+ [{"number":51,"expected_path":"providers/goated--nuvio--8c7202df852f641a.js","expected_rule":"js/incomplete-sanitization","reason":"false positive","comment":"The flagged replacement is an intentional JavaScript-string decoder for packed provider payloads, not an input sanitizer or security boundary. Escaping backslashes at this point would change the decoded payload semantics."},{"number":50,"expected_path":"providers/desiflix--published-baseline--650717c1f5b6ba9c.js","expected_rule":"js/incomplete-sanitization","reason":"false positive","comment":"The flagged replacement is an intentional JavaScript-string decoder for packed provider payloads, not an input sanitizer or security boundary. Escaping backslashes at this point would change the decoded payload semantics."},{"number":49,"expected_path":"upstream-lkg/providers/c91c43aedb5b489c07a030766fd22550cf8773fce6845f21f4a20c7398efeb94.js","expected_rule":"js/bad-tag-filter","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":48,"expected_path":"upstream-lkg/providers/3b567b1e8e83d64777b617ee9323f411dab1474c700864058c4444e4f52cf842.js","expected_rule":"js/bad-tag-filter","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":47,"expected_path":"upstream-lkg/providers/bd2eb51b581fbc1ff781565964f2b0c6246dec4f80f8033e251b00910ecf6677.js","expected_rule":"js/double-escaping","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":46,"expected_path":"upstream-lkg/providers/bd2eb51b581fbc1ff781565964f2b0c6246dec4f80f8033e251b00910ecf6677.js","expected_rule":"js/double-escaping","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":45,"expected_path":"upstream-lkg/providers/0dbdc78b24804babc29f0674da00a46e7b7915ebb5278d58790439d4ba03690b.js","expected_rule":"js/double-escaping","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":44,"expected_path":"providers/mallumv--published-baseline--b856f62c06439259.js","expected_rule":"js/double-escaping","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."},{"number":43,"expected_path":"providers/mallumv--published-baseline--b856f62c06439259.js","expected_rule":"js/double-escaping","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."},{"number":42,"expected_path":"providers/cinemacity--published-baseline--b29fc200525c01c8.js","expected_rule":"js/double-escaping","reason":"false positive","comment":"The flagged replacement is parser/decoder normalization of upstream encoded markup/JSON, not a sanitization boundary or HTML output encoding step. The decoded value is subsequently parsed/handled as provider data."},{"number":41,"expected_path":"providers/anizone--published-baseline--6392e84aa252cc85.js","expected_rule":"js/double-escaping","reason":"false positive","comment":"The flagged replacement is parser/decoder normalization of upstream encoded markup/JSON, not a sanitization boundary or HTML output encoding step. The decoded value is subsequently parsed/handled as provider data."},{"number":40,"expected_path":"providers/anizone.js","expected_rule":"js/double-escaping","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."},{"number":39,"expected_path":"upstream-lkg/providers/d67399b8f3d221dea530132cbaafc95777469e1f12fed665b7c2d90f5823e195.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":38,"expected_path":"upstream-lkg/providers/d67399b8f3d221dea530132cbaafc95777469e1f12fed665b7c2d90f5823e195.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":37,"expected_path":"upstream-lkg/providers/d67399b8f3d221dea530132cbaafc95777469e1f12fed665b7c2d90f5823e195.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":36,"expected_path":"upstream-lkg/providers/d67399b8f3d221dea530132cbaafc95777469e1f12fed665b7c2d90f5823e195.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":35,"expected_path":"upstream-lkg/providers/d67399b8f3d221dea530132cbaafc95777469e1f12fed665b7c2d90f5823e195.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":34,"expected_path":"upstream-lkg/providers/d67399b8f3d221dea530132cbaafc95777469e1f12fed665b7c2d90f5823e195.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":33,"expected_path":"upstream-lkg/providers/bd2eb51b581fbc1ff781565964f2b0c6246dec4f80f8033e251b00910ecf6677.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":32,"expected_path":"upstream-lkg/providers/bd2eb51b581fbc1ff781565964f2b0c6246dec4f80f8033e251b00910ecf6677.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":31,"expected_path":"upstream-lkg/providers/9c1149723e462761700eb5f67d19271225bbf29d2c4670d60314b77361a98c21.