diff --git a/pkg/channels/pico/pico.go b/pkg/channels/pico/pico.go
index 0a7bf15a4..38efe28ff 100644
--- a/pkg/channels/pico/pico.go
+++ b/pkg/channels/pico/pico.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -73,10 +74,19 @@ func NewPicoChannel(cfg config.PicoConfig, messageBus *bus.MessageBus) (*PicoCha
 
 	allowOrigins := cfg.AllowOrigins
 	checkOrigin := func(r *http.Request) bool {
-		if len(allowOrigins) == 0 {
-			return true // allow all if not configured
-		}
 		origin := r.Header.Get("Origin")
+		// If no origins are configured, allow same-origin only (default Gorilla behavior).
+		if len(allowOrigins) == 0 {
+			if origin == "" {
+				return true
+			}
+			u, err := url.Parse(origin)
+			if err != nil {
+				return false
+			}
+			return u.Host == r.Host
+		}
+		// If origins are configured, check for '*' or exact match.
 		for _, allowed := range allowOrigins {
 			if allowed == "*" || allowed == origin {
 				return true
diff --git a/semgrep-results-owasp.json b/semgrep-results-owasp.json
new file mode 100644
index 000000000..92df3fbb3
--- /dev/null
+++ b/semgrep-results-owasp.json
@@ -0,0 +1 @@
+{"version":"1.154.0","results":[{"check_id":"yaml.github-actions.security.run-shell-injection.run-shell-injection","path":".github\\workflows\\docker-build.yml","start":{"line":56,"col":9,"offset":1828},"end":{"line":62,"col":3,"offset":2333},"extra":{"message":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".","metadata":{"category":"security","cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections","https://securitylab.github.com/research/github-actions-untrusted-input/"],"technology":["github-actions"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Command Injection"],"source":"https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection","shortlink":"https://sg.run/pkzk"},"severity":"ERROR","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.run-shell-injection.run-shell-injection","path":".github\\workflows\\release.yml","start":{"line":117,"col":9,"offset":3369},"end":{"line":121,"col":3,"offset":3522},"extra":{"message":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".","metadata":{"category":"security","cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections","https://securitylab.github.com/research/github-actions-untrusted-input/"],"technology":["github-actions"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Command Injection"],"source":"https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection","shortlink":"https://sg.run/pkzk"},"severity":"ERROR","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.run-shell-injection.run-shell-injection","path":".github\\workflows\\upload-tos.yml","start":{"line":25,"col":9,"offset":563},"end":{"line":34,"col":3,"offset":869},"extra":{"message":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".","metadata":{"category":"security","cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections","https://securitylab.github.com/research/github-actions-untrusted-input/"],"technology":["github-actions"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Command Injection"],"source":"https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection","shortlink":"https://sg.run/pkzk"},"severity":"ERROR","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.run-shell-injection.run-shell-injection","path":".github\\workflows\\upload-tos.yml","start":{"line":40,"col":9,"offset":1107},"end":{"line":49,"col":23,"offset":1591},"extra":{"message":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".","metadata":{"category":"security","cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections","https://securitylab.github.com/research/github-actions-untrusted-input/"],"technology":["github-actions"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Command Injection"],"source":"https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection","shortlink":"https://sg.run/pkzk"},"severity":"ERROR","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.audit.net.use-tls.use-tls","path":"examples\\pico-echo-server\\main.go","start":{"line":159,"col":12,"offset":3830},"end":{"line":159,"col":43,"offset":3861},"extra":{"message":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.","fix":"http.ListenAndServeTLS(*addr, certFile, keyFile, nil)","metadata":{"cwe":["CWE-319: Cleartext Transmission of Sensitive Information"],"owasp":["A03:2017 - Sensitive Data Exposure","A02:2021 - Cryptographic Failures","A04:2025 - Cryptographic Failures"],"references":["https://golang.org/pkg/net/http/#ListenAndServeTLS"],"category":"security","technology":["go"],"confidence":"MEDIUM","subcategory":["audit"],"likelihood":"LOW","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Mishandled Sensitive Information"],"source":"https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls","shortlink":"https://sg.run/dKbY"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.audit.crypto.math_random.math-random-used","path":"pkg\\channels\\feishu\\feishu_64.go","start":{"line":10,"col":3,"offset":134},"end":{"line":10,"col":12,"offset":143},"extra":{"message":"Do not use `math/rand`. Use `crypto/rand` instead.","fix":"crypto/rand","metadata":{"cwe":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"],"owasp":["A02:2021 - Cryptographic Failures","A04:2025 - Cryptographic Failures"],"references":["https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation"],"category":"security","technology":["go"],"confidence":"MEDIUM","subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues"],"source":"https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used","shortlink":"https://sg.run/6nK6"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","path":"pkg\\channels\\irc\\irc.go","start":{"line":80,"col":21,"offset":1996},"end":{"line":82,"col":4,"offset":2058},"extra":{"message":"`MinVersion` is missing from this TLS configuration.  By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.","fix":"tls.Config{ ServerName: extractHost(c.config.Server), MinVersion: tls.VersionTLS13 }","metadata":{"cwe":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"],"owasp":["A03:2017 - Sensitive Data Exposure","A02:2021 - Cryptographic Failures","A04:2025 - Cryptographic Failures"],"source-rule-url":"https://github.com/securego/gosec/blob/master/rules/tls_config.go","references":["https://go.dev/doc/go1.22#minor_library_changes","https://pkg.go.dev/crypto/tls#:~:text=MinVersion","https://www.us-cert.gov/ncas/alerts/TA14-290A"],"category":"security","technology":["go"],"confidence":"HIGH","subcategory":["audit"],"likelihood":"MEDIUM","impact":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues"],"source":"https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","shortlink":"https://sg.run/oxEN"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","path":"pkg\\channels\\manager_channel.go","start":{"line":26,"col":11,"offset":617},"end":{"line":26,"col":30,"offset":636},"extra":{"message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.","metadata":{"owasp":["A03:2017 - Sensitive Data Exposure","A02:2021 - Cryptographic Failures","A04:2025 - Cryptographic Failures"],"cwe":["CWE-328: Use of Weak Hash"],"source-rule-url":"https://github.com/securego/gosec#available-rules","category":"security","technology":["go"],"confidence":"MEDIUM","references":["https://owasp.org/Top10/A02_2021-Cryptographic_Failures"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Insecure Hashing Algorithm"],"source":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","shortlink":"https://sg.run/2xB5"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","path":"pkg\\channels\\pico\\pico.go","start":{"line":346,"col":15,"offset":9469},"end":{"line":346,"col":55,"offset":9509},"extra":{"message":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\"","metadata":{"category":"security","cwe":["CWE-352: Cross-Site Request Forgery (CSRF)"],"owasp":["A01:2021 - Broken Access Control","A01:2025 - Broken Access Control"],"references":["https://pkg.go.dev/github.com/gorilla/websocket#Upgrader"],"technology":["gorilla"],"confidence":"MEDIUM","cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site Request Forgery (CSRF)"],"source":"https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","shortlink":"https://sg.run/xXpz"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.audit.crypto.math_random.math-random-used","path":"pkg\\channels\\telegram\\command_registration.go","start":{"line":5,"col":3,"offset":44},"end":{"line":5,"col":12,"offset":53},"extra":{"message":"Do not use `math/rand`. Use `crypto/rand` instead.","fix":"crypto/rand","metadata":{"cwe":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"],"owasp":["A02:2021 - Cryptographic Failures","A04:2025 - Cryptographic Failures"],"references":["https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation"],"category":"security","technology":["go"],"confidence":"MEDIUM","subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues"],"source":"https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used","shortlink":"https://sg.run/6nK6"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","path":"pkg\\channels\\wecom\\media.go","start":{"line":695,"col":9,"offset":19412},"end":{"line":695,"col":22,"offset":19425},"extra":{"message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.","metadata":{"owasp":["A03:2017 - Sensitive Data Exposure","A02:2021 - Cryptographic Failures","A04:2025 - Cryptographic Failures"],"cwe":["CWE-328: Use of Weak Hash"],"source-rule-url":"https://github.com/securego/gosec#available-rules","category":"security","technology":["go"],"confidence":"MEDIUM","references":["https://owasp.org/Top10/A02_2021-Cryptographic_Failures"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Insecure Hashing Algorithm"],"source":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","shortlink":"https://sg.run/2xB5"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","path":"pkg\\channels\\weixin\\media.go","start":{"line":790,"col":12,"offset":21339},"end":{"line":790,"col":25,"offset":21352},"extra":{"message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.","metadata":{"owasp":["A03:2017 - Sensitive Data Exposure","A02:2021 - Cryptographic Failures","A04:2025 - Cryptographic Failures"],"cwe":["CWE-328: Use of Weak Hash"],"source-rule-url":"https://github.com/securego/gosec#available-rules","category":"security","technology":["go"],"confidence":"MEDIUM","references":["https://owasp.org/Top10/A02_2021-Cryptographic_Failures"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Insecure Hashing Algorithm"],"source":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","shortlink":"https://sg.run/2xB5"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.audit.crypto.math_random.math-random-used","path":"pkg\\config\\config.go","start":{"line":7,"col":3,"offset":67},"end":{"line":7,"col":12,"offset":76},"extra":{"message":"Do not use `math/rand`. Use `crypto/rand` instead.","fix":"crypto/rand","metadata":{"cwe":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"],"owasp":["A02:2021 - Cryptographic Failures","A04:2025 - Cryptographic Failures"],"references":["https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation"],"category":"security","technology":["go"],"confidence":"MEDIUM","subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues"],"source":"https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used","shortlink":"https://sg.run/6nK6"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.audit.crypto.math_random.math-random-used","path":"pkg\\providers\\antigravity_provider.go","start":{"line":10,"col":3,"offset":98},"end":{"line":10,"col":12,"offset":107},"extra":{"message":"Do not use `math/rand`. Use `crypto/rand` instead.","fix":"crypto/rand","metadata":{"cwe":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"],"owasp":["A02:2021 - Cryptographic Failures","A04:2025 - Cryptographic