MCP Scanner
ScanLeaderboardDocsSign in
Home/stripe/agent-toolkit/Results
0F

ai

stripe/agent-toolkit

303 files · 436 findings

Share GitHub SARIF JSON
2 critical97 high83 medium254 low
Tool Poisoningclean
Command Injection1 issue
Path Traversal3 issues
SSRF12 issues
Credential Theft42 issues
Excessive Permissionsclean
Missing Auth67 issues
Supply Chain
Supply Chain23

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:25
uses: actions/checkout@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

Logging Deficiency263

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/card-element-to-checkout/environment/client/scripts.js:278
console.log('Proceeding to checkout with items:', selectedItems);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

SSRF12

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/card-element-to-checkout/solution/client/return.js:11
window.location.replace('http://localhost:5000/checkout.html')
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Credential Theft42

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/furever/environment/app/api/debug/create_checkout_session/route.ts:43
const redirectUrl = `${process.env.NEXTAUTH_URL}/payments`;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Runtime Tool Poisoning4

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

benchmarks/furever/environment/scripts/setup-accounts.py:1602
[t for t in transactions if t.description == "loan"]
How to fix
Missing Auth67

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/environment/server/server.js:24
app.get('/', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Insecure Communication4

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

benchmarks/galtee-basic/environment/server/server.js:113
app.listen(4242, () => console.log(`Node server listening at http://localhost:4242`));
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Data Exfiltration12

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

benchmarks/galtee-basic/solution/server.js:43
return res.status(500).send({ error: { message: err.message } });
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Excessive Data Exposure4

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

benchmarks/galtee-basic/solution/server.js:41
db.all('SELECT * FROM products', [], (err, rows) => {
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

Path Traversal3

Windows-style path traversal patterns

high

Backslash-based directory traversal patterns targeting Windows file systems.

benchmarks/galtee-invoicing/solution/migrate.js:303
console.log("Starting migration...\n");
How to fix

Normalize path separators and apply traversal checks for both forward and backslashes.

Command Injection1

child_process import with unsanitized usage

high

Direct usage of child_process module methods with variable arguments may allow command injection.

skills/sync.js:3
const { execSync } = require("child_process");
How to fix

Use execFile with explicit argument arrays instead of child_process with string commands.

Shadow MCP Server1

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tools/typescript/src/modelcontextprotocol/register-paid-tool.ts:190
mcpServer.tool(toolName, toolDescription, paramsSchema, callback as any);
How to fix
23 issues
Rug Pullclean
Data Exfiltration12 issues
Insecure Communication4 issues
Excessive Data Exposure4 issues
Logging Deficiency263 issues
Runtime Tool Poisoning4 issues
Shadow MCP Server1 issue

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:28
uses: pnpm/action-setup@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:33
uses: actions/setup-node@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:65
uses: actions/checkout@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:68
uses: pnpm/action-setup@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:73
uses: actions/setup-node@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:101
uses: actions/checkout@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:138
uses: actions/checkout@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:141
uses: actions/setup-python@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:146
uses: astral-sh/setup-uv@v2
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/npm_release_shared.yml:27
- uses: actions/checkout@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/npm_release_shared.yml:30
uses: pnpm/action-setup@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/npm_release_shared.yml:34
- uses: actions/setup-node@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/pypi_release.yml:20
uses: actions/checkout@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/pypi_release.yml:23
uses: actions/setup-python@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/pypi_release.yml:28
uses: astral-sh/setup-uv@v2
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/pypi_release.yml:47
uses: actions/upload-artifact@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/pypi_release.yml:68
uses: actions/download-artifact@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/sync-skills.yml:18
uses: actions/checkout@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/sync-skills.yml:21
uses: actions/setup-node@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/sync-skills.yml:32
uses: peter-evans/create-pull-request@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

benchmarks/furever/environment/.github/workflows/test.yml:21
- uses: actions/checkout@v2
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

