Hardcoded secret-like literal.


Dynamic code execution, expression evaluation, or runtime compilation.

exec(params: { query: string }): Promise<void>;


const match = SYNTHETIC_EVENT_CONDITION_RE.exec(condition);


while ((match = regex.exec(value)) !== null) {


Potential command execution or shell invocation with variable input.

const child = Bun.spawn(["next", "dev", "-p", String(port)], {


const result = spawnSync(command, args, {


const result = spawnSync("bash", localArgs, {


const result = spawnSync("ssh", sshArgs, {


return spawnSync("git", ["remote", "get-url", name], {


const result = spawnSync("bun", ["run", "check:docker-workspace"], {


const child = Bun.spawn(buildArgs(trimmed), {


Outbound HTTP request site that may be attacker-controlled.

const response = await fetch(url.toString(), {


Request header or framework/proxy context read that may influence auth, routing, tenant, runtime, debug, or middleware behavior.

"content-type": response.headers.get("content-type") ?? "application/json"


return (response.headers.get("content-type") ?? "").toLowerCase().includes("application/json");


throw new Error(`${url.pathname} returned non-JSON content (${response.headers.get("content-type") ?? "none"}): ${sample}`);


Redirect sink that may accept user-controlled URLs.


const authorization = req.headers.get("authorization") ?? "";


return req.headers.get("x-synthetic-admin-token")?.trim() ?? "";


logger.info("api listening", { host: env.API_HOST, port: server.port });


HTML injection sink or template escape bypass.

console.warn(`Invalid ${key}="${raw}", using ${fallback}`);


console.warn(`Invalid LIVE_LIMIT_DEFAULT="${raw}", using ${fallback}`);


it("allows the hosted production origin on /options", () => {


it("keeps /tape trusted as a compatibility path on the same origin", () => {


Filesystem access using path joins or user-controllable paths.

{["Ticker", "Contract", "Expiry", "Notional", "Side", "Delta", "Condition"].map(h => {h}	)}

{flowRows.map((r) => <tr key={r.join(


const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";


const host = isLocal ? `${hostname}:4000` : window.location.host;


const remainder = parts.slice(2).join(" -> ");


const response = await fetch(url.toString());


const response = await fetch(url.toString(), { signal: abort.signal });


Missing refs: {missingRefs.slice(0, 4).join(", ")}


<div className="drawer-note news-drawer-body" dangerouslySetInnerHTML={{ __html: body.html }} />


void fetch(buildApiUrl(buildAlertContextPath(selectedAlert.trace_id)), { signal: abort.signal })


const response = await fetch(buildApiUrl(`/flow/packets/${encodeURIComponent(packetId)}`));


const classes = ["terminal-pane", className].filter(Boolean).join(" ");


const focus = state.activeTickers.length > 0 ? state.activeTickers.join(", ") : "ALL";


const response = await fetch(SYNTHETIC_ADMIN_PROXY_PATHS.status, {


const fields = report.retentionDrift.map((delta) => delta.field).join(",");


const path = issue.path.length > 0 ? issue.path.join(".") : "<root>";


Raw SQL construction or query execution that may need parameterization review.

query(params: { query: string; format: ClickHouseQueryFormat }): Promise<ClickHouseQueryResult>;


const rows = values.map((value) => JSON.stringify(value)).join("\n");


return values.map((value) => quoteString(value)).join(", ");


const whereClause = conditions.length > 0 ? ` WHERE ${conditions.join(" AND ")}` : "";


const alertResult = await client.query({


query: `SELECT * FROM ${OPTION_PRINTS_TABLE} WHERE ${conditions.join(" AND ")} ORDER BY ts ASC, seq ASC LIMIT ${safeLimit}`,


query: `SELECT * FROM ${EQUITY_PRINTS_TABLE} WHERE ${conditions.join(" AND ")} ORDER BY ts ASC, seq ASC LIMIT ${safeLimit}`,


query: `SELECT * FROM ${OPTION_PRINTS_TABLE} WHERE ${conditions.join(" AND ")} ORDER BY ts DESC, seq DESC LIMIT ${safeLimit}`,


query: `SELECT * FROM ${OPTION_NBBO_TABLE} WHERE ${conditions.join(" AND ")} ORDER BY ts DESC, seq DESC LIMIT ${safeLimit}`,


query: `SELECT * FROM ${EQUITY_PRINTS_TABLE} WHERE ${conditions.join(" AND ")} ORDER BY ts DESC, seq DESC LIMIT ${safeLimit}`,


query: `SELECT * FROM ${FLOW_PACKETS_TABLE} WHERE ${memberPredicates.join(" OR ")} ORDER BY source_ts DESC, seq DESC LIMIT ${clampLookupLimit(ids.length * 4)}`,


query: `SELECT * FROM ${SMART_MONEY_EVENTS_TABLE} WHERE ${packetPredicates.join(" OR ")} ORDER BY source_ts DESC, seq DESC LIMIT ${clampLookupLimit(ids.length * 4)}`,


query: `SELECT * FROM ${CLASSIFIER_HITS_TABLE} WHERE ${tracePredicates.join(" OR ")} ORDER BY source_ts DESC, seq DESC LIMIT ${clampLookupLimit(ids.length * 4)}`,


query: `SELECT * FROM ${EQUITY_PRINT_JOINS_TABLE} WHERE ${whereParts.join(" OR ")} ORDER BY source_ts DESC, seq DESC LIMIT ${lookupLimit}`,