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":30,"expected_path":"upstream-lkg/providers/bd2eb51b581fbc1ff781565964f2b0c6246dec4f80f8033e251b00910ecf6677.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":29,"expected_path":"upstream-lkg/providers/bd2eb51b581fbc1ff781565964f2b0c6246dec4f80f8033e251b00910ecf6677.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":28,"expected_path":"upstream-lkg/providers/25135c174b05435d6dc8fe5216eb78b836150646ed15a7da65e8e85d70bd1c98.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":27,"expected_path":"upstream-lkg/providers/25135c174b05435d6dc8fe5216eb78b836150646ed15a7da65e8e85d70bd1c98.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Immutable upstream LKG/provenance snapshot. NiakVIO does not edit these archived third-party bytes in place; the snapshot is not directly published/executed as the production bundle. Re-triage the corresponding current provider artifact separately."},{"number":23,"expected_path":"providers/vidnest.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."},{"number":22,"expected_path":"providers/vidnest.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."},{"number":21,"expected_path":"providers/vidnest--published-baseline--eb1bc5d977e45b6f.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."},{"number":20,"expected_path":"providers/vidnest--published-baseline--eb1bc5d977e45b6f.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."},{"number":19,"expected_path":"providers/nakios--published-baseline--8cbd6be89842391c.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"false positive","comment":"The hostname-like substring checks form a denylist for known demo/test media, not an allowlist or trust decision. A substring match can only reject additional media; it cannot authorize an untrusted host."},{"number":18,"expected_path":"providers/nakios--published-baseline--8cbd6be89842391c.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"false positive","comment":"The hostname-like substring checks form a denylist for known demo/test media, not an allowlist or trust decision. A substring match can only reject additional media; it cannot authorize an untrusted host."},{"number":17,"expected_path":"providers/nakios--published-baseline--8cbd6be89842391c.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"false positive","comment":"The hostname-like substring checks form a denylist for known demo/test media, not an allowlist or trust decision. A substring match can only reject additional media; it cannot authorize an untrusted host."},{"number":16,"expected_path":"providers/mallumv--published-baseline--b856f62c06439259.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."},{"number":15,"expected_path":"providers/mallumv--published-baseline--b856f62c06439259.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."},{"number":14,"expected_path":"providers/mallumv--published-baseline--b856f62c06439259.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."},{"number":13,"expected_path":"providers/mallumv--published-baseline--b856f62c06439259.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."},{"number":12,"expected_path":"providers/hdhub4u--published-baseline--10e6245742b935ac.js","expected_rule":"js/incomplete-url-substring-sanitization","reason":"false positive","comment":"The URL is already parsed with new URL(...).hostname; this substring only selects an extractor/redirect handler. It is not an allowlist, authorization decision, or network trust boundary."},{"number":11,"expected_path":"providers/persianstremio--published-baseline--7aba3c7fae6dd298.js","expected_rule":"js/clear-text-logging","reason":"false positive","comment":"CodeQL inferred secrecy from the TMDB_API_KEY identifier. This is an intentionally embedded public client credential already shipped in the provider bundle, not a user secret or server-side credential; logging cannot disclose information that is not already present in the distributed artifact."},{"number":10,"expected_path":"providers/animekai--published-baseline--05f8a46be0e9cc89.js","expected_rule":"js/clear-text-logging","reason":"won't fix","comment":"Third-party/generated provider artifact is disabled or not referenced by the current manifest. It is retained for recovery/provenance and must be re-triaged before any future activation; it is not part of the active provider surface."}]
0 commit comments