openqodex 0.1.0

package/lenses/id-enumeration-sequential.md

@@ -0,0 +1,49 @@
+---
+name: id-enumeration-sequential
+description: Sequential / integer IDs used as URL parameters for access-controlled resources
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+  hunk_regex: "(req\\.params|c\\.req\\.param|request\\.match_info|path_params).{0,30}(id|uid|user|order|invoice)"
+security: true
+confidence_floor: 0.7
+---
+
+A handler accepts a sequential integer ID from the URL
+(`/orders/:id`, `/users/:id`) and looks up the row by primary key
+without verifying that the authenticated principal OWNS that row.
+This is IDOR (Insecure Direct Object Reference): an attacker just
+increments / decrements the ID to enumerate other users' data.
+
+Even when the ID type is opaque (UUID), the missing-authz check is
+still a bug; the attacker may have obtained a leaked link.
+
+Flag when:
+- the handler resolves a record by `id` from the URL
+- the subsequent query has no `where: { ownerId: ctx.user.id }`
+  (or equivalent) clause
+- there's no permission check / policy call between the lookup and
+  the response
+
+Suppress when:
+- the row IS scoped to the authenticated user in the query
+- a policy / RBAC / row-level-security check runs explicitly
+- the resource is public by design (a blog post, a published
+  document) and the handler is the public endpoint

package/lenses/interactive-state-decoupled-from-output.md

@@ -0,0 +1,67 @@
+---
+name: interactive-state-decoupled-from-output
+description: New user-mutable state is introduced but an output that should depend on it reads a static or duplicate source instead
+triggers:
+  files:
+    - "*.tsx"
+    - "*.jsx"
+    - "*.vue"
+    - "*.svelte"
+    - "**/*.tsx"
+    - "**/*.jsx"
+    - "**/*.vue"
+    - "**/*.svelte"
+  hunk_regex: "useState|useReducer|writable\\(|ref\\(|reactive\\(|toggle|setSelected|setChecked|setEnabled|setWatched|setFilter"
+confidence_floor: 0.72
+---
+
+This diff adds a piece of user-mutable state (a `useState` /
+`useReducer` / store `writable` / `ref` / a `toggle*` handler that
+flips a Set or boolean) AND there is an output in the same component
+whose meaning DEPENDS on that state but which is computed from a
+different, static, or duplicate source, so toggling the control in
+the UI has no effect on the output it appears to govern.
+
+The classic shape: a user can star/unstar, select/deselect, enable/
+disable, or filter items, but a derived view (an alert banner, a
+count, a summary, a "what matches" list, a submit payload) is built
+from a constant default list, an unrelated prop, or a separately
+hardcoded copy of the same data, not from the live state the user
+just changed. Each line reads correctly on its own; the bug is the
+MISSING wire between the state and the consumer.
+
+Flag when, in this diff:
+- new interactive state `S` is introduced (and a handler mutates it),
+  AND
+- there is a rendered output or computed value `O` whose
+  semantics clearly should reflect `S` (it is "about" the same thing
+  the user is toggling), BUT
+- `O` is derived from a static constant, a duplicated literal, or a
+  different source, never reading `S`.
+
+Trace it: find every place the new state SHOULD be read (the outputs
+that semantically depend on it) and check each actually reads it. An
+output that reads a static/duplicate source instead of `S` is the
+finding. This also surfaces nearby dead code: a status/variant value
+that no branch ever produces, or the same metric rendered from two
+different sources that can disagree.
+
+Suppress when:
+- the static source is intentional and documented (e.g. the default
+  list is the seed and the toggle layers on top, and the output
+  correctly merges both),
+- the output genuinely should not depend on the state (the
+  resemblance is coincidental),
+- the state is purely presentational (drives only its own control's
+  appearance, like a star's fill) and no other output is expected to
+  track it.
+
+Severity: `major` when the decoupling makes a user-facing control a
+no-op for the thing it implies it controls (e.g. unwatching a
+category in the UI but the alert still fires for it); `minor` for
+cosmetic-only mismatches.
+
+Example: a "watched categories" toggle drove only
+the star icon while the threshold-breach alert banner was computed
+from a separate static `DEFAULT_WATCHES` constant, so starring /
+unstarring had no effect on which categories tripped the alert.

