AI Fix Prompts for Waveguide Generator

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/ui/simulation/SimulationPanel.js
**Line**: 62
**Severity**: CRITICAL

**Current code around the issue:**
```
      57 | 
      58 |     this.setupEventListeners();
      59 |     this.setupMeshListener();
      60 |     this.setupSmoothingListener();
      61 |     this.setupKeyboardShortcuts();
>>>   62 |     this.setupSimulationParamBindings();
      63 |     this.checkSolverConnection();
      64 |     this.restoreJobs();
      65 |   }
      66 | 
      67 |   async restoreJobs() {
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/ui/paramPanel.js
**Line**: 113
**Severity**: CRITICAL

**Current code around the issue:**
```
     108 | 
     109 |   // Create the full UI structure
     110 |   createFullPanel() {
     111 |     this.container.innerHTML = "";
     112 |     if (this.simulationSettingsContainer) {
>>>  113 |       this.simulationSettingsContainer.innerHTML = "";
     114 |     }
     115 |     if (this.simulationContainer) {
     116 |       this.simulationContainer.innerHTML = "";
     117 |     }
     118 |     this.controlIdCounter = 0;
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/ui/paramPanel.js
**Line**: 131
**Severity**: CRITICAL

**Current code around the issue:**
```
     126 |       {
     127 |         includeOwners: ["paramPanel"],
     128 |       },
     129 |     );
     130 | 
>>>  131 |     if (this.simulationSettingsContainer) {
     132 |       this.renderSections(
     133 |         this.simulationSettingsContainer,
     134 |         getParameterSections("simulation", type),
     135 |         state.params,
     136 |         {
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/ui/paramPanel.js
**Line**: 133
**Severity**: CRITICAL

**Current code around the issue:**
```
     128 |       },
     129 |     );
     130 | 
     131 |     if (this.simulationSettingsContainer) {
     132 |       this.renderSections(
>>>  133 |         this.simulationSettingsContainer,
     134 |         getParameterSections("simulation", type),
     135 |         state.params,
     136 |         {
     137 |           includeIds: ["frequency-sweep"],
     138 |         },
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/ui/paramPanel.js
**Line**: 369
**Severity**: CRITICAL

**Current code around the issue:**
```
     364 |   }
     365 | 
     366 |   showFormulaInfo(fieldLabel = null) {
     367 |     let infoPanel = document.getElementById("formula-info-panel");
     368 |     if (infoPanel) {
>>>  369 |       this.updateFormulaInfoContext(infoPanel, fieldLabel);
     370 |       infoPanel.classList.add("visible");
     371 |       this._formulaInfoReleaseFocus = trapFocus(infoPanel, {
     372 |         initialFocus: infoPanel.querySelector(".formula-info-close"),
     373 |       });
     374 |       return;
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/ui/paramPanel.js
**Line**: 456
**Severity**: CRITICAL

**Current code around the issue:**
```
     451 |     };
     452 | 
     453 |     closeBtn.onclick = closePanel;
     454 |     infoPanel.addEventListener("keydown", escapeHandler);
     455 | 
>>>  456 |     this.updateFormulaInfoContext(infoPanel, fieldLabel);
     457 |     document.body.appendChild(infoPanel);
     458 |     this._formulaInfoReleaseFocus = trapFocus(infoPanel, {
     459 |       initialFocus: closeBtn,
     460 |     });
     461 |   }
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/app/events.js
**Line**: 146
**Severity**: CRITICAL

**Current code around the issue:**
```
     141 |           ImportedMeshState.vertices = result.vertices;
     142 |           ImportedMeshState.indices = result.indices;
     143 |           ImportedMeshState.physicalTags = result.physicalTags;
     144 |           ImportedMeshState.physicalNames = result.physicalNames;
     145 |           appUiFileOps.setExportFields(
>>>  146 |             appUiFileOps.deriveExportFieldsFromFileName(file.name),
     147 |           );
     148 |           const banner = document.getElementById("imported-mesh-banner");
     149 |           const filenameSpan = document.getElementById(
     150 |             "imported-mesh-filename",
     151 |           );
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/geometry/engine/buildWaveguideMesh.js
**Line**: 168
**Severity**: CRITICAL

**Current code around the issue:**
```
     163 |     console.error(`[Geometry] Invalid mesh generated: max index ${maxIndex} >= vertex count ${vertexCount}`);
     164 |   }
     165 | 
     166 |   if (
     167 |     hasEnclosure
>>>  168 |     || options.useLegacyOrientationRepair === true
     169 |     || meshParams.useLegacyOrientationRepair === true
     170 |   ) {
     171 |     orientMeshConsistently(vertices, indices, {
     172 |       preferOutward: fullCircle
     173 |     });
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/geometry/engine/buildWaveguideMesh.js
**Line**: 169
**Severity**: CRITICAL

