diegosouzapw eff7de2284 docs(security): note CodeQL custom-sanitizer limitation as dismissal precedent ...

CodeQL js/stack-trace-exposure does not recognize sanitizers reached
through a custom helper indirection — flagging callsites like
open-sse/utils/error.ts::errorResponse and
open-sse/executors/cursor.ts::buildErrorResponse even though both route
through sanitizeErrorMessage().

Record the dismissal precedent (alerts #224 and #231, May 2026):
- Add a "Known CodeQL limitation" section in
  docs/security/ERROR_SANITIZATION.md documenting how to handle future
  occurrences (verify callchain → verify test coverage → dismiss with
  reference, do NOT duplicate the pattern inline).
- Extend CLAUDE.md Hard Rule #14 with the precedent so the next
  engineer doesn't try to "fix" the false positive by weakening the
  shared sanitizer.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-14 14:10:29 -03:00

..

COMPLIANCE.md

feat(docs): add YAML frontmatter to all docs (title/version/lastUpdated)

2026-05-13 18:46:05 -03:00

ERROR_SANITIZATION.md

docs(security): note CodeQL custom-sanitizer limitation as dismissal precedent

2026-05-14 14:10:29 -03:00

GUARDRAILS.md

feat(docs): add YAML frontmatter to all docs (title/version/lastUpdated)

2026-05-13 18:46:05 -03:00

PUBLIC_CREDS.md

fix(security): close remaining CodeQL alerts + document mandatory patterns

2026-05-14 11:12:14 -03:00

STEALTH_GUIDE.md

docs(security): note CodeQL custom-sanitizer limitation as dismissal precedent

2026-05-14 14:10:29 -03:00