AI Fix Prompts for Freecell Online

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 1806
**Severity**: CRITICAL

**Current code around the issue:**
```
    1801 | 
    1802 |     // Show selection glow
    1803 |     this.showSelectionGlow(sprite);
    1804 | 
    1805 |     // Highlight valid destinations so user knows where to tap
>>> 1806 |     this.showDestinationHighlights(destinations);
    1807 | 
    1808 |     // Audio + haptic feedback on select
    1809 |     soundManager.cardSelect();
    1810 |     this.vibrate();
    1811 |   }
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 1368
**Severity**: CRITICAL

**Current code around the issue:**
```
    1363 |     const topSlot = this.getTopRowSlotAtPoint(x, y);
    1364 |     if (topSlot) {
    1365 |       if (this.selectedCard) {
    1366 |         this.handleTopRowPlacement(topSlot);
    1367 |       } else if (topSlot.type === 'freecell') {
>>> 1368 |         this.handleFreeCellTouchSelect(topSlot.index);
    1369 |       }
    1370 |       return;
    1371 |     }
    1372 | 
    1373 |     // Check cascades
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 1607
**Severity**: CRITICAL

**Current code around the issue:**
```
    1602 |     } else {
    1603 |       this.dragCards = [];
    1604 |       this.clearSelection();
    1605 |       // If tapped a free cell with a card, select it
    1606 |       if (slot.type === 'freecell') {
>>> 1607 |         this.handleFreeCellTouchSelect(slot.index);
    1608 |       }
    1609 |     }
    1610 |   }
    1611 | 
    1612 |   private handleFreeCellTouchSelect(index: number): void {
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 199
**Severity**: CRITICAL

**Current code around the issue:**
```
     194 |       this.repositionAllCards(false);
     195 |     };
     196 |     this.scale.on('resize', this.scaleResizeHandler, this);
     197 | 
     198 |     // Force resize on orientation change (Phaser doesn't always catch it)
>>>  199 |     this.orientationChangeHandler = () => {
     200 |       // Delay to let browser finish viewport animation (address bar, etc.)
     201 |       setTimeout(() => {
     202 |         const parent = this.scale.parent as HTMLElement;
     203 |         if (parent) {
     204 |           this.scale.resize(parent.clientWidth, parent.clientHeight);
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 215
**Severity**: CRITICAL

**Current code around the issue:**
```
     210 |         if (parent) {
     211 |           this.scale.resize(parent.clientWidth, parent.clientHeight);
     212 |         }
     213 |       }, 500);
     214 |     };
>>>  215 |     this.trackDomListener(window, 'orientationchange', this.orientationChangeHandler);
     216 |     // Also listen to resize as backup (some browsers fire resize instead)
     217 |     this.windowResizeHandler = () => {
     218 |       if (this.resizeTimeout) {
     219 |         clearTimeout(this.resizeTimeout);
     220 |       }
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 222
**Severity**: CRITICAL

**Current code around the issue:**
```
     217 |     this.windowResizeHandler = () => {
     218 |       if (this.resizeTimeout) {
     219 |         clearTimeout(this.resizeTimeout);
     220 |       }
     221 |       this.resizeTimeout = setTimeout(() => {
>>>  222 |         this.orientationChangeHandler?.();
     223 |       }, 150);
     224 |     };
     225 |     this.trackDomListener(window, 'resize', this.windowResizeHandler);
     226 | 
     227 |     // Listen for bridge events
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 331
**Severity**: CRITICAL

**Current code around the issue:**
```
     326 |       this.updateDraggedCards(this.activeDragTarget, 300, 28, dt, true);
     327 |       return;
     328 |     }
     329 | 
     330 |     if (this.isSettlingDrag && this.settleTargets.length === this.activeDragCards.length) {
>>>  331 |       const settled = this.updateDraggedCardsToTargets(this.settleTargets, 180, 22, dt);
     332 |       if (settled) {
     333 |         this.finishSettledDrag();
     334 |       }
     335 |     }
     336 |   }
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 364
**Severity**: CRITICAL

**Current code around the issue:**
```
     359 |     for (const { target, type, listener, options } of this.trackedDomListeners) {
     360 |       target.removeEventListener(type, listener, options as EventListenerOptions | boolean | undefined);
     361 |     }
     362 |     this.trackedDomListeners = [];
     363 | 
>>>  364 |     this.orientationChangeHandler = null;
     365 |     this.windowResizeHandler = null;
     366 |     this.clearActiveDragState(true);
     367 |   }
     368 | 
     369 |   private trackDomListener(
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 433
**Severity**: CRITICAL