Failures"],"references":["https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation"],"category":"security","technology":["go"],"confidence":"MEDIUM","subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues"],"source":"https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used","shortlink":"https://sg.run/6nK6"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.filepath-clean-misuse.filepath-clean-misuse","path":"web\\backend\\embed.go","start":{"line":56,"col":17,"offset":1654},"end":{"line":56,"col":64,"offset":1701},"extra":{"message":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.","fix":"filepath.FromSlash(filepath.Clean(\"/\"+strings.Trim(strings.TrimPrefix(r.URL.Path, \"/\"), \"/\")))","metadata":{"references":["https://pkg.go.dev/path#Clean","http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html","https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/","https://dzx.cz/2021/04/02/go_path_traversal/","https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme"],"cwe":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"owasp":["A05:2017 - Broken Access Control","A01:2021 - Broken Access Control","A01:2025 - Broken Access Control"],"category":"security","technology":["go"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","interfile":true,"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Path Traversal"],"source":"https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse","shortlink":"https://sg.run/ZKzw"},"severity":"ERROR","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","path":"web\\backend\\middleware\\launcher_dashboard_auth.go","start":{"line":57,"col":21,"offset":1869},"end":{"line":65,"col":3,"offset":2098},"extra":{"message":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.","fix":"http.Cookie{\r\n\t\tName:     LauncherDashboardCookieName,\r\n\t\tValue:    sessionValue,\r\n\t\tPath:     \"/\",\r\n\t\tMaxAge:   launcherDashboardSessionMaxAgeSec,\r\n\t\tHttpOnly: true,\r\n\t\tSameSite: http.SameSiteLaxMode,\r\n\t\tSecure:   secure(r),\r\n\t}","metadata":{"cwe":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"],"owasp":["A05:2021 - Security Misconfiguration","A02:2025 - Security Misconfiguration"],"references":["https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go","https://golang.org/src/net/http/cookie.go"],"category":"security","technology":["go"],"confidence":"MEDIUM","subcategory":["vuln"],"likelihood":"LOW","impact":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cookie Security"],"source":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","shortlink":"https://sg.run/N4G7"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","path":"web\\backend\\middleware\\launcher_dashboard_auth.go","start":{"line":73,"col":21,"offset":2401},"end":{"line":82,"col":3,"offset":2619},"extra":{"message":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.","fix":"http.Cookie{\r\n\t\tName:     LauncherDashboardCookieName,\r\n\t\tValue:    \"\",\r\n\t\tPath:     \"/\",\r\n\t\tMaxAge:   -1,\r\n\t\tHttpOnly: true,\r\n\t\tSameSite: http.SameSiteLaxMode,\r\n\t\tSecure:   secure(r),\r\n\t\tExpires:  time.Unix(0, 0),\r\n\t}","metadata":{"cwe":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"],"owasp":["A05:2021 - Security Misconfiguration","A02:2025 - Security Misconfiguration"],"references":["https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go","https://golang.org/src/net/http/cookie.go"],"category":"security","technology":["go"],"confidence":"MEDIUM","subcategory":["vuln"],"likelihood":"LOW","impact":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cookie Security"],"source":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","shortlink":"https://sg.run/N4G7"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[{"code":3,"level":"warn","type":["PartialParsing",[{"path":"docker\\Dockerfile","start":{"line":26,"col":1,"offset":0},"end":{"line":43,"col":16,"offset":517}}]],"message":"Syntax error at line docker\\Dockerfile:26:\n `HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \\\r\n  CMD wget -q --spider http://localhost:18790/health || exit 1\r\n\r\n# Copy binary\r\nCOPY --from=builder /src/build/picoclaw /usr/local/bin/picoclaw\r\n\r\n# Create non-root user and group\r\nRUN addgroup -g 1000 picoclaw && \\\r\n    adduser -D -u 1000 -G picoclaw picoclaw\r\n\r\n# Switch to non-root user\r\nUSER picoclaw\r\n\r\n# Run onboard to create initial directories and config\r\nRUN /usr/local/bin/picoclaw