← Back to Build Report

🔒 Security Scan Report

Commit: 3ff0010d6f413e3a40e7c7e0e41cea5fbadd4b87

npm Vulnerabilities

2
info: 0, low: 0, moderate: 1, high: 0, critical: 0, total: 1

ESLint Errors

3
Security-related errors

ESLint Warnings

41
Security-related warnings
⚠️ Note: All security findings are for informational purposes only and do not block builds. Please review and address high-severity vulnerabilities as soon as possible.

Download Security Data

📄 Download npm audit JSON 📄 Download ESLint JSON 📄 Download Combined JSON

npm Audit Vulnerabilities

Package Severity Description
qs moderate { "source": 1243452, "name": "qs", "dependency": "qs", "title": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)", "url": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw", "severity": "moderate", "cwe": [ "CWE-248", "CWE-704" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.7.0 <=6.16.0" }

ESLint Security Issues

File:Line Severity Rule Message
src/api/content-deletion.js:268 warning no-unused-vars 'disputeId' is assigned a value but never used.
src/api/content-deletion.test.js:11 warning no-unused-vars 'storage' is assigned a value but never used.
src/api/content.js:42 warning no-unused-vars '_uploaderId' is assigned a value but never used.
src/api/content.js:45 warning no-unused-vars '_pendingR2Deletion' is assigned a value but never used.
src/api/content.js:46 warning no-unused-vars '_deletionReason' is assigned a value but never used.
src/api/content.js:47 warning no-unused-vars '_availabilityVersion' is assigned a value but never used.
src/api/content.js:48 warning no-unused-vars '_r2MetaVersion' is assigned a value but never used.
src/api/disputes.js:218 warning no-unused-vars 'userId' is assigned a value but never used.
src/api/payments.js:632 warning no-unused-vars 'env' is defined but never used. Allowed unused args must match /^_/u.
src/auth/download-tokens.js:45 warning security/detect-non-literal-regexp Found non-literal argument to RegExp Constructor
src/auth/utils.test.js:242 warning no-unused-vars 'result' is assigned a value but never used.
src/browser-client-safety.test.js:19 warning promise/no-callback-in-promise Avoid calling back inside of a promise.
src/browser-sdk-release.test.js:7 warning security/detect-non-literal-fs-filename Found readFileSync from package "node:fs" with non literal argument at index 0
src/browser-sdk-release.test.js:8 warning security/detect-non-literal-fs-filename Found readFileSync from package "node:fs" with non literal argument at index 0
src/browser-sdk-release.test.js:12 warning security/detect-non-literal-fs-filename Found readFileSync from package "node:fs" with non literal argument at index 0
src/browser-sdk-release.test.js:13 warning security/detect-non-literal-fs-filename Found readFileSync from package "node:fs" with non literal argument at index 0
src/docs-textpad.test.js:5 warning security/detect-non-literal-fs-filename Found readFileSync from package "node:fs" with non literal argument at index 0
src/docs-textpad.test.js:21 warning security/detect-non-literal-regexp Found non-literal argument to RegExp Constructor
src/docs-textpad.test.js:25 error no-new-func The Function constructor is eval.
src/docs-textpad.test.js:35 warning security/detect-non-literal-fs-filename Found readFileSync from package "node:fs" with non literal argument at index 0
src/durable-objects/alert-store.js:95 warning no-unused-vars 'key' is assigned a value but never used.
src/durable-objects/application-registry.test.js:118 error no-script-url Script URL is a form of eval.
src/durable-objects/content-metadata-rate-limit.test.js:417 warning no-unused-vars 'now' is assigned a value but never used.
src/durable-objects/content-metadata.js:12 warning no-unused-vars 'MINIMUM_MTBR_MS' is assigned a value but never used.
src/durable-objects/contest-record.js:11 warning no-unused-vars 'request' is defined but never used. Allowed unused args must match /^_/u.
src/durable-objects/message-thread.js:11 warning no-unused-vars 'request' is defined but never used. Allowed unused args must match /^_/u.
src/durable-objects/user-profile.js:83 error promise/always-return Each then() should return a value or throw
src/durable-objects/user-profile.js:781 warning jsdoc/require-param-description Missing JSDoc @param "keyId" description.
src/durable-objects/user-profile.js:1064 warning no-unused-vars '_hash' is assigned a value but never used.
src/index.js:307 warning jsdoc/tag-lines Expected only 0 line after block description
src/index.js:844 warning no-unused-vars 'handleRoot' is defined but never used.
src/integration/content-lifecycle.test.js:6 warning no-unused-vars 'beforeEach' is defined but never used.
src/integration/content-lifecycle.test.js:37 warning security/detect-non-literal-regexp Found non-literal argument to RegExp Constructor
src/integration/content-lifecycle.test.js:95 warning no-unused-vars 'id' is defined but never used. Allowed unused args must match /^_/u.
src/integration/content-lifecycle.test.js:150 warning no-unused-vars 'hash' is defined but never used. Allowed unused args must match /^_/u.
src/services/content-deletion.js:8 warning jsdoc/tag-lines Expected only 0 line after block description
src/services/content-deletion.js:107 warning jsdoc/tag-lines Expected only 0 line after block description
src/services/content-deletion.test.js:6 warning no-unused-vars 'beforeEach' is defined but never used.
src/services/content-deletion.test.js:41 warning no-unused-vars 'id' is defined but never used. Allowed unused args must match /^_/u.
src/services/content-deletion.test.js:61 warning no-unused-vars 'id' is defined but never used. Allowed unused args must match /^_/u.
src/services/content-deletion.test.js:72 warning no-unused-vars 'key' is defined but never used. Allowed unused args must match /^_/u.
src/utils/backup.js:49 warning jsdoc/no-undefined-types The type 'DurableObjectState' is undefined.
src/utils/backup.js:91 warning jsdoc/no-undefined-types The type 'DurableObjectState' is undefined.
src/utils/supplier-fallback.js:10 warning no-unused-vars 'ROLLING_WINDOW_SIZE' is assigned a value but never used.