@sentry/warden 0.1.1 → 0.3.0

package/dist/utils/exec.js

@@ -0,0 +1,111 @@
+import { spawnSync } from 'node:child_process';
+/**
+ * Error thrown when a command fails.
+ */
+export class ExecError extends Error {
+    command;
+    exitCode;
+    stderr;
+    signal;
+    constructor(command, exitCode, stderr, signal) {
+        const details = stderr || (signal ? `Killed by signal ${signal}` : 'Unknown error');
+        super(`Command failed: ${command}\n${details}`);
+        this.command = command;
+        this.exitCode = exitCode;
+        this.stderr = stderr;
+        this.signal = signal;
+        this.name = 'ExecError';
+    }
+}
+/**
+ * Git environment variables that disable interactive prompts.
+ * - GIT_TERMINAL_PROMPT=0: Disables git's internal prompts
+ * - GIT_SSH_COMMAND with BatchMode=yes: Makes SSH fail instead of prompting for passphrase
+ */
+export const GIT_NON_INTERACTIVE_ENV = {
+    GIT_TERMINAL_PROMPT: '0',
+    GIT_SSH_COMMAND: 'ssh -o BatchMode=yes',
+};
+/**
+ * Build spawn options for non-interactive execution.
+ * - stdin: 'ignore' maps to /dev/null, ensuring immediate EOF on read (no hangs)
+ * - stdout/stderr: 'pipe' to capture output
+ */
+function buildSpawnOptions(options) {
+    return {
+        encoding: 'utf-8',
+        cwd: options?.cwd,
+        env: options?.env ? { ...process.env, ...options.env } : process.env,
+        timeout: options?.timeout,
+        stdio: ['ignore', 'pipe', 'pipe'],
+    };
+}
+/**
+ * Execute a shell command in non-interactive mode.
+ * Uses piped stdio to avoid passing terminal to child process.
+ *
+ * @param command - The shell command to execute
+ * @param options - Execution options (cwd, env, timeout)
+ * @returns The trimmed stdout output
+ * @throws ExecError if the command fails
+ */
+export function execNonInteractive(command, options) {
+    const spawnOptions = buildSpawnOptions(options);
+    // Use shell to execute the command string
+    const result = spawnSync(command, {
+        ...spawnOptions,
+        shell: true,
+    });
+    if (result.error) {
+        throw new ExecError(command, null, result.error.message, null);
+    }
+    if (result.status !== 0) {
+        const stderr = typeof result.stderr === 'string' ? result.stderr.trim() : '';
+        throw new ExecError(command, result.status, stderr, result.signal?.toString() ?? null);
+    }
+    const stdout = typeof result.stdout === 'string' ? result.stdout : '';
+    return stdout.trim();
+}
+/**
+ * Execute a file with arguments in non-interactive mode.
+ * Uses execFile semantics (no shell), avoiding shell injection vulnerabilities.
+ * Uses piped stdio to avoid passing terminal to child process.
+ *
+ * @param file - The executable to run
+ * @param args - Arguments to pass to the executable
+ * @param options - Execution options (cwd, env, timeout)
+ * @returns The trimmed stdout output
+ * @throws ExecError if the command fails
+ */
+export function execFileNonInteractive(file, args, options) {
+    const spawnOptions = buildSpawnOptions(options);
+    const command = `${file} ${args.join(' ')}`;
+    const result = spawnSync(file, args, spawnOptions);
+    if (result.error) {
+        throw new ExecError(command, null, result.error.message, null);
+    }
+    if (result.status !== 0) {
+        const stderr = typeof result.stderr === 'string' ? result.stderr.trim() : '';
+        throw new ExecError(command, result.status, stderr, result.signal?.toString() ?? null);
+    }
+    const stdout = typeof result.stdout === 'string' ? result.stdout : '';
+    return stdout.trim();
+}
+/**
+ * Execute a git command in non-interactive mode.
+ * Combines execFileNonInteractive with GIT_NON_INTERACTIVE_ENV for
+ * defense-in-depth against SSH prompts.
+ *
+ * @param args - Arguments to pass to git
+ * @param options - Execution options (cwd, env, timeout)
+ * @returns The trimmed stdout output
+ * @throws ExecError if the command fails
+ */
+export function execGitNonInteractive(args, options) {
+    const env = {
+        ...options?.env,
+        ...GIT_NON_INTERACTIVE_ENV, // Always override to ensure non-interactive
+    };
+    return execFileNonInteractive('git', args, { ...options, env });
+}
+//# sourceMappingURL=exec.js.map

package/dist/utils/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/utils/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAC;AAEtE;;GAEG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEhB;IACA;IACA;IACA;IAJlB,YACkB,OAAe,EACf,QAAuB,EACvB,MAAc,EACd,MAAqB;QAErC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACpF,KAAK,CAAC,mBAAmB,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC;QANhC,YAAO,GAAP,OAAO,CAAQ;QACf,aAAQ,GAAR,QAAQ,CAAe;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAe;QAIrC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAWD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,mBAAmB,EAAE,GAAG;IACxB,eAAe,EAAE,sBAAsB;CACxC,CAAC;AAEF;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAqB;IAC9C,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO,EAAE,GAAG;QACjB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;QACpE,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,OAAqB;IACvE,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAEhD,0CAA0C;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE;QAChC,GAAG,YAAY;QACf,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,IAAc,EACd,OAAqB;IAErB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAE5C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAEnD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAc,EAAE,OAAqB;IACzE,MAAM,GAAG,GAAG;QACV,GAAG,OAAO,EAAE,GAAG;QACf,GAAG,uBAAuB,EAAE,4CAA4C;KACzE,CAAC;IAEF,OAAO,sBAAsB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/utils/index.d.ts

@@ -1,5 +1,7 @@
 export { processInBatches } from './async.js';
 export { getVersion, getMajorVersion } from './version.js';
+export { ExecError, execNonInteractive, execFileNonInteractive, execGitNonInteractive, GIT_NON_INTERACTIVE_ENV, } from './exec.js';
+export type { ExecOptions } from './exec.js';
 /** Default concurrency for parallel trigger/skill execution */
 export declare const DEFAULT_CONCURRENCY = 4;
 /**

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE3D,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B/C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAEvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B/C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAEvD"}

package/dist/utils/index.js

@@ -1,5 +1,6 @@
 export { processInBatches } from './async.js';
 export { getVersion, getMajorVersion } from './version.js';
+export { ExecError, execNonInteractive, execFileNonInteractive, execGitNonInteractive, GIT_NON_INTERACTIVE_ENV, } from './exec.js';
 /** Default concurrency for parallel trigger/skill execution */
 export const DEFAULT_CONCURRENCY = 4;
 /**

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE3D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,+DAA+D;IAC/D,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,wFAAwF;IACxF,qEAAqE;IACrE,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,SAAS,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,SAAS,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,uCAAuC;IACvC,SAAS,GAAG,SAAS;SAClB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEzB,+BAA+B;IAC/B,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACrF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AAGnB,+DAA+D;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,+DAA+D;IAC/D,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,wFAAwF;IACxF,qEAAqE;IACrE,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,SAAS,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,SAAS,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,uCAAuC;IACvC,SAAS,GAAG,SAAS;SAClB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEzB,+BAA+B;IAC/B,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACrF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/warden",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Event-driven agent that reacts to GitHub events and executes skills via Claude Code SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -8,20 +8,6 @@
   "bin": {
     "warden": "dist/cli/index.js"
   },
-  "scripts": {
-    "cli": "tsx src/cli/index.ts",
-    "build": "tsc",
-    "build:action": "ncc build src/action/main.ts -o dist/action --source-map --license licenses.txt",
-    "dev": "tsc --watch",
-    "lint": "eslint src",
-    "lint:fix": "eslint src --fix",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:examples": "vitest run --config vitest.integration.config.ts",
-    "typecheck": "tsc --noEmit",
-    "prepare": "simple-git-hooks",
-    "release": "pnpm lint && pnpm build && pnpm test && npm version"
-  },
   "simple-git-hooks": {
     "pre-commit": "pnpm lint-staged && pnpm typecheck"
   },
@@ -57,6 +43,7 @@
     "dotenv": "^17.2.3",
     "fast-glob": "^3.3.3",
     "figures": "^6.1.0",
+    "ignore": "^7.0.5",
     "ink": "^5.2.1",
     "ink-spinner": "^5.0.0",
     "react": "^18.3.1",
@@ -79,5 +66,17 @@
   },
   "engines": {
     "node": ">=20.0.0"
+  },
+  "scripts": {
+    "cli": "tsx src/cli/index.ts",
+    "build": "tsc",
+    "build:action": "ncc build src/action/main.ts -o dist/action --source-map --license licenses.txt",
+    "dev": "tsc --watch",
+    "lint": "eslint src",
+    "lint:fix": "eslint src --fix",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:examples": "vitest run --config vitest.integration.config.ts",
+    "typecheck": "tsc --noEmit"
   }
-}
+}

package/.agents/skills/find-bugs/SKILL.md

@@ -1,75 +0,0 @@
----
-name: find-bugs
-description: Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
----
-
-# Find Bugs
-
-Review changes on this branch for bugs, security vulnerabilities, and code quality issues.
-
-## Phase 1: Complete Input Gathering
-
-1. Get the FULL diff: `git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD`
-2. If output is truncated, read each changed file individually until you have seen every changed line
-3. List all files modified in this branch before proceeding
-
-## Phase 2: Attack Surface Mapping
-
-For each changed file, identify and list:
-
-* All user inputs (request params, headers, body, URL components)
-* All database queries
-* All authentication/authorization checks
-* All session/state operations
-* All external calls
-* All cryptographic operations
-
-## Phase 3: Security Checklist (check EVERY item for EVERY file)
-
-* [ ] **Injection**: SQL, command, template, header injection
-* [ ] **XSS**: All outputs in templates properly escaped?
-* [ ] **Authentication**: Auth checks on all protected operations?
-* [ ] **Authorization/IDOR**: Access control verified, not just auth?
-* [ ] **CSRF**: State-changing operations protected?
-* [ ] **Race conditions**: TOCTOU in any read-then-write patterns?
-* [ ] **Session**: Fixation, expiration, secure flags?
-* [ ] **Cryptography**: Secure random, proper algorithms, no secrets in logs?
-* [ ] **Information disclosure**: Error messages, logs, timing attacks?
-* [ ] **DoS**: Unbounded operations, missing rate limits, resource exhaustion?
-* [ ] **Business logic**: Edge cases, state machine violations, numeric overflow?
-
-## Phase 4: Verification
-
-For each potential issue:
-
-* Check if it's already handled elsewhere in the changed code
-* Search for existing tests covering the scenario
-* Read surrounding context to verify the issue is real
-
-## Phase 5: Pre-Conclusion Audit
-
-Before finalizing, you MUST:
-
-1. List every file you reviewed and confirm you read it completely
-2. List every checklist item and note whether you found issues or confirmed it's clean
-3. List any areas you could NOT fully verify and why
-4. Only then provide your final findings
-
-## Output Format
-
-**Prioritize**: security vulnerabilities > bugs > code quality
-
-**Skip**: stylistic/formatting issues
-
-For each issue:
-
-* **File:Line** - Brief description
-* **Severity**: Critical/High/Medium/Low
-* **Problem**: What's wrong
-* **Evidence**: Why this is real (not already fixed, no existing test, etc.)
-* **Fix**: Concrete suggestion
-* **References**: OWASP, RFCs, or other standards if applicable
-
-If you find nothing significant, say so - don't invent issues.
-
-Do not make changes - just report findings. I'll decide what to address.