onboard\r\n\r\nENTRYPOINT [\"picoclaw\"]\r\nCMD [\"gateway\"]` was unexpected","path":"docker\\Dockerfile","spans":[{"file":"docker\\Dockerfile","start":{"line":26,"col":1,"offset":0},"end":{"line":43,"col":16,"offset":517}}]}],"paths":{"scanned":[".dockerignore",".env.example",".github\\dependabot.yml",".github\\ISSUE_TEMPLATE\\bug_report.md",".github\\ISSUE_TEMPLATE\\feature_request.md",".github\\ISSUE_TEMPLATE\\general-task---todo.md",".github\\pull_request_template.md",".github\\workflows\\build.yml",".github\\workflows\\docker-build.yml",".github\\workflows\\nightly.yml",".github\\workflows\\pr.yml",".github\\workflows\\release.yml",".github\\workflows\\upload-tos.yml",".gitignore",".golangci.yaml",".goreleaser.yaml","assets\\arch.jpg","assets\\clawdchat-icon.png","assets\\compare.jpg","assets\\hardware-banner.jpg","assets\\launcher-tui.jpg","assets\\launcher-webui.jpg","assets\\licheervnano.png","assets\\logo.jpg","assets\\logo.webp","assets\\macos-gatekeeper-allow.jpg","assets\\macos-gatekeeper-warning.jpg","assets\\picoclaw_search.gif","assets\\termux.jpg","assets\\wechat.png","assets\\wecom-qr-binding.jpg","cmd\\picoclaw\\dns_noresolv.go","cmd\\picoclaw\\internal\\agent\\command.go","cmd\\picoclaw\\internal\\agent\\helpers.go","cmd\\picoclaw\\internal\\auth\\command.go","cmd\\picoclaw\\internal\\auth\\helpers.go","cmd\\picoclaw\\internal\\auth\\login.go","cmd\\picoclaw\\internal\\auth\\logout.go","cmd\\picoclaw\\internal\\auth\\models.go","cmd\\picoclaw\\internal\\auth\\status.go","cmd\\picoclaw\\internal\\auth\\wecom.go","cmd\\picoclaw\\internal\\auth\\weixin.go","cmd\\picoclaw\\internal\\cron\\add.go","cmd\\picoclaw\\internal\\cron\\command.go","cmd\\picoclaw\\internal\\cron\\disable.go","cmd\\picoclaw\\internal\\cron\\enable.go","cmd\\picoclaw\\internal\\cron\\helpers.go","cmd\\picoclaw\\internal\\cron\\list.go","cmd\\picoclaw\\internal\\cron\\remove.go","cmd\\picoclaw\\internal\\gateway\\command.go","cmd\\picoclaw\\internal\\helpers.go","cmd\\picoclaw\\internal\\migrate\\command.go","cmd\\picoclaw\\internal\\model\\command.go","cmd\\picoclaw\\internal\\onboard\\command.go","cmd\\picoclaw\\internal\\onboard\\helpers.go","cmd\\picoclaw\\internal\\skills\\command.go","cmd\\picoclaw\\internal\\skills\\helpers.go","cmd\\picoclaw\\internal\\skills\\install.go","cmd\\picoclaw\\internal\\skills\\installbuiltin.go","cmd\\picoclaw\\internal\\skills\\list.go","cmd\\picoclaw\\internal\\skills\\listbuiltin.go","cmd\\picoclaw\\internal\\skills\\remove.go","cmd\\picoclaw\\internal\\skills\\search.go","cmd\\picoclaw\\internal\\skills\\show.go","cmd\\picoclaw\\internal\\status\\command.go","cmd\\picoclaw\\internal\\status\\helpers.go","cmd\\picoclaw\\internal\\version\\command.go","cmd\\picoclaw\\main.go","cmd\\picoclaw-launcher-tui\\config\\config.go","cmd\\picoclaw-launcher-tui\\main.go","cmd\\picoclaw-launcher-tui\\README.md","cmd\\picoclaw-launcher-tui\\ui\\app.go","cmd\\picoclaw-launcher-tui\\ui\\channels.go","cmd\\picoclaw-launcher-tui\\ui\\gateway.go","cmd\\picoclaw-launcher-tui\\ui\\home.go","cmd\\picoclaw-launcher-tui\\ui\\models.go","cmd\\picoclaw-launcher-tui\\ui\\schemes.go","cmd\\picoclaw-launcher-tui\\ui\\users.go","config\\config.example.json","CONTRIBUTING.md","CONTRIBUTING.zh.md","docker\\docker-compose.full.yml","docker\\docker-compose.yml","docker\\Dockerfile","docker\\Dockerfile.full","docker\\Dockerfile.goreleaser","docker\\Dockerfile.goreleaser.launcher","docker\\Dockerfile.heavy","docker\\entrypoint.sh","docs\\agent-refactor\\context.md","docs\\agent-refactor\\README.md","docs\\ANTIGRAVITY_AUTH.md","docs\\ANTIGRAVITY_USAGE.md","docs\\channels\\dingtalk\\README.fr.md","docs\\channels\\dingtalk\\README.ja.md","docs\\channels\\dingtalk\\README.md","docs\\channels\\dingtalk\\README.pt-br.md","docs\\channels\\dingtalk\\README.vi.md","docs\\channels\\dingtalk\\README.zh.md","docs\\channels\\discord\\README.fr.md","docs\\channels\\discord\\README.ja.md","docs\\channels\\discord\\README.md","docs\\channels\\discord\\README.pt-br.md","docs\\channels\\discord\\README.vi.md","docs\\channels\\discord\\README.zh.md","docs\\channels