OpenRouter for agent tools. Join community here: https://discord.gg/6mQYYfFMAn
This report summarizes scanner evidence for superdesigndev/treg, a Python project with 4,985 GitHub stars. SynthScan examined 567,735 lines of code across 3639 source files, recording 4808 pattern matches distributed across 20 syntactic categories. The legacy adjusted pattern signal is 9.9 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 3717 finding(s).
Are imports declared and package/API names verified? 581 finding(s).
Are wrappers, guards, and repeated structures necessary? 3747 finding(s).
Which changes need focused human review? 4808 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 4808 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | frontend/e2e/agents.spec.ts | 112 | async function waitForConsumedCredential(page: Page, orgId: number, keyId: number) { | CODE |
| LOW | tests/test_gtm_engineering_page.py | 18 | async def test_hub_is_served_canonical_and_measurable(clients: AsyncClient): | CODE |
| LOW | tests/test_gtm_engineering_page.py | 38 | async def test_every_internal_link_on_the_hub_resolves(clients: AsyncClient): | CODE |
| LOW | tests/test_gtm_engineering_page.py | 50 | async def test_hub_is_linked_from_its_pillars_and_listed(clients: AsyncClient): | CODE |
| LOW | tests/test_gtm_engineering_page.py | 82 | async def test_markdown_twin_carries_every_chapter(clients: AsyncClient): | CODE |
| LOW | tests/test_gtm_engineering_page.py | 99 | async def test_studies_publish_results_without_naming_the_databases(clients: AsyncClient): | CODE |
| LOW | tests/test_arena_verification_insights.py | 22 | def test_projection_thresholds_and_phone_does_not_imply_ownership(): | CODE |
| LOW | tests/test_arena_verification_insights.py | 49 | def test_reject_private_content_and_invalid_aggregates(change): | CODE |
| LOW | tests/test_arena_verification_insights.py | 56 | async def test_published_snapshot_survives_observation_refresh_and_reimport(clients): | CODE |
| LOW | tests/test_arena_verification_insights.py | 71 | async def test_empty_database_has_no_verification_rates(clients): | CODE |
| LOW | tests/test_arena_verification_insights.py | 75 | def test_validity_uses_completed_returned_emails_not_lookup_baseline(): | CODE |
| LOW | tests/test_arena_verification_insights.py | 92 | def test_phone_format_validity_has_a_separate_completed_check_denominator(): | CODE |
| LOW | tests/test_feedback.py | 23 | async def test_feedback_is_durable_and_private_to_the_team(clients): | CODE |
| LOW | tests/test_feedback.py | 55 | async def test_invalid_feedback_is_not_stored(clients, body): | CODE |
| LOW | tests/test_feedback.py | 60 | async def test_call_references_verify_only_same_team_without_requiring_audit(clients): | CODE |
| LOW | tests/test_feedback.py | 81 | async def test_rate_limit_is_per_team(clients, monkeypatch): | CODE |
| LOW | tests/test_feedback.py | 92 | async def test_failed_insert_rolls_back_without_an_acknowledgement(clients, monkeypatch): | CODE |
| LOW | tests/test_feedback.py | 109 | async def test_admin_can_filter_and_page_reports(clients, monkeypatch): | CODE |
| LOW | tests/test_feedback.py | 127 | def test_cli_feedback_sends_only_the_declared_fields(monkeypatch, capsys): | CODE |
| LOW | tests/test_feedback.py | 149 | async def test_team_mcp_submits_to_the_intake(clients): | CODE |
| LOW | tests/test_feedback.py | 163 | async def test_mcp_exposes_the_small_category_enum(): | CODE |
| LOW | tests/test_feedback.py | 177 | async def test_deleting_a_team_removes_its_feedback(clients): | CODE |
| LOW | tests/test_feedback.py | 192 | async def test_public_demo_token_cannot_submit_feedback(clients): | CODE |
| LOW | tests/test_feedback.py | 204 | def test_cli_feedback_get_uses_the_configured_registry(monkeypatch, capsys): | CODE |
| LOW | tests/test_feedback.py | 229 | def test_cli_feedback_errors_are_actionable_without_echoing_input(monkeypatch, capsys, status, code, hint): | CODE |
| LOW | tests/test_feedback.py | 248 | def test_cli_feedback_validates_message_before_sending(monkeypatch, capsys, message, length): | CODE |
| LOW | tests/test_feedback.py | 260 | def test_cli_feedback_network_errors_do_not_claim_a_submission_failed(monkeypatch, capsys, action, code): | CODE |
| LOW⚡ | tests/test_feedback.py | 280 | def test_cli_feedback_keeps_category_first_shorthand(monkeypatch): | CODE |
| LOW⚡ | tests/test_feedback.py | 288 | def test_cli_feedback_stdin_never_waits_for_interactive_input(monkeypatch, capsys): | CODE |
| LOW⚡ | tests/test_feedback.py | 296 | async def test_internal_handling_does_not_change_public_receipt(clients): | CODE |
| LOW | tests/test_capacity_know.py | 24 | async def test_policy_population_covers_every_platform_slot_and_both_aggregators(): | CODE |
| LOW | tests/test_capacity_know.py | 36 | async def test_platform_account_has_a_known_dashboard_only_capacity_policy( | CODE |
| LOW | tests/test_capacity_know.py | 56 | async def test_import_creates_one_policy_per_account_and_flags_unknowns_without_overwriting(): | CODE |
| LOW | tests/test_capacity_know.py | 77 | def test_snapshot_never_carries_a_credential(): | CODE |
| LOW | tests/test_capacity_know.py | 109 | async def test_sweep_one_failing_collector_does_not_stop_the_others(monkeypatch): | CODE |
| LOW | tests/test_capacity_know.py | 140 | async def test_view_sees_a_published_state_from_a_fresh_process_within_the_ttl(): | CODE |
| LOW | tests/test_capacity_know.py | 157 | def test_capacity_view_getters_are_sync_and_io_free(): | CODE |
| LOW | tests/test_maintenance.py | 221 | def test_real_serve_path_can_query_database_after_pre_serve_maintenance(tmp_path): | CODE |
| LOW | tests/test_maintenance.py | 287 | def test_empty_database_upgrade_uses_pure_alembic_without_provisioning_a_user(tmp_path): | CODE |
| LOW | tests/test_maintenance.py | 306 | def test_raw_asgi_boots_when_database_is_at_head(tmp_path): | CODE |
| LOW | tests/test_maintenance.py | 316 | def test_raw_asgi_refuses_a_database_behind_head(tmp_path): | CODE |
| LOW | tests/test_maintenance.py | 330 | def test_raw_asgi_warns_and_serves_when_database_revision_is_unknown_newer(tmp_path): | CODE |
| LOW | tests/test_maintenance.py | 346 | def test_upgrade_refuses_an_unstamped_pre_adoption_database(tmp_path): | CODE |
| LOW | tests/test_maintenance.py | 360 | def test_upgrade_names_the_rollback_when_the_database_is_newer_than_the_build(tmp_path): | CODE |
| LOW | tests/test_maintenance.py | 377 | def test_upgrade_applies_a_pending_revision_from_one_behind_head(tmp_path): | CODE |
| LOW | tests/test_maintenance.py | 392 | def test_upgrade_backfills_companions_and_is_idempotent(tmp_path): | CODE |
| LOW | tests/test_maintenance.py | 409 | def test_app_lifespan_does_not_run_release_backfills(tmp_path, ads_enabled): | CODE |
| LOW | tests/test_maintenance.py | 484 | async def test_upgrade_retries_a_lock_timeout_and_resumes(monkeypatch, caplog): | CODE |
| LOW | tests/test_maintenance.py | 499 | async def test_upgrade_gives_up_after_the_retry_budget(monkeypatch): | CODE |
| LOW | tests/test_maintenance.py | 513 | async def test_upgrade_does_not_retry_other_database_errors(monkeypatch): | CODE |
| LOW | tests/test_call_pool_discipline.py | 46 | async def dispose_exhausted_pool_on_its_own_loop(): | CODE |
| LOW | tests/test_call_pool_discipline.py | 53 | def _relay_that_checks_the_pool(seen: list[int]): | CODE |
| LOW | tests/test_call_pool_discipline.py | 66 | async def test_a_metered_call_holds_no_db_connection_while_upstream_is_called( | CODE |
| LOW | tests/test_call_pool_discipline.py | 77 | async def test_an_own_key_call_holds_no_db_connection_while_upstream_is_called( | CODE |
| LOW | tests/test_call_pool_discipline.py | 91 | async def test_a_burst_larger_than_the_pool_settles_every_call_at_provider_speed( | CODE |
