Issues

Stage-1 consistency corrections are shadowed by a stale `finding`, so a corrected VULNERABLE is never verified and never disclosed

#331

· gadievron opened

on Aug 23, 2026

JS/TS: top-level bootstrap code (IIFE, callbacks, bare calls, initialisers) loses its call-graph edges in any multi-unit file

#330

· gadievron opened

on Aug 22, 2026

Ruby FunctionExtractor silently drops inline-visibility methods (`private def foo`), losing the unit and its call-graph node

#329

· gadievron opened

on Aug 22, 2026

Python-path scans accept `--processing-level codeql|exploitable`, silently fall back to reachable-only, and report the requested level as the level used

#328

· gadievron opened

on Aug 22, 2026

Swift call graph: an arithmetic-expression callee falls through the two-branch whitelist, losing the call edge (`f() + g()` loses `g`)

#327

· gadievron opened

on Aug 22, 2026

CSV export reads only `llm_context`, so `unit_description` is empty after a default agentic enhance — the fallback PR #133 added to `analyzer.py` was never applied here

#326

· gadievron opened

on Aug 22, 2026

`npm install` bootstrap runs with no timeout behind a lock with no acquisition deadline, so a stalled npm hangs every concurrent parse (PR #135's named follow-up)

#325

· gadievron opened

on Aug 22, 2026

A Stage-1 result with neither `verdict` nor `finding` is counted in no bucket and adopted as complete on resume, so `units_analyzed` overstates and the unit is never retried

#324

· gadievron opened

on Aug 22, 2026

Detector blackout advisory has no deterministic surface: absent from the Go terminal summary and exit envelope, and rendered in SUMMARY_REPORT.md only at the LLM's discretion (PRs #233/#238's deferred follow-up)

#323

· gadievron opened

on Aug 22, 2026

A scanned repo's own `OPENANT.json` can suppress unlimited vulnerability classes: no count bound, no permissiveness warning on that path, and `context_source` is recorded as "generated" so the provenance banner never fires

#322

· gadievron opened

on Aug 22, 2026

Single-shot enhance never writes `security_classification`, so `--exploitable-only`/`--exploitable-all` select zero units and `--limit` loses its ordering

#321

· gadievron opened

on Aug 22, 2026

webui scan subprocesses run with no deadline, so a hung parser holds one of four scan slots indefinitely and `OPENANT_INVOKE_TIMEOUT` has no effect (PR #237's stated follow-up)

#320

· gadievron opened

on Aug 22, 2026

Navigation Menu

Uh oh!

All issues

Stage-1 consistency corrections are shadowed by a stale `finding`, so a corrected VULNERABLE is never verified and never disclosed

JS/TS: top-level bootstrap code (IIFE, callbacks, bare calls, initialisers) loses its call-graph edges in any multi-unit file

Ruby FunctionExtractor silently drops inline-visibility methods (`private def foo`), losing the unit and its call-graph node

Python-path scans accept `--processing-level codeql|exploitable`, silently fall back to reachable-only, and report the requested level as the level used

Swift call graph: an arithmetic-expression callee falls through the two-branch whitelist, losing the call edge (`f() + g()` loses `g`)

CSV export reads only `llm_context`, so `unit_description` is empty after a default agentic enhance — the fallback PR #133 added to `analyzer.py` was never applied here

`npm install` bootstrap runs with no timeout behind a lock with no acquisition deadline, so a stalled npm hangs every concurrent parse (PR #135's named follow-up)

A Stage-1 result with neither `verdict` nor `finding` is counted in no bucket and adopted as complete on resume, so `units_analyzed` overstates and the unit is never retried

Detector blackout advisory has no deterministic surface: absent from the Go terminal summary and exit envelope, and rendered in SUMMARY_REPORT.md only at the LLM's discretion (PRs #233/#238's deferred follow-up)

A scanned repo's own `OPENANT.json` can suppress unlimited vulnerability classes: no count bound, no permissiveness warning on that path, and `context_source` is recorded as "generated" so the provenance banner never fires

Single-shot enhance never writes `security_classification`, so `--exploitable-only`/`--exploitable-all` select zero units and `--limit` loses its ordering

webui scan subprocesses run with no deadline, so a hung parser holds one of four scan slots indefinitely and `OPENANT_INVOKE_TIMEOUT` has no effect (PR #237's stated follow-up)

Uh oh!

Search results