**Current code around the issue:**
```
     164 |   }
     165 | 
     166 |   if (
     167 |     hasEnclosure
     168 |     || options.useLegacyOrientationRepair === true
>>>  169 |     || meshParams.useLegacyOrientationRepair === true
     170 |   ) {
     171 |     orientMeshConsistently(vertices, indices, {
     172 |       preferOutward: fullCircle
     173 |     });
     174 |   }
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/modules/ui/index.js
**Line**: 161
**Severity**: CRITICAL

**Current code around the issue:**
```
     156 |     showCommandSuggestion(options = {}) {
     157 |       return feedback.showCommandSuggestion?.(options);
     158 |     },
     159 | 
     160 |     deriveExportFieldsFromFileName(fileName, options = {}) {
>>>  161 |       return fileOps.deriveExportFieldsFromFileName?.(fileName, options);
     162 |     },
     163 | 
     164 |     setExportFields(fields = {}, doc) {
     165 |       return fileOps.setExportFields?.(fields, doc);
     166 |     },
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/modules/ui/index.js
**Line**: 169
**Severity**: CRITICAL

**Current code around the issue:**
```
     164 |     setExportFields(fields = {}, doc) {
     165 |       return fileOps.setExportFields?.(fields, doc);
     166 |     },
     167 | 
     168 |     resetParameterChangeTracking(options = {}) {
>>>  169 |       return fileOps.resetParameterChangeTracking?.(options);
     170 |     },
     171 | 
     172 |     chooseOutputFolder() {
     173 |       return fileOps.selectOutputFolder?.();
     174 |     },
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/ui/paramPanel.js
**Line**: 79
**Severity**: CRITICAL

**Current code around the issue:**
```
      74 | 
      75 | export class ParamPanel {
      76 |   constructor(containerId) {
      77 |     this.container = document.getElementById(containerId);
      78 |     if (!this.container) throw new Error(`Container ${containerId} not found`);
>>>   79 |     this.simulationSettingsContainer = document.getElementById(
      80 |       "simulation-settings-container",
      81 |     );
      82 |     this.simulationContainer = document.getElementById(
      83 |       "simulation-param-container",
      84 |     );
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: src/ui/paramPanel.js
**Line**: 112
**Severity**: CRITICAL

**Current code around the issue:**
```
     107 |   }
     108 | 
     109 |   // Create the full UI structure
     110 |   createFullPanel() {
     111 |     this.container.innerHTML = "";
>>>  112 |     if (this.simulationSettingsContainer) {
     113 |       this.simulationSettingsContainer.innerHTML = "";
     114 |     }
     115 |     if (this.simulationContainer) {
     116 |       this.simulationContainer.innerHTML = "";
     117 |     }
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: src/app/exports.js
**Line**: 80
**Severity**: HIGH

**Current code around the issue:**
```
      75 |     console.log('');
      76 |     console.log('Test 2: Root endpoint check');
      77 |     console.log('  URL:', `${backendUrl}/`);
      78 |     try {
      79 |       const start = performance.now();
>>>   80 |       const res = await fetch(`${backendUrl}/`);
      81 |       const elapsed = (performance.now() - start).toFixed(0);
      82 |       console.log(`  OK: HTTP ${res.status} (${elapsed}ms)`);
      83 |       console.log('  Data:', await res.json());
      84 |     } catch (error) {
      85 |       console.error('  Failed:', error.name, '-', error.message);
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: src/app/exports.js
**Line**: 106
**Severity**: HIGH

**Current code around the issue:**
```
     101 |           lengthSegments: 20
     102 |         },
     103 |         mshVersion: '2.2'
     104 |       };
     105 |       const start = performance.now();
>>>  106 |       const res = await fetch(`${backendUrl}/api/mesh/build`, {
     107 |         method: 'POST',
     108 |         headers: { 'Content-Type': 'application/json' },
     109 |         body: JSON.stringify(testPayload)
     110 |       });
     111 |       const elapsed = (performance.now() - start).toFixed(0);
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: src/app/exports.js
**Line**: 67
**Severity**: HIGH

**Current code around the issue:**
```
      62 | 
      63 |     console.log('Test 1: Health endpoint check');
      64 |     console.log('  URL:', `${backendUrl}/health`);
      65 |     try {
      66 |       const start = performance.now();
>>>   67 |       const res = await fetch(`${backendUrl}/health`);
      68 |       const elapsed = (performance.now() - start).toFixed(0);
      69 |       console.log(`  OK: HTTP ${res.status} (${elapsed}ms)`);
      70 |       console.log('  Data:', await res.json());
      71 |     } catch (error) {
      72 |       console.error('  Failed:', error.name, '-', error.message);
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded sast found ([sast:aljefra/taint-path-traversal] Path Traversal via Tainted Data)
**File**: server/services/solve_readiness.py
**Line**: 24
**Severity**: HIGH