| LOW | tests/test_call_pool_discipline.py | 103 | async def _relay_after_everyone_arrives(*args, **kwargs): | CODE |
| LOW | tests/test_call_pool_discipline.py | 145 | async def test_a_catalog_search_storm_cannot_starve_calls_of_the_pool( | CODE |
| LOW | tests/test_call_pool_discipline.py | 199 | async def test_http_and_mcp_catalog_search_share_one_nonblocking_refresh( | CODE |
| LOW | tests/test_call_pool_discipline.py | 247 | async def test_a_settle_that_loses_the_pool_once_retries_and_still_charges( | CODE |
| LOW | tests/test_call_pool_discipline.py | 274 | async def test_auth_releases_a_single_slot_pool_before_an_application_session( | CODE |
| 3164 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_maintenance.py | 204 | except (OSError, urllib.error.URLError): | CODE |
| HIGH | tests/test_maintenance.py | 249 | except (OSError, urllib.error.URLError): | CODE |
| HIGH | tests/conftest.py | 503 | except ImportError: | CODE |
| HIGH | tests/conftest.py | 509 | except ImportError: | CODE |
| HIGH | tests/conftest.py | 514 | except ImportError: | CODE |
| HIGH | tests/test_localproxy.py | 483 | except OSError: | CODE |
| HIGH | tests/test_localproxy.py | 403 | except (ssl.SSLError, OSError): | CODE |
| HIGH | tests/test_call_response_limits.py | 73 | except (BrokenPipeError, ConnectionResetError): | CODE |
| HIGH | …/skills/ugc-talking-head-video/scripts/caption_burn.py | 31 | except Exception: pass | CODE |
| HIGH | scripts/catalog_verify_extended.py | 322 | except ValueError: | CODE |
| HIGH | scripts/catalog_verify_extended.py | 235 | except Exception: | CODE |
| HIGH | scripts/catalog_verify.py | 174 | except ValueError: | CODE |
| HIGH | src/treg/bootstrap.py | 601 | except Exception: # noqa: BLE001 - diagnostics must not break a gauge or shutdown | CODE |
| HIGH | src/treg/worker.py | 419 | except Exception: # noqa: BLE001 - local exit summaries remain the fallback evidence | CODE |
| HIGH | src/treg/worker.py | 409 | except Exception: # noqa: BLE001 - preserve the command's result/failure | CODE |
| HIGH | src/treg/runner.py | 123 | except (ValueError, OSError): # pragma: no cover - defensive; never fail a run over a limit | CODE |
| HIGH | src/treg/runner.py | 170 | except (ProcessLookupError, PermissionError): | CODE |
| HIGH | src/treg/runner.py | 271 | except (asyncio.TimeoutError, ProcessLookupError, asyncio.CancelledError): | CODE |
| HIGH | src/treg/skills.py | 63 | except OSError: | CODE |
| HIGH | src/treg/health.py | 252 | except Exception: # noqa: BLE001 — an alert hiccup must never break the run | CODE |
| HIGH | src/treg/shell.py | 218 | except (ProcessLookupError, OSError): | CODE |
| HIGH | src/treg/providers.py | 731 | except (ValueError, IndexError): | CODE |
| HIGH | src/treg/cli.py | 136 | except Exception: | CODE |
| HIGH | src/treg/cli.py | 540 | except Exception: | CODE |
| HIGH | src/treg/cli.py | 799 | except KeyboardInterrupt: | CODE |
| HIGH | src/treg/cli.py | 853 | except OSError: | CODE |
| HIGH | src/treg/cli.py | 1605 | except Exception: | CODE |
| HIGH | src/treg/cli.py | 1612 | except (OSError, json.JSONDecodeError): | CODE |
| HIGH | src/treg/cli.py | 2311 | except (TypeError, ValueError): | CODE |
| HIGH | src/treg/cli.py | 3277 | except ModuleNotFoundError: | CODE |
| HIGH | src/treg/cli.py | 3989 | except Exception: # noqa: BLE001 — optional extras; the treg skill already installed | CODE |
| HIGH | src/treg/cli.py | 1289 | except ImportError: | CODE |
| HIGH | src/treg/cli.py | 1320 | except ImportError: | CODE |
| HIGH | src/treg/cli.py | 2610 | except ValueError: | CODE |
| HIGH | src/treg/cli.py | 2932 | except (ProcessLookupError, OSError): | CODE |
| HIGH | src/treg/cli.py | 2993 | except Exception: # noqa: BLE001 — reporting must never mask the CLI's own failure | CODE |
| HIGH | src/treg/cli.py | 3050 | except OSError: | CODE |
| HIGH | src/treg/cli.py | 3973 | except OSError: | CODE |
| HIGH | src/treg/cli.py | 5953 | except Exception: # noqa: BLE001 — an access hint must never break the catalog page | CODE |
| HIGH | src/treg/cli.py | 1598 | except OSError: | CODE |
| HIGH | src/treg/cli.py | 3039 | except OSError: | CODE |
| HIGH | src/treg/mcp.py | 1463 | except ValueError: | CODE |
| HIGH | src/treg/mcp.py | 1558 | except ValueError: | CODE |
| HIGH | src/treg/localproxy.py | 400 | except OSError: | CODE |
| HIGH | src/treg/localproxy.py | 558 | except (ConnectionError, OSError): | CODE |
| HIGH | src/treg/localproxy.py | 565 | except (ConnectionError, OSError, RuntimeError): | CODE |
| HIGH | src/treg/localproxy.py | 579 | except (ConnectionError, OSError, asyncio.IncompleteReadError): | CODE |
| HIGH | src/treg/localproxy.py | 839 | except (ValueError, httpx.HTTPError, TypeError): | CODE |
| HIGH | src/treg/localproxy.py | 269 | except (ValueError, TypeError, OSError): | CODE |
| HIGH | src/treg/localproxy.py | 585 | except (ConnectionError, OSError, RuntimeError): | CODE |
| HIGH | src/treg/localproxy.py | 1093 | except (RuntimeError, TimeoutError, asyncio.TimeoutError, asyncio.CancelledError): | CODE |
| HIGH | src/treg/localproxy.py | 1077 | except (OSError, RuntimeError): | CODE |
| HIGH | src/treg/localproxy.py | 206 | except OSError: | CODE |
| HIGH | src/treg/localproxy.py | 225 | except OSError: | CODE |
| HIGH | src/treg/localproxy.py | 1082 | except (httpx.HTTPError, RuntimeError, OSError): | CODE |
| HIGH | src/treg/analytics.py | 181 | except Exception: # noqa: BLE001 — analytics must never surface into a caller's path | CODE |
| HIGH | src/treg/analytics.py | 292 | except Exception: # noqa: BLE001 — reporting a fault must never become another fault | CODE |
| HIGH | src/treg/analytics.py | 389 | except Exception: # noqa: BLE001 — a PostHog hiccup costs this batch, nothing else | CODE |
| HIGH | src/treg/analytics.py | 323 | except Exception: # noqa: BLE001 — Handler.emit must never escape into its caller | CODE |
| HIGH | src/treg/analytics.py | 405 | except (asyncio.CancelledError, Exception): # noqa: BLE001 | CODE |
| 46 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | e2e_check.py | 7 | CODE | |
| LOW | tests/test_gtm_engineering_page.py | 5 | CODE | |
| LOW | tests/test_capacity_know.py | 4 | CODE | |
| LOW | tests/test_maintenance.py | 3 | CODE | |
| LOW | tests/test_call_pool_discipline.py | 17 | CODE | |
| LOW | tests/test_call_pool_discipline.py | 31 | CODE | |
| LOW | tests/test_call_pool_discipline.py | 39 | CODE | |
| LOW | tests/test_db_pool_isolation.py | 14 | CODE | |
| LOW | tests/test_billing.py | 15 | CODE | |
| LOW | tests/test_endpoint_stats.py | 8 | CODE | |
| LOW | tests/test_catalog_api.py | 9 | CODE | |
| LOW | tests/test_step3_crud_auth_audit.py | 6 | CODE | |
| LOW | tests/test_postgres_reset.py | 3 | CODE | |
| LOW | tests/test_admin.py | 4 | CODE | |
| LOW | tests/test_money_trace_postgres.py | 3 | CODE | |
| LOW | tests/test_moltsets.py | 11 | CODE | |
| LOW | tests/test_fsjail.py | 4 | CODE | |
| LOW | tests/conftest.py | 8 | CODE | |
| LOW | tests/test_connections.py | 8 | CODE | |
| LOW | tests/test_injectors.py | 7 | CODE | |
| LOW | tests/test_localproxy.py | 14 | CODE | |
| LOW | tests/test_call_architecture.py | 3 | CODE | |
| LOW | tests/test_security_round2.py | 2 | CODE | |
| LOW | tests/test_tag_billing.py | 12 | CODE | |
| LOW | tests/test_catalog_search.py | 5 | CODE | |
| LOW | tests/test_aigc_pr_b.py | 3 | CODE | |
| LOW | tests/test_influencersclub_overflow.py | 26 | CODE | |
| LOW | tests/test_influencersclub_overflow.py | 27 | CODE | |
| LOW | tests/test_asgi_middleware.py | 3 | CODE | |
| LOW | tests/test_detail_pages.py | 8 | CODE | |
| LOW | tests/test_onboard.py | 7 | CODE | |
| LOW | tests/test_security_round3.py | 2 | CODE | |
| LOW | tests/test_refusal_audit.py | 10 | CODE | |
| LOW | tests/test_static_pages.py | 4 | CODE | |
| LOW | tests/test_alembic_baseline.py | 3 | CODE | |