\\feishu\\README.fr.md","docs\\channels\\feishu\\README.ja.md","docs\\channels\\feishu\\README.md","docs\\channels\\feishu\\README.pt-br.md","docs\\channels\\feishu\\README.vi.md","docs\\channels\\feishu\\README.zh.md","docs\\channels\\line\\README.fr.md","docs\\channels\\line\\README.ja.md","docs\\channels\\line\\README.md","docs\\channels\\line\\README.pt-br.md","docs\\channels\\line\\README.vi.md","docs\\channels\\line\\README.zh.md","docs\\channels\\maixcam\\README.fr.md","docs\\channels\\maixcam\\README.ja.md","docs\\channels\\maixcam\\README.md","docs\\channels\\maixcam\\README.pt-br.md","docs\\channels\\maixcam\\README.vi.md","docs\\channels\\maixcam\\README.zh.md","docs\\channels\\matrix\\README.fr.md","docs\\channels\\matrix\\README.ja.md","docs\\channels\\matrix\\README.md","docs\\channels\\matrix\\README.pt-br.md","docs\\channels\\matrix\\README.vi.md","docs\\channels\\matrix\\README.zh.md","docs\\channels\\onebot\\README.fr.md","docs\\channels\\onebot\\README.ja.md","docs\\channels\\onebot\\README.md","docs\\channels\\onebot\\README.pt-br.md","docs\\channels\\onebot\\README.vi.md","docs\\channels\\onebot\\README.zh.md","docs\\channels\\qq\\README.fr.md","docs\\channels\\qq\\README.ja.md","docs\\channels\\qq\\README.md","docs\\channels\\qq\\README.pt-br.md","docs\\channels\\qq\\README.vi.md","docs\\channels\\qq\\README.zh.md","docs\\channels\\slack\\README.fr.md","docs\\channels\\slack\\README.ja.md","docs\\channels\\slack\\README.md","docs\\channels\\slack\\README.pt-br.md","docs\\channels\\slack\\README.vi.md","docs\\channels\\slack\\README.zh.md","docs\\channels\\telegram\\README.fr.md","docs\\channels\\telegram\\README.ja.md","docs\\channels\\telegram\\README.md","docs\\channels\\telegram\\README.pt-br.md","docs\\channels\\telegram\\README.vi.md","docs\\channels\\telegram\\README.zh.md","docs\\channels\\wecom\\README.fr.md","docs\\channels\\wecom\\README.ja.md","docs\\channels\\wecom\\README.md","docs\\channels\\wecom\\README.pt-br.md","docs\\channels\\wecom\\README.vi.md","docs\\channels\\wecom\\README.zh.md","docs\\channels\\weixin\\README.md","docs\\channels\\weixin\\README.zh.md","docs\\chat-apps.md","docs\\config-versioning.md","docs\\configuration.md","docs\\credential_encryption.md","docs\\cron.md","docs\\debug.md","docs\\design\\hook-system-design.zh.md","docs\\design\\issue-783-investigation-and-fix-plan.zh.md","docs\\design\\provider-refactoring-tests.md","docs\\design\\provider-refactoring.md","docs\\design\\steering-spec.md","docs\\docker.md","docs\\fr\\ANTIGRAVITY_AUTH.md","docs\\fr\\ANTIGRAVITY_USAGE.md","docs\\fr\\chat-apps.md","docs\\fr\\configuration.md","docs\\fr\\credential_encryption.md","docs\\fr\\debug.md","docs\\fr\\docker.md","docs\\fr\\hardware-compatibility.md","docs\\fr\\providers.md","docs\\fr\\spawn-tasks.md","docs\\fr\\tools_configuration.md","docs\\fr\\troubleshooting.md","docs\\hardware-compatibility.md","docs\\hooks\\README.md","docs\\hooks\\README.zh.md","docs\\it\\configuration.md","docs\\ja\\ANTIGRAVITY_AUTH.md","docs\\ja\\ANTIGRAVITY_USAGE.md","docs\\ja\\chat-apps.md","docs\\ja\\configuration.md","docs\\ja\\credential_encryption.md","docs\\ja\\debug.md","docs\\ja\\docker.md","docs\\ja\\hardware-compatibility.md","docs\\ja\\providers.md","docs\\ja\\spawn-tasks.md","docs\\ja\\tools_configuration.md","docs\\ja\\troubleshooting.md","docs\\migration\\model-list-migration.md","docs\\my\\chat-apps.md","docs\\my\\configuration.md","docs\\my\\debug.md","docs\\my\\docker.md","docs\\my\\spawn-tasks.md","docs\\my\\troubleshooting.md","docs\\providers.md","docs\\pt-br\\ANTIGRAVITY_AUTH.md","docs\\pt-br\\ANTIGRAVITY_USAGE.md","docs\\pt-br\\chat-apps.md","docs\\pt-br\\configuration.md","docs\\pt-br\\credential_encryption.md","docs\\pt-br\\debug.md","docs\\pt-br\\docker.md","docs\\pt-br\\hardware-compatibility.md","docs\\pt-br\\providers.md","docs\\pt-br\\spawn-tasks.md","docs\\pt-br\\tools_configuration.md","docs\\pt-br\\troubleshooting.md","docs\\security_configuration.md","docs\\sensitive_data_filtering.md","docs\\spawn-tasks.md","docs\\steering.md","docs\\subturn.md","docs\\tools_configuration.md