benchmarks/furever/environment/.github/workflows/test.yml:22
- uses: actions/setup-node@v1
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/card-element-to-checkout/solution/client/scripts.js:278
console.log('Proceeding to checkout with items:', selectedItems);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/account_session/route.ts:34
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/account_session/route.ts:39
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/account_session/route.ts:44
console.log('No demo onboarding account found');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/account_update/route.ts:23
console.log('updating account with, ', update);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/account_update/route.ts:28
console.log('updated account, ', newUser);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/payment_method_settings/create_checkout_session/route.ts:90
console.log('Created checkout session!', checkoutSessionResponse);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/setup_accounts/create_charges/route.ts:180
console.log('in function');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/setup_accounts/create_charges/route.ts:184
console.log('Creating payments with the following parameters:', json);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/setup_accounts/create_charges/route.ts:197
console.log('creating customer', name, email, description);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/setup_accounts/create_charges/route.ts:224
console.log('creating');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/setup_accounts/create_risk_intervention/route.ts:27
console.log('Created interventionResponse!', interventionResponse);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/setup_accounts/route.ts:88
console.log('updating account with, ', update);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/api/webhooks/route.ts:43
console.log('Unhandled event type', event.type);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

benchmarks/furever/environment/app/hooks/useConnect.ts:69
console.log('Fetching client secret for demo onboarding');
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/hooks/useConnect.ts:69
console.log('Fetching client secret for demo onboarding');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/environment/app/models/salon.ts:50
console.log(err);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

benchmarks/furever/environment/scripts/setup-accounts.py:1228
log.info(f"Charges are disabled for account {account.id}")
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

benchmarks/furever/environment/scripts/setup-accounts.py:1305
log.info(f"Charges are disabled for account {account.id}")
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

benchmarks/furever/environment/scripts/setup-accounts.py:1381
log.info(f"Skipping payouts on account {account.id} as they are disabled")
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

benchmarks/furever/environment/scripts/setup-accounts.py:1566
log.info(f"Charges are disabled for account {account.id}")
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/solution/app/api/account_session/route.ts:34
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/solution/app/api/account_session/route.ts:39
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/furever/solution/app/api/account_session/route.ts:44
console.log('No demo onboarding account found');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-basic/environment/server/server.js:90
console.log(`⚠️  Webhook signature verification failed.`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-basic/environment/server/server.js:106
console.log('💰 Payment captured!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-basic/environment/server/server.js:108
console.log('❌ Payment failed.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-basic/environment/server/server.js:113
app.listen(4242, () => console.log(`Node server listening at http://localhost:4242`));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-basic/solution/server.js:345
console.log(`⚠️  Webhook signature verification failed.`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-basic/solution/server.js:361
console.log('💰 Payment captured!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-basic/solution/server.js:363
console.log('❌ Payment failed.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-basic/solution/server.js:368
app.listen(4242, () => console.log(`Node server listening at http://localhost:4242`));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/environment/server/server.js:45
console.log(`Node server listening at http://localhost:4242`)
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/migrate.js:116
console.log("✓ Created bookings table");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/migrate.js:138
console.log(`✓ Created Stripe product: ${productId} (${product.id})`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/migrate.js:150
console.log(`  ✓ Created price: ${amount} ${currency} (${price.id})`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/migrate.js:229
console.log(`\nMigrating ${bookings.length} bookings...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/migrate.js:233
console.log("Migrating booking:", bookings[i]);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/migrate.js:288
console.log(`  ✓ Migrated ${i + 1}/${bookings.length} bookings`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/migrate.js:292
console.log(`✓ Migrated all ${bookings.length} bookings`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/migrate.js:303
console.log("Starting migration...\n");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/migrate.js:308
console.log("✓ Connected to database");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/migrate.js:314
console.log("\nCreating Stripe products...");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/migrate.js:332
console.log("\n✓ Migration completed successfully!");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/galtee-invoicing/solution/server.js:293
console.log(`Node server listening at http://localhost:4242`)
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/saas-starter-embedded-checkout/environment/app/api/stripe/webhook/route.ts:30
console.log(`Unhandled event type ${event.type}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