package/lenses/json-parse-no-try-catch.md

@@ -0,0 +1,41 @@
+---
+name: json-parse-no-try-catch
+description: JSON.parse over untrusted input without try/catch, crashes the request
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+  hunk_regex: "JSON\\.parse\\s*\\("
+confidence_floor: 0.7
+---
+
+`JSON.parse(input)` throws on invalid input. When the input is a
+request body, query string, cookie, or external API response, an
+attacker can crash the handler by sending non-JSON. In Express 4
+this surfaces as a 500 + log spam; in async handlers without an
+async error boundary it can become an unhandled rejection.
+
+Flag when `JSON.parse(...)` is called on a value sourced from
+`req.body|req.query|req.cookies|req.headers|response|fetch result|
+file read|process.argv` and the call is NOT inside a `try { ... }
+catch` (or wrapped by a parser like `Zod.safeParse(JSON.parse(...))`
+that itself doesn't catch the parse phase).
+
+Suppress when:
+- a `try/catch` surrounds the call and returns a sensible response
+- the body parser of the framework already runs `JSON.parse` and
+  surfaces a typed error (`express.json()`, Hono's `await c.req.json()`
+  inside an error-handling app)
+- the value is provably valid JSON from a controlled internal
+  source (a value the SAME service wrote moments ago and the parse
+  is the reverse trip)

package/lenses/missing-rate-limit-on-auth.md

@@ -0,0 +1,49 @@
+---
+name: missing-rate-limit-on-auth
+description: Login / password-reset / OTP / signup endpoint without rate limiting visible
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+  hunk_regex: "(login|signin|sign-in|signup|register|forgot[-_]?password|reset[-_]?password|verify[-_]?otp|send[-_]?otp|magic[-_]?link)"
+security: true
+confidence_floor: 0.7
+---
+
+A login / signup / password-reset / OTP-verify / magic-link
+endpoint is registered without a rate-limit middleware visible.
+Without one: credential stuffing trivially scales, password-reset
+email pumps spam any address, OTP-verify allows brute force, and
+signup bots burn through plan limits.
+
+Flag when:
+- the new route handles auth-flow input (password, OTP code, email
+  send) and the diff doesn't show a rate-limiter on the route OR
+  a `rateLimit` / `limiter.consume` call inside the body
+
+Suppress when:
+- a `limiter` / `rateLimit` middleware is chained on the route
+- the framework / platform applies per-IP throttling at the edge
+  (Vercel, Cloudflare, AWS WAF) and that's documented in the
+  repo (CLAUDE.md, README, infra notes)
+- the endpoint is a webhook with HMAC signature (different threat
+  model: bot calls are rejected by signature check)
+- the project explicitly uses a 3rd party (Clerk / Auth0 / WorkOS
+  / Supabase Auth) that owns auth flows; the route is a thin
+  pass-through and the provider rate-limits

package/lenses/oauth-scope-wider-than-use.md

@@ -0,0 +1,79 @@
+---
+name: oauth-scope-wider-than-use
+description: Connector requests an OAuth scope no code path in it actually uses
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.mjs"
+    - "*.py"
+    - "*.rb"
+    - "*.go"
+    - "*.java"
+    - "*.kt"
+    - "*.json"
+    - "*.yaml"
+    - "*.yml"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.mjs"
+    - "**/*.py"
+    - "**/*.rb"
+    - "**/*.go"
+    - "**/*.java"
+    - "**/*.kt"
+    - "**/*.json"
+    - "**/*.yaml"
+    - "**/*.yml"
+  hunk_regex: "scope=|scopes?\\s*[:=]\\s*[\\[\\(\"']|\\.scope\\(|setScope\\(|\"scopes\"\\s*:"
+security: true
+confidence_floor: 0.75
+---
+
+A connector asks the provider for a scope, and nothing in the connector
+ever calls an endpoint that needs it. The declaration is usually one
+string in an authorize URL, a client constructor, or a manifest, written
+once when the integration was built and never narrowed as the feature
+shrank. The cost is real: the token the user grants can do more than
+the product does, so a leaked token, a compromised server, or a bug in
+the connector reaches data and writes the product never intended to
+touch. A `full` scope on a connector that only reads one record is the
+shape.
+
+How to check, before you flag anything:
+
+- Find the scope declaration. Read the whole line and the call it sits
+  in, so you can quote it and say which scopes are requested.
+- Enumerate every provider call the connector makes. Search the
+  connector's own directory for the provider's base URL, its client
+  class, or the SDK method prefix (search for callers of the client,
+  then for the base URL) and list the endpoints you found.
+- Map each requested scope to the calls that need it, using the
+  provider's own scope documentation as the connector states it, not a
+  guess about naming.
+- Report every scope with no call behind it. One finding per unused
+  scope, not one per connector.
+
+What to cite:
+
+- The scope declaration line, with file and line, quoted whole.
+- The provider calls you found, each as a supporting quote with its file
+  and line. This is what makes the finding checkable: without the list,
+  "no call needs this" is an assertion, not evidence.
+
+Suppress when:
+
+- the provider only grants the scope as part of a bundle (some providers
+  have no finer grain than `read`), and the connector says so
+- the scope is used on a path behind a feature flag or an unreleased
+  code path that is still in the tree
+- a sibling connector or a shared client in the same repository uses the
+  same credential, so the calls live outside this directory; widen the
+  search before flagging
+- the connector is a thin proxy whose callers make the provider calls
+
+Severity: medium by default. High when the unused scope grants write,
+delete, or admin access, since the blast radius of the extra grant is
+then the user's data rather than a wider read.