","docs\\troubleshooting.md","docs\\vi\\ANTIGRAVITY_AUTH.md","docs\\vi\\ANTIGRAVITY_USAGE.md","docs\\vi\\chat-apps.md","docs\\vi\\configuration.md","docs\\vi\\credential_encryption.md","docs\\vi\\debug.md","docs\\vi\\docker.md","docs\\vi\\hardware-compatibility.md","docs\\vi\\providers.md","docs\\vi\\spawn-tasks.md","docs\\vi\\tools_configuration.md","docs\\vi\\troubleshooting.md","docs\\zh\\ANTIGRAVITY_AUTH.md","docs\\zh\\ANTIGRAVITY_USAGE.md","docs\\zh\\chat-apps.md","docs\\zh\\configuration.md","docs\\zh\\credential_encryption.md","docs\\zh\\debug.md","docs\\zh\\docker.md","docs\\zh\\hardware-compatibility.md","docs\\zh\\providers.md","docs\\zh\\sensitive_data_filtering.md","docs\\zh\\spawn-tasks.md","docs\\zh\\tools_configuration.md","docs\\zh\\troubleshooting.md","examples\\pico-echo-server\\main.go","examples\\pico-echo-server\\README.md","go.mod","go.sum","LICENSE","Makefile","pkg\\agent\\context.go","pkg\\agent\\context_budget.go","pkg\\agent\\definition.go","pkg\\agent\\eventbus.go","pkg\\agent\\events.go","pkg\\agent\\hook_mount.go","pkg\\agent\\hook_process.go","pkg\\agent\\hooks.go","pkg\\agent\\instance.go","pkg\\agent\\loop.go","pkg\\agent\\loop_mcp.go","pkg\\agent\\loop_media.go","pkg\\agent\\memory.go","pkg\\agent\\model_resolution.go","pkg\\agent\\registry.go","pkg\\agent\\steering.go","pkg\\agent\\subturn.go","pkg\\agent\\thinking.go","pkg\\agent\\turn.go","pkg\\audio\\asr\\agent.go","pkg\\audio\\asr\\asr.go","pkg\\audio\\asr\\audio_model_transcriber.go","pkg\\audio\\asr\\elevenlabs_transcriber.go","pkg\\audio\\asr\\README.md","pkg\\audio\\asr\\README_zh.md","pkg\\audio\\asr\\whisper_transcriber.go","pkg\\audio\\ogg.go","pkg\\audio\\sentence.go","pkg\\audio\\tts\\mimo_tts.go","pkg\\audio\\tts\\openai_tts.go","pkg\\audio\\tts\\README.md","pkg\\audio\\tts\\README_zh.md","pkg\\audio\\tts\\tts.go","pkg\\auth\\anthropic_usage.go","pkg\\auth\\oauth.go","pkg\\auth\\pkce.go","pkg\\auth\\store.go","pkg\\auth\\token.go","pkg\\bus\\bus.go","pkg\\bus\\types.go","pkg\\channels\\base.go","pkg\\channels\\dingtalk\\dingtalk.go","pkg\\channels\\dingtalk\\init.go","pkg\\channels\\discord\\discord.go","pkg\\channels\\discord\\init.go","pkg\\channels\\discord\\voice.go","pkg\\channels\\dynamic_mux.go","pkg\\channels\\errors.go","pkg\\channels\\errutil.go","pkg\\channels\\feishu\\common.go","pkg\\channels\\feishu\\feishu_32.go","pkg\\channels\\feishu\\feishu_64.go","pkg\\channels\\feishu\\init.go","pkg\\channels\\feishu\\token_cache.go","pkg\\channels\\interfaces.go","pkg\\channels\\irc\\handler.go","pkg\\channels\\irc\\init.go","pkg\\channels\\irc\\irc.go","pkg\\channels\\line\\init.go","pkg\\channels\\line\\line.go","pkg\\channels\\maixcam\\init.go","pkg\\channels\\maixcam\\maixcam.go","pkg\\channels\\manager.go","pkg\\channels\\manager_channel.go","pkg\\channels\\marker.go","pkg\\channels\\matrix\\init.go","pkg\\channels\\matrix\\matrix.go","pkg\\channels\\media.go","pkg\\channels\\onebot\\init.go","pkg\\channels\\onebot\\onebot.go","pkg\\channels\\pico\\client.go","pkg\\channels\\pico\\init.go","pkg\\channels\\pico\\pico.go","pkg\\channels\\pico\\protocol.go","pkg\\channels\\qq\\audio_duration.go","pkg\\channels\\qq\\botgo_logger.go","pkg\\channels\\qq\\init.go","pkg\\channels\\qq\\qq.go","pkg\\channels\\README.md","pkg\\channels\\README.zh.md","pkg\\channels\\registry.go","pkg\\channels\\slack\\init.go","pkg\\channels\\slack\\slack.go","pkg\\channels\\split.go","pkg\\channels\\telegram\\command_registration.go","pkg\\channels\\telegram\\init.go","pkg\\channels\\telegram\\parse_markdown_to_md_v2.go","pkg\\channels\\telegram\\parser_markdown_to_html.go","pkg\\channels\\telegram\\telegram.go","pkg\\channels\\telegram\\testdata\\md2_all_formats.txt","pkg\\channels\\voice_capabilities.go","pkg\\channels\\webhook.go","pkg\\channels\\wecom\\init.go","pkg\\channels\\wecom\\media.go","pkg\\channels\\wecom\\protocol.go","pkg\\channels\\wecom\\reqid_store.go","pkg\\channels\\wecom\\wecom.go","pkg\\channels\\weixin\\api.go","pkg\\channels\\weixin\\auth.go","pkg\\channels\\weixin\\media.go","pkg\\channels\\weixin\\state.go","pkg\\channels\\weixin\