[audit] Security, AX compliance, missing tests, error handling #5

New issue

Open

opened 2026-03-22 16:41:00 +00:00 by Virgil · 4 comments

Virgil commented

2026-03-22 16:41:00 +00:00

Member

Full audit:

Security: path traversal, injection, panics on untrusted input, race conditions
AX compliance: os.Getenv → core.Env, filepath.* → core.Path*, fmt.Sprintf → core.Sprintf, strings.* → core.*, errors.New/fmt.Errorf → core.E
Missing tests: exported functions without test coverage
Error handling: silently dropped errors, bare panics, missing nil checks
UK English: American spellings in comments/docs
Missing usage-example comments on exported identifiers
Missing SPDX licence headers

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: path traversal, injection, panics on untrusted input, race conditions 2. AX compliance: os.Getenv → core.Env, filepath.* → core.Path*, fmt.Sprintf → core.Sprintf, strings.* → core.*, errors.New/fmt.Errorf → core.E 3. Missing tests: exported functions without test coverage 4. Error handling: silently dropped errors, bare panics, missing nil checks 5. UK English: American spellings in comments/docs 6. Missing usage-example comments on exported identifiers 7. Missing SPDX licence headers Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 16:47:14 +00:00

Author

Member

Gemini Audit Findings (24 total)

HIGH

os.Getenv used directly: LANG, LC_ALL, LC_MESSAGES (localise.go:88-92)

MEDIUM

errors.New sentinel (i18n.go:27)
fmt.Sprintf in log.E call (calibrate.go:143)
strings.HasPrefix (handler.go:12)
strings.Contains (service.go:321)
strings.ToLower (grammar.go:43)
strings.TrimSpace (reversal/tokeniser.go:212)
strings.ReplaceAll (loader.go:32)
Silently dropped errors (service.go:177, core_service.go:60)

LOW

American spelling: ErrServiceNotInitialized (i18n.go:29)
fmt.Errorf in test (compose_test.go:126)
Missing usage-example comments on 6+ exported types

## Gemini Audit Findings (24 total) ### HIGH 1. os.Getenv used directly: LANG, LC_ALL, LC_MESSAGES (localise.go:88-92) ### MEDIUM 2. errors.New sentinel (i18n.go:27) 3. fmt.Sprintf in log.E call (calibrate.go:143) 4. strings.HasPrefix (handler.go:12) 5. strings.Contains (service.go:321) 6. strings.ToLower (grammar.go:43) 7. strings.TrimSpace (reversal/tokeniser.go:212) 8. strings.ReplaceAll (loader.go:32) 9. Silently dropped errors (service.go:177, core_service.go:60) ### LOW 10. American spelling: ErrServiceNotInitialized (i18n.go:29) 11. fmt.Errorf in test (compose_test.go:126) 12. Missing usage-example comments on 6+ exported types

Virgil commented

2026-03-22 16:54:29 +00:00

Author

Member

Gemini Audit Findings

HIGH

os.Getenv(LANG/LC_ALL/LC_MESSAGES) — localise.go:88-92

MEDIUM

errors.New sentinel (i18n.go:27)
fmt.Sprintf in log.E (calibrate.go:143)
strings.* (5 files)
Dropped errors (service.go:177, core_service.go:60)

LOW

American spelling: ErrServiceNotInitialized (i18n.go:29)

## Gemini Audit Findings ### HIGH - os.Getenv(LANG/LC_ALL/LC_MESSAGES) — localise.go:88-92 ### MEDIUM - errors.New sentinel (i18n.go:27) - fmt.Sprintf in log.E (calibrate.go:143) - strings.* (5 files) - Dropped errors (service.go:177, core_service.go:60) ### LOW - American spelling: ErrServiceNotInitialized (i18n.go:29)

Virgil referenced this issue

2026-03-23 07:38:42 +00:00

[agent/codex] Fix ALL findings from issue #5. Read CLAUDE.md first. os.Get... #6

Virgil commented

2026-03-23 07:38:54 +00:00

Author

Member

Fix Applied

Commit 01463be: fix(i18n): resolve issue 5 audit findings

os.Getenv(LANG/LC_ALL/LC_MESSAGES) → core.Env
errors.New sentinel replaced with core.E
fmt.Sprintf → core.Sprintf
strings.* → core.* across 5 files
Dropped errors in service.go/core_service.go surfaced
American spelling ErrServiceNotInitialized → ErrServiceNotInitialised
242 additions across 15 files with new tests

## Fix Applied Commit 01463be: fix(i18n): resolve issue 5 audit findings - os.Getenv(LANG/LC_ALL/LC_MESSAGES) → core.Env - errors.New sentinel replaced with core.E - fmt.Sprintf → core.Sprintf - strings.* → core.* across 5 files - Dropped errors in service.go/core_service.go surfaced - American spelling ErrServiceNotInitialized → ErrServiceNotInitialised - 242 additions across 15 files with new tests

Virgil commented

2026-03-23 09:01:30 +00:00

Author

Member