benchmarks/saas-starter-partial-payments/environment/app/api/stripe/webhook/route.ts:30
console.log(`Unhandled event type ${event.type}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

llm/ai-sdk/meter/examples/anthropic.ts:133
console.log('\n=== Sample 6: Stream with Max Tokens ===');
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:29
console.log('\n=== Sample 1: Basic generateText with Claude ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:42
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:47
console.log('\n=== Sample 2: Stream Text with Claude ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:66
console.log('\n\nFull text:', fullText);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:71
console.log('\n=== Sample 3: With System Message ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:85
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:90
console.log('\n=== Sample 4: Multi-turn Conversation ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:110
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:115
console.log('\n=== Sample 5: Using Claude Haiku ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:128
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:133
console.log('\n=== Sample 6: Stream with Max Tokens ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:150
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:155
console.log('Starting Vercel AI SDK + Anthropic + Stripe Metering Examples');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:156
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:168
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:169
console.log('All examples completed successfully!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/anthropic.ts:170
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:35
console.log('\n=== Sample 1: Basic generateText with Gemini ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:48
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:53
console.log('\n=== Sample 2: Stream Text with Gemini ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:72
console.log('\n\nFull text:', fullText);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:77
console.log('\n=== Sample 3: With System Message ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:91
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:96
console.log('\n=== Sample 4: Multi-turn Conversation ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:113
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:118
console.log('\n=== Sample 5: Longer Response ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:131
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:136
console.log('\n=== Sample 6: Stream with Temperature Control ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:154
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:159
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:162
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:174
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:175
console.log('All examples completed successfully!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/google.ts:176
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

