Search results

contrast and readability

Status: Open.

#11 In jamalrfordii-arch/Vanguard-Map;

· tobydoig opened on Jul 9, 2026

No CI pipeline, no root package.json, no dependency scanning, and no SRI on 617KB vendored library

Status: Open.

#10 In jamalrfordii-arch/Vanguard-Map;

· tg12 opened on Jun 15, 2026

No Content-Security-Policy, X-Frame-Options, or X-Content-Type-Options headers — API keys in localStorage have no XSS backstop

Status: Open.

#9 In jamalrfordii-arch/Vanguard-Map;

· tg12 opened on Jun 15, 2026

Invalid Claude model IDs (claude-haiku-4-5-20251001, claude-opus-4-6) silently disable AI assessments with generic 502 errors

Status: Open.

#8 In jamalrfordii-arch/Vanguard-Map;

· tg12 opened on Jun 15, 2026

Entire codebase has one test file; zero coverage of AIS pipeline, anomaly detection, proxy routes, Equasis scraper, and alert system

Status: Open.

#7 In jamalrfordii-arch/Vanguard-Map;

· tg12 opened on Jun 15, 2026

Agent suite uses claude-opus-4-6 with no spend cap, no approval gate, and auto-continuation up to 64k tokens per run

Status: Open.

#6 In jamalrfordii-arch/Vanguard-Map;

· tg12 opened on Jun 15, 2026

OpenWeatherMap API key passed as URL query parameter in /weather route — key appears in server logs and browser history

Status: Open.

#5 In jamalrfordii-arch/Vanguard-Map;

· tg12 opened on Jun 15, 2026

equasis-lookup.js automates web scraping of ToS-restricted service with disguised User-Agent; authenticated session exposed unauthenticated via /vessel route

Status: Open.

#4 In jamalrfordii-arch/Vanguard-Map;

· tg12 opened on Jun 15, 2026

Stored XSS via AIS vessel names and destinations injected unescaped into innerHTML in alertsManager.js and main.js

Status: Open.

#3 In jamalrfordii-arch/Vanguard-Map;

· tg12 opened on Jun 15, 2026

Unvalidated user-controlled parameters injected into GIBS and tile proxy URLs — URL manipulation via open proxy

Status: Open.

#2 In jamalrfordii-arch/Vanguard-Map;

· tg12 opened on Jun 15, 2026

flight-proxy.js binds to 0.0.0.0 with wildcard CORS and no auth — paid AI API and Equasis session exposed to any LAN caller

Status: Open.

#1 In jamalrfordii-arch/Vanguard-Map;

· tg12 opened on Jun 15, 2026