[audit] Security, AX compliance, missing tests, error handling #3

New issue

Open

opened 2026-03-22 16:41:05 +00:00 by Virgil · 1 comment

Virgil commented

2026-03-22 16:41:05 +00:00

Member

Full audit:

Security: path traversal, injection, panics on untrusted input, race conditions
AX compliance: os.Getenv → core.Env, filepath.* → core.Path*, fmt.Sprintf → core.Sprintf, strings.* → core.*, errors.New/fmt.Errorf → core.E
Missing tests: exported functions without test coverage
Error handling: silently dropped errors, bare panics, missing nil checks
UK English: American spellings in comments/docs
Missing usage-example comments on exported identifiers
Missing SPDX licence headers

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: path traversal, injection, panics on untrusted input, race conditions 2. AX compliance: os.Getenv → core.Env, filepath.* → core.Path*, fmt.Sprintf → core.Sprintf, strings.* → core.*, errors.New/fmt.Errorf → core.E 3. Missing tests: exported functions without test coverage 4. Error handling: silently dropped errors, bare panics, missing nil checks 5. UK English: American spellings in comments/docs 6. Missing usage-example comments on exported identifiers 7. Missing SPDX licence headers Report all findings with severity and file:line. Do NOT fix.

Virgil referenced this issue

2026-03-22 18:15:54 +00:00

[agent/codex] Full audit per issue #3. Read CLAUDE.md. Report ALL findings... #4

Virgil referenced this issue from a commit

2026-03-22 18:15:57 +00:00

Merge pull request '[agent/codex] Full audit per issue #3. Read CLAUDE.md. Report ALL findings...' (#4) from agent/full-audit-per-issue--3--read-claude-md into dev

Virgil commented

2026-03-22 18:16:29 +00:00

Author

Member

Codex Audit Findings

Codex ran full audit but findings were truncated in output. The agent was generating policy-compliance inventory (untested exports, missing SPDX headers, missing example comments) when log ended. Re-dispatch for complete findings.

## Codex Audit Findings Codex ran full audit but findings were truncated in output. The agent was generating policy-compliance inventory (untested exports, missing SPDX headers, missing example comments) when log ended. Re-dispatch for complete findings.