full_name: "John Doe", | CODE |
| LOW | frontend/__mocks__/deviceUserMock.ts | 12 | email: "test@test.com", | CODE |
| LOW | frontend/utilities/helpers.tests.tsx | 108 | email: "admin@example.com", | CODE |
| LOW | …ppInstallDetailsModal/VppInstallDetailsModal.tests.tsx | 576 | deviceAuthToken="fake_token" | CODE |
| LOW | frontend/hooks/useFormValidation.tests.ts | 219 | act(() => result.current.setField("email", "user@example.com")); | CODE |
| LOW | frontend/pages/LoginPage/LoginPreviewPage.tsx | 60 | email: "admin@example.com", | CODE |
| LOW | …tyFeed/GlobalActivityItem/GlobalActivityItem.tests.tsx | 517 | user_email: "user@example.com", | CODE |
| LOW | …tyFeed/GlobalActivityItem/GlobalActivityItem.tests.tsx | 527 | expect(screen.getByText("user@example.com")).toBeInTheDocument(); | CODE |
| LOW | …tyFeed/GlobalActivityItem/GlobalActivityItem.tests.tsx | 540 | user_email: "user@example.com", | CODE |
| LOW | …tyFeed/GlobalActivityItem/GlobalActivityItem.tests.tsx | 550 | expect(screen.getByText("user@example.com")).toBeInTheDocument(); | CODE |
| LOW | …tyFeed/GlobalActivityItem/GlobalActivityItem.tests.tsx | 632 | user_email: "user@example.com", | CODE |
| LOW | …tyFeed/GlobalActivityItem/GlobalActivityItem.tests.tsx | 643 | expect(screen.getByText("user@example.com")).toBeInTheDocument(); | CODE |
| LOW | …n/ManageUsersPage/components/UserForm/helpers.tests.ts | 11 | email: "user@example.com", | CODE |
| LOW | …ManageUsersPage/components/UserForm/UserForm.tests.tsx | 236 | await user.type(screen.getByLabelText("Email"), "user@example.com"); | CODE |
| LOW | …ManageUsersPage/components/UserForm/UserForm.tests.tsx | 254 | defaultEmail: "user@example.com", | CODE |
| LOW | …oogleWorkspaceSection/GoogleWorkspaceSection.tests.tsx | 37 | impersonated_user_email: "admin@example.com", | CODE |
| LOW | …oogleWorkspaceSection/GoogleWorkspaceSection.tests.tsx | 46 | expect(screen.getByDisplayValue("admin@example.com")).toBeInTheDocument(); | CODE |
| LOW | …ents/GoogleWorkspaceSection/GoogleWorkspaceSection.tsx | 233 | placeholder="admin@example.com" | CODE |
| LOW | …/pages/admin/OrgSettingsPage/cards/Smtp/Smtp.tests.tsx | 42 | smtpSenderAddress: "admin@example.com", | CODE |
| LOW | …olicyAutomationsModal/PolicyAutomationsModal.tests.tsx | 21 | author_email: "admin@example.com", | CODE |
| LOW | …/details/PolicyDetailsPage/PolicyDetailsPage.tests.tsx | 59 | author_email: "admin@example.com", | CODE |
| LOW | …icyAutomationsFields/PolicyAutomationsFields.tests.tsx | 77 | author_email: "admin@example.com", | CODE |
| LOW | …/PolicyAutomationsList/PolicyAutomationsList.tests.tsx | 29 | author_email: "admin@example.com", | CODE |
| LOW | …onents/PatchAutomationCta/PatchAutomationCta.tests.tsx | 18 | author_email: "admin@example.com", | CODE |
| LOW | frontend/pages/hosts/details/cards/User/User.tests.tsx | 24 | expect(screen.getByText("John Doe")).toBeInTheDocument(); | CODE |
| LOW | …r/components/UpdateEndUserModal/UpdateEndUserModal.tsx | 50 | placeholder="user@example.com" | CODE |
| LOW | …es/hosts/details/cards/Policies/HostPolicies.tests.tsx | 20 | author_email: "test@test.com", | CODE |
| LOW | ee/fleet-agent-downloader/config/bootstrap.js | 63 | { emailAddress: 'admin@example.com', fullName: 'Ryan Dahl', isSuperAdmin: true, password: await sails.helpers.passwo | CODE |
| LOW | ee/fleet-agent-downloader/assets/dependencies/vue.js | 6412 | key === 'placeholder' && !el.__ieph | CODE |
| LOW | ee/fleet-agent-downloader/assets/styles/pages/faq.less | 7 | [purpose='placeholder'] { | CODE |
| LOW | ee/server/scim/users_test.go | 103 | Email: "user@example.com", | CODE |
| LOW | ee/server/scim/users_test.go | 140 | UserName: "user@example.com", | CODE |
| LOW | ee/server/scim/users_test.go | 249 | fleetUser := newTestFleetUser(&fleetUserOpts{name: "John Doe", email: "john@example.com", ssoEnabled: true}) | CODE |
| LOW | ee/server/scim/users_test.go | 268 | assert.Equal(t, "John Doe", deleted.UserName) | CODE |
| LOW | ee/server/scim/users_test.go | 332 | email: "admin@example.com", | CODE |
| LOW | ee/server/scim/users_test.go | 345 | scimUser := newTestScimUser(&scimUserOpts{userName: "admin@example.com"}) | CODE |
| LOW | ee/server/scim/users_test.go | 359 | email: "admin@example.com", | CODE |
| LOW | ee/server/scim/users_test.go | 375 | scimUser := newTestScimUser(&scimUserOpts{userName: "admin@example.com"}) | CODE |
| LOW | ee/server/scim/users_test.go | 386 | name: "Jane Doe", | CODE |
| LOW | ee/server/scim/users_test.go | 445 | if email == "user@example.com" { | CODE |
| LOW | ee/server/scim/users_test.go | 463 | assert.Equal(t, "user@example.com", emailQueried) | CODE |
| LOW | ee/server/scim/users_test.go | 486 | mocks.matchFleetUserByEmail("user@example.com", newTestFleetUser(&fleetUserOpts{id: 100, email: "user@example.com"})) | CODE |
| LOW | ee/server/scim/users_test.go | 494 | scimUser := newTestScimUser(&scimUserOpts{id: 7, userName: "user@example.com"}) | CODE |
| LOW | ee/server/scim/users_test.go | 508 | scimUser := newTestScimUser(&scimUserOpts{id: 7, userName: "user@example.com"}) | CODE |
| LOW | ee/server/scim/users_test.go | 553 | scimUser := newTestScimUser(&scimUserOpts{userName: "admin@example.com"}) | CODE |
| LOW | ee/server/scim/users_test.go | 555 | email: "admin@example.com", | CODE |
| LOW | ee/server/scim/users_test.go | 680 | userName: "user@example.com", | CODE |
| 308 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmd/osquery-perf/android_agent.go | 590 | // Step 1: Register with mock AMAPI proxy (retry with backoff) | COMMENT |
| LOW | cmd/osquery-perf/android_agent.go | 604 | // Step 2: Send ENROLLMENT PubSub to Fleet (retry with backoff) | COMMENT |
| LOW | cmd/osquery-perf/android_agent.go | 633 | // Step 3: Periodic status reports + command ack + certificate verification loop | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 858 | // Step 1: Create a CA and a team with a certificate template referencing it via GitOps. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 923 | // Step 2: Run gitops removing the CA but WITHOUT the team file. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 954 | // Step 3: Run gitops removing BOTH the CA and the certificate template. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 2528 | // Step 1: Apply a manual label with hosts. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 2557 | // Step 2: Re-apply the same label without the hosts key. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 2584 | // Step 3: Re-apply with empty hosts to clear membership. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 5616 | // Step 1: Apply a full global config with policies, agent_options, controls, and reports. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 5677 | // Step 2: Apply a minimal global config that omits policies, agent_options, reports, labels. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 5873 | // Step 1: Apply a full fleet config with policies, agent_options, controls, features, reports, and software. | COMMENT |
