All findings
500 findings across categories.
Category:
Severity:
Rule:
500 findings
| Category | Rule | Evidence | Actions | ||
|---|---|---|---|---|---|
| high | security theater | security_theater.api_key_scopes_never_enforced | .codex/skills/.system/skill-installer/agents/openai.yaml:1 | interface: Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .codex/skills/.system/skill-installer/agents/openai.yaml:2 | display_name: "Skill Installer" Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | apps/app/app/(authenticated)/kitchen/task-card.tsx:119 | }, Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .codex/skills/.system/skill-installer/agents/openai.yaml:5 | icon_large: "./assets/skill-installer.png" Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | apps/app/app/(authenticated)/kitchen/task-card.tsx:121 | label: "Canceled", Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .codex/skills/.system/skill-installer/agents/openai.yaml:6 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:1 | --- Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:2 | description: Definitive guidelines for building robust, secure, and efficient Stripe integrations using modern API practices (v2, Checkout Sessions, Payment Intents, Elements) and essential safeguards like idempotency and webhook verificati Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:3 | globs: **/* Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:4 | --- Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:7 | This guide outlines the definitive best practices for integrating Stripe into our applications. Adhere to these rules to ensure secure, performant, and maintainable payment flows. Always target the latest Stripe API version (`2025-12-15.clo Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .codex/skills/.system/skill-installer/agents/openai.yaml:4 | icon_small: "./assets/skill-installer-small.svg" Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:23 | const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:8 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:9 | ## 1. Code Organization & Structure Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:10 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:11 | ### 1.1. Secure API Key Management Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:12 | Never hardcode API keys. Store them securely in environment variables. Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:13 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:14 | ❌ BAD: Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:15 | ```javascript Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:16 | const stripe = require('stripe')('sk_test_YOUR_SECRET_KEY');Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:17 | ``` Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:18 | Scope-checking auth functions defined but never consumed by route handlers | |
| high | security theater | security_theater.api_key_scopes_never_enforced | .cursor/rules/stripe.mdc:19 | ✅ GOOD: Scope-checking auth functions defined but never consumed by route handlers |
Page 1 of 20