package/lenses/object-spread-clobber.md

@@ -0,0 +1,44 @@
+---
+name: object-spread-clobber
+description: "{ ...existing, ...incoming } overwrites server-controlled fields with user input"
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+  hunk_regex: "\\{\\s*\\.\\.\\."
+confidence_floor: 0.7
+---
+
+`{ ...existing, ...input }` spreads a user-supplied object over a
+server-controlled one. Any field name in `input` that overlaps
+`existing` wins, including fields the caller wasn't supposed to
+write (`id`, `userId`, `role`, `tier`, `isAdmin`, `createdAt`,
+`stripeCustomerId`).
+
+Mass-assignment is the classic Rails / Express / Hono shape:
+`db.update({ where, data: { ...req.body } })`.
+
+Flag when:
+- the spread merges a request-sourced object into a DB write
+  payload / state object
+- there's no explicit allow-list pick (`pick(input, [...])` /
+  `{ name: input.name, email: input.email }`) before the spread
+- the model has any field that an authenticated user shouldn't be
+  able to set (role, owner, billing)
+
+Suppress when:
+- the spread is preceded by an allow-list pick / Zod parse with a
+  strict schema (`schema.parse(input)` rejecting unknown keys)
+- the spread is between two server-controlled objects only
+- the destination is a transient payload (not persisted), and the
+  extra fields are deliberately allowed

package/lenses/open-redirect-from-untrusted-host.md

@@ -0,0 +1,55 @@
+---
+name: open-redirect-from-untrusted-host
+description: HTTP redirect using a URL/host taken from query / body without allow-list
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "*.java"
+    - "*.kt"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+    - "**/*.java"
+    - "**/*.kt"
+  hunk_regex: "redirect\\s*\\(|res\\.redirect\\b|Location:|http\\.Redirect\\b|return\\s+redirect|RedirectView\\b|return\\s+[\"']redirect:"
+security: true
+confidence_floor: 0.7
+---
+
+A redirect target is constructed from request input (`?next=...`,
+`?returnTo=...`, form field, JSON body) without validating that the
+host belongs to a known allow-list. Phishing attacks chain
+`/login?next=https://attacker.example/fake-login` so the trusted
+host is the first thing the user sees in the URL bar.
+
+Flag when a `redirect(url)` / `res.redirect(url)` / `Location:`
+header is built from a request-derived URL string that isn't
+validated against a list of allowed hosts or constrained to a
+relative path.
+
+Suppress when:
+- the redirect target is constrained to a same-origin pathname
+  (starts with `/`, no scheme / host)
+- the URL is parsed and checked against an allow-list of hosts
+  before redirect
+- the value is the OUTPUT of a server-controlled flow (OAuth state
+  recovered from session, post-payment URL from a payment provider
+  the project controls)
+
+In Java and Kotlin the idiom is `response.sendRedirect(target)`, a
+Spring `RedirectView`, or a controller returning the string
+`"redirect:"` with a request value appended.