**Current code around the issue:**
```
     428 |     const targetY = rawTarget.y - this.activeDragOffsets.y;
     429 |     const targets = this.activeDragCards.map((_, i) => ({
     430 |       x: targetX,
     431 |       y: targetY + i * overlap,
     432 |     }));
>>>  433 |     this.updateDraggedCardsToTargets(targets, stiffness, damping, dt, trackRotation);
     434 |   }
     435 | 
     436 |   private updateDraggedCardsToTargets(
     437 |     targets: Array<{ x: number; y: number }>,
     438 |     stiffness: number,
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 465
**Severity**: CRITICAL

**Current code around the issue:**
```
     460 |       velocity.y = yUpdate.velocity;
     461 | 
     462 |       const angleTarget = trackRotation
     463 |         ? Phaser.Math.Clamp(xUpdate.velocity * 0.04, -8, 8)
     464 |         : 0;
>>>  465 |       const angleVelocity = this.activeDragAngleVelocities[i] ?? 0;
     466 |       const angleUpdate = this.springUpdate(card.angle, angleTarget, angleVelocity, stiffness, damping, 1, dt);
     467 |       card.angle = angleUpdate.position;
     468 |       this.activeDragAngleVelocities[i] = angleUpdate.velocity;
     469 | 
     470 |       if (
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 468
**Severity**: CRITICAL

**Current code around the issue:**
```
     463 |         ? Phaser.Math.Clamp(xUpdate.velocity * 0.04, -8, 8)
     464 |         : 0;
     465 |       const angleVelocity = this.activeDragAngleVelocities[i] ?? 0;
     466 |       const angleUpdate = this.springUpdate(card.angle, angleTarget, angleVelocity, stiffness, damping, 1, dt);
     467 |       card.angle = angleUpdate.position;
>>>  468 |       this.activeDragAngleVelocities[i] = angleUpdate.velocity;
     469 | 
     470 |       if (
     471 |         Math.abs(card.x - target.x) > 0.6 ||
     472 |         Math.abs(card.y - target.y) > 0.6 ||
     473 |         Math.abs(velocity.x) > 8 ||
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 476
**Severity**: CRITICAL

**Current code around the issue:**
```
     471 |         Math.abs(card.x - target.x) > 0.6 ||
     472 |         Math.abs(card.y - target.y) > 0.6 ||
     473 |         Math.abs(velocity.x) > 8 ||
     474 |         Math.abs(velocity.y) > 8 ||
     475 |         Math.abs(card.angle - angleTarget) > 0.4 ||
>>>  476 |         Math.abs(this.activeDragAngleVelocities[i]) > 6
     477 |       ) {
     478 |         allSettled = false;
     479 |       }
     480 |     }
     481 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 522
**Severity**: CRITICAL

**Current code around the issue:**
```
     517 |     this.activeDragCards = [];
     518 |     this.activeDragFrom = null;
     519 |     this.activeDragTarget = null;
     520 |     this.activeDragOffsets = { x: 0, y: 0 };
     521 |     this.activeDragVelocities = [];
>>>  522 |     this.activeDragAngleVelocities = [];
     523 |     this.settleTargets = [];
     524 |     this.pendingSettledMove = null;
     525 |     this.isDragging = false;
     526 |     this.isSettlingDrag = false;
     527 |     this.dragSource = null;
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 1006
**Severity**: CRITICAL

**Current code around the issue:**
```
    1001 |       for (let i = cardIndex; i < cascade.length; i++) {
    1002 |         const sprite = this.cardSprites.get(cascade[i].id);
    1003 |         if (sprite) {
    1004 |           this.activeDragCards.push(sprite);
    1005 |           this.activeDragVelocities.push({ x: 0, y: 0 });
>>> 1006 |           this.activeDragAngleVelocities.push(0);
    1007 |           sprite.setDepth(1000 + (i - cardIndex));
    1008 |           sprite.setScale(1.08); // Lift effect
    1009 |         }
    1010 |       }
    1011 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 1054
**Severity**: CRITICAL

**Current code around the issue:**
```
    1049 |         const sprite = this.cardSprites.get(card.id);
    1050 |         if (sprite) {
    1051 |           this.clearActiveDragState(true);
    1052 |           this.activeDragCards = [sprite];
    1053 |           this.activeDragVelocities = [{ x: 0, y: 0 }];
>>> 1054 |           this.activeDragAngleVelocities = [0];
    1055 |           sprite.setDepth(1000);
    1056 |           sprite.setScale(1.08);
    1057 |           this.activeDragOffsets = { x: x - sprite.x, y: y - sprite.y };
    1058 |           this.activeDragFrom = { type: 'freecell', index: topSlot.index };
    1059 |           this.activeDragTarget = { x, y };
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 1254
**Severity**: CRITICAL

**Current code around the issue:**
```
    1249 |       for (let i = cardIndex; i < cascade.length; i++) {
    1250 |         const sprite = this.cardSprites.get(cascade[i].id);
    1251 |         if (sprite) {
    1252 |           this.activeDragCards.push(sprite);
    1253 |           this.activeDragVelocities.push({ x: 0, y: 0 });
>>> 1254 |           this.activeDragAngleVelocities.push(0);
    1255 |           sprite.setDepth(1000 + (i - cardIndex));
    1256 |         }
    1257 |       }
    1258 | 
    1259 |       if (this.activeDragCards.length > 0) {
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/game/FreeCellScene.ts
**Line**: 1285
**Severity**: CRITICAL