const root = parts.slice(0, -5).join("-");


const repoRoot = path.resolve(import.meta.dir, "..");


const deploymentRoot = path.join(repoRoot, "deployment/docker/workspace-root");


const rootPackagePath = path.join(repoRoot, "package.json");


const deploymentPackagePath = path.join(deploymentRoot, "package.json");


const rootTsconfigPath = path.join(repoRoot, "tsconfig.base.json");


const deploymentTsconfigPath = path.join(deploymentRoot, "tsconfig.base.json");


const rootLockPath = path.join(repoRoot, "bun.lock");


const deploymentLockPath = path.join(deploymentRoot, "bun.lock");


const parsed = Function(`"use strict"; return (${raw});`)() as T;


const packageJsonPath = path.join(repoRoot, workspacePath, "package.json");


path.join(process.env.HOME ?? "", ".ssh", "delta_ed25519");


const repoRoot = path.resolve(path.dirname(scriptPath), "..");


native Experimental host-native Bun services managed by systemd.


DEPLOY_PUBLIC_API_HEALTH_URL Optional separate public API health URL for two-origin deployments.


candidates.push("forgejo", "origin", "github", ...localGitRemotes());


`Unable to resolve a deploy git remote. Checked candidates: ${deduped.join(", ")}`


const units = nativeUnitsForScope(scope).map((value) => shellEscape(value)).join(" ");


: `docker compose build ${buildServices.join(" ")}`;


const upCommand = `docker compose ${[...upArgs, ...rolloutServices].join(" ")}`;


buildSteps.push(`${NATIVE_SYSTEMCTL_PREFIX} restart ${nativeUnitsForScope(scope).map((value) => shellEscape(value)).join(" ")}`);


? `docker compose ps ${psServices.join(" ")}`


: `docker compose logs --tail=100 ${logServices.join(" ")}`;


`docker compose exec -T api bun -e 'const r = await fetch("http://127.0.0.1:4000/health"); if (!r.ok) throw new Error("api healthcheck failed: " + r.status); console.log(await r.text())'`


`docker compose exec -T web bun -e 'const r = await fetch("http://127.0.0.1:3000/"); if (!r.ok) throw new Error("web healthcheck failed: " + r.status); console.log(r.status)'`


const stateDir = path.join(process.cwd(), ".tmp");


const pidFile = path.join(stateDir, "dev-desktop-runner-pids.json");


await writeFile(pidFile, JSON.stringify(payload, null, 2));


const raw = await readFile(pidFile, "utf8");


const checkTcp = (host: string, port: number, timeoutMs = 1000): Promise<boolean> => {


const socket = net.connect({ host, port });


const pidFile = path.join(stateDir, "dev-services-runner-pids.json");


const pidFile = path.join(stateDir, "dev-runner-pids.json");


return { host: fallbackHost, port: fallbackPort };


return { host: url.hostname || fallbackHost, port };


const repoRoot = path.resolve(import.meta.dir, "..");


const deploymentRoot = path.join(repoRoot, "deployment/docker/workspace-root");


const source = path.join(repoRoot, fileName);


const destination = path.join(deploymentRoot, fileName);


const root = parts.slice(0, -5).join("-");


const id = `flowpacket:${pseudoContractId}:${bucketStartTs}:${contractIds.join("|")}`;


const dedupeKey = `${pseudoContractId}:${bucketStartTs}:${contractIds.join("|")}`;


const response = await fetch(url.toString(), {


throw new Error(`Unknown replay stream(s): ${invalid.join(", ")}`);


await clickhouse.query({ query: "SELECT 1", format: "JSONEachRow" });


Public route, handler, controller, workflow, or operation entry point.


"content-type": response.headers.get("content-type") ?? "application/json"


return (response.headers.get("content-type") ?? "").toLowerCase().includes("application/json");


throw new Error(`${url.pathname} returned non-JSON content (${response.headers.get("content-type") ?? "none"}): ${sample}`);


const authorization = req.headers.get("authorization") ?? "";


return req.headers.get("x-synthetic-admin-token")?.trim() ?? "";


after_ts: url.searchParams.get("after_ts") ?? undefined,


after_seq: url.searchParams.get("after_seq") ?? undefined,


limit: url.searchParams.get("limit") ?? undefined


before_ts: url.searchParams.get("before_ts") ?? undefined,


before_seq: url.searchParams.get("before_seq") ?? undefined,


const raw = url.searchParams.get("source");


underlying_id: url.searchParams.get("underlying_id") ?? undefined,


start_ts: url.searchParams.get("start_ts") ?? undefined,


end_ts: url.searchParams.get("end_ts") ?? undefined,


interval_ms: url.searchParams.get("interval_ms") ?? undefined,


limit: url.searchParams.get("limit") ?? undefined,


cache: url.searchParams.get("cache") ?? undefined


const cached = (this.genericItems.get("options") ?? [])


const items = (this.genericItems.get("options") ?? [])


const items = (this.genericItems.get("flow") ?? [])


const cached = (this.genericItems.get("equities") ?? [])


const items = (this.genericItems.get("equities") ?? []).slice(0, limit);


view: url.searchParams.get("view") ?? undefined,


security: url.searchParams.get("security") ?? undefined,


side: url.searchParams.get("side") ?? undefined,


type: url.searchParams.get("type") ?? undefined,


min_notional: url.searchParams.get("min_notional") ?? undefined


optionContractId: url.searchParams.get("option_contract_id") ?? undefined


const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";