| LOW | …ationtest/gitops/gitops_enterprise_integration_test.go | 5943 | // Step 2: Apply a minimal fleet config that omits policies, agent_options, controls, reports, software, settings. | COMMENT |
| LOW | orbit/pkg/luks/snapd_fde.go | 71 | // Step 1: generate a recovery key. snapd answers synchronously with the key | COMMENT |
| LOW | orbit/pkg/luks/snapd_fde.go | 86 | // Step 2: enroll the generated key under the Fleet-owned name (a name-only | COMMENT |
| LOW | orbit/pkg/luks/snapd_fde.go | 115 | // Step 3: validate the freshly enrolled key before escrowing it, mirroring | COMMENT |
| LOW⚡ | tools/github-manage/pkg/ghapi/workflows.go | 462 | // Step 1: Add to drafting | COMMENT |
| LOW⚡ | tools/github-manage/pkg/ghapi/workflows.go | 470 | // Step 2: Add :product | COMMENT |
| LOW⚡ | tools/github-manage/pkg/ghapi/workflows.go | 474 | // Step 3: Set status to confirm and celebrate | COMMENT |
| LOW⚡ | tools/github-manage/pkg/ghapi/workflows.go | 482 | // Step 4: Remove :release | COMMENT |
| LOW | tools/cis/cis-test-runner.py | 1262 | # Step 1: remove profile → query should poll to False | COMMENT |
| LOW | tools/cis/cis-test-runner.py | 1282 | # Step 2: re-install profile → query should poll to True | COMMENT |
| LOW | tools/cis/cis-test-runner.py | 1382 | # Step 1: Push enable profile, poll: enable passes + disable fails | COMMENT |
| LOW | tools/cis/cis-test-runner.py | 1405 | # Step 2: Push disable profile, poll: disable passes + enable fails | COMMENT |
| LOW⚡ | tools/dibble/pkg/command/wizard.go | 29 | // Step 1: resolve config (URL + token), prompting only for what's missing. | COMMENT |
| LOW⚡ | tools/dibble/pkg/command/wizard.go | 39 | // Step 2: ping. Fail fast so the user knows their config is wrong before | COMMENT |
| LOW | tools/dibble/pkg/command/wizard.go | 72 | // Step 3: theme picker. | COMMENT |
| LOW | tools/dibble/pkg/command/wizard.go | 90 | // Step 4: persist final config (URL, token, theme, insecure) if we | COMMENT |
| LOW | tools/dibble/pkg/command/wizard.go | 111 | // Step 5: entity multi-select. | COMMENT |
| LOW | tools/dibble/pkg/command/wizard.go | 162 | // Step 6: counts. | COMMENT |
| LOW | tools/dibble/pkg/command/wizard.go | 185 | // Step 7: run. | COMMENT |
| LOW | …ontend/pages/admin/OrgSettingsPage/cards/Info/Info.tsx | 261 | // Step 1: org_info PATCH. Errors here surface as an org-info | COMMENT |
| LOW | ee/server/service/calendar.go | 154 | // Now, we need to check if there are any events in the queue that need to be re-processed. | COMMENT |
| LOW | …ained-apps/outputs/omnissa-horizon-client/windows.json | 21 | "c624ea6f": "# Locates Omnissa Horizon Client's uninstaller from the registry and runs it\n# silently.\n#\n# Omnissa | CODE |
| LOW | server/mdm/android/service/service.go | 1851 | // Step 1: Get all install templates and transition pending → delivering (atomically) | COMMENT |
| LOW | server/mdm/android/service/service.go | 1879 | // Step 2: Build and send config to AMAPI with ALL certificate templates | COMMENT |
| LOW | server/mdm/android/service/service.go | 1897 | // Step 3: Transition delivering → delivered | COMMENT |
| LOW⚡ | server/fleetmcp/fleet_integration_test.go | 164 | // Step 3: return more hosts than the cap (set to 5 above) so the | COMMENT |
| LOW⚡ | server/fleetmcp/fleet_integration_test.go | 174 | // Step 2: one version per title. | COMMENT |
| LOW⚡ | server/fleetmcp/fleet_integration_test.go | 181 | // Step 1: one title, short page → stop. | COMMENT |
| LOW | server/fleetmcp/fleet_integration.go | 1746 | // Step 1: software titles affected by this CVE (optionally team-scoped). | COMMENT |
| LOW | server/fleetmcp/fleet_integration.go | 1799 | // Step 2: per title, fetch detail to get version IDs. | COMMENT |
| LOW | server/fleetmcp/fleet_integration.go | 1843 | // Step 3: per version_id, fetch hosts with composing filters server-side. | COMMENT |
| LOW | server/datastore/mysql/software_upgrade_code_test.go | 439 | // Step 3: Host A reports v2.0 with empty upgrade_code | COMMENT |
| LOW | server/datastore/mysql/software_upgrade_code_test.go | 475 | // Step 1: Host A reports "7-Zip 24.08 (x64 edition)" with upgrade_code | COMMENT |
| LOW | server/datastore/mysql/software_upgrade_code_test.go | 513 | // Step 2: Host B reports "7-Zip 24.09 (x64 edition)" with SAME upgrade_code but different name | COMMENT |
| LOW | server/datastore/mysql/microsoft_mdm_test.go | 5799 | // Step 1: create a remove row and ACK it as verified → row deleted. | COMMENT |
| LOW | server/datastore/mysql/microsoft_mdm_test.go | 5837 | // Step 2: fresh install of the same profile with a new command UUID. | COMMENT |
| LOW | server/datastore/mysql/locks.go | 66 | // information_schema.innodb_lock_waits has been deprecated in MySQL 8, so we need to check if it exists. | COMMENT |
| LOW | server/datastore/mysql/microsoft_mdm.go | 3931 | // Step 1: Load UUIDs of profiles to be deleted. | COMMENT |
| LOW | server/datastore/mysql/microsoft_mdm.go | 3944 | // Step 2: Retain the content of profiles being deleted so the profile-manager cron can build <Delete> commands after t | COMMENT |
| LOW | server/datastore/mysql/microsoft_mdm.go | 3955 | // Step 3: Delete the config profile rows. | COMMENT |
| LOW | server/datastore/mysql/microsoft_mdm.go | 3975 | // Step 4: Clean up host-profile rows for deleted profiles (terminal removes + never-sent installs). The actual <Delete | COMMENT |
| LOW | server/datastore/mysql/software_test.go | 2496 | // Step 1: Host1 reports multiple software with the same bundle ID but different versions | COMMENT |
| LOW⚡ | server/datastore/mysql/software_test.go | 2510 | // Step 2: Host2 also reports the same software | COMMENT |
| LOW⚡ | server/datastore/mysql/software_test.go | 2517 | // Step 3: Host3 reports the SAME software but with a different name | COMMENT |
| LOW⚡ | server/datastore/mysql/software_test.go | 2526 | // Step 4: Verify insertion into software behavior | COMMENT |
| LOW | server/datastore/mysql/software_test.go | 11659 | // Step 1: Initial software setup - just one app with bundle ID | COMMENT |
| LOW | server/datastore/mysql/apple_mdm.go | 7750 | // Step 1: Get up to 3 old command UUIDs from nano_enrollment_queue for this | COMMENT |
| LOW | server/datastore/mysql/apple_mdm.go | 7771 | // Step 2: From ncr, find which of those command UUIDs have been acknowledged or | COMMENT |
| 39 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | orbit/pkg/table/extension.go | 197 | // factors. Vendored from github.com/karmine05/agentic-detector. | COMMENT |
| MEDIUM | orbit/pkg/table/internal/fsutil/fsutil.go | 256 | // large, machine-generated, or irrelevant to agentic-config discovery. | COMMENT |
| MEDIUM | orbit/pkg/table/ai_tools/README.md | 13 | - Upstream: https://github.com/karmine05/agentic-detector | CODE |
| MEDIUM | orbit/pkg/table/ai_tools/internal/classify/classify.go | 6 | // agentic-risk signal. | COMMENT |
| MEDIUM | orbit/pkg/table/ai_tools/internal/evidence/bundle.go | 215 | // Skip path-like or dotdir "names" (e.g. ".claude", "agentic-detector"). | COMMENT |
| MEDIUM | orbit/pkg/table/ai_tools/internal/netsock/netsock.go | 2 | // agentic network sockets: locally-bound AI/MCP/inference listeners and | COMMENT |
| MEDIUM | orbit/pkg/table/ai_tools/internal/agents/agents.go | 54 | // single highest-risk agentic posture on a host. | COMMENT |
| MEDIUM | tools/release/publish_release.sh | 411 | local qa_groups=("#g-apple-at-work" "#g-auto-patching" "#g-byod" "#g-orchestration" "#g-supply-chain" "#g-power- | CODE |
| MEDIUM | tools/github-manage/pkg/tui/table.go | 17 | // prioritize labels 'story', 'bug', ':release', ':product', '#g-mdm', '#g-orchestration', | COMMENT |
| MEDIUM | tools/github-manage/pkg/tui/table.go | 24 | priorityLabels := map[string]bool{"story": true, "bug": true, ":release": true, ":product": true, "#g-mdm": true, "#g-o | CODE |
| MEDIUM | tools/github-manage/pkg/ghapi/projects.go | 41 | 71: "#g-orchestration", // g-orchestration project | CODE |
| MEDIUM | …reTitleDetailsPage/AddVersionModal/AddVersionModal.tsx | 67 | // Submitting an unmodified scaffold is treated as "no configuration". | COMMENT |
| MEDIUM | …Page/EditConfigurationModal/EditConfigurationModal.tsx | 75 | // Place cursor between <dict> tags when starting with empty XML scaffold | COMMENT |
| MEDIUM | …tleDetailsPage/VersionFormFields/VersionFormFields.tsx | 45 | // Add/Edit modals treat an unmodified scaffold as "no configuration" so the | COMMENT |
| MEDIUM | …TitleDetailsPage/EditVersionModal/EditVersionModal.tsx | 58 | // Submitting an unmodified scaffold is treated as "no configuration". | COMMENT |
| MEDIUM | …TitleDetailsPage/EditVersionModal/EditVersionModal.tsx | 80 | // Pre-fill the editor with the scaffold when the stored config is empty. | COMMENT |
| MEDIUM | …TitleDetailsPage/EditVersionModal/EditVersionModal.tsx | 105 | // Empty editor or unmodified scaffold clears the config (null for | COMMENT |
| MEDIUM | …TitleDetailsPage/EditVersionModal/EditVersionModal.tsx | 107 | // deliberate clear, same effect as the scaffold. | COMMENT |
| MEDIUM | ee/cis/prompt.md | 40 | ### Step 0: If this is a new OS version, scaffold and register it first | COMMENT |
| MEDIUM | articles/the-cost-of-code-as-config.md | 119 | The quickest way to see this in detail is to inspect our [it-and-security](https://github.com/fleetdm/fleet/tree/main/it | CODE |
| MEDIUM | articles/build-configuration-profiles-with-ai.md | 9 | - Fleet, with your configuration in a Git repository. An agent needs that reviewable, schema-legible structure to act ag | CODE |
| MEDIUM | articles/supercharging-endpoint-management.md | 1 | # Supercharging endpoint management with AI assistants and event-driven automation | COMMENT |
| MEDIUM | articles/not-everything-runs-in-kubernete.md | 28 | #### Cloud-based data leader chooses Fleet for orchestration: | COMMENT |
| MEDIUM | articles/rethinking-endpoint-management.md | 47 | ## The orchestration layer | COMMENT |
| MEDIUM | articles/warp-breach-find-which-laptops-run-warp.md | 31 | This is the same argument Fleet made in [agentic security is only as good as the device data underneath it](https://flee | CODE |
| MEDIUM | articles/spain-ai-agent-data-breach-no-human.md | 10 | - **We called this one early.** In ["Agentic security is only as good as the device data underneath it,"](https://fleetd | CODE |
| MEDIUM | articles/spain-ai-agent-data-breach-no-human.md | 53 | - [**Read the fuller argument**](https://fleetdm.com/articles/agentic-security-needs-ground-truth) for what ground truth | CODE |
| MEDIUM | articles/spain-ai-agent-data-breach-no-human.md | 58 | - SecurityWeek, [First Agentic AI Data Breach Reported to Spanish Regulator](https://www.securityweek.com/first-agentic- | CODE |
| MEDIUM | articles/nvidia-gtc-2026.md | 5 | **[NVIDIA GTC](https://www.nvidia.com/gtc/) BERLIN — Oct. 21, 2026** — [Fleet Device Management](https://fleetdm.com), t | CODE |
| MEDIUM | articles/endpoint-data-loss-prevention.md | 75 | ### How should teams compare browser-based DLP with agent-based DLP? | COMMENT |
| MEDIUM | …cles/sashiko-kernel-cves-which-linux-hosts-affected.md | 48 | - **Read the argument for ground truth:** [fleetdm.com/articles/agentic-security-needs-ground-truth](https://fleetdm.com | CODE |
| MEDIUM | …icles/zammad-zero-days-root-flaw-find-where-it-runs.md | 17 | DIVD discloses vulnerabilities for a living, and on September 21 its own Zammad helpdesk was breached. On October 1, DIV | CODE |
| MEDIUM | …icles/zammad-zero-days-root-flaw-find-where-it-runs.md | 24 | [Help Net Security](https://www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/) and [SecurityWeek](https: | CODE |
| MEDIUM | …icles/zammad-zero-days-root-flaw-find-where-it-runs.md | 53 | Fleet has argued that [agentic security needs ground truth](https://fleetdm.com/articles/agentic-security-needs-ground-t | CODE |
| MEDIUM | …icles/zammad-zero-days-root-flaw-find-where-it-runs.md | 67 | - **Read the argument for ground truth:** [fleetdm.com/articles/agentic-security-needs-ground-truth](https://fleetdm.com | CODE |
| MEDIUM | …icles/zammad-zero-days-root-flaw-find-where-it-runs.md | 71 | - Help Net Security, [AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit](https://www.he | CODE |
| MEDIUM | .claude/skills/fleet-article-formatting/SKILL.md | 127 | ### Honest-claims guardrails | COMMENT |
| MEDIUM | .claude/skills/aikido-tickets/SKILL.md | 57 | | Orchestration | `#g-orchestration` | https://github.com/orgs/fleetdm/projects/71/ | | CODE |
| MEDIUM | .claude/skills/fleet-case-study-formatting/SKILL.md | 143 | ### Voice and honesty guardrails — stricter than other content types | COMMENT |
| MEDIUM | server/service/integration_mdm_macos_setup_test.go | 2081 | // The integration test scaffold doesn't register the rotation cron, so | COMMENT |
| MEDIUM | …s/Contributing/architecture/modular-monolith/README.md | 111 | ├── bootstrap/ # Public: dependency injection entry point | CODE |
| MEDIUM | docs/Get started/FAQ.md | 486 | ### If I use a software orchestration tool (Ansible, Chef, Puppet, etc.) to manage agent options, do I have to apply the | COMMENT |
| MEDIUM | handbook/it/security.md | 2126 | In June 2026, [Aikido Security](https://www.aikido.dev/) performed a white box penetration test of the Fleet application | CODE |
| MEDIUM | handbook/company/product-groups.md | 38 | | [Orchestration](#orchestration-group) | Increase Fleet's integration footprint. Measured by the number of configu | CODE |
| MEDIUM | handbook/company/product-groups.md | 68 | > The [Slack channel](https://fleetdm.slack.com/archives/C084F4MKYSJ), [kanban release board](https://github.com/orgs/fl | CODE |
| MEDIUM | handbook/company/product-groups.md | 1235 | Please see [handbook/company/product-groups/orchestration](https://fleetdm.com/handbook/company/product-groups#orchestra | CODE |
