AI Fix Prompts for Nix Fleet

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-requests] SSRF via HTTP Client with Variable URL)
**File**: agents/lib/gh-manifest-server.py
**Line**: 67
**Severity**: HIGH

**Current code around the issue:**
```
      62 |                     headers={
      63 |                         "Accept": "application/vnd.github+json",
      64 |                     },
      65 |                     data=b"",
      66 |                 )
>>>   67 |                 resp = urllib.request.urlopen(req)
      68 |                 data = json.loads(resp.read())
      69 |             except Exception as e:
      70 |                 self.send_response(500)
      71 |                 self.end_headers()
      72 |                 self.wfile.write(f"Error exchanging code: {e}".encode())
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/taint-path-traversal] Path Traversal via Tainted Data)
**File**: agents/lib/gh-manifest-server.py
**Line**: 88
**Severity**: HIGH

**Current code around the issue:**
```
      83 |                 "webhook_secret": data.get("webhook_secret", ""),
      84 |                 "owner": data.get("owner", {}).get("login", ""),
      85 |                 "html_url": data.get("html_url", ""),
      86 |             }
      87 | 
>>>   88 |             with open(OUTPUT_FILE, "w") as f:
      89 |                 json.dump(result, f, indent=2)
      90 | 
      91 |             self.send_response(200)
      92 |             self.send_header("Content-Type", "text/html")
      93 |             self.end_headers()
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 23
**Severity**: HIGH

**Current code around the issue:**
```
      18 | // Load hosts list
      19 | async function loadHosts() {
      20 |   const grid = document.getElementById("hosts-grid");
      21 | 
      22 |   try {
>>>   23 |     const response = await fetch(`${API_BASE}/hosts`);
      24 |     if (!response.ok) throw new Error("Failed to fetch hosts");
      25 | 
      26 |     const data = await response.json();
      27 |     const hosts = data.hosts || [];
      28 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 37
**Severity**: HIGH

**Current code around the issue:**
```
      32 |     let healthy = 0,
      33 |       drifted = 0,
      34 |       pullMode = 0;
      35 | 
      36 |     // Render host cards
>>>   37 |     grid.innerHTML = hosts
      38 |       .map((host) => {
      39 |         const status = getHostStatus(host);
      40 |         if (status === "healthy") healthy++;
      41 |         if (status === "drifted") drifted++;
      42 |         if (host.pull_mode) pullMode++;
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 53
**Severity**: HIGH

**Current code around the issue:**
```
      48 |     document.getElementById("healthy-hosts").textContent = healthy;
      49 |     document.getElementById("drifted-hosts").textContent = drifted;
      50 |     document.getElementById("pull-mode-hosts").textContent = pullMode;
      51 | 
      52 |     if (hosts.length === 0) {
>>>   53 |       grid.innerHTML = '<div class="loading">No hosts configured</div>';
      54 |     }
      55 |   } catch (error) {
      56 |     console.error("Error loading hosts:", error);
      57 |     grid.innerHTML = `<div class="loading">Error loading hosts: ${error.message}</div>`;
      58 |   }
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 57
**Severity**: HIGH

**Current code around the issue:**
```
      52 |     if (hosts.length === 0) {
      53 |       grid.innerHTML = '<div class="loading">No hosts configured</div>';
      54 |     }
      55 |   } catch (error) {
      56 |     console.error("Error loading hosts:", error);
>>>   57 |     grid.innerHTML = `<div class="loading">Error loading hosts: ${error.message}</div>`;
      58 |   }
      59 | }
      60 | 
      61 | // Determine host status
      62 | function getHostStatus(host) {
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 142
**Severity**: HIGH