**Current code around the issue:**
```
    1280 |         const sprite = this.cardSprites.get(card.id);
    1281 |         if (sprite) {
    1282 |           this.clearActiveDragState(true);
    1283 |           this.activeDragCards = [sprite];
    1284 |           this.activeDragVelocities = [{ x: 0, y: 0 }];
>>> 1285 |           this.activeDragAngleVelocities = [0];
    1286 |           sprite.setDepth(1000);
    1287 |           this.activeDragOffsets = { x: x - sprite.x, y: y - sprite.y };
    1288 |           this.activeDragFrom = { type: 'freecell', index: topSlot.index };
    1289 |           this.activeDragTarget = { x, y };
    1290 |           if (!this.timer.isRunning) this.timer.start();
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: public/sw.js
**Line**: 63
**Severity**: HIGH

**Current code around the issue:**
```
      58 |     return;
      59 |   }
      60 | 
      61 |   // Everything else: network-first
      62 |   event.respondWith(
>>>   63 |     fetch(request)
      64 |       .then((response) => {
      65 |         if (response.ok) {
      66 |           const clone = response.clone();
      67 |           caches.open(CACHE_NAME).then((cache) => cache.put(request, clone));
      68 |         }
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'jonnydigital__freecell-online'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: public/sw.js
**Line**: 49
**Severity**: HIGH

**Current code around the issue:**
```
      44 |   // Card images: cache-first (large, rarely change)
      45 |   if (url.pathname.startsWith('/cards/')) {
      46 |     event.respondWith(
      47 |       caches.match(request).then((cached) => {
      48 |         if (cached) return cached;
>>>   49 |         return fetch(request).then((response) => {
      50 |           if (response.ok) {
      51 |             const clone = response.clone();
      52 |             caches.open(CACHE_NAME).then((cache) => cache.put(request, clone));
      53 |           }
      54 |           return response;
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Address OWASP A02 (Cryptographic Failures) compliance gap in 'jonnydigital__freecell-online'.

**OWASP Category**: A02 -- Cryptographic Failures
**Fix guidance**: Remove hardcoded secrets, use strong encryption (AES-256-GCM), enforce TLS, never store passwords in plaintext (use bcrypt/argon2).

**Steps:**
1. Identify all code paths related to cryptographic failures
2. Apply the fixes described above
3. Add automated tests to verify the fix
4. Document any security assumptions in code comments

Address OWASP A06 (Vulnerable Components) compliance gap in 'jonnydigital__freecell-online'.

**OWASP Category**: A06 -- Vulnerable Components
**Fix guidance**: Update all dependencies to latest stable versions, remove unused dependencies, monitor for new CVEs.

**Steps:**
1. Identify all code paths related to vulnerable components
2. Apply the fixes described above
3. Add automated tests to verify the fix
4. Document any security assumptions in code comments

Address OWASP A07 (Auth Failures) compliance gap in 'jonnydigital__freecell-online'.

**OWASP Category**: A07 -- Auth Failures
**Fix guidance**: Implement proper session management, use MFA where possible, enforce strong passwords, protect against brute force.

**Steps:**
1. Identify all code paths related to auth failures
2. Apply the fixes described above
3. Add automated tests to verify the fix
4. Document any security assumptions in code comments

Repository 'jonnydigital__freecell-online' is failing the quality gate.

Failed conditions:
- overall_score: actual 0.0 >= 50 (FAILED)
- security_score: actual 0.0 >= 40 (FAILED)
- critical_credentials: actual 17.0 <= 0 (FAILED)

Fix each failing condition to make the repo pass the quality gate.

Repository 'jonnydigital__freecell-online' has 10 open issues:

- [CRITICAL] Hard-coded api_key: Vault Token (src/game/FreeCellScene.ts)
- [CRITICAL] Hard-coded api_key: Vault Token (src/game/FreeCellScene.ts)
- [CRITICAL] Hard-coded api_key: Vault Token (src/game/FreeCellScene.ts)
- [CRITICAL] Hard-coded api_key: Vault Token (src/game/FreeCellScene.ts)
- [CRITICAL] Hard-coded api_key: Vault Token (src/game/FreeCellScene.ts)
- [CRITICAL] Hard-coded api_key: Vault Token (src/game/FreeCellScene.ts)
- [CRITICAL] Hard-coded api_key: Vault Token (src/game/FreeCellScene.ts)
- [CRITICAL] Hard-coded api_key: Vault Token (src/game/FreeCellScene.ts)
- [CRITICAL] Hard-coded api_key: Vault Token (src/game/FreeCellScene.ts)
- [CRITICAL] Hard-coded api_key: Vault Token (src/game/FreeCellScene.ts)

Resolve each issue. For security issues, apply the appropriate fix. For quality issues, refactor the affected code.

Static analysis found 2 security issues in 'jonnydigital__freecell-online':

- [HIGH] [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL at public/sw.js:49
- [HIGH] [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL at public/sw.js:63

For each finding:
- SQL injection: use parameterized queries
- Command injection: use subprocess with list args, no shell=True
- Path traversal: validate and sanitize paths
- Insecure deserialization: use json instead of pickle
- IaC misconfigs: apply the suggested fix from the rule