llm/ai-sdk/meter/examples/openai.ts:98
console.log('\n=== Sample 5: With Max Tokens ===');
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:29
console.log('\n=== Sample 1: Basic generateText ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:39
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:44
console.log('\n=== Sample 2: Stream Text ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:60
console.log('\n\nFull text:', fullText);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:65
console.log('\n=== Sample 3: With System Message ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:75
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:80
console.log('\n=== Sample 4: Multi-turn Conversation ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:93
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:98
console.log('\n=== Sample 5: With Max Tokens ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:108
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:113
console.log('\n=== Sample 6: Using GPT-4 ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:122
console.log('Response:', text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:127
console.log('\n=== Sample 7: Stream with System Message ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:141
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:146
console.log('Starting Vercel AI SDK + Stripe Metering Examples');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:147
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:160
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:161
console.log('All examples completed successfully!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/meter/examples/openai.ts:162
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:32
console.log('=== Example 1: Simple text generation with Claude Sonnet 4 ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:40
console.log('Response:', result1.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:41
console.log('Usage:', result1.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:42
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:44
console.log('=== Example 2: Streaming with Claude Opus 4 ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:58
console.log('\n\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:60
console.log('=== Example 3: Chat conversation with Claude 3.7 Sonnet ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:78
console.log('Response:', result3.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:79
console.log('Usage:', result3.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:80
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:82
console.log('=== Example 4: Using Claude 3.5 Haiku for quick responses ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:93
console.log('Response:', result4.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:94
console.log('Usage:', result4.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:95
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:97
console.log('=== Example 5: Complex reasoning with Claude Opus 4.1 ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:109
console.log('Response:', result5.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:110
console.log('Usage:', result5.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:111
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:113
console.log('=== Example 6: Per-call customer ID override ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:126
console.log('Response:', result7.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:127
console.log('Usage:', result7.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:128
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/anthropic.ts:130
console.log('=== All examples completed! ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:32
console.log('=== Example 1: Simple text generation with Gemini 2.5 Pro ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:40
console.log('Response:', result1.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:41
console.log('Usage:', result1.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:42
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:44
console.log('=== Example 2: Streaming with Gemini 2.5 Flash ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:58
console.log('\n\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:60
console.log('=== Example 3: Chat conversation with Gemini 2.0 Flash ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:81
console.log('Response:', result3.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:82
console.log('Usage:', result3.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:83
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:85
console.log('=== Example 4: Using Gemini 2.5 Flash Lite for quick responses ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:96
console.log('Response:', result4.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:97
console.log('Usage:', result4.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:98
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:100
console.log('=== Example 5: Long-form content with Gemini 2.5 Pro ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:112
console.log('Response:', result5.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:113
console.log('Usage:', result5.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:114
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:116
console.log('=== Example 6: Streaming with custom headers ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:135
console.log('\n\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/google.ts:137
console.log('=== All examples completed! ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:32
console.log('=== Example 1: Simple text generation with OpenAI GPT-5 ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:42
console.log('Response:', result1.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:43
console.log('Usage:', result1.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:44
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:46
console.log('=== Example 2: Streaming with GPT-4.1 ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:49
console.log(`Sending request with prompt: "${streamPrompt}"`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:50
console.log(`Model: openai/gpt-4.1`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:51
console.log(`Customer ID: ${process.env.STRIPE_CUSTOMER_ID}\n`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:65
console.log('Stream started, consuming chunks...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:79
console.log(`\n\n(Received ${chunkCount} chunks)`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:83
console.log('Final text length:', finalText.length);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:84
console.log('Usage:', usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:86
console.log('=== Example 3: Chat conversation with GPT-4.1-mini ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:100
console.log('Response:', result3.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:101
console.log('Usage:', result3.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:102
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:104
console.log('=== Example 4: Using OpenAI o3 reasoning model ===\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:115
console.log('Response:', result4.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:116
console.log('Usage:', result4.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:117
console.log('\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/ai-sdk/provider/examples/openai.ts:119
console.log('=== All examples completed! ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:41
console.log('Response:', response.content[0]);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:42
console.log('Usage:', response.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:72
console.log('\n\nFull content:', fullContent);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:109
console.log('Response:', JSON.stringify(response.content, null, 2));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:110
console.log('Usage:', response.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:125
console.log('Response:', response.content[0]);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:126
console.log('Usage:', response.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:144
console.log('Response:', response.content[0]);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:145
console.log('Usage:', response.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:150
console.log('Starting Anthropic Usage Tracking Examples');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:151
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:156
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:157
console.log('Sample 1: Basic Message');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:158
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:161
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:162
console.log('Sample 2: Streaming Message');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:163
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:166
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:167
console.log('Sample 3: Message with Tools');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:168
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:171
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:172
console.log('Sample 4: Message with System Prompt');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:173
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:176
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:177
console.log('Sample 5: Multi-turn Conversation');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:178
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:181
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:182
console.log('All examples completed successfully!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/anthropic.ts:183
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:40
console.log('Response:', response.text());
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:41
console.log('Usage:', response.usageMetadata);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:68
console.log('\n\nFull text:', fullText);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:69
console.log('Usage:', (await meteredStream.response).usageMetadata);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:111
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:115
console.log('Usage:', response.usageMetadata);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:133
console.log('Response:', response.text());
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:134
console.log('Usage:', response.usageMetadata);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:155
console.log('Response:', result.response.text());
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:156
console.log('Usage:', result.response.usageMetadata);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:161
console.log('Starting Gemini Usage Tracking Examples');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:162
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:167
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:168
console.log('Sample 1: Basic Text Generation');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:169
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:172
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:173
console.log('Sample 2: Streaming Text Generation');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:174
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:177
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:178
console.log('Sample 3: Function Calling');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:179
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:182
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:183
console.log('Sample 4: System Instructions');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:184
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:187
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:188
console.log('Sample 5: Multi-turn Chat');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:189
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:192
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:193
console.log('All examples completed successfully!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/gemini.ts:194
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:41
console.log('Response:', response.choices[0]?.message?.content);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:42
console.log('Usage:', response.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:67
console.log('\n\nFull content:', fullContent);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:106
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:110
console.log('Usage:', response.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:174
console.log('\nUsage in stream:', chunk.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:178
console.log('\nTool calls:', Array.from(toolCalls.values()));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:193
console.log('Response:', JSON.stringify(response.output, null, 2));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:194
console.log('Usage:', response.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:220
console.log('Final output:', JSON.stringify(finalOutput, null, 2));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:221
console.log('Usage:', finalUsage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:255
console.log('Parsed response:', response.output[0]);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:256
console.log('Usage:', response.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:269
console.log('Embedding dimensions:', response.data[0]?.embedding.length);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:270
console.log('First 5 values:', response.data[0]?.embedding.slice(0, 5));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:271
console.log('Usage:', response.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:290
console.log('Response:', response.choices[0]?.message?.content);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:291
console.log('Usage:', response.usage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:296
console.log('Starting OpenAI Usage Tracking Examples');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:297
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:312
console.log('\n' + '='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:313
console.log('All examples completed successfully!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

llm/token-meter/examples/openai.ts:314
console.log('='.repeat(80));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

skills/sync.js:30
console.log(`Found ${skills.length} skills`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

skills/sync.js:41
console.log(`Syncing skill: ${skill.name}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

skills/sync.js:58
console.log(`  Written: ${outputPath}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

tools/modelcontextprotocol/build-dxt.js:30
console.log('🔨 Building with esbuild...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

tools/modelcontextprotocol/build-dxt.js:48
console.log('✅ Build completed successfully!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

tools/modelcontextprotocol/build-dxt.js:49
console.log('📦 Output: dxt-dist/index.js');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

tools/modelcontextprotocol/build-dxt.js:66
console.log('✅ DXT extension built successfully!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

tools/modelcontextprotocol/build-dxt.js:67
console.log('📦 Output: stripe.dxt');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

tools/typescript/examples/ai-sdk/index.ts:26
console.log(result);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tools/typescript/examples/cloudflare/src/app.ts:36
// const isLoggedIn = false;
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tools/typescript/examples/cloudflare/src/oauth.ts:36
// const isLoggedIn = false;
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

tools/typescript/examples/langchain/index.ts:44
console.log(response);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

tools/typescript/examples/openai/index.ts:43
console.log(completion.choices[0].message);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/card-element-to-checkout/solution/server/server.py:226
return_url='http://localhost:5000/return.html?session_id={CHECKOUT_SESSION_ID}',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/checkout-gym/environment/client/return.js:11
window.replace('http://localhost:4242/checkout.html')
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/checkout-gym/environment/server/submission.json:11
"return_url": "http://localhost:4242/session-status?session_id={CHECKOUT_SESSION_ID}"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/furever/grader/payments.py:34
url = f"http://localhost:{port}"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/galtee-basic/environment/client/return.js:11
window.replace('http://localhost:4242/checkout.html')
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/galtee-basic/solution/server.js:236
return_url: 'http://localhost:4242/return.html',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/galtee-invoicing/environment/client/return.js:11
window.replace('http://localhost:4242/checkout.html')
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tools/python/examples/openai/customer_support/emailer.py:167
_, thrid_data = imap_conn.fetch(email.id, "(X-GM-THRID)")
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tools/typescript/examples/cloudflare/src/index.ts:46
success_url: 'http://localhost:4242/payment/success',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tools/typescript/examples/cloudflare/src/index.ts:75
success_url: 'http://localhost:4242/payment/success',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tools/typescript/examples/cloudflare/src/index.ts:103
success_url: 'http://localhost:4242/payment/success',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/furever/environment/app/api/payment_method_settings/create_checkout_session/route.ts:47
const redirectUrl = `${process.env.NEXTAUTH_URL}/settings`;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/furever/environment/app/api/webhooks/route.ts:16
const secret = process.env.STRIPE_WEBHOOK_SECRET;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/furever/environment/app/api/webhooks/route.ts:29
process.env.STRIPE_WEBHOOK_SECRET || ''
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/galtee-basic/environment/server/server.js:7
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY, {
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/galtee-basic/environment/server/server.js:79
if (process.env.STRIPE_WEBHOOK_SECRET) {
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/galtee-basic/environment/server/server.js:87
process.env.STRIPE_WEBHOOK_SECRET
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/galtee-basic/solution/server.js:9
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY, {
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/galtee-basic/solution/server.js:334
if (process.env.STRIPE_WEBHOOK_SECRET) {
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/galtee-basic/solution/server.js:342
process.env.STRIPE_WEBHOOK_SECRET
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/galtee-invoicing/environment/server/server.js:6
const stripe = require("stripe")(process.env.STRIPE_SECRET_KEY, {
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/galtee-invoicing/solution/migrate.js:7
const stripe = require("stripe")(process.env.STRIPE_SECRET_KEY, {
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/galtee-invoicing/solution/server.js:8
const stripe = require("stripe")(process.env.STRIPE_SECRET_KEY, {
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/saas-starter-embedded-checkout/environment/app/api/stripe/webhook/route.ts:5
const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

benchmarks/saas-starter-partial-payments/environment/app/api/stripe/webhook/route.ts:5
const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/meter/examples/anthropic.ts:17
const STRIPE_API_KEY = process.env.STRIPE_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/meter/examples/anthropic.ts:19
const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/meter/examples/google.ts:18
const STRIPE_API_KEY = process.env.STRIPE_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/meter/examples/google.ts:21
process.env.GOOGLE_GENERATIVE_AI_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/meter/examples/openai.ts:17
const STRIPE_API_KEY = process.env.STRIPE_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/meter/examples/openai.ts:19
const OPENAI_API_KEY = process.env.OPENAI_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/provider/examples/anthropic.ts:18
if (!process.env.STRIPE_API_KEY) {
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/provider/examples/anthropic.ts:28
apiKey: process.env.STRIPE_API_KEY!,
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/provider/examples/google.ts:18
if (!process.env.STRIPE_API_KEY) {
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/provider/examples/google.ts:28
apiKey: process.env.STRIPE_API_KEY!,
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/provider/examples/google.ts:120
apiKey: process.env.STRIPE_API_KEY!,
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/provider/examples/openai.ts:18
if (!process.env.STRIPE_API_KEY) {
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/provider/examples/openai.ts:28
apiKey: process.env.STRIPE_API_KEY!,
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/provider/stripe-provider.ts:46
*   apiKey: process.env.STRIPE_API_KEY,
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/provider/stripe-provider.ts:73
const apiKey = config.apiKey || process.env.STRIPE_API_KEY;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/provider/stripe-provider.ts:164
*   apiKey: process.env.STRIPE_API_KEY,
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/ai-sdk/provider/stripe-provider.ts:189
const apiKey = config.apiKey || process.env.STRIPE_API_KEY;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/token-meter/examples/anthropic.ts:16
const STRIPE_API_KEY = process.env.STRIPE_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/token-meter/examples/anthropic.ts:18
const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/token-meter/examples/gemini.ts:16
const STRIPE_API_KEY = process.env.STRIPE_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/token-meter/examples/gemini.ts:18
const GOOGLE_GENERATIVE_AI_API_KEY = process.env.GOOGLE_GENERATIVE_AI_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/token-meter/examples/openai.ts:16
const STRIPE_API_KEY = process.env.STRIPE_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

llm/token-meter/examples/openai.ts:18
const OPENAI_API_KEY = process.env.OPENAI_API_KEY!;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

tools/modelcontextprotocol/src/cli.ts:38
const apiKey = options.apiKey || process.env.STRIPE_SECRET_KEY;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

tools/typescript/examples/ai-sdk/index.ts:8
secretKey: process.env.STRIPE_SECRET_KEY!,
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

tools/typescript/examples/langchain/index.ts:14
secretKey: process.env.STRIPE_SECRET_KEY!,
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

