CodeQL cli#1 (high, clear-text logging) src/commands/doctor/index.ts:123 — the doctor prints apiKey.slice(0, 12) (a wave_sk_… prefix). Deliberate for identification, but 12 characters is more than needed; consider 8 and a note. CodeQL cli#4 (missing rate limiting) and Aikido 522730011 (Express security headers) point at templates/webhook-handler/src/index.ts — example code scaffolded into user projects; add helmet + a rate limiter to the template so users start hardened. Aikido 522729986-522730010 (file inclusion in src/commands/init and link, device-flow) are local-CLI filesystem reads driven by the user's own arguments — no trust boundary; dismiss at the vendor.
Filed by the 2026-09-02 go-live security audit lane. Source-of-truth read from origin/main; vendor finding ids are listed so the row can be closed at the vendor when this lands.
https://claude.ai/code/session_01K9mRh8G2ugbUt2kaXvFvF6
CodeQL cli#1 (high, clear-text logging) src/commands/doctor/index.ts:123 — the doctor prints
apiKey.slice(0, 12)(awave_sk_…prefix). Deliberate for identification, but 12 characters is more than needed; consider 8 and a note. CodeQL cli#4 (missing rate limiting) and Aikido 522730011 (Express security headers) point at templates/webhook-handler/src/index.ts — example code scaffolded into user projects; add helmet + a rate limiter to the template so users start hardened. Aikido 522729986-522730010 (file inclusion in src/commands/init and link, device-flow) are local-CLI filesystem reads driven by the user's own arguments — no trust boundary; dismiss at the vendor.Filed by the 2026-09-02 go-live security audit lane. Source-of-truth read from
origin/main; vendor finding ids are listed so the row can be closed at the vendor when this lands.https://claude.ai/code/session_01K9mRh8G2ugbUt2kaXvFvF6