package/lenses/orm-drizzle-on-conflict-clobber.md

@@ -0,0 +1,47 @@
+---
+name: orm-drizzle-on-conflict-clobber
+description: Drizzle / Kysely onConflictDoUpdate that updates every column, clobbers downstream writes
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+  hunk_regex: "onConflictDoUpdate|onConflict\\s*\\(|insertOrUpdate"
+confidence_floor: 0.7
+---
+
+A Drizzle `onConflictDoUpdate({ set: { ... } })` (or Kysely
+`onConflict(...).doUpdateSet`) with a `set:` block that updates
+**every column** the insert tried to write overwrites columns the
+caller didn't mean to touch. Webhook replays, idempotent retries,
+and "create or update" code paths regress columns that downstream
+handlers have already advanced (status, tier, role, lastSeenAt,
+updatedAt).
+
+Closely related to the existing `upsert-state-column` lens, but
+focused on the Drizzle / Kysely shape where the `set:` block is
+copied directly from the insert values without a deliberate column
+filter.
+
+Flag when the `set:` block contains the same columns as the insert
+AND any of those columns are state-bearing (status, stage, role,
+plan, tier, version, updatedAt) or are commonly written by other
+code paths (preferences, profile fields).
+
+Suppress when:
+- the `set:` block explicitly OMITS state-bearing columns
+- the conflict clause uses `target: ...` with `setWhere` /
+  `where: ...` that constrains the update to rows in a known state
+- `onConflictDoNothing` (no clobber)
+- the conflict target is a uniqueness column whose only path to
+  conflict is a literal duplicate of the same write (idempotent
+  semantic is the actual goal)

package/lenses/path-traversal-in-fs-access.md

@@ -0,0 +1,59 @@
+---
+name: path-traversal-in-fs-access
+description: File system read / write using a path built from user input
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "*.java"
+    - "*.kt"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+    - "**/*.java"
+    - "**/*.kt"
+  hunk_regex: "(readFile|writeFile|createReadStream|createWriteStream|open\\s*\\(|os\\.path\\.join|filepath\\.Join|File\\.open|fs\\.|\\bFile\\s*\\(|Paths\\.get\\s*\\(|Files\\.(readAllBytes|newInputStream|copy)\\s*\\()"
+security: true
+confidence_floor: 0.7
+---
+
+A filesystem call (`fs.readFile`, `fs.writeFile`, `open`, etc.)
+uses a path built by joining a base directory with a value sourced
+from request input. `../../../etc/passwd` and absolute-path
+substitution bypass the base. Reads leak arbitrary files; writes
+let an attacker plant malicious content where the server will
+serve / execute it.
+
+Flag when the path argument is a join of:
+- a server-controlled prefix (`./uploads/`, `path.join(BASE, ...)`)
+- AND a value from `req.body`, `req.query`, `req.params`, form
+  upload, parsed JSON, command-line args, or env
+
+Suppress when:
+- the user input is run through a sanitizer that strips `..` /
+  `/` / null bytes
+- the final path is `path.resolve`d and then verified to live
+  beneath the base directory (`resolved.startsWith(base + sep)`)
+- the input is a whitelisted enum / UUID lookup that the path
+  derives from an internal mapping (not used as the filename
+  directly)
+- the file is served via a CDN / object store with its own access
+  control (no FS at all)
+
+In Java and Kotlin the idiom is `new File(base + userInput)` (Kotlin
+drops the `new`),
+`Paths.get(...)` or `Files.readAllBytes(...)` on a path segment taken
+from a request parameter or a multipart upload's filename.

package/lenses/pii-in-url-or-log.md

@@ -0,0 +1,48 @@
+---
+name: pii-in-url-or-log
+description: PII (email, phone, SSN, full name) in URLs or unredacted log statements
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+  hunk_regex: "(email|phone|ssn|password|address|fullName|first_name|last_name|dob|date_of_birth)\\b"
+security: true
+confidence_floor: 0.7
+---
+
+A PII field (email, phone, SSN, full name, address, DOB) is
+embedded in a URL query string OR logged unredacted. URL params
+land in CDN logs, browser history, referrer headers to third
+parties, and analytics services. Logs land in aggregators that
+many engineers + vendors can read.
+
+Flag when:
+- a PII field is concatenated into a URL string for a redirect /
+  fetch / external API
+- a log call passes a record / object that contains a PII field
+  without going through a redaction layer
+
+Suppress when:
+- the PII goes in the request BODY (POST/PUT) rather than the URL
+- the log call explicitly uses a redactor / pino's `redact` /
+  custom `scrubPii` helper
+- the value being logged is an internal ID / hash of the PII, not
+  the PII itself
+- the URL is internal-only (no proxy / CDN / referrer leak) AND
+  there's a documented reason (still recommend moving it to the body)