| LOW | tests/test_surface_snapshot.py | 3 | CODE | |
| LOW | tests/test_plugin.py | 28 | CODE | |
| LOW | tests/test_step5_skills.py | 8 | CODE | |
| LOW | tests/test_enrich_arena.py | 16 | CODE | |
| LOW | tests/test_enrich_arena.py | 17 | CODE | |
| LOW | tests/test_capacity_collectors.py | 7 | CODE | |
| LOW | tests/test_relay_content_length.py | 8 | CODE | |
| LOW | tests/test_financialdatasets.py | 3 | CODE | |
| LOW | tests/test_hub.py | 8 | CODE | |
| LOW | tests/test_hub.py | 19 | CODE | |
| LOW | tests/test_money_admission_postgres.py | 7 | CODE | |
| LOW | tests/test_table_oauth.py | 9 | CODE | |
| LOW | tests/test_table_oauth.py | 16 | CODE | |
| LOW | tests/test_providers.py | 8 | CODE | |
| LOW | tests/test_auth.py | 7 | CODE | |
| LOW | tests/test_asynctasks.py | 3 | CODE | |
| LOW | tests/test_catalog_observation_cache.py | 3 | CODE | |
| LOW | tests/test_walking_skeleton.py | 7 | CODE | |
| LOW | tests/test_find_index.py | 4 | CODE | |
| LOW | tests/test_oauth_connect.py | 6 | CODE | |
| LOW | tests/test_table.py | 8 | CODE | |
| LOW | tests/test_table.py | 16 | CODE | |
| LOW | tests/test_capacity_smoothing.py | 5 | CODE | |
| LOW | tests/test_capacity_smoothing.py | 24 | CODE | |
| LOW | tests/test_capacity_smoothing.py | 24 | CODE | |
| 411 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_catalog_api.py | 933 | no_price: {usd: null, kind: treg_shared_plan, basis: "treg shared-plan rate. $10/mo. break-even at 1,000 calls/mo", | CODE |
| HIGH⚡ | tests/test_hub.py | 1368 | "export default async function run(ctx) { return { email: null, results: 0 }; }") | CODE |
| HIGH⚡ | tests/test_hub.py | 1605 | " return { rows: r.json.data, count: FULL ? r.json.data.length : null };" | CODE |
| HIGH | tests/test_hub.py | 1547 | " return ctx.inputs.search === 'none' ? { rows: null, count: null } : { rows: [1], count: 1 };" | CODE |
| HIGH⚡ | tests/test_cache_result_admission.py | 276 | raw = b'{"data":{"name":null}}' | CODE |
| HIGH⚡ | tests/test_routing.py | 875 | miss_tomba = b'{"data": {"email": null, "score": null, "first_name": "Z", "verification": {"status": null}}}' | CODE |
| HIGH⚡ | tests/test_routing.py | 879 | assert A._observed_cost_micro(_mk("findymail", endpoint_id="findymail.search.name", cost_type="per_success"), b'{"co | CODE |
| HIGH⚡ | tests/test_routing.py | 880 | assert A._observed_cost_micro(_mk("leadsforge", endpoint_id="leadsforge.people.email.find", cost_type="per_success") | CODE |
| HIGH⚡ | tests/test_routing.py | 881 | assert A._observed_cost_micro(_mk("leadsforge", endpoint_id="leadsforge.people.email.find", cost_type="per_call"), b | CODE |
| HIGH | tests/test_routing.py | 1334 | fail = b'{"code": 301, "data": null, "message": "COLLECT FAILED, SEND REQUEST AGAIN"}' | CODE |
| HIGH⚡ | tests/test_hub_sandbox.py | 68 | const a = []; while (true) { a.push("x".repeat(1000000)); } | CODE |
| HIGH | tests/test_capacity_overflow_routes.py | 227 | b'"type":"InsufficientCredits","expected":null,"actual":null}],"success":false}') | CODE |
| HIGH⚡ | tests/test_shell.py | 152 | r = subprocess.run(["/bin/sh", "-c", "stripe deploy --prod && true"], env=env, capture_output=True) | CODE |
| HIGH⚡ | tests/test_marketplace_call.py | 860 | mk, b'{"ai_overview":null,"search_metadata":{"ai_overview_state":"not_served"}}') == 0 | CODE |
| HIGH⚡ | tests/test_marketplace_call.py | 863 | assert call_settle._observed_cost_micro(mk, b'{"ai_overview":null}') is None | CODE |
| HIGH⚡ | tests/test_marketplace_call.py | 1046 | mk, b'{"results": [], "total_deduction_dollars": null}' | CODE |
| HIGH⚡ | tests/test_marketplace_call.py | 1049 | mk, b'{"total_deduction_dollars": null}' | CODE |
| HIGH⚡ | tests/test_marketplace_call.py | 1052 | mk, b'{"results": null, "total_deduction_dollars": null}' | CODE |
| HIGH⚡ | tests/test_marketplace_call.py | 1118 | ("aviato.companies.enrich.bulk", 150_000, b'{"companies": [{"id": "1"}, null]}', 150_000), | CODE |
| HIGH⚡ | tests/test_marketplace_call.py | 1119 | ("aviato.people.enrich.bulk", 70_000, b'[{"id": "1"}, null]', 70_000), | CODE |
| HIGH⚡ | tests/test_marketplace_call.py | 1216 | assert call_settle._observed_cost_micro(f, b'{"data": {"email": null, "score": null}}') == 0, \ | CODE |
| HIGH⚡ | tests/test_marketplace_call.py | 1218 | assert call_settle._observed_cost_micro(f, b'{"data": {"email": "", "score": null}}') == 0, \ | CODE |
| HIGH⚡ | tests/test_marketplace_call.py | 1235 | assert call_settle._observed_cost_micro(t, b'{"code": 400, "message": "Request failed. You won\'t be charged for thi | CODE |
| HIGH⚡ | tests/test_marketplace_call.py | 3145 | assert call_settle._observed_cost_micro(mk, b'{"success":true,"result":null,"status":"NOT_FOUND"}') == 0 | CODE |
| HIGH | tests/test_marketplace_call.py | 1177 | assert call_settle._observed_cost_micro(_mk("apollo"), b'{"organization": null}') == 0, "a 2xx miss is free" | CODE |
| HIGH | tests/test_marketplace_call.py | 2466 | b'{}', b'{"data": {}}', b'{"data": {"emails": null}}', | CODE |
| HIGH | tests/test_marketplace_call.py | 2467 | b'{"data": {"emails": {}}}', b'{"data": null}', b'not json', | CODE |
| HIGH | tests/test_mcp.py | 577 | f"the SDK fills absent keys in as null, so a strict client " | CODE |
| HIGH | tests/test_mcp.py | 557 | """`total=False` says a key may be ABSENT; it does not say the value may be null, and nulls reach | STRING |
| HIGH | tests/test_mcp.py | 565 | So EVERY field of EVERY tool must allow null, not just the ones known to carry data nulls. | STRING |
| HIGH | tests/test_arena_insights.py | 181 | body=b'{"data":{"email":null}}')) | CODE |
| HIGH | scripts/backfill_call_archive_links.py | 57 | and cached = false and archive_key_hash is null) as unlinked_calls | CODE |
| HIGH | marketing/landing/build_html.py | 4 | python3 build.py && python3 build_html.py | STRING |
| HIGH | marketing/landing/build_html.py | 558 | window.tregEvents.push([name, p, Date.now()]); | CODE |
| HIGH | marketing/landing/build_html.py | 559 | if (window.posthog && window.posthog.capture) window.posthog.capture(name, p); | CODE |
| HIGH | marketing/landing/build_html.py | 582 | if (a && a.tagName !== 'DETAILS') ev(a.dataset.ev); | CODE |
| HIGH | marketing/landing/build_review.py | 4 | python3 build.py && python3 build_review.py [outfile] | STRING |
| HIGH | src/treg/fsjail.py | 32 | '(allow file-write* (regex #"^/dev/"))\n' # /dev/null, /dev/tty, /dev/stdout, … | CODE |
| HIGH⚡ | src/treg/mcp.py | 307 | # says a key may be ABSENT; it does not say the value may be null, and nulls arrive from two | COMMENT |
| HIGH⚡ | src/treg/mcp.py | 314 | # advertised schema (`type: string`, no null) refuses the whole answer with -32602. `| None` turns | COMMENT |
| HIGH⚡ | src/treg/mcp.py | 315 | # the advertised type into `anyOf [string, null]`, which is the truth of what we send. | COMMENT |
| HIGH | src/treg/hub_sandbox.py | 10 | parent → child {"op": "run", "script": "...", "inputs": {...}, "data": [rows] | null, "memory_mb": 64, "wall_s": 120 | STRING |
| HIGH⚡ | src/treg/hub_sandbox.py | 49 | if (c === ",") { row.push(field); field = ""; i++; continue; } | CODE |
| HIGH⚡ | src/treg/hub_sandbox.py | 51 | if (c === "\\n") { row.push(field); rows.push(row); row = []; field = ""; i++; continue; } | CODE |
| HIGH⚡ | src/treg/hub_sandbox.py | 54 | if (field !== "" || row.length) { row.push(field); rows.push(row); } | CODE |
| HIGH⚡ | src/treg/hub_sandbox.py | 57 | return rows.slice(1).filter(r => r.length > 1 || (r.length === 1 && r[0] !== "")).map(r => { | CODE |
| HIGH | src/treg/hub_sandbox.py | 69 | p.resolve({ status: reply.status, headers: reply.headers, json: reply.json, text: reply.text, truncated: !!reply.trunc | CODE |
| HIGH⚡ | src/treg/hub_sandbox.py | 154 | globalThis.__state = "pending"; globalThis.__out = null; globalThis.__err = null; | CODE |
| HIGH⚡ | src/treg/hub_sandbox.py | 157 | .catch(e => { globalThis.__err = (e === null || e === undefined) ? "InternalError: out of memory" | CODE |
| HIGH⚡ | src/treg/hub_sandbox.py | 157 | .catch(e => { globalThis.__err = (e === null || e === undefined) ? "InternalError: out of memory" | CODE |
| HIGH⚡ | src/treg/hub_sandbox.py | 158 | : (e && e.message !== undefined ? (e.name + ": " + e.message) : String(e)) | CODE |
| HIGH⚡ | src/treg/hub_sandbox.py | 159 | + (e && e.stack ? "\\n" + e.stack : ""); globalThis.__state = "error"; }); | CODE |
| HIGH | src/treg/routers/catalog.py | 70 | # UI separately when a platform has only free endpoints (price_from stays null). | COMMENT |
| HIGH | src/treg/routers/auth.py | 541 | mk('h1',null,email?('Logged in as '+email):'Logged in'); | CODE |
| HIGH | src/treg/routers/auth.py | 542 | mk('p',null,'Return to your terminal. The CLI is finishing up.'); | CODE |
| HIGH | src/treg/routers/auth.py | 560 | let CREATED_ORG=null; // remember a just-created team so a retry (e.g. after a wrong code) reuses it, never makes a 2nd | CODE |
| HIGH | src/treg/infra/db.py | 327 | "SELECT 'column', table_name, column_name, data_type || is_nullable " | CODE |
| HIGH | src/treg/application/connect.py | 1320 | # No SQL filter on tool_access: "all tools" is stored as JSON null, which IS NOT NULL | COMMENT |
| HIGH | src/treg/domain/catalog/routing/paths.py | 261 | """Convert declared empty markers to null; retain the original nonempty value.""" | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tests/test_plugin.py | 168 | # -------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_plugin.py | 170 | # -------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_plugin.py | 272 | # -------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_plugin.py | 275 | # -------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_plugin.py | 320 | # -------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_plugin.py | 322 | # -------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_hub.py | 72 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_hub.py | 115 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_hub.py | 707 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_hub.py | 944 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_hub.py | 1243 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_hub.py | 1253 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_hub.py | 1559 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 213 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 304 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 380 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 464 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 587 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 642 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 809 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 852 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 1000 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 1212 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 1281 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 1342 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_hub.py | 1431 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_table.py | 30 | # ------------------------------------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/test_table.py | 111 | # ------------------------------------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/test_table.py | 211 | # ------------------------------------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/test_hub_sandbox.py | 220 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_archive.py | 52 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_archive.py | 120 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_archive.py | 263 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_archive.py | 772 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive.py | 24 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive.py | 156 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive.py | 288 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive.py | 318 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive.py | 458 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive.py | 805 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive.py | 896 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive.py | 1161 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive_opt_out.py | 55 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive_opt_out.py | 118 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive_opt_out.py | 277 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_archive_opt_out.py | 302 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_cli.py | 1203 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_marketplace_call.py | 3179 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp.py | 1028 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp.py | 1036 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp.py | 1401 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/callmatrix/test_hub_run.py | 227 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/callmatrix/test_hub_run.py | 363 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/callmatrix/test_hub_run.py | 516 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/callmatrix/test_hub_run.py | 646 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/catalog_ingest.py | 66 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/catalog_ingest.py | 304 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/catalog_ingest.py | 815 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/catalog_ingest.py | 927 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/catalog_ingest.py | 1284 | # --------------------------------------------------------------------------------------------- | COMMENT |
| 52 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/callmatrix/asserts.py | 66 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | …/skills/ugc-talking-head-video/scripts/caption_burn.py | 31 | except Exception: pass | CODE |
| LOW | …nts/skills/ugc-talking-head-video/scripts/host_file.py | 29 | except Exception: return "" | CODE |
| LOW | scripts/catalog_verify_extended.py | 235 | except Exception: | CODE |
| LOW | scripts/catalog_ingest.py | 966 | except Exception: | CODE |
| LOW | scripts/smoke_archive_r2.py | 41 | except Exception: | CODE |
| LOW | scripts/catalog_ingest_crawl4ai_recipes.py | 259 | except Exception as exc: # noqa: BLE001 - a capture failure leaves the row unverified | CODE |
| LOW | src/treg/bootstrap.py | 417 | except Exception: # pragma: no cover - exercised by deploys without the optional dependency | CODE |
| LOW | src/treg/bootstrap.py | 601 | except Exception: # noqa: BLE001 - diagnostics must not break a gauge or shutdown | CODE |
| LOW | src/treg/bootstrap.py | 638 | except Exception: # noqa: BLE001 - a gauge must never take the service down | CODE |
| LOW | src/treg/worker.py | 409 | except Exception: # noqa: BLE001 - preserve the command's result/failure | CODE |
| LOW | src/treg/worker.py | 419 | except Exception: # noqa: BLE001 - local exit summaries remain the fallback evidence | CODE |
| LOW | src/treg/bootstrap_http.py | 195 | except Exception: # noqa: BLE001 -- a malformed encoded body is a client error, not a 500 | CODE |
| LOW | src/treg/audit.py | 235 | except Exception: # noqa: BLE001 — audit must never surface into a call's result | CODE |
| LOW | src/treg/health.py | 86 | except Exception as exc: # noqa: BLE001 — transport/timeout says nothing about the credential | CODE |
| LOW | src/treg/health.py | 162 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | src/treg/health.py | 177 | except Exception as exc: # noqa: BLE001 — contain the blast radius to this one tool | CODE |
| LOW | src/treg/health.py | 252 | except Exception: # noqa: BLE001 — an alert hiccup must never break the run | CODE |
| LOW | src/treg/shell.py | 298 | except Exception as exc: # noqa: BLE001 — teardown must finish even if the add-on fails | CODE |
| LOW | src/treg/archive_bodies.py | 46 | except Exception: # noqa: BLE001 - an unanswered HEAD is not proof; upload again | CODE |
| LOW | src/treg/archive_bodies.py | 226 | except Exception as exc: | CODE |
| LOW | src/treg/archive_bodies.py | 390 | except Exception: | CODE |
| LOW | src/treg/archive_bodies.py | 440 | except Exception as exc: | CODE |
| LOW | src/treg/api.py | 177 | except Exception: # noqa: BLE001 — an editable/source run has no installed metadata | CODE |
| LOW | src/treg/api.py | 598 | except Exception as exc: # noqa: BLE001 — a failed oauth refresh must read clearly, like /call | CODE |
| LOW | src/treg/providers.py | 689 | except Exception: | CODE |
| LOW | src/treg/providers.py | 695 | except Exception: | CODE |
| MEDIUM | src/treg/cli.py | 66 | def _load_config() -> dict: | CODE |
| MEDIUM | src/treg/cli.py | 3663 | def cmd_skill_push(args, cfg) -> None: | CODE |
| LOW | src/treg/cli.py | 105 | except Exception: | CODE |
| LOW | src/treg/cli.py | 115 | except Exception: | CODE |
| LOW | src/treg/cli.py | 136 | except Exception: | CODE |
| LOW | src/treg/cli.py | 149 | except Exception: # noqa: BLE001 — the caller decides whether this optional exchange is required | CODE |
| LOW | src/treg/cli.py | 153 | except Exception: # noqa: BLE001 — an edge/proxy response need not be JSON | CODE |
| LOW | src/treg/cli.py | 325 | except Exception: | CODE |
| LOW | src/treg/cli.py | 424 | except Exception: | CODE |
| LOW | src/treg/cli.py | 459 | except Exception as exc: # noqa: BLE001 — network/DNS: report, don't persist a maybe-bad token | CODE |
| LOW | src/treg/cli.py | 514 | except Exception as exc: | CODE |
| LOW | src/treg/cli.py | 540 | except Exception: | CODE |
| LOW | src/treg/cli.py | 547 | except Exception: | CODE |
| LOW | src/treg/cli.py | 834 | except Exception: # noqa: BLE001 — a transient failure just means "no smart hint" | CODE |
| LOW | src/treg/cli.py | 893 | except Exception: | CODE |
| LOW | src/treg/cli.py | 1235 | except Exception: # noqa: BLE001 | CODE |
| LOW | src/treg/cli.py | 1334 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | src/treg/cli.py | 1347 | except Exception: # noqa: BLE001 — a walkthrough must survive an unreachable registry | CODE |
| LOW | src/treg/cli.py | 1380 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | src/treg/cli.py | 1605 | except Exception: | CODE |
| LOW | src/treg/cli.py | 2028 | except Exception: # a flaky/non-JSON poll shouldn't abort the loop | CODE |
| LOW | src/treg/cli.py | 2064 | except Exception as exc: | CODE |
| LOW | src/treg/cli.py | 2993 | except Exception: # noqa: BLE001 — reporting must never mask the CLI's own failure | CODE |
| LOW | src/treg/cli.py | 3092 | except Exception: # noqa: BLE001 — a missing/odd config just means no registry host is added | CODE |
| LOW | src/treg/cli.py | 3888 | except Exception as exc: # noqa: BLE001 — network/DNS: report, don't write a maybe-bad token | CODE |
| LOW | src/treg/cli.py | 3955 | except Exception as exc: # noqa: BLE001 — network/HTTP; report and exit non-zero for install.sh | CODE |
| LOW | src/treg/cli.py | 3989 | except Exception: # noqa: BLE001 — optional extras; the treg skill already installed | CODE |
| LOW | src/treg/cli.py | 4153 | except Exception: | CODE |
| LOW | src/treg/cli.py | 4167 | except Exception: | CODE |
| LOW | src/treg/cli.py | 4263 | except Exception: | CODE |
| LOW | src/treg/cli.py | 4282 | except Exception: | CODE |
| LOW | src/treg/cli.py | 4337 | except Exception: # noqa: BLE001 — can't reach the registry ≠ can't switch | CODE |
| LOW | src/treg/cli.py | 4385 | except Exception: # noqa: BLE001 — questionary absent → fall back to a typed list | CODE |
| 221 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .gitleaks.toml | 21 | # The scanner reads every fetched branch, so the seo branch carrying treg's key as a constant | COMMENT |
| LOW | .gitleaks.toml | 41 | # rules curation follows. The scoping below is therefore narrow — the entropy rules only, in that | COMMENT |
| LOW | frontend/src/views.ts | 1 | import { defineAsyncComponent, type Component, type ComponentPublicInstance } from 'vue' | COMMENT |
| LOW | frontend/src/state/catalogComputed.js | 21 | mkAccounts(){ return this.connAccounts.filter(a=>a.service===this.mkService); }, | COMMENT |
| LOW | frontend/src/state/referrals.js | 1 | COMMENT | |
| LOW | frontend/src/state/catalog.js | 261 | }, | COMMENT |
| LOW | frontend/src/state/catalog.js | 361 | // The two measured numbers, one rule each wherever they show: success once 20 calls are decided, | COMMENT |
| LOW | frontend/src/state/catalog.js | 381 | // reader sees no way to bring their own key. `mkOauth` stays false without the registry, so the | COMMENT |
| LOW | frontend/src/pages/SearchPage.vue | 1 | <script> | COMMENT |
| LOW | tests/test_mcp.py | 1241 | # says "crypto", nobody's endpoint text says "cryptocurrency", and substring containment only | COMMENT |
| LOW | dsh/cordis.patch.yml | 1 | # The layer this bundle contributes to a dsh profile that lists it. | COMMENT |
| LOW | examples/hub/ai-visibility/run.js | 1 | // ai-visibility: ask five AI answer engines the same question, report who they mention. | COMMENT |
| LOW | examples/hub/company-consensus/run.js | 1 | // company-consensus: one company's details from two independent sources, and whether they agree. | COMMENT |
| LOW | examples/hub/verified-email/run.js | 1 | // verified-email: one person's work email, found and then checked, in one call. | COMMENT |
| LOW | examples/hub/search-console-health/run.js | 1 | // search-console-health: one Search Console property's health, in one call, on the CALLER's own | COMMENT |
| LOW | examples/hub/lead-pipeline/run.js | 1 | // lead-pipeline: the people at a company, each with a work email that has been checked. | COMMENT |
| LOW | scripts/dev-local.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/catalog_verify_extended.py | 361 | # ("2026-07-27 23:27:48") — an extractor that trusted the field name would write a date string | COMMENT |
| LOW | scripts/catalog_ingest.py | 301 | return out | COMMENT |
| LOW | scripts/catalog_ingest.py | 581 | if body is not None: | COMMENT |
| LOW | scripts/catalog_ingest.py | 1301 | "dexscreener": "crypto", | COMMENT |
| LOW | scripts/catalog_ingest.py | 1341 | # not-found on the canonical example. Listing them would put two endpoints that return nothing on | COMMENT |
| LOW | scripts/catalog_ingest.py | 1381 | _ANYAPI_MEASURED: dict[str, dict] | None = None | COMMENT |
| LOW | scripts/catalog_ingest.py | 1641 | COMMENT | |
| LOW | scripts/smoke-domain.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/fresh-test-reset.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | src/treg/bootstrap_http.py | 21 | # /call/, /mcp/, auth flows, webhooks, agent-fetched pages like /vendor-listing, install scripts | COMMENT |
| LOW | src/treg/config.py | 121 | demo_stripe_webhook_secret: str = "" | COMMENT |
| LOW | src/treg/config.py | 141 | # `treg run --server` allow-list. The server only executes an entrypoint that is a catalog-known CLI | COMMENT |
| LOW | src/treg/config.py | 161 | # a code change — and so the ledger records the rate that was in force for each call. | COMMENT |
| LOW | src/treg/config.py | 181 | spool_budget_bytes: int = Field(default=512 * 1024 * 1024, ge=1) | COMMENT |
| LOW | src/treg/config.py | 321 | overflow_key_orthogonal: str = "" | COMMENT |
| LOW | src/treg/config.py | 341 | # The discovery EXPERIMENT (application.search_experiment): a relevance judge (TypeSafe's Jev) | COMMENT |
| LOW | src/treg/config.py | 361 | search_experiment_candidates: int = 30 | COMMENT |
| LOW | src/treg/config.py | 381 | # (GitHub, their company, their homepage), asks the LLM for task inputs grounded in what it | COMMENT |
| LOW | src/treg/config.py | 401 | # checks are skipped. | COMMENT |
| LOW | src/treg/config.py | 421 | find_embed_api_key: str = Field(default="", repr=False) | COMMENT |
| LOW | src/treg/config.py | 441 | # teams mid-workload (thousands of refused calls against a funded balance) and never on abuse; | COMMENT |
| LOW | src/treg/config.py | 461 | # Top-up amounts, in whole USD (the ONLY place dollars appear — billing.py converts to micro-USD | COMMENT |
| LOW | src/treg/config.py | 481 | autotopup_default_amount_usd: int = 20 | COMMENT |
| LOW | src/treg/config.py | 521 | # lever. | COMMENT |
| LOW | src/treg/config.py | 561 | # team. The middle stage between "off" and "open": the owner's own team tries the live hub on | COMMENT |
| LOW | src/treg/config.py | 581 | # surface before its production Inspector and custom-connector gates have passed. | COMMENT |
| LOW | src/treg/config.py | 601 | github_client_secret: str = "" | COMMENT |
| LOW | src/treg/config.py | 621 | posthog_host: str = "https://eu.i.posthog.com" | COMMENT |
| LOW | src/treg/config.py | 641 | # from the project its live token is paired with. Empty = Ads shows as unconfigured (correct — it | COMMENT |
| LOW | src/treg/config.py | 681 | tiktok_client_id: str = "" | COMMENT |
| LOW | src/treg/config.py | 721 | # response, which is an unauthenticated account-takeover vector in prod — so it defaults OFF and | COMMENT |
| LOW | src/treg/audit.py | 241 | logging.getLogger("treg.audit").error( | COMMENT |
| LOW | src/treg/models.py | 41 | id: int | None = Field(default=None, primary_key=True) | COMMENT |
| LOW | src/treg/models.py | 61 | # `ledgerentry` cost a scan of the platform's whole day per call and emptied the API pool | COMMENT |
| LOW | src/treg/models.py | 81 | autotopup_monthly_cap_micro: int = Field(default=0) # 0 = "use the configured default" | COMMENT |
| LOW | src/treg/models.py | 101 | # Which keys of the X-Treg-Meta bag this team may set budgets on. DECLARED rather than arbitrary | COMMENT |
| LOW | src/treg/models.py | 201 | promoted_from: str = Field(default="") | COMMENT |
| LOW | src/treg/models.py | 321 | class CallRecord(SQLModel, table=True): | COMMENT |
| LOW | src/treg/models.py | 341 | # That load is why the API pool saturates: the three pools bulkhead | COMMENT |
| LOW | src/treg/models.py | 401 | # The hash itself never carries a body, so it is safe to keep forever; it is the future cache key | COMMENT |
| LOW | src/treg/models.py | 421 | # or endpoint) | request (malformed pre-relay: wrong method, missing param, bad body). What | COMMENT |
| LOW | src/treg/models.py | 441 | # migration's ALTER TABLE ADD COLUMN append position. | COMMENT |
| LOW | src/treg/models.py | 561 | code_verifier: str = Field(default="") | COMMENT |
| 162 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | e2e_check.py | 66 | CODE | |
| LOW | tests/test_maintenance.py | 165 | CODE | |
| LOW | tests/test_maintenance.py | 221 | CODE | |
| LOW | tests/test_web_arena.py | 435 | CODE | |
| LOW | tests/test_archive_r2.py | 496 | CODE | |
| LOW | tests/test_money_trace_runner.py | 161 | CODE | |
| LOW | tests/test_passthrough.py | 62 | CODE | |
| LOW | tests/callmatrix/provider.py | 93 | CODE | |
| LOW | tests/callmatrix/asserts.py | 48 | CODE | |
| LOW | …nts/skills/tools-registry-context/scripts/build-map.py | 37 | CODE | |
| LOW | scripts/bench_money_admission.py | 47 | CODE | |
| LOW | scripts/catalog_verify_extended.py | 199 | CODE | |
| LOW | scripts/catalog_verify_extended.py | 428 | CODE | |
| LOW | scripts/catalog_verify_extended.py | 494 | CODE | |
| LOW | scripts/catalog_ingest.py | 407 | CODE | |
| LOW | scripts/catalog_ingest.py | 485 | CODE | |
| LOW | scripts/catalog_ingest.py | 646 | CODE | |
| LOW | scripts/catalog_ingest.py | 771 | CODE | |
| LOW | scripts/catalog_ingest.py | 951 | CODE | |
| LOW | scripts/catalog_ingest.py | 1074 | CODE | |
| LOW | scripts/catalog_ingest.py | 2398 | CODE | |
| LOW | scripts/catalog_backfill_added.py | 155 | CODE | |
| LOW | scripts/catalog_verify.py | 85 | CODE | |
| LOW | scripts/minimax_plugin.py | 59 | CODE | |
| LOW | scripts/contactout_overflow_verify.py | 27 | CODE | |
| LOW | scripts/catalog_validate.py | 184 | CODE | |
| LOW | scripts/catalog_validate.py | 398 | CODE | |
| LOW | scripts/catalog_validate.py | 513 | CODE | |
| LOW | scripts/catalog_validate.py | 547 | CODE | |
| LOW | scripts/catalog_validate.py | 709 | CODE | |
| LOW | scripts/catalog_validate.py | 816 | CODE | |
| LOW | scripts/catalog_validate.py | 1075 | CODE | |
| LOW | scripts/catalog_validate.py | 1149 | CODE | |
| LOW | scripts/catalog_validate.py | 561 | CODE | |
| LOW | scripts/catalog_cost_provenance.py | 298 | CODE | |
| LOW | marketing/landing/build.py | 15 | CODE | |
| LOW | marketing/landing/build_html.py | 102 | CODE | |
| LOW | marketing/landing/build_html.py | 240 | CODE | |
| LOW | marketing/landing/build_html.py | 280 | CODE | |
| LOW | marketing/landing/build_html.py | 366 | CODE | |
| LOW | marketing/landing/build_html.py | 481 | CODE | |
| LOW | marketing/landing/build_html.py | 623 | CODE | |
| LOW | marketing/landing/build_review.py | 24 | CODE | |
| LOW | marketing/landing/build_review.py | 88 | CODE | |
| LOW | src/treg/bootstrap.py | 607 | CODE | |
| LOW | src/treg/worker.py | 133 | CODE | |
| LOW | src/treg/egress.py | 37 | CODE | |
| LOW | src/treg/bootstrap_http.py | 51 | CODE | |
| LOW | src/treg/audit.py | 200 | CODE | |
| LOW | src/treg/skills.py | 153 | CODE | |
| LOW | src/treg/skills.py | 323 | CODE | |
| LOW | src/treg/health.py | 126 | CODE | |
| LOW | src/treg/health.py | 215 | CODE | |
| LOW | src/treg/convert.py | 90 | CODE | |
| LOW | src/treg/convert.py | 292 | CODE | |
| LOW | src/treg/archive_bodies.py | 156 | CODE | |
| LOW | src/treg/archive_bodies.py | 419 | CODE | |
| LOW | src/treg/api.py | 258 | CODE | |
| LOW | src/treg/providers.py | 364 | CODE | |
| LOW | src/treg/providers.py | 470 | CODE | |
| 131 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | frontend/e2e/teams.spec.ts | 46 | await expect(cap).toHaveAttribute('placeholder', 'No limit') | CODE |
| LOW | frontend/src/components/FilterBox.vue | 11 | <input :ref="el => register && register(el as Element | null)" v-model="q" :aria-label="label" :placeholder="placehold | CODE |
| LOW | frontend/src/components/CatalogSearch.vue | 27 | :aria-label="scope ? 'Search '+scopeLabel : 'Search the catalog'" :placeholder="placeholder" | CODE |
| LOW⚡ | tests/test_team_limit.py | 28 | first = (await clients.post('/users', json={'email': 'legacy-limit@example.org'})).json() | CODE |
| LOW | tests/test_team_limit.py | 47 | other = (await clients.post('/users', json={'email': 'other-owner@example.org'})).json() | CODE |
| LOW | tests/test_team_limit.py | 103 | other = (await clients.post('/users', json={'email': 'race-owner@example.org'})).json() | CODE |
| LOW⚡ | tests/test_alembic_baseline.py | 126 | VALUES ('pre-upgrade@example.org', false, false, 0, false, false, CURRENT_TIMESTAMP) | CODE |
| LOW⚡ | tests/test_alembic_baseline.py | 132 | FROM "user" WHERE email = 'pre-upgrade@example.org' | CODE |
| LOW⚡ | tests/test_alembic_baseline.py | 139 | WHERE email = 'pre-upgrade@example.org' | CODE |
| LOW⚡ | tests/test_alembic_baseline.py | 142 | SELECT signup_promo_available FROM "user" WHERE email = 'pre-upgrade@example.org' | CODE |
| LOW⚡ | tests/test_error_capture.py | 474 | fake_key = "sk_live_ABCDEFGHIJKLMNOP1234" | CODE |
| LOW⚡ | tests/test_error_capture.py | 477 | 400, f'{{"message":"bad token {fake_key} and {fake_jwt}"}}'.encode())) | CODE |
| LOW⚡ | tests/test_error_capture.py | 481 | assert fake_key not in row["error_response"] | CODE |
| LOW | tests/test_orgs.py | 62 | r = await verified_signup(clients, json={"email": "throwaway-team@example.org"}) | CODE |
| LOW⚡ | tests/test_signup_promo.py | 37 | r = await clients.post('/users', json={'email': 'unverified@example.org'}) | CODE |
| LOW⚡ | tests/test_signup_promo.py | 45 | token = await verified_identity(clients, 'unverified@example.org') | CODE |
| LOW⚡ | tests/test_signup_promo.py | 55 | token = await verified_identity(clients, 'verified@example.org') | CODE |
| LOW⚡ | tests/test_signup_promo.py | 64 | user = (await db.execute(select(User).where(User.email == 'verified@example.org'))).scalar_one() | CODE |
| LOW⚡ | tests/test_signup_promo.py | 71 | token = await verified_identity(clients, 'delete@example.org') | CODE |
| LOW⚡ | tests/test_signup_promo.py | 84 | json={'email': 'invite-code@example.org', 'role': 'member'}) | CODE |
| LOW⚡ | tests/test_signup_promo.py | 87 | 'email': 'invite-code@example.org', 'code': invite.json()['code']}) | CODE |
| LOW⚡ | tests/test_signup_promo.py | 95 | db.add(User(email='legacy@example.org', signup_promo_available=False)) | CODE |
| LOW⚡ | tests/test_signup_promo.py | 97 | token = await verified_identity(clients, 'legacy@example.org') | CODE |
| LOW⚡ | tests/test_signup_promo.py | 103 | token = await verified_identity(clients, 'failure@example.org') | CODE |
| LOW⚡ | tests/test_signup_promo.py | 115 | user = (await db.execute(select(User).where(User.email == 'failure@example.org'))).scalar_one() | CODE |
| LOW⚡ | tests/test_signup_promo.py | 125 | token = await verified_identity(clients, 'disabled@example.org') | CODE |
| LOW⚡ | tests/test_signup_promo.py | 142 | db.execute(text("INSERT INTO \"user\" VALUES (1, 'existing@example.org')")) | CODE |
| LOW⚡ | tests/test_signup_promo.py | 146 | db.execute(text("INSERT INTO \"user\" (id, email) VALUES (2, 'old-writer@example.org')")) | CODE |
| LOW⚡ | tests/test_signup_promo.py | 148 | assert User(email='new-code@example.org').signup_promo_available is True | CODE |
| LOW⚡ | tests/test_cli_key_compatibility.py | 12 | for path, body in [('/auth/email/start', {'email': 'new@example.org'}), | CODE |
| LOW⚡ | tests/test_cli_key_compatibility.py | 13 | ('/auth/email/verify', {'email': 'new@example.org', 'code': '123456'})]: | CODE |
| LOW⚡ | tests/test_cli_key_compatibility.py | 29 | response = await clients.post('/auth/email/start', json={'email': 'new@example.org'}, headers=headers) | CODE |
| LOW⚡ | tests/test_cli_key_compatibility.py | 36 | ('/invites/accept', {'email': 'new@example.org', 'code': 'unused'}), | CODE |
| LOW | tests/test_onboarding_v2.py | 407 | uid = await _new_user("cy@example.org") | CODE |
| LOW | tests/test_onboarding_v2.py | 409 | org = Org(name="cy@example.org", slug=f"cy-{uid}") | CODE |
| LOW | tests/test_ledger.py | 427 | user = User(email="promo-atomic@example.org", email_verified_at=utcnow_naive()) | CODE |
| LOW | src/treg/catalog/leadmagic.yaml | 56 | body: {full_name: "Jane Doe", domain: "leadmagic.io"} | CODE |
| LOW | src/treg/catalog/examples/oceanio.people.search.json | 10 | "name": "Jane Doe", | CODE |
| LOW | …catalog/examples/dropleads.people.enrich.verified.json | 1 | {"success":true,"status":"success","person":{"id":"example-person","first_name":"Jane","last_name":"Doe","name":"Jane Do | CODE |
| LOW | …leadsforge.linkedin.company.followers.job.results.json | 7 | "name": "Jane Doe", | CODE |
| LOW | src/treg/catalog/examples/findymail.contacts.get.json | 8 | "name": "Jane Doe", | CODE |
| LOW | src/treg/catalog/examples/dropleads.people.enrich.json | 1 | {"success":true,"person":{"id":"example-person","first_name":"Jane","last_name":"Doe","name":"Jane Doe","title":"Founder | CODE |
| LOW | src/treg/catalog/examples/wiza.people.search.json | 1 | {"status":{"code":200,"message":""},"data":{"total":1,"profiles":[{"full_name":"Jane Doe","linkedin_url":"linkedin.com/i | CODE |
| LOW | …treg/catalog/examples/companyenrich.people.lookup.json | 3 | "name": "Jane Doe", | CODE |
| LOW | src/treg/catalog/examples/exa.people.search.json | 7 | "title": "Jane Doe", | CODE |
| LOW | src/treg/catalog/examples/exa.people.search.json | 17 | "name": "Jane Doe", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/treg/web/tutorial.md | 78 | ## Step 1 - Find a tool by what it DOES | COMMENT |
| LOW | src/treg/web/tutorial.md | 100 | ## Step 2 - Read the price before you spend | COMMENT |
| LOW | src/treg/web/tutorial.md | 123 | ## Step 3 - Call it, with no key anywhere | COMMENT |
| LOW | src/treg/web/tutorial.md | 136 | ## Step 4 - See exactly what it cost | COMMENT |
| LOW | src/treg/web/tutorial.md | 157 | ## Step 5 - Tom signs in (the email door) | COMMENT |
| LOW | src/treg/web/tutorial.md | 176 | ## Step 6 - Tom creates the team | COMMENT |
| LOW | src/treg/web/tutorial.md | 200 | ## Step 7 - Tom invites Bob | COMMENT |
| LOW | src/treg/web/tutorial.md | 220 | ## Step 8 - Bob signs in as himself | COMMENT |
| LOW | src/treg/web/tutorial.md | 237 | ## Step 9 - Bob sees his invite (no code) | COMMENT |
| LOW | src/treg/web/tutorial.md | 261 | ## Step 10 - Bob accepts | COMMENT |
| LOW | src/treg/web/tutorial.md | 280 | ## Step 11 - Bob's two hats | COMMENT |
| LOW | src/treg/web/tutorial.md | 299 | ## Step 12 - Tom invites Alice as a viewer | COMMENT |
| LOW | src/treg/web/tutorial.md | 319 | ## Step 13 - Alice joins by code (no login first) | COMMENT |
| LOW | src/treg/web/tutorial.md | 339 | ## Step 14 - The viewer role has teeth | COMMENT |
| LOW | src/treg/web/tutorial.md | 358 | ## Step 15 - Bob registers a secret | COMMENT |
| LOW | src/treg/web/tutorial.md | 378 | ## Step 16 - Bob registers a tool | COMMENT |
| LOW | src/treg/web/tutorial.md | 400 | ## Step 17 - Alice calls it (with no key) | COMMENT |
| LOW | src/treg/web/tutorial.md | 422 | ## Step 18 - Every call is on the record | COMMENT |
| LOW | src/treg/web/tutorial.md | 449 | ## Step 19 - Call by full URL (agent-native) | COMMENT |
| LOW | src/treg/web/tutorial.md | 464 | ## Step 20 - The raw HTTP underneath | COMMENT |
| LOW | src/treg/web/tutorial.md | 482 | ## Step 21 - Draft a skill's registration | COMMENT |
| LOW | src/treg/web/tutorial.md | 502 | ## Step 22 - Upload the whole skill | COMMENT |
| LOW | src/treg/web/tutorial.md | 580 | ## Step 23 - See the team | COMMENT |
| LOW | src/treg/web/tutorial.md | 597 | ## Step 24 - Promote Bob to admin | COMMENT |
| LOW | src/treg/web/tutorial.md | 615 | ## Step 25 - Admin rights in action | COMMENT |
| LOW | src/treg/web/tutorial.md | 634 | ## Step 26 - Review pending invites | COMMENT |
| LOW | src/treg/web/tutorial.md | 652 | ## Step 27 - Revoke an invite | COMMENT |
| LOW | src/treg/web/tutorial.md | 668 | ## Step 28 - The role gate, from the viewer side | COMMENT |
| LOW | src/treg/web/tutorial.md | 687 | ## Step 29 - Become the platform operator | COMMENT |
| LOW | src/treg/web/tutorial.md | 702 | ## Step 30 - The whole platform at a glance | COMMENT |
| LOW | src/treg/web/tutorial.md | 720 | ## Step 31 - Every org, across all tenants | COMMENT |
| LOW | src/treg/web/tutorial.md | 738 | ## Step 32 - Grant a real user super-admin | COMMENT |
| LOW | src/treg/web/tutorial.md | 760 | ## Step 33 - The same registry, in the browser | COMMENT |
| LOW | src/treg/web/tutorial.md | 784 | ## Step 34 - Delete the tool | COMMENT |
| LOW | src/treg/web/tutorial.md | 800 | ## Step 35 - Delete the org (full cascade) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | frontend/src/dialogs/EditToolDialog.vue | 63 | <p class="sub" v-if="!tForm.cli.deny.length && !(tForm.cli.deny_defaults && catalogExtra.length)" style="fon | CODE |
| MEDIUM | docs/context/interface/cli.md | 492 | ## Skill scaffolding + the `treg.json` contract (`convert.py`) | COMMENT |