**Current code around the issue:**
```
      19 | 
      20 | 
      21 | def resolve_readiness_record_path() -> Path:
      22 |     raw = str(os.environ.get("WG_BOUNDED_SOLVE_RECORD_PATH") or "").strip()
      23 |     if raw:
>>>   24 |         return Path(raw).expanduser().resolve()
      25 |     return _default_readiness_record_path()
      26 | 
      27 | 
      28 | def _current_host_fingerprint() -> Dict[str, str]:
      29 |     return {
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'm3gnus__waveguide-generator'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: src/app/updates.js
**Line**: 32
**Severity**: HIGH

**Current code around the issue:**
```
      27 |     button.disabled = true;
      28 |     button.textContent = 'Checking...';
      29 |   }
      30 | 
      31 |   try {
>>>   32 |     const response = await fetch(`${DEFAULT_BACKEND_URL}/api/updates/check`);
      33 |     let payload = null;
      34 | 
      35 |     try {
      36 |       payload = await response.json();
      37 |     } catch {
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Address OWASP A02 (Cryptographic Failures) compliance gap in 'm3gnus__waveguide-generator'.

**OWASP Category**: A02 -- Cryptographic Failures
**Fix guidance**: Remove hardcoded secrets, use strong encryption (AES-256-GCM), enforce TLS, never store passwords in plaintext (use bcrypt/argon2).

**Steps:**
1. Identify all code paths related to cryptographic failures
2. Apply the fixes described above
3. Add automated tests to verify the fix
4. Document any security assumptions in code comments

Address OWASP A07 (Auth Failures) compliance gap in 'm3gnus__waveguide-generator'.

**OWASP Category**: A07 -- Auth Failures
**Fix guidance**: Implement proper session management, use MFA where possible, enforce strong passwords, protect against brute force.

**Steps:**
1. Identify all code paths related to auth failures
2. Apply the fixes described above
3. Add automated tests to verify the fix
4. Document any security assumptions in code comments

Repository 'm3gnus__waveguide-generator' is failing the quality gate.

Failed conditions:
- overall_score: actual 0.0 >= 50 (FAILED)
- security_score: actual 0.0 >= 40 (FAILED)
- critical_credentials: actual 13.0 <= 0 (FAILED)

Fix each failing condition to make the repo pass the quality gate.

Repository 'm3gnus__waveguide-generator' has 10 open issues:

- [CRITICAL] Hard-coded api_key: Vault Token (src/ui/simulation/SimulationPanel.js)
- [CRITICAL] Hard-coded api_key: Vault Token (src/ui/paramPanel.js)
- [CRITICAL] Hard-coded api_key: Vault Token (src/ui/paramPanel.js)
- [CRITICAL] Hard-coded api_key: Vault Token (src/ui/paramPanel.js)
- [CRITICAL] Hard-coded api_key: Vault Token (src/ui/paramPanel.js)
- [CRITICAL] Hard-coded api_key: Vault Token (src/ui/paramPanel.js)
- [CRITICAL] Hard-coded api_key: Vault Token (src/app/events.js)
- [CRITICAL] Hard-coded api_key: Vault Token (src/geometry/engine/buildWaveguideMesh.js)
- [CRITICAL] Hard-coded api_key: Vault Token (src/geometry/engine/buildWaveguideMesh.js)
- [CRITICAL] Hard-coded api_key: Vault Token (src/modules/ui/index.js)

Resolve each issue. For security issues, apply the appropriate fix. For quality issues, refactor the affected code.

Static analysis found 5 security issues in 'm3gnus__waveguide-generator':

- [HIGH] [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL at src/app/exports.js:67
- [HIGH] [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL at src/app/exports.js:80
- [HIGH] [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL at src/app/exports.js:106
- [HIGH] [sast:aljefra/taint-path-traversal] Path Traversal via Tainted Data at server/services/solve_readiness.py:24
- [HIGH] [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL at src/app/updates.js:32

For each finding:
- SQL injection: use parameterized queries
- Command injection: use subprocess with list args, no shell=True
- Path traversal: validate and sanitize paths
- Insecure deserialization: use json instead of pickle
- IaC misconfigs: apply the suggested fix from the rule