Raw scanner ground truth only — the LLM triage/verification layer has not run, so these findings are unvetted (false positives not yet removed). Identical hits are grouped.
rule javascript.lang.security.audit.code-string-concat.code-string-concat
rule generic.secrets.security.detected-github-token.detected-github-token
rule javascript.lang.security.detect-child-process.detect-child-process
rule javascript.express.security.audit.xss.direct-response-write.direct-response-write
rule javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage