panic-attack estate sweep — Track C tracking issue
panic-attack assail flagged the findings below in this repo on 2026-05-26. They are aggregated here for human triage rather than as individual PRs because each requires judgement (supply-chain pin choice, schema-design call, mutation-test gap, etc.).
PA001/PA007 UnsafeCode/UnsafeFFI findings are NOT in this list. Findings already suppressed in audits/assail-classifications.a2ml are also excluded.
Estate tracker: hyperpolymath/panic-attack#32.
CommandInjection (2 findings)
file:line list
High rescript-templater/init-raczotbuild.rkt:? System/process call in rescript-templater/init-raczotbuild.rkt
### `DynamicCodeExecution` (2 findings)
file:line list
High voyant-export/accessibility-tools/browser-extension/popup.js:? DOM manipulation (innerHTML/document.write) in voyant-export/accessibility-tools/browser-extension/popup.js
### `SupplyChain` (1 findings)
file:line list
🤖 Discovered during the panic-attack estate sweep (2026-05-26). See hyperpolymath/panic-attack#32 for campaign tracker.
panic-attack estate sweep — Track C tracking issue
panic-attack assailflagged the findings below in this repo on 2026-05-26. They are aggregated here for human triage rather than as individual PRs because each requires judgement (supply-chain pin choice, schema-design call, mutation-test gap, etc.).PA001/PA007 UnsafeCode/UnsafeFFI findings are NOT in this list. Findings already suppressed in
audits/assail-classifications.a2mlare also excluded.Estate tracker: hyperpolymath/panic-attack#32.
CommandInjection(2 findings)file:line list
file:line list
file:line list
🤖 Discovered during the panic-attack estate sweep (2026-05-26). See hyperpolymath/panic-attack#32 for campaign tracker.