package/lenses/race-check-then-act.md

@@ -0,0 +1,49 @@
+---
+name: race-check-then-act
+description: Check-then-act on a database row without a transaction / unique constraint
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+  hunk_regex: "\\b(findFirst|findOne|findUnique|select|exists|count)\\b.{0,300}\\b(insert|create|update|save|delete)\\b"
+confidence_floor: 0.7
+---
+
+A handler reads a row to decide whether to insert / update / delete
+(check-then-act), but the read and the write are NOT in the same
+transaction AND the table has no unique constraint backing the
+invariant. Concurrent requests both pass the check and both
+proceed: two users get the same username, two orders against the
+same inventory unit, two emails for "first signup" bonus.
+
+Flag when:
+- a `findOne` / `findFirst` / `count` / `exists` is followed by an
+  `insert` / `update` / `delete` keyed on the same predicate
+- the two operations are NOT wrapped in a single `transaction(...)`
+  / `db.tx(...)`
+- the predicate column is NOT a primary key / unique index
+
+Suppress when:
+- the operations run inside a single transaction with an explicit
+  isolation level that prevents the race (serializable, or
+  `SELECT ... FOR UPDATE`)
+- the write uses an idempotent shape that survives the race
+  (`INSERT ... ON CONFLICT DO NOTHING`, `UPDATE ... WHERE col = old`)
+- a unique constraint / partial index on the table guarantees the
+  invariant at the DB layer regardless of the app-level check

package/lenses/react-dangerously-set-inner-html.md

@@ -0,0 +1,32 @@
+---
+name: react-dangerously-set-inner-html
+description: dangerouslySetInnerHTML fed by untrusted / unsanitized input
+triggers:
+  files:
+    - "*.tsx"
+    - "*.jsx"
+    - "**/*.tsx"
+    - "**/*.jsx"
+  hunk_regex: "dangerouslySetInnerHTML"
+security: true
+confidence_floor: 0.7
+---
+
+`dangerouslySetInnerHTML` bypasses React's HTML escaping. Any value
+that traces back to user input, a network response, or
+markdown/HTML rendered without sanitization is a stored or reflected
+XSS sink.
+
+Flag when the `__html` value's provenance is unsanitized: a prop or
+state variable that came from `fetch`, `URLSearchParams`, `params`,
+form input, comment / post / message content, or any markdown
+rendered without an escaping pipeline.
+
+Suppress when:
+- the value is run through `DOMPurify.sanitize` /
+  `sanitize-html` / equivalent immediately before the assignment
+- the value is a literal string from the component itself (build-time
+  constant, not user-derived)
+- the value is the output of a markdown library configured with
+  HTML disabled (`marked` with `sanitize: true`, `remark-html` with
+  `sanitize` plugin, `markdown-it` without `html: true`)

package/lenses/react-fetch-in-effect-without-abort.md

@@ -0,0 +1,31 @@
+---
+name: react-fetch-in-effect-without-abort
+description: useEffect fires a fetch but doesn't abort it on cleanup / dep change
+triggers:
+  files:
+    - "*.tsx"
+    - "*.jsx"
+    - "**/*.tsx"
+    - "**/*.jsx"
+  hunk_regex: "useEffect\\s*\\([\\s\\S]{0,300}?\\bfetch\\s*\\("
+confidence_floor: 0.7
+---
+
+A `useEffect` issues a `fetch` (or axios / ky / undici) but doesn't
+hand the request an `AbortSignal` whose controller is aborted in the
+cleanup. When the component unmounts before the response arrives,
+or the deps change and the effect re-runs, the in-flight response
+still resolves and calls `setState` on an unmounted component (or
+clobbers fresher state with stale data from the previous request).
+
+Flag when the fetch is started inside a `useEffect` and the cleanup
+returned from the effect doesn't call `controller.abort()` (or the
+fetch isn't passed a `signal` at all).
+
+Suppress when:
+- the body uses `react-query` / `swr` / TanStack Query (those
+  handle abort + race themselves)
+- the cleanup uses an `ignore` boolean flag inside the
+  `.then(data => { if (!ignore) setState(data) })` pattern (slightly
+  worse than abort but still correct)
+- the request is fire-and-forget with no `setState` in the chain