tools/typescript/examples/openai/index.ts:10
secretKey: process.env.STRIPE_SECRET_KEY!,
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tools/python/stripe_agent_toolkit/shared/mcp_client.py:195
result = await session.call_tool(name, final_args)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tools/typescript/examples/langchain/index.ts:36
const response = await agentExecutor.invoke({
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tools/typescript/src/langchain/toolkit.ts:29
this.description = description;
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/environment/server/server.js:29
app.get('/config', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/environment/server/server.js:35
app.get('/products', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/environment/server/server.js:46
app.post('/create-payment-intent', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/environment/server/server.js:75
app.post('/webhook', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/environment/server/server.js:24
app.get('/', (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/environment/server/server.js:29
app.get('/config', (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/environment/server/server.js:35
app.get('/products', (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/environment/server/server.js:46
app.post('/create-payment-intent', async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/environment/server/server.js:75
app.post('/webhook', async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

benchmarks/galtee-basic/environment/server/server.js:46
app.post('/create-payment-intent', async (req, res) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

benchmarks/galtee-basic/environment/server/server.js:75
app.post('/webhook', async (req, res) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:29
app.get('/', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:34
app.get('/config', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:40
app.get('/products', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:51
app.get('/customer/:email/bookings', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:96
app.get('/customer/:email/bookings/:product', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:143
app.post('/customer/:email/bookings/:product/refund', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:203
app.post('/purchase', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:301
app.post('/create-payment-intent', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:330
app.post('/webhook', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/solution/server.js:29
app.get('/', (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/solution/server.js:34
app.get('/config', (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/solution/server.js:40
app.get('/products', (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/solution/server.js:51
app.get('/customer/:email/bookings', (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/solution/server.js:96
app.get('/customer/:email/bookings/:product', (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/solution/server.js:143
app.post('/customer/:email/bookings/:product/refund', async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/solution/server.js:203
app.post('/purchase', async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/solution/server.js:301
app.post('/create-payment-intent', async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-basic/solution/server.js:330
app.post('/webhook', async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

benchmarks/galtee-basic/solution/server.js:143
app.post('/customer/:email/bookings/:product/refund', async (req, res) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

benchmarks/galtee-basic/solution/server.js:203
app.post('/purchase', async (req, res) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

benchmarks/galtee-basic/solution/server.js:301
app.post('/create-payment-intent', async (req, res) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

benchmarks/galtee-basic/solution/server.js:330
app.post('/webhook', async (req, res) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/environment/server/server.js:13
app.get("/config", (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/environment/server/server.js:19
app.get("/products", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/environment/server/server.js:31
app.post("/purchase", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-invoicing/environment/server/server.js:13
app.get("/config", (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-invoicing/environment/server/server.js:19
app.get("/products", async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-invoicing/environment/server/server.js:31
app.post("/purchase", async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

benchmarks/galtee-invoicing/environment/server/server.js:31
app.post("/purchase", async (req, res) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/solution/server.js:90
app.get("/products", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/solution/server.js:112
app.post("/purchase", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/solution/server.js:256
app.get("/customer/:email/bookings", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-invoicing/solution/server.js:90
app.get("/products", async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-invoicing/solution/server.js:112
app.post("/purchase", async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

benchmarks/galtee-invoicing/solution/server.js:256
app.get("/customer/:email/bookings", async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

benchmarks/galtee-invoicing/solution/server.js:112
app.post("/purchase", async (req, res) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

gemini-extension.json:7
"oauth": {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

llm/ai-sdk/provider/stripe-provider.ts:83
Authorization: `Bearer ${apiKey}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

llm/ai-sdk/provider/stripe-provider.ts:199
Authorization: `Bearer ${apiKey}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tools/modelcontextprotocol/src/cli.ts:77
Authorization: `Bearer ${options.apiKey}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tools/python/stripe_agent_toolkit/shared/mcp_client.py:83
"Authorization": f"Bearer {self._config['secret_key']}",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tools/typescript/examples/cloudflare/package.json:21
"@cloudflare/workers-oauth-provider": "^0.0.5",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