**Current code around the issue:**
```
     137 |   if (!confirm(`Apply configuration to ${hostName}?`)) return;
     138 | 
     139 |   addActivity(`Triggering apply on ${hostName}...`);
     140 | 
     141 |   try {
>>>  142 |     const response = await fetch(`${API_BASE}/hosts/${hostName}/apply`, {
     143 |       method: "POST",
     144 |     });
     145 | 
     146 |     if (!response.ok) throw new Error("Apply failed");
     147 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 163
**Severity**: HIGH

**Current code around the issue:**
```
     158 | // Check drift on a host
     159 | async function checkDrift(hostName) {
     160 |   addActivity(`Checking drift on ${hostName}...`);
     161 | 
     162 |   try {
>>>  163 |     const response = await fetch(`${API_BASE}/drift/check?host=${hostName}`, {
     164 |       method: "POST",
     165 |     });
     166 | 
     167 |     if (!response.ok) throw new Error("Drift check failed");
     168 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 184
**Severity**: HIGH

**Current code around the issue:**
```
     179 | // Check drift on all hosts
     180 | async function checkAllDrift() {
     181 |   addActivity("Checking drift on all hosts...");
     182 | 
     183 |   try {
>>>  184 |     const response = await fetch(`${API_BASE}/drift/check`, {
     185 |       method: "POST",
     186 |     });
     187 | 
     188 |     if (!response.ok) throw new Error("Drift check failed");
     189 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 202
**Severity**: HIGH

**Current code around the issue:**
```
     197 | // Trigger pull on a host
     198 | async function triggerPull(hostName) {
     199 |   addActivity(`Triggering pull on ${hostName}...`);
     200 | 
     201 |   try {
>>>  202 |     const response = await fetch(`${API_BASE}/pull-mode/${hostName}/trigger`, {
     203 |       method: "POST",
     204 |     });
     205 | 
     206 |     if (!response.ok) throw new Error("Pull trigger failed");
     207 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 227
**Severity**: HIGH

**Current code around the issue:**
```
     222 |   const modal = document.getElementById("modal");
     223 |   const title = document.getElementById("modal-title");
     224 |   const body = document.getElementById("modal-body");
     225 | 
     226 |   title.textContent = `Host: ${hostName}`;
>>>  227 |   body.innerHTML = '<div class="loading">Loading details...</div>';
     228 |   modal.classList.remove("hidden");
     229 | 
     230 |   try {
     231 |     // Fetch host details and OS info in parallel
     232 |     const [hostResponse, osInfoResponse] = await Promise.all([
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 233
**Severity**: HIGH

**Current code around the issue:**
```
     228 |   modal.classList.remove("hidden");
     229 | 
     230 |   try {
     231 |     // Fetch host details and OS info in parallel
     232 |     const [hostResponse, osInfoResponse] = await Promise.all([
>>>  233 |       fetch(`${API_BASE}/hosts/${hostName}`),
     234 |       fetch(`${API_BASE}/hosts/${hostName}/os-info`),
     235 |     ]);
     236 | 
     237 |     if (!hostResponse.ok) throw new Error("Failed to fetch details");
     238 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 234
**Severity**: HIGH

**Current code around the issue:**
```
     229 | 
     230 |   try {
     231 |     // Fetch host details and OS info in parallel
     232 |     const [hostResponse, osInfoResponse] = await Promise.all([
     233 |       fetch(`${API_BASE}/hosts/${hostName}`),
>>>  234 |       fetch(`${API_BASE}/hosts/${hostName}/os-info`),
     235 |     ]);
     236 | 
     237 |     if (!hostResponse.ok) throw new Error("Failed to fetch details");
     238 | 
     239 |     const host = await hostResponse.json();
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 368
**Severity**: HIGH

**Current code around the issue:**
```
     363 |             }
     364 |             ${aptActionsHtml}
     365 |             ${host.state && Object.keys(host.state).length > 0 ? `<h4 style="margin-top: 1.5rem; margin-bottom: 0.5rem;">State</h4><pre>${JSON.stringify(host.state, null, 2)}</pre>` : ""}
     366 |         `;
     367 |   } catch (error) {
>>>  368 |     body.innerHTML = `<div class="loading">Error: ${error.message}</div>`;
     369 |   }
     370 | }
     371 | 
     372 | // APT package management functions
     373 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 383
**Severity**: HIGH

**Current code around the issue:**
```
     378 |       '<span style="color: var(--accent-blue);">Checking for updates...</span>';
     379 |   }
     380 |   addActivity(`Checking updates on ${hostName}...`);
     381 | 
     382 |   try {
>>>  383 |     const response = await fetch(`${API_BASE}/hosts/${hostName}/apt/updates`);
     384 |     if (!response.ok) throw new Error("Failed to check updates");
     385 | 
     386 |     const status = await response.json();
     387 | 
     388 |     if (statusDiv) {
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 429
**Severity**: HIGH

**Current code around the issue:**
```
     424 |     addActivity(
     425 |       `${hostName}: ${status.pending_updates} updates (${status.security_updates} security)`,
     426 |     );
     427 |   } catch (error) {
     428 |     if (statusDiv) {
>>>  429 |       statusDiv.innerHTML = `<span style="color: var(--accent-red);">Error: ${error.message}</span>`;
     430 |     }
     431 |     addActivity(
     432 |       `Failed to check updates on ${hostName}: ${error.message}`,
     433 |       "error",
     434 |     );
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 445
**Severity**: HIGH

**Current code around the issue:**
```
     440 |   if (!confirm(`Run ${action} on ${hostName}? This may take several minutes.`))
     441 |     return;
     442 | 
     443 |   const statusDiv = document.getElementById(`apt-status-${hostName}`);
     444 |   if (statusDiv) {
>>>  445 |     statusDiv.innerHTML = `<span style="color: var(--accent-blue);">Running ${action}...</span>`;
     446 |   }
     447 |   addActivity(`Running ${action} on ${hostName}...`);
     448 | 
     449 |   try {
     450 |     const response = await fetch(
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 460
**Severity**: HIGH

**Current code around the issue:**
```
     455 | 
     456 |     const result = await response.json();
     457 | 
     458 |     if (statusDiv) {
     459 |       if (result.success) {
>>>  460 |         statusDiv.innerHTML = `<span style="color: var(--accent-green);">Upgrade complete! ${result.upgraded_packages?.length || 0} packages upgraded.</span>`;
     461 |       } else {
     462 |         statusDiv.innerHTML = `<span style="color: var(--accent-red);">Upgrade failed: ${result.error}</span>`;
     463 |       }
     464 |     }
     465 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 462
**Severity**: HIGH

**Current code around the issue:**
```
     457 | 
     458 |     if (statusDiv) {
     459 |       if (result.success) {
     460 |         statusDiv.innerHTML = `<span style="color: var(--accent-green);">Upgrade complete! ${result.upgraded_packages?.length || 0} packages upgraded.</span>`;
     461 |       } else {
>>>  462 |         statusDiv.innerHTML = `<span style="color: var(--accent-red);">Upgrade failed: ${result.error}</span>`;
     463 |       }
     464 |     }
     465 | 
     466 |     addActivity(
     467 |       `${hostName}: ${action} ${result.success ? "completed" : "failed"}`,
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'zach-source__nix-fleet'.

**Issue**: Hard-coded sast found ([sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment)
**File**: cmd/nixfleet/internal/server/ui/app.js
**Line**: 472
**Severity**: HIGH

**Current code around the issue:**
```
     467 |       `${hostName}: ${action} ${result.success ? "completed" : "failed"}`,
     468 |       result.success ? "info" : "error",
     469 |     );
     470 |   } catch (error) {
     471 |     if (statusDiv) {
>>>  472 |       statusDiv.innerHTML = `<span style="color: var(--accent-red);">Error: ${error.message}</span>`;
     473 |     }
     474 |     addActivity(`${action} failed on ${hostName}: ${error.message}`, "error");
     475 |   }
     476 | }
     477 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('SAST_KEY')` (Python) or `process.env.SAST_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Address OWASP A02 (Cryptographic Failures) compliance gap in 'zach-source__nix-fleet'.

**OWASP Category**: A02 -- Cryptographic Failures
**Fix guidance**: Remove hardcoded secrets, use strong encryption (AES-256-GCM), enforce TLS, never store passwords in plaintext (use bcrypt/argon2).

**Steps:**
1. Identify all code paths related to cryptographic failures
2. Apply the fixes described above
3. Add automated tests to verify the fix
4. Document any security assumptions in code comments

Address OWASP A07 (Auth Failures) compliance gap in 'zach-source__nix-fleet'.

**OWASP Category**: A07 -- Auth Failures
**Fix guidance**: Implement proper session management, use MFA where possible, enforce strong passwords, protect against brute force.

**Steps:**
1. Identify all code paths related to auth failures
2. Apply the fixes described above
3. Add automated tests to verify the fix
4. Document any security assumptions in code comments

Repository 'zach-source__nix-fleet' is failing the quality gate.

Failed conditions:
- overall_score: actual 0.0 >= 50 (FAILED)
- security_score: actual 0.0 >= 40 (FAILED)

Fix each failing condition to make the repo pass the quality gate.

Repository 'zach-source__nix-fleet' has 10 open issues:

- [HIGH] Hard-coded sast: [sast:aljefra/taint-path-traversal] Path Traversal via Tainted Data (agents/lib/gh-manifest-server.py)
- [HIGH] Hard-coded sast: [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL (cmd/nixfleet/internal/server/ui/app.js)
- [HIGH] Hard-coded sast: [sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment (cmd/nixfleet/internal/server/ui/app.js)
- [HIGH] Hard-coded sast: [sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment (cmd/nixfleet/internal/server/ui/app.js)
- [HIGH] Hard-coded sast: [sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment (cmd/nixfleet/internal/server/ui/app.js)
- [HIGH] Hard-coded sast: [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL (cmd/nixfleet/internal/server/ui/app.js)
- [HIGH] Hard-coded sast: [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL (cmd/nixfleet/internal/server/ui/app.js)
- [HIGH] Hard-coded sast: [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL (cmd/nixfleet/internal/server/ui/app.js)
- [HIGH] Hard-coded sast: [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL (cmd/nixfleet/internal/server/ui/app.js)
- [HIGH] Hard-coded sast: [sast:aljefra/ssrf-requests] SSRF via HTTP Client with Variable URL (agents/lib/gh-manifest-server.py)

Resolve each issue. For security issues, apply the appropriate fix. For quality issues, refactor the affected code.

Static analysis found 23 security issues in 'zach-source__nix-fleet':

- [HIGH] [sast:aljefra/taint-path-traversal] Path Traversal via Tainted Data at agents/lib/gh-manifest-server.py:88
- [HIGH] [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL at cmd/nixfleet/internal/server/ui/app.js:23
- [HIGH] [sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment at cmd/nixfleet/internal/server/ui/app.js:37
- [HIGH] [sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment at cmd/nixfleet/internal/server/ui/app.js:53
- [HIGH] [sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment at cmd/nixfleet/internal/server/ui/app.js:57
- [HIGH] [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL at cmd/nixfleet/internal/server/ui/app.js:142
- [HIGH] [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL at cmd/nixfleet/internal/server/ui/app.js:163
- [HIGH] [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL at cmd/nixfleet/internal/server/ui/app.js:184
- [HIGH] [sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL at cmd/nixfleet/internal/server/ui/app.js:202
- [HIGH] [sast:aljefra/ssrf-requests] SSRF via HTTP Client with Variable URL at agents/lib/gh-manifest-server.py:67

For each finding:
- SQL injection: use parameterized queries
- Command injection: use subprocess with list args, no shell=True
- Path traversal: validate and sanitize paths
- Insecure deserialization: use json instead of pickle
- IaC misconfigs: apply the suggested fix from the rule