| MEDIUM | .github/workflows/check-go-patch-release.yml | 6 | # #g-orchestration board: one for updating Go in the Fleet server and one for | COMMENT |
| MEDIUM | .github/workflows/check-go-patch-release.yml | 177 | labels: '#g-orchestration', | CODE |
| MEDIUM | .github/workflows/check-go-patch-release.yml | 199 | labels: ['#g-orchestration'], | CODE |
| MEDIUM | .github/workflows/check-go-patch-release.yml | 209 | // --- Project board: add to #g-orchestration and set status to "Inbox" --- | COMMENT |
| MEDIUM | .github/workflows/check-go-patch-release.yml | 225 | const PROJECT_ID = 'PVT_kwDOBDAnic4A4BEx'; // #g-orchestration (#71) | CODE |
| MEDIUM | .github/workflows/check-go-patch-release.yml | 248 | console.log(`Issue #${issue.number} is already on the #g-orchestration board — skipping.`); | CODE |
| MEDIUM | .github/workflows/check-go-patch-release.yml | 264 | console.log(`Added issue #${issue.number} to #g-orchestration board (item ${itemId})`); | CODE |
| MEDIUM | …ithub/actions/eng-metrics/test/markdown-parser.test.js | 520 | ### orchestration group | COMMENT |
| MEDIUM | .github/ISSUE_TEMPLATE/release-qa-fleetd.md | 5 | labels: '#g-orchestration,:release' | CODE |
| MEDIUM | .github/ISSUE_TEMPLATE/release-qa.md | 5 | labels: '#g-orchestration,#g-apple-at-work,#g-power-to-pc,#g-auto-patching,#g-supply-chain,#g-byod,:release' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | cmd/fleet/serve_test.go | 49 | // more robust pattern instead of doing this everywhere | COMMENT |
| MEDIUM | orbit/pkg/setup_experience/setup_experience.go | 74 | // when we check for them? Should we have a more robust way to handle the indeterminate | COMMENT |
| MEDIUM | tools/hangar/internal/settings/settings.go | 297 | // adopted, so an upgrade is seamless. | COMMENT |
| MEDIUM | tools/github-manage/pkg/jarvis/board.go | 3 | // leverage-ordered buckets (what's blocking others, what's a quick win, what | COMMENT |
| MEDIUM | tools/github-manage/pkg/jarvis/board.go | 23 | // Bucket groups items by leverage — who is blocked and how cheaply you can clear it. | COMMENT |
| MEDIUM | tools/github-manage/pkg/jarvis/board.go | 38 | // BucketOrder is the display and priority order, highest leverage first. | COMMENT |
| MEDIUM | tools/github-manage/pkg/jarvis/fetch.go | 69 | // repo and classifies them into the leverage board. It runs the gh calls | COMMENT |
| MEDIUM | tools/github-manage/pkg/jarvis/fetch.go | 129 | // leverage buckets below so they aren't shown twice. | COMMENT |
| MEDIUM | tools/github-manage/pkg/jarvis/projectview.go | 63 | // keys surfaced (to exclude from the leverage buckets), and status/project | COMMENT |
| MEDIUM | tools/github-manage/pkg/jarvis/workitem.go | 48 | // Claude session working on it. It's an issue-centric overlay on the leverage | COMMENT |
| MEDIUM | tools/github-manage/pkg/jarvis/workitem.go | 57 | PR *Item // linked PR item (already leverage-classified), nil if none | CODE |
| MEDIUM | tools/github-manage/pkg/jarvis/projectview_test.go | 11 | // leverage bucket from the last full fetch. | COMMENT |
| MEDIUM | tools/github-manage/pkg/jarvis/projectview_test.go | 54 | // #200 must be removed from the leverage bucket (no longer shown twice). | COMMENT |
| MEDIUM | tools/github-manage/pkg/jarvis/projectview_test.go | 54 | // #200 must be removed from the leverage bucket (no longer shown twice). | COMMENT |
| MEDIUM | tools/github-manage/pkg/jarvis/buckets.go | 24 | // BuildBoard classifies the user's PRs and assigned issues into leverage buckets. | COMMENT |
| MEDIUM | frontend/pages/hosts/ManageHostsPage/helpers.ts | 26 | // Consider using a third-party library if more robust validation is desired | COMMENT |
| MEDIUM | …ontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx | 1174 | // No success toast, to make column setting more seamless | COMMENT |
| MEDIUM | ee/server/service/software_installers.go | 2133 | // the correct, timing-robust signal. See #48879. | COMMENT |
| LOW | ee/maintained-apps/outputs/zed/windows.json | 20 | "3b164442": "# Locates Zed's Inno Setup uninstaller from the registry and runs it silently.\n# Zed's Inno installer | CODE |
| LOW | ee/maintained-apps/outputs/windsurf/windows.json | 21 | "bb230cc3": "$softwareNameLike = \"Windsurf*\"\n$publisherLike = \"*Codeium*\"\n\n$paths = @(\n 'HKLM:\\SOFTWARE | CODE |
| LOW | ee/maintained-apps/outputs/antigravity-ide/windows.json | 20 | "65cab11a": "$softwareNameLike = \"Antigravity*\"\n$publisherLike = \"*Google*\"\n\n$paths = @(\n 'HKLM:\\SOFTWA | CODE |
| MEDIUM | …/vulnerability-dashboard/assets/dependencies/moment.js | 3418 | // to utilize falling through the cases. | COMMENT |
| MEDIUM | ee/cis/win-11/cis-policy-queries.yml | 4587 | Note #1: Organizations that utilize 3rd-party commercial software to manage unique & complex local Administrator pas | CODE |
| MEDIUM | ee/cis/win-11-intune/l1_win11_intune.yaml | 10032 | Note #2: Organizations that utilize a third--party solution for patching may choose to | CODE |
| MEDIUM | website/scripts/build-static-content.js | 909 | let mdStringForThisOpenPosition = `# ${openPosition.jobTitle}\n\n## Let's start with why we exist. 📡\n\nEver | CODE |
| MEDIUM | website/assets/js/pages/configuration-builder.page.js | 48 | // Used to keep track of which payloads have been added to the profile builder. (Essentially formData for the payloa | COMMENT |
| MEDIUM | website/assets/js/pages/configuration-builder.page.js | 5760 | // Used to keep track of which payloads have been added to the profile builder. (Essentially formData for the payl | COMMENT |
| MEDIUM | website/assets/dependencies/moment.js | 3418 | // to utilize falling through the cases. | COMMENT |
| MEDIUM | server/mdm/maintainedapps/installers.go | 96 | // This is OK for the first 20 apps we support, but we should do something more robust once we | COMMENT |
| MEDIUM | server/mdm/nanomdm/test/protocol/transport.go | 40 | // The MDM channels utilize this transport to communicate with the host. | COMMENT |
| MEDIUM | server/mdm/nanomdm/storage/mysql/async.go | 66 | // value. Otherwise it returns nil and false. Essentially, if the number of | COMMENT |
| MEDIUM | server/mdm/nanomdm/push/service/service.go | 187 | // some environments may heavily utilize individual pushes. | COMMENT |
| MEDIUM | server/fleetmcp/schema.go | 364 | // and a little more robust than the previous tokenizer since it survives | COMMENT |
| MEDIUM | server/service/integration_mdm_lifecycle_test.go | 1680 | // This mirrors how GetHostMDMCheckinInfo derives SCEPRenewalInProgress and is robust to a host | COMMENT |
| MEDIUM | server/service/validation_setup.go | 31 | // TODO - implement more robust URL validation here | COMMENT |
| MEDIUM | …er/service/integration_enterprise_software_fma_test.go | 658 | // first been added via FMA. For a more robust handling of possible error scenarios when adding | COMMENT |
| MEDIUM | …er/service/integration_enterprise_certificates_test.go | 231 | // name-based lookup instead of list-position keeps the test robust against any order | COMMENT |
| MEDIUM | …s/solutions/cis/win-11/policies/cis-policy-queries.yml | 3913 | Note #1: Organizations that utilize 3rd-party commercial software to manage unique & complex local Administrator pas | CODE |
| MEDIUM | …lutions/cis/win-11-intune/policies/l1_win11_intune.yml | 6143 | # tags: framework:CISv8.1, benchmark:win11, level:1, platform:windows, category:configuration, requirement:standard, c | COMMENT |
| MEDIUM | …lutions/cis/win-11-intune/policies/l1_win11_intune.yml | 9073 | Note #2: Organizations that utilize a third--party solution for patching may choose to | CODE |
| MEDIUM | handbook/company/testimonials.yml | 369 | # quote: We started working with Fleet Device Management in early March 2022 because we were looking for a reliable ob | COMMENT |
| MEDIUM | handbook/company/open-positions.yml | 51 | # - 🧠 Identify opportunities to improve financial systems and tooling, implementing best practices that reduce manua | COMMENT |
| MEDIUM | handbook/company/open-positions.yml | 59 | # - 🧑💻 Comfortable working with modern tooling and excited to leverage technology to automate and streamline financ | COMMENT |
| MEDIUM | handbook/company/open-positions.yml | 103 | # - 🚀 Work collaboratively with product and engineering teams to facilitate feature development based on customer asks. | COMMENT |
| MEDIUM | handbook/company/open-positions.yml | 112 | # - 🧑🔬 Experience working with Enterprise customers to coordinate resolution of complex technical issues and project m | COMMENT |
| MEDIUM | handbook/company/open-positions.yml | 164 | # - 🦢 Work with the Product Design, Customer Success, and Engineering teams to facilitate feature development based o | COMMENT |
| MEDIUM | handbook/company/open-positions.yml | 305 | # - 🚀 Work collaboratively with product and engineering teams to facilitate feature development based on customer as | COMMENT |
| MEDIUM | handbook/company/open-positions.yml | 423 | # - 🦢 Work with the Product Design, Customer Success, and Engineering teams to facilitate feature development based | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …fleet-agent-downloader/assets/dependencies/sails.io.js | 908 | self._raw.io.engine.transport.on('error', function(err){ | CODE |
| CRITICAL | …eet-agent-downloader/assets/dependencies/jquery.min.js | 4 | null==d?void 0:d))},attrHooks:{type:{set:function(a,b){if(!o.radioValue&&"radio"===b&&B(a,"input")){var c=a.value;return | CODE |
| CRITICAL | ee/server/service/googlecas/googlecas.go | 161 | issued, err := client.Projects.Locations.CaPools.Certificates.Create(ca.CAPoolResourceName(), request). | CODE |
| CRITICAL | …ulnerability-dashboard/assets/dependencies/sails.io.js | 908 | self._raw.io.engine.transport.on('error', function(err){ | CODE |
| CRITICAL | …nerability-dashboard/assets/dependencies/jquery.min.js | 4 | null==d?void 0:d))},attrHooks:{type:{set:function(a,b){if(!o.radioValue&&"radio"===b&&B(a,"input")){var c=a.value;return | CODE |
| CRITICAL | website/scripts/deliver-estimation-report.js | 70 | graphqlHairball.data.organization.projectsNext.nodes.map((betaProject) => ({ | CODE |
| CRITICAL | website/assets/dependencies/sails.io.js | 908 | self._raw.io.engine.transport.on('error', function(err){ | CODE |
| CRITICAL | website/assets/dependencies/jquery.min.js | 4 | null==d?void 0:d))},attrHooks:{type:{set:function(a,b){if(!o.radioValue&&"radio"===b&&B(a,"input")){var c=a.value;return | CODE |
| CRITICAL | server/mdm/android/service/androidmgmt/proxy_client.go | 242 | call := p.mgmt.Enterprises.Devices.Operations.Get(operationName).Context(ctx) | CODE |
| CRITICAL | server/mdm/android/service/androidmgmt/google_client.go | 250 | op, err := g.mgmt.Enterprises.Devices.Operations.Get(operationName).Context(ctx).Do() | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | orbit/pkg/packaging/windows_templates.go | 710 | # Creating a COM instance of the WindowsInstaller.Installer COM object | COMMENT |
| MEDIUM⚡ | tools/tuf/releaser.sh | 218 | # Create a branch to make the changelog update on. | COMMENT |
| MEDIUM⚡ | tools/tuf/releaser.sh | 226 | # Create a new branch to cherry pick the changelog commit to. | COMMENT |
| MEDIUM⚡ | tools/tuf/releaser.sh | 230 | # Create a new PR with the changelog. | COMMENT |
| MEDIUM | tools/loadtest/scripts_and_profiles/main.go | 487 | # Create the extensions directory | COMMENT |
| MEDIUM | tools/software/icons/generate-icons.sh | 397 | # Create a temporary icns file from the extracted PNG for compatibility with rest of script | COMMENT |
| MEDIUM | ee/server/service/embedded_scripts/linux_lock.sh | 63 | # Create the pam_nologin files with our custom message | COMMENT |
| MEDIUM | ee/server/service/embedded_scripts/linux_lock.sh | 91 | # Create a systemd service to recreate nologin files on boot | COMMENT |
| MEDIUM | docs/queries.yml | 2078 | # Create a custom object with the desired fields. | COMMENT |
| MEDIUM | docs/queries.yml | 2370 | # Create a custom object with the desired fields | COMMENT |
| MEDIUM | docs/queries.yml | 2438 | # Create a custom object with the desired fields | COMMENT |
| MEDIUM | docs/scripts.yml | 51 | # Create the file using touch | COMMENT |
| MEDIUM | docs/scripts.yml | 623 | # Create the local user account | COMMENT |
| MEDIUM | docs/solutions/macos/scripts/macos_sethostname.sh | 13 | # Define the new hostname | COMMENT |
| MEDIUM | docs/solutions/linux/scripts/linux_sethostname.sh | 21 | # Define the new hostname | COMMENT |
| MEDIUM | docs/solutions/apple-container/fleetlab.sh | 56 | # Create a self-signed certificate whose Subject Alternative Names (SANs) cover | COMMENT |
| MEDIUM | …tions/cis/macos-15/scripts/macos15-CIS_sudo_logging.sh | 15 | # Create the file if it doesn't exist | COMMENT |
| MEDIUM | .github/zizmor-gate.yml | 5 | # This file is passed explicitly via the action's `config:` input rather than being named | COMMENT |
| MEDIUM | .github/workflows/deploy-agent-downloader.yml | 103 | # Create a git tree object from the currently staged repository state for this Heroku deploy. | COMMENT |
| MEDIUM | .github/workflows/deploy-agent-downloader.yml | 105 | # Create a parentless commit from the tree object. | COMMENT |
| MEDIUM | .github/workflows/deploy-vulnerability-dashboard.yml | 106 | # Create a git tree object that contains only the changes in the /website folder. | COMMENT |
| MEDIUM | .github/workflows/deploy-vulnerability-dashboard.yml | 108 | # Create a parentless commit from the tree object. | COMMENT |
| MEDIUM | .github/workflows/deploy-fleet-website.yml | 135 | # Create a git tree object that contains only the changes in the /website folder. | COMMENT |
| MEDIUM | .github/workflows/deploy-fleet-website.yml | 137 | # Create a parentless commit from the tree object. | COMMENT |
| MEDIUM | …structure/infrastructure/terraform/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | …re/infrastructure/guardduty-alerts/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | …arch_ansible/roles/elasticapm/templates/apm-server.yml | 19 | # Define a shared secret token for authorizing agents using the "Bearer" authorization method. | COMMENT |
| MEDIUM | …frastructure/dogfood/terraform/gcp/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | …re/dogfood/terraform/aws-tf-module/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | …orm/aws-tf-module/db-temp-restores/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/release/calendar-sync/sync.py | 276 | def match_develop_to_milestone( | CODE |
| LOW | tools/release/calendar-sync/sync.py | 301 | def fleetd_release_day_summary(version: str) -> str: | CODE |
| LOW | tools/api/README.md | 150 | def get_all_vulnerable_software_titles(): | CODE |
| LOW | tools/api/README.md | 164 | def get_hosts_for_software_version(version_id): | CODE |
| LOW | tools/cis/CIS-Benchmark-diff.py | 18 | def remove_trailing_whitespace(text): | CODE |
| LOW | tools/cis/CIS-Benchmark-diff.py | 39 | def extract_recommendations_fitz(pdf_path, start_phrase, end_phrase): | CODE |
| LOW | tools/cis/cis-test-runner.py | 352 | def _find_enable_disable_profiles(cis_id: str, profiles_dir: Path) -> tuple[Path | None, Path | None]: | CODE |
| LOW | tools/cis/cis-test-runner.py | 976 | def wait_for_fleet_registration( | CODE |
| LOW | …perArchLinuxRolling/TooltipWrapperArchLinuxRolling.tsx | 10 | export default function TooltipWrapperArchLinuxRolling({ | CODE |
| LOW | …uppet/fleetdm/spec/functions/preassign_profile_spec.rb | 132 | def expect_successful_calls_with_host_profiles(host_profiles, ensure_profile) | CODE |
| LOW | …fleet-agent-downloader/assets/dependencies/sails.io.js | 899 | })(function goAheadAndActuallyConnect() { | CODE |
| LOW | ee/fleet-agent-downloader/assets/dependencies/vue.js | 2146 | function extractPropsFromVNodeData ( | CODE |
| LOW | ee/fleet-agent-downloader/assets/dependencies/vue.js | 4064 | function createFunctionalComponent ( | CODE |
| LOW | ee/fleet-agent-downloader/assets/dependencies/vue.js | 4105 | function cloneAndMarkFunctionalResult (vnode, data, contextVm, options) { | CODE |
| LOW | ee/fleet-agent-downloader/assets/dependencies/vue.js | 4322 | function createComponentInstanceForVnode ( | CODE |
| LOW | ee/fleet-agent-downloader/assets/dependencies/vue.js | 4690 | function resolveConstructorOptions (Ctor) { | CODE |
| LOW | ee/fleet-agent-downloader/assets/dependencies/vue.js | 5791 | function removeAndInvokeRemoveHook (vnode, rm) { | CODE |
| LOW | ee/fleet-agent-downloader/assets/dependencies/vue.js | 6708 | function getAndRemoveAttr ( | CODE |
| LOW | ee/fleet-agent-downloader/assets/dependencies/vue.js | 9961 | function isDirectChildOfTemplateFor (node) { | CODE |
| LOW | ee/fleet-agent-downloader/assets/dependencies/vue.js | 10706 | function createCompileToFunctionFn (compile) { | CODE |
| LOW | …/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js | 91 | function getSpecialTransitionEndEvent() { | CODE |
| LOW | …/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js | 154 | getTransitionDurationFromElement: function getTransitionDurationFromElement(element) { | CODE |
| LOW | …/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js | 1893 | function getOffsetRectRelativeToArbitraryNode(children, parent) { | CODE |
| LOW | …/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js | 1945 | function getViewportOffsetRectRelativeToArtbitraryNode(element) { | CODE |
| LOW | …/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js | 1993 | function getFixedPositionOffsetParent(element) { | CODE |
| LOW | …/vulnerability-dashboard/assets/dependencies/moment.js | 626 | function replaceLongDateFormatTokens(input) { | CODE |
| LOW | …/vulnerability-dashboard/assets/dependencies/moment.js | 2386 | function configFromStringAndFormat(config) { | CODE |
| LOW | …/vulnerability-dashboard/assets/dependencies/moment.js | 2967 | function isDaylightSavingTimeShifted () { | CODE |
| LOW | …/vulnerability-dashboard/assets/dependencies/moment.js | 3081 | function positiveMomentsDifference(base, other) { | CODE |
| LOW | …/vulnerability-dashboard/assets/dependencies/moment.js | 4324 | function getSetRelativeTimeRounding (roundingFunction) { | CODE |
| LOW | …/vulnerability-dashboard/assets/dependencies/moment.js | 4336 | function getSetRelativeTimeThreshold (threshold, limit) { | CODE |
| LOW | …ulnerability-dashboard/assets/dependencies/sails.io.js | 899 | })(function goAheadAndActuallyConnect() { | CODE |
| LOW | ee/vulnerability-dashboard/assets/dependencies/vue.js | 2146 | function extractPropsFromVNodeData ( | CODE |
| LOW | ee/vulnerability-dashboard/assets/dependencies/vue.js | 4064 | function createFunctionalComponent ( | CODE |
| LOW | ee/vulnerability-dashboard/assets/dependencies/vue.js | 4105 | function cloneAndMarkFunctionalResult (vnode, data, contextVm, options) { | CODE |
| LOW | ee/vulnerability-dashboard/assets/dependencies/vue.js | 4322 | function createComponentInstanceForVnode ( | CODE |
| LOW | ee/vulnerability-dashboard/assets/dependencies/vue.js | 4690 | function resolveConstructorOptions (Ctor) { | CODE |
| LOW | ee/vulnerability-dashboard/assets/dependencies/vue.js | 5791 | function removeAndInvokeRemoveHook (vnode, rm) { | CODE |
| LOW | ee/vulnerability-dashboard/assets/dependencies/vue.js | 6708 | function getAndRemoveAttr ( | CODE |
| LOW | ee/vulnerability-dashboard/assets/dependencies/vue.js | 9961 | function isDirectChildOfTemplateFor (node) { | CODE |
| LOW | ee/vulnerability-dashboard/assets/dependencies/vue.js | 10706 | function createCompileToFunctionFn (compile) { | CODE |
| LOW | …/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js | 91 | function getSpecialTransitionEndEvent() { | CODE |
| LOW | …/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js | 154 | getTransitionDurationFromElement: function getTransitionDurationFromElement(element) { | CODE |
| LOW | …/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js | 1893 | function getOffsetRectRelativeToArbitraryNode(children, parent) { | CODE |
| LOW | …/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js | 1945 | function getViewportOffsetRectRelativeToArtbitraryNode(element) { | CODE |
| LOW | …/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js | 1993 | function getFixedPositionOffsetParent(element) { | CODE |
| LOW | …ile-generator/configuration-profile-generator-cases.js | 2323 | function isWorthRetryingAfterAPause(err) { | CODE |
| LOW | …enerator/tests/configuration-profile-generator.test.js | 372 | function withAdmxTemplatesCollapsed(profile) { | CODE |
| LOW | website/api/helpers/generate-configuration-profile.js | 281 | function mobileconfigWrittenFromPayloadSettings(rawResult) { | CODE |
| LOW | website/api/helpers/generate-configuration-profile.js | 314 | function windowsProfileWrittenFromCommands(rawResult) { | CODE |
| LOW | website/api/helpers/generate-configuration-profile.js | 343 | function withDoubleEscapedLineBreaksRepaired(content, profileType) { | CODE |