tools/typescript/examples/cloudflare/src/app.ts:25
app.get('/', async (c) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

tools/typescript/examples/cloudflare/src/app.ts:33
app.get('/authorize', async (c) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

tools/typescript/examples/cloudflare/src/app.ts:65
app.get('/payment/success', async (c) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

tools/typescript/examples/cloudflare/src/app.ts:77
app.post('/approve', async (c) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

tools/typescript/examples/cloudflare/src/app.ts:77
app.post('/approve', async (c) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tools/typescript/examples/cloudflare/src/index.ts:8
import {OAuthProvider} from '@cloudflare/workers-oauth-provider';
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tools/typescript/examples/cloudflare/src/index.ts:119
// Export the OAuth handler as the default
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

tools/typescript/examples/cloudflare/src/oauth.ts:25
app.get('/', async (c) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

tools/typescript/examples/cloudflare/src/oauth.ts:33
app.get('/authorize', async (c) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

tools/typescript/examples/cloudflare/src/oauth.ts:65
app.get('/payment/success', async (c) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

tools/typescript/examples/cloudflare/src/oauth.ts:77
app.post('/approve', async (c) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

tools/typescript/examples/cloudflare/src/oauth.ts:77
app.post('/approve', async (c) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tools/typescript/src/shared/mcp-client.ts:56
Authorization: `Bearer ${this.config.secretKey}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

benchmarks/galtee-basic/solution/server.js:368
app.listen(4242, () => console.log(`Node server listening at http://localhost:4242`));
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

benchmarks/galtee-invoicing/environment/server/server.js:44
app.listen(4242, () =>
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

benchmarks/galtee-invoicing/solution/server.js:292
app.listen(4242, () =>
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

benchmarks/galtee-basic/solution/server.js:61
return res.status(500).send({ error: { message: err.message } });
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

benchmarks/galtee-basic/solution/server.js:106
return res.status(500).send({ error: { message: err.message } });
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

benchmarks/galtee-basic/solution/server.js:110
return res.status(404).send({ error: { message: 'Booking not found' } });
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

benchmarks/galtee-basic/solution/server.js:152
return res.status(500).send({ error: { message: err.message } });
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

benchmarks/galtee-basic/solution/server.js:156
return res.status(404).send({ error: { message: 'Booking not found' } });
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

benchmarks/galtee-basic/solution/server.js:187
return res.status(500).send({ error: { message: err.message } });
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

benchmarks/galtee-basic/solution/server.js:189
res.send({ success: true, message: 'Booking refunded successfully' });
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

benchmarks/galtee-basic/solution/server.js:215
return res.status(500).send({ error: { message: err.message } });
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

benchmarks/galtee-basic/solution/server.js:266
return res.status(500).send({ error: { message: err.message } });
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

tools/modelcontextprotocol/src/index.ts:48
await stdioTransport.send(message);
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

tools/modelcontextprotocol/src/index.ts:83
await httpTransport!.send(message);
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

benchmarks/galtee-basic/solution/server.js:148
'SELECT * FROM bookings WHERE customer = ? AND product = ?',
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

benchmarks/galtee-basic/solution/server.js:213
db.get('SELECT * FROM products WHERE id = ?', [product], async (err, productRow) => {
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

benchmarks/galtee-invoicing/solution/server.js:265
SELECT * FROM bookings WHERE customer = ?
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

fs operations without path sanitization

medium

File system operations using variables without prior path validation or sanitization may allow traversal attacks.

skills/sync.js:56
await fs.mkdir(path.dirname(outputPath), { recursive: true });
How to fix

Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.

fs operations without path sanitization

medium

File system operations using variables without prior path validation or sanitization may allow traversal attacks.

skills/sync.js:57
await fs.writeFile(outputPath, content, "utf8");
How to fix

Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.