| MEDIUM | src/treg/config.py | 482 | # Hard guardrails on the off-session charge — the difference between "convenient" and "a runaway | COMMENT |
| MEDIUM | src/treg/maintenance.py | 23 | # new code serves traffic. Task bodies remain with their owning subsystem; this is orchestration. | COMMENT |
| MEDIUM⚡ | src/treg/web/media/jev/xboost-seed.json | 1 | {"ran_at":"2026-09-19T11:11:30+00:00","since":"2026-09-18","topics":["introducing","launching today","now available","we | CODE |
| MEDIUM⚡ | src/treg/web/media/jev/xboost-seed.json | 1 | {"ran_at":"2026-09-19T11:11:30+00:00","since":"2026-09-18","topics":["introducing","launching today","now available","we | CODE |
| MEDIUM⚡ | src/treg/web/media/jev/xboost-seed.json | 1 | {"ran_at":"2026-09-19T11:11:30+00:00","since":"2026-09-18","topics":["introducing","launching today","now available","we | CODE |
| MEDIUM⚡ | src/treg/web/media/jev/xboost-seed.json | 1 | {"ran_at":"2026-09-19T11:11:30+00:00","since":"2026-09-18","topics":["introducing","launching today","now available","we | CODE |
| MEDIUM⚡ | src/treg/web/media/jev/signals.json | 1 | {"ran_at":"2026-09-19T07:33:22+00:00","topics":["GTM tools stack","enrichment waterfall Clay","lead enrichment data qual | CODE |
| MEDIUM⚡ | src/treg/web/media/jev/signals.json | 1 | {"ran_at":"2026-09-19T07:33:22+00:00","topics":["GTM tools stack","enrichment waterfall Clay","lead enrichment data qual | CODE |
| MEDIUM⚡ | src/treg/web/media/jev/signals.json | 1 | {"ran_at":"2026-09-19T07:33:22+00:00","topics":["GTM tools stack","enrichment waterfall Clay","lead enrichment data qual | CODE |
| MEDIUM | src/treg/catalog/aliases.yaml | 8 | # the cheap layer before any embedding model — see docs/context/architecture/catalog.md ("Search | COMMENT |
| MEDIUM | src/treg/catalog/examples/anyapi.google.serp.news.json | 18 | "url": "https://www.nytimes.com/2026/09/16/technology/openai-model-safety-guardrails.html" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .gitleaks.toml | 60 | # — the harness deletes its database between runs, so it never needed a constant — and the value has | COMMENT |
| MEDIUM | e2e-server.sh | 26 | # harness deletes its database between runs, so it has no such need — and a committed key is a | COMMENT |
| MEDIUM | frontend/src/state/agentsComputed.js | 24 | '# Where to persist these, per agent harness:', | CODE |
| MEDIUM | dsh/cordis.patch.yml | 17 | # https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md | COMMENT |
| MEDIUM | src/treg/config.py | 584 | # Browser-only OAuth/MCP test harness. It handles real grants and therefore belongs on local | COMMENT |
| MEDIUM | src/treg/cli.py | 687 | # deadlocks when the reader (pty harness, agent) hasn't consumed the frame yet | COMMENT |
| MEDIUM⚡ | src/treg/web/media/jev/xboost-seed.json | 1 | {"ran_at":"2026-09-19T11:11:30+00:00","since":"2026-09-18","topics":["introducing","launching today","now available","we | CODE |
| MEDIUM⚡ | src/treg/web/media/jev/xboost-seed.json | 1 | {"ran_at":"2026-09-19T11:11:30+00:00","since":"2026-09-18","topics":["introducing","launching today","now available","we | CODE |
| MEDIUM⚡ | src/treg/web/media/jev/xboost-seed.json | 1 | {"ran_at":"2026-09-19T11:11:30+00:00","since":"2026-09-18","topics":["introducing","launching today","now available","we | CODE |
| MEDIUM⚡ | src/treg/web/media/jev/signals.json | 1 | {"ran_at":"2026-09-19T07:33:22+00:00","topics":["GTM tools stack","enrichment waterfall Clay","lead enrichment data qual | CODE |
| MEDIUM | …/catalog/examples/crawl4ai.web.scrape.job.results.json | 13 | "markdown": "**Notice:** This page displays a fallback because interactive scripts did not run. Possible causes incl | CODE |
| MEDIUM | …/treg/catalog/examples/crawl4ai.web.extract.batch.json | 11 | "markdown": "**Notice:** This page displays a fallback because interactive scripts did not run. Possible causes in | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | frontend/src/agent-setup/data.ts | 43 | const value = token ? (masked ? token.slice(0,14)+'••••••••••••••••' : token) : '<YOUR_TOKEN>' | CODE |
| HIGH | frontend/src/state/catalogComputed.js | 371 | epTrySetupLine(){ const S=this.activeSlugNow||'<team-slug>', T=this.myToken||'<YOUR_TOKEN>'; | CODE |
| HIGH | frontend/src/state/onboardingComputed.js | 11 | welcomeSetupFull(){ return this.welcomeSetupCmd+'\n\nwith team '+(this.activeSlugNow||'<team-slug>')+' token: '+(thi | CODE |
| HIGH | frontend/src/state/onboardingComputed.js | 12 | welcomeSetupMasked(){ const t=this.myToken?(this.startTokenShow?this.myToken:(this.myToken.slice(0,14)+'•••••••••••••••• | CODE |
| HIGH | frontend/src/onboarding/ConnectBlock.vue | 37 | const masked = computed(() => props.token ? props.token.slice(0, 14) + '••••••••••••••••' : '<YOUR_TOKEN>') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/treg/catalog/tiktok.yaml | 107 | post_info: {type: object, required: true, note: "{\"title\": \"caption, 2,200 chars, #hashtags and @mentions wor | CODE |
| HIGH | src/treg/catalog/examples/akta.companies.news.json | 94 | "full_text": "News/ Industrials/ CMPR/ Articles Details Cimpress Missed EPS by 20%-Why the Canva Upside Still Matt | CODE |
| HIGH | src/treg/catalog/examples/finnhub.company.news.json | 524 | "image": "https://cdn.benzinga.com/files/images/story/2026/08/13/AI-generated-image-of-Tesla-dealership.png?width=20 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_billing.py | 98 | async def _set_org(org_id: int, **fields) -> None: | CODE |
| LOW | tests/test_reconcile.py | 65 | async def _settles(rows: list[dict]) -> None: | CODE |
| LOW | tests/test_usage_caps.py | 59 | async def _set_counter(org_id: int, email: str, n: int, day: date) -> None: | CODE |
| LOW | tests/test_marketplace_call.py | 1832 | async def _set_claim(key: str, **values) -> None: | CODE |
| LOW | src/treg/infra/money_trace.py | 222 | def _set_stage(txn: _Txn, stage: str, now: float) -> None: | CODE |
| LOW | src/treg/application/call/service.py | 211 | def _set_caller_max_cost(request, mk: MarketplaceCall) -> None: | CODE |
| LOW | src/treg/application/call/service.py | 576 | def _set_response_header(response: UpstreamResponse, name: str, value: str) -> None: | CODE |
| LOW | src/treg/domain/catalog/routing/paths.py | 47 | def set_path(doc: dict, path: str, value: Any) -> None: | CODE |
| LOW | src/treg/domain/feedback/__init__.py | 5 | __all__ = ["add", "get", "recent"] | CODE |
| LOW | src/treg/domain/hub/__init__.py | 8 | __all__ = ["PAY_NOTE", "ManifestError", "fees_label", "Validated", "price_label", "range_label", "seeded_observed", "sel | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_web_arena_calls.py | 14 | CODE | |
| LOW | tests/test_onboarding_v2.py | 58 | CODE | |
| LOW | tests/test_capacity_overflow.py | 47 | CODE | |
| LOW | src/treg/audit.py | 59 | CODE | |
| LOW | src/treg/mcp.py | 1239 | CODE | |
| LOW | src/treg/mcp.py | 1255 | CODE | |
| LOW | src/treg/mcp.py | 1825 | CODE | |
| LOW | src/treg/routers/auth.py | 939 | CODE | |
| LOW | src/treg/routers/auth.py | 998 | CODE | |
| LOW | src/treg/infra/money_trace_runner.py | 155 | CODE | |
| LOW | src/treg/infra/money_trace_runner.py | 240 | CODE | |
| LOW | src/treg/application/call/service.py | 929 | CODE | |
| LOW | src/treg/application/call/settle.py | 1125 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_mcp_install.py | 362 | # Create an SSL error the same way Python's ssl module does | COMMENT |
| MEDIUM | src/treg/localproxy.py | 299 | # Create the key file 0600 BEFORE any bytes go in — writing first and chmod-ing after leaves a | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_aigc_pr_b.py | 250 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/dev-local.sh | 14 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_released_cli_compat.py | 64 | def handle_request(self, request): | CODE |