| LOW | website/api/helpers/generate-configuration-profile.js | 397 | function doesContentMatchProfileType(content, profileType) { | CODE |
| LOW | website/assets/dependencies/moment.js | 626 | function replaceLongDateFormatTokens(input) { | CODE |
| LOW | website/assets/dependencies/moment.js | 2386 | function configFromStringAndFormat(config) { | CODE |
| LOW | website/assets/dependencies/moment.js | 2967 | function isDaylightSavingTimeShifted () { | CODE |
| LOW | website/assets/dependencies/moment.js | 3081 | function positiveMomentsDifference(base, other) { | CODE |
| LOW | website/assets/dependencies/moment.js | 4324 | function getSetRelativeTimeRounding (roundingFunction) { | CODE |
| LOW | website/assets/dependencies/moment.js | 4336 | function getSetRelativeTimeThreshold (threshold, limit) { | CODE |
| LOW | website/assets/dependencies/sails.io.js | 899 | })(function goAheadAndActuallyConnect() { | CODE |
| LOW | website/assets/dependencies/vue.js | 2146 | function extractPropsFromVNodeData ( | CODE |
| 21 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | website/assets/robots.txt | 16 | # include providing AI-generated search summaries. | COMMENT |
| HIGH | …cles/sashiko-kernel-cves-which-linux-hosts-affected.md | 16 | In March, Kroah-Hartman [told The Register](https://www.theregister.com/software/2026/03/26/linux-kernel-czar-says-ai-bu | CODE |
| HIGH | …eet-ai-assisted-policy-descriptions-and-resolutions.md | 43 | Also, the end user can read about a policy during an [automated maintenance window scheduled in their calendar](https:// | CODE |
| HIGH | server/service/profile_validation.go | 189 | // Strict mode checks AI-generated profiles, whose findings should be visible; | COMMENT |
| HIGH | handbook/engineering/README.md | 216 | > [Ownership](https://fleetdm.com/handbook/company#ownership) is one of Fleet's key values. When a bot opens a PR on you | CODE |
| HIGH | handbook/engineering/README.md | 216 | > [Ownership](https://fleetdm.com/handbook/company#ownership) is one of Fleet's key values. When a bot opens a PR on you | CODE |
| HIGH | handbook/company/product-groups.md | 265 | - Whether a [sub-task](#sub-tasks) should be created versus folded into the parent story, including reviewing any AI-gen | CODE |
| HIGH | handbook/company/open-positions.yml | 501 | # - 🌐 Assist with domain registrations, SaaS tool evaluations, and vendor management as requested. | COMMENT |
| HIGH | handbook/company/pricing-features-table.yml | 1531 | # - description: AI generated CVSS v4 context. Coming soon (2024-12-31). | COMMENT |
| HIGH | handbook/company/pricing-features-table.yml | 1539 | # - industryName: AI-generated descriptions (optional) | COMMENT |
| HIGH | handbook/company/why-this-way.md | 310 | ## Why read every line of AI-generated work? | COMMENT |
| HIGH | handbook/company/why-this-way.md | 317 | - **Cognitive debt.** Anything generated by AI that you didn't write yourself starts as cognitive debt. You don't fully | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | orbit/goreleaser-windows-arm64.yml | 6 | # If this is updated make sure to update the "How to build from source" section in the README.md. | COMMENT |
| LOW | orbit/goreleaser-macos.yml | 6 | # If this is updated make sure to update the "How to build from source" section in the README.md. | COMMENT |
| LOW | orbit/goreleaser-windows.yml | 6 | # If this is updated make sure to update the "How to build from source" section in the README.md. | COMMENT |
| LOW | orbit/goreleaser-linux.yml | 6 | # If this is updated make sure to update the "How to build from source" section in the README.md. | COMMENT |
| LOW | orbit/goreleaser-linux-arm64.yml | 6 | # If this is updated make sure to update the "How to build from source" section in the README.md. | COMMENT |
| MEDIUM⚡ | tools/release/publish_release.sh | 692 | # Now you can use the $dry_run variable to see if the option was set | COMMENT |
| LOW | ee/fleet-agent-downloader/config/models.js | 83 | // Plus, don't forget to configure MongoDB as your default datastore: | COMMENT |
| LOW | ee/vulnerability-dashboard/config/models.js | 83 | // Plus, don't forget to configure MongoDB as your default datastore: | COMMENT |
| LOW | website/config/models.js | 83 | // Plus, don't forget to configure MongoDB as your default datastore: | COMMENT |
| LOW | docs/solutions/tines/mdm-migration-jamf-pro.json | 153 | "content": "# Configuration\n\n## Jamf\n\nSet up a Jamf Pro [API Role and Client](https://learn.jamf.com/en-US/bun | CODE |
| MEDIUM | handbook/company/pricing-features-table.yml | 1 | # [?]: To generate new ASCII art headings used in this file, you can use the @mikermcneil/kit npm package. See https://g | COMMENT |
| LOW⚡ | .github/workflows/test-go.yaml | 81 | # make sure to update supported versions docs when MySQL versions change | COMMENT |
| LOW⚡ | .github/workflows/test-go.yaml | 122 | # make sure to update supported versions docs when Redis/Valkey versions change | COMMENT |
| LOW⚡ | .github/workflows/test-go-activity.yaml | 48 | # make sure to update supported versions docs when MySQL versions change | COMMENT |
| LOW | .github/workflows/golangci-lint.yml | 73 | # Don't forget to update | COMMENT |
| LOW | .github/workflows/golangci-lint.yml | 131 | # Don't forget to update | COMMENT |
| LOW | .github/scripts/rclone-install.sh | 17 | #when adding a tool to the list make sure to also add its corresponding command further in the script | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 169 | CODE | |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 267 | CODE | |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 322 | CODE | |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 354 | CODE | |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 371 | CODE | |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 659 | CODE | |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 713 | CODE | |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 775 | CODE | |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 918 | CODE | |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 968 | CODE | |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 1143 | CODE | |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 156 | CODE | |
| LOW | tools/release/calendar-sync/sync.py | 106 | CODE | |
| LOW | tools/release/calendar-sync/sync.py | 453 | CODE | |
| LOW | tools/cis/CIS-Benchmark-diff.py | 39 | CODE | |
| LOW | tools/cis/cis-test-runner.py | 398 | CODE | |
| LOW | tools/cis/cis-test-runner.py | 976 | CODE | |
| LOW | tools/cis/cis-test-runner.py | 1004 | CODE | |
| LOW | tools/cis/cis-test-runner.py | 1227 | CODE | |
