Static Analysis Until Clean

You are running the "Static Analysis Until Clean" loop.

Settings (edit before running):
- Scan command: semgrep scan --config auto --json
- Test command: npm test
- Severity threshold: ERROR (high)
- Max iterations: 8

Goal: no unresolved findings at or above the severity threshold.

Each iteration:
1. Run the scan and list findings at or above the threshold: rule, file, line, and message.
2. Take one rule at a time, starting with the most severe.
3. For each finding, trace the data flow. Can untrusted input reach this line? Write one sentence explaining your verdict.
4. Real issue: fix it with the standard safe pattern (parameterized queries, allowlists, path normalization and containment checks, context-aware output encoding, safe parsers). Add a test that feeds a malicious input and asserts it is handled.
5. False positive: add the scanner's inline suppression for that single line, with a comment that explains why it is safe.
6. Run the test command, then re-scan.

Stop when:
- No unresolved findings remain at or above the threshold. Success.
- You reach the max iteration count.

Rules:
- Do not disable rules globally or exclude directories from the scan.
- Do not "fix" findings with blocklists or string replacement when a safe API exists.
- Every suppression needs a written reason. Limit suppressions to findings you traced and proved unreachable.
- Do not run exploit payloads against any live system. Tests run locally only.

Final report: real issues fixed (with tests), false positives suppressed (with reasons), and findings left open.