Open findings
42
across 3 auditors
a single pass samples; run several and keep what recurs
By severity
Mean score
5↑ 4
latest run of 3 of 3 auditors · change over 1 with history
Fix firstshowing 8 of 42
- high
Recheck and confirm stages execute after the response stream closes, so their outcomes cannot reach the caller
Orchestration pipeline after the NDJSON stream is closed; recheck stage and confirmResolved fan-out (per submitted architecture: "the recheck and confirm stages fire after the response stream has closed") · Agent Patterns · certain
- high
Spend limit is enforced once before the stream opens while N+1 further model calls run ungated
Pre-stream spend check in runAudit; subsequent re-checker call and per-finding confirmer calls (per submitted concern: "Spend limits are checked once before the stream opens") · Agent Patterns · certain
- high
confirmResolved dispatches every confirmer call concurrently with no pool or semaphore
confirmResolved — `await Promise.all(resolved.map(confirmOne))` · Agent Patterns · certain
- high
Refusal fallback recurses into runAudit with no depth counter or re-entry guard
Refusal-fallback path in runAudit — per submitted concern: "The refusal-fallback retry recurses into runAudit, which could re-enter if the error is misclassified" · Agent Patterns · certain
- high
Input bundle is truncated by dropping whole files with no notice to the model or the reader
Bundle assembly for the auditor prompt — evidenced by this very submission: "lib/auditors/types.ts was dropped for size — that's the schema contract all three stages depend on" · Agent Patterns · certain
- high
Confirmer fan-out cardinality is determined by model output with no hard cap
confirmResolved — "one per resolved finding, no limit" · Agent Patterns · likely
- high
Background stages scheduled after response completion may be killed by the serverless runtime
Same post-stream continuation that invokes the re-checker and confirmResolved after the NDJSON response is returned · Agent Patterns · possible
- high
Homepage JavaScript wipes the server-rendered product grid and rebuilds it client-side
index.html:1186 — `grid.innerHTML=''` then rebuild from `DUSKGILD_DATA`; static markup emitted by the generator into the `BUILD:CARDS-DARK` / `BUILD:CARDS-OW` markers · SEO Basics · certain
Auditor health
Recent runs
- Security1mo ago26,407 chars1 medium4 low1 info5/10
- SEO Basics2mo ago15,423 chars1 high4 medium6 low1 info6/10
- Security2mo ago122 chars1 critical3 high3 medium1 low1/10
- Security2mo ago126 chars2 critical3 high3 medium1 low1/10
- Agent Patterns2mo ago1,789 chars7 high15 medium2 low4/10
- Security2mo ago9 chars10/10
- Security2mo ago171 chars2 critical2 high3 medium1 low1/10