| LOW | tools/cis/cis-test-runner.py | 1811 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 169 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 267 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 322 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 354 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 371 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 659 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 713 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 775 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 918 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 968 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 1143 | CODE | |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 156 | CODE | |
| LOW | …utions/api-scripts/sync_applecare_coverage_to_fleet.py | 194 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 210 | except ImportError: | CODE |
| HIGH | tools/cis/cis-test-runner.py | 923 | except subprocess.TimeoutExpired: | CODE |
| HIGH | tools/cis/cis-test-runner.py | 990 | except (HTTPError, URLError): | CODE |
| HIGH | .claude/skills/fleet-gitops/scripts/validate.py | 210 | except ImportError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 194 | except Exception as e: # noqa: BLE001 - any network or parse failure just disables the check | CODE |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 247 | except Exception as e: # noqa: BLE001 - PyYAML raises its own hierarchy | CODE |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 499 | except Exception: # noqa: BLE001 | CODE |
| LOW | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 503 | except Exception as e: # noqa: BLE001 | CODE |
| MEDIUM | …es/new/.agents/skills/fleet-gitops/scripts/validate.py | 106 | def rel(self, p): | CODE |
| LOW | tools/release/calendar-sync/sync.py | 784 | except Exception as e: # noqa: BLE001 | CODE |
| LOW⚡ | tools/cis/cis-test-runner.py | 1459 | except Exception as e: | CODE |
| LOW | tools/cis/cis-test-runner.py | 2242 | except Exception as e: | STRING |
| LOW | articles/google-conditional-access-integration.md | 215 | except Exception as e: | CODE |
| LOW | articles/google-conditional-access-integration.md | 262 | except Exception as e: | CODE |
| MEDIUM | articles/google-conditional-access-integration.md | 129 | def upstream_error(source, r): | CODE |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 194 | except Exception as e: # noqa: BLE001 - any network or parse failure just disables the check | CODE |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 247 | except Exception as e: # noqa: BLE001 - PyYAML raises its own hierarchy | CODE |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 499 | except Exception: # noqa: BLE001 | CODE |
| LOW | .claude/skills/fleet-gitops/scripts/validate.py | 503 | except Exception as e: # noqa: BLE001 | CODE |
| MEDIUM | .claude/skills/fleet-gitops/scripts/validate.py | 106 | def rel(self, p): | CODE |
| LOW | …aude/skills/handbook-pr/scripts/check-handbook-diff.sh | 183 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/mdm/nanodep/godep/account_driven_enrollment.go | 37 | // TODO: Implement error checks to cover https://developer.apple.com/documentation/devicemanagement/assign-account-drive | COMMENT |
| LOW | server/mdm/microsoft/wstep.go | 63 | // TODO: implement other methods as needed: | COMMENT |
| LOW | server/mdm/scep/depot/bolt/depot.go | 175 | // TODO: implement allowTime | COMMENT |
| LOW | server/mdm/scep/depot/bolt/depot.go | 176 | // TODO: implement revocation | COMMENT |
| LOW | server/service/integration_mdm_misc_test.go | 640 | // TODO: Add tests for other combinations of mac and windows mdm enabled/disabled | COMMENT |
| LOW | server/service/integration_mdm_misc_test.go | 785 | // TODO: Add tests for other combinations of mac and windows mdm enabled/disabled | COMMENT |
| LOW | server/service/mdm_test.go | 1347 | // TODO: Add tests for Apple DDM authz? | COMMENT |
| LOW | server/service/apple_mdm_test.go | 5863 | // TODO: Add tests for gitops and observer plus roles? (Settings endpoint test above may also need to be updated) | COMMENT |
| LOW | …er/service/integration_certificate_authorities_test.go | 122 | URL: mockHydrantServer.URL, // TODO: implement a test server? | CODE |
| LOW | server/service/integration_mdm_profiles_crud_test.go | 742 | // TODO: Add tests for OS updates declaration when implemented. | COMMENT |
| LOW | server/vulnerabilities/nvd/tools/cpedict/cpedict.go | 51 | // TODO: implement | COMMENT |
| LOW | server/vulnerabilities/nvd/tools/cpedict/cpedict.go | 57 | // TODO: implement | COMMENT |
| LOW | server/vulnerabilities/nvd/tools/cpedict/cpedict.go | 99 | // TODO: implement ProvenanceRecord | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/version-from-branch.sh | 5 | # Usage: | COMMENT |
| LOW | …/cleanup-docker-sha-tags/cleanup-dockerhub-sha-tags.sh | 6 | # Usage: | COMMENT |
| LOW | tools/cleanup-docker-sha-tags/cleanup-quay-sha-tags.sh | 6 | # Usage: | COMMENT |
| LOW | tools/release/backport-check.sh | 15 | # Usage: | COMMENT |
| LOW | tools/loadtest/metrics/collect-metrics.sh | 5 | # Usage: | COMMENT |
| LOW | tools/loadtest/metrics/compare-metrics.sh | 5 | # Usage: | COMMENT |
| LOW | tools/loadtest/scripts_and_profiles/main.go | 142 | # Usage: | COMMENT |
| LOW | tools/docker-idp/build-push-docker-idp.sh | 13 | # Usage: | COMMENT |
| LOW | server/platform/logging/testutils/test_logger.go | 12 | // Example usage: | COMMENT |
| LOW | …s/solutions/macos/scripts/uninstall-santa-extension.sh | 7 | # Usage: | COMMENT |
| LOW | apps/fleet-desktop-macos/dev-notify.sh | 8 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | articles/remote-yara-rules.md | 46 | [API](https://fleetdm.com/docs/rest-api/rest-api#modify-configuration). Reference each rule file by path under the main | CODE |
| HIGH | docs/Configuration/agent-configuration.md | 269 | # returned by `SELECT platform FROM os_version`. In this example, the base | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | website/scripts/freeze-open-pull-requests.js | 12 | sails_custom__githubAccessToken=YOUR_TOKEN_HERE sails run scripts/freeze-open-pull-requests.js --dry | CODE |
| HIGH | website/scripts/freeze-open-pull-requests.js | 15 | sails_custom__githubAccessToken=YOUR_TOKEN_HERE sails run scripts/freeze-open-pull-requests.js --limit=100`, | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/fleet-slackbot/slack-handlers.js | 76 | async function handleRequest({ userText, userId, channelId, threadTs, messageTs, threadContext, client, config, github, | CODE |
| LOW | ee/fleet-agent-downloader/assets/dependencies/vue.js | 3446 | function getData (data, vm) { | CODE |
| LOW | ee/vulnerability-dashboard/assets/dependencies/vue.js | 3446 | function getData (data, vm) { | CODE |
| LOW | ee/fleetd-chrome/src/mockServiceWorker.js | 140 | async function handleRequest(event, requestId) { | CODE |
| LOW | website/assets/dependencies/vue.js | 3446 | function getData (data, vm) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/release/calendar-sync/sync.py | 22 | CODE | |
| LOW | tools/cis/cis-test-runner.py | 18 | CODE | |
| LOW | …f-module/db-temp-restores/scripts/show_db_temp_info.py | 4 | CODE |