\types.go","pkg\\channels\\weixin\\weixin.go","pkg\\channels\\whatsapp\\init.go","pkg\\channels\\whatsapp\\whatsapp.go","pkg\\channels\\whatsapp_native\\init.go","pkg\\channels\\whatsapp_native\\whatsapp_native.go","pkg\\channels\\whatsapp_native\\whatsapp_native_stub.go","pkg\\commands\\builtin.go","pkg\\commands\\cmd_check.go","pkg\\commands\\cmd_clear.go","pkg\\commands\\cmd_help.go","pkg\\commands\\cmd_list.go","pkg\\commands\\cmd_reload.go","pkg\\commands\\cmd_show.go","pkg\\commands\\cmd_start.go","pkg\\commands\\cmd_subagents.go","pkg\\commands\\cmd_switch.go","pkg\\commands\\cmd_use.go","pkg\\commands\\definition.go","pkg\\commands\\executor.go","pkg\\commands\\handler_agents.go","pkg\\commands\\registry.go","pkg\\commands\\request.go","pkg\\commands\\runtime.go","pkg\\config\\config.go","pkg\\config\\config_old.go","pkg\\config\\config_struct.go","pkg\\config\\defaults.go","pkg\\config\\envkeys.go","pkg\\config\\example_security_usage.go","pkg\\config\\gateway.go","pkg\\config\\migration.go","pkg\\config\\security.go","pkg\\config\\version.go","pkg\\constants\\channels.go","pkg\\credential\\credential.go","pkg\\credential\\keygen.go","pkg\\credential\\store.go","pkg\\cron\\service.go","pkg\\devices\\events\\events.go","pkg\\devices\\service.go","pkg\\devices\\source.go","pkg\\devices\\sources\\usb_linux.go","pkg\\devices\\sources\\usb_stub.go","pkg\\env.go","pkg\\fileutil\\file.go","pkg\\gateway\\channel_matrix.go","pkg\\gateway\\gateway.go","pkg\\health\\server.go","pkg\\heartbeat\\service.go","pkg\\identity\\identity.go","pkg\\logger\\logger.go","pkg\\logger\\logger_3rd_party.go","pkg\\logger\\panic.go","pkg\\logger\\panic_unix.go","pkg\\logger\\panic_win.go","pkg\\mcp\\manager.go","pkg\\media\\store.go","pkg\\media\\tempdir.go","pkg\\memory\\jsonl.go","pkg\\memory\\migration.go","pkg\\memory\\store.go","pkg\\migrate\\internal\\common.go","pkg\\migrate\\internal\\types.go","pkg\\migrate\\migrate.go","pkg\\migrate\\sources\\openclaw\\common.go","pkg\\migrate\\sources\\openclaw\\openclaw_config.go","pkg\\migrate\\sources\\openclaw\\openclaw_handler.go","pkg\\pid\\pidfile.go","pkg\\pid\\pidfile_unix.go","pkg\\pid\\pidfile_windows.go","pkg\\providers\\anthropic\\provider.go","pkg\\providers\\anthropic_messages\\provider.go","pkg\\providers\\antigravity_provider.go","pkg\\providers\\azure\\provider.go","pkg\\providers\\bedrock\\provider_bedrock.go","pkg\\providers\\bedrock\\provider_stub.go","pkg\\providers\\claude_cli_provider.go","pkg\\providers\\claude_provider.go","pkg\\providers\\codex_cli_credentials.go","pkg\\providers\\codex_cli_provider.go","pkg\\providers\\codex_provider.go","pkg\\providers\\common\\common.go","pkg\\providers\\cooldown.go","pkg\\providers\\error_classifier.go","pkg\\providers\\factory.go","pkg\\providers\\factory_provider.go","pkg\\providers\\fallback.go","pkg\\providers\\github_copilot_provider.go","pkg\\providers\\http_provider.go","pkg\\providers\\legacy_provider.go","pkg\\providers\\model_ref.go","pkg\\providers\\openai_compat\\provider.go","pkg\\providers\\openai_responses_common\\responses_common.go","pkg\\providers\\protocoltypes\\types.go","pkg\\providers\\tool_call_extract.go","pkg\\providers\\toolcall_utils.go","pkg\\providers\\types.go","pkg\\routing\\agent_id.go","pkg\\routing\\classifier.go","pkg\\routing\\features.go","pkg\\routing\\route.go","pkg\\routing\\router.go","pkg\\routing\\session_key.go","pkg\\session\\jsonl_backend.go","pkg\\session\\manager.go","pkg\\session\\session_store.go","pkg\\skills\\clawhub_registry.go","pkg\\skills\\installer.go","pkg\\skills\\loader.go","pkg\\skills\\registry.go","pkg\\skills\\search_cache.go","pkg\\state\\state.go","pkg\\tools\\base.go","pkg\\tools\\cron.go","pkg\\tools\\edit.go","pkg\\tools\\filesystem.go","pkg\\tools\\i2c.go","pkg\\tools\\i2c_linux.go","pkg\\tools\\i2c_other.go","pkg\\tools\\load_image.go","pkg\\tools\\mcp_tool.go","pkg\\tools\\message.go","pkg\\tools\\normalization.go","pkg\\tools\\reaction.go","pkg\\tools\\registry.go","pkg\\tools\\result.go","pkg\\tools\\search_tool.go","pkg\\tools\\send_file.go","pkg\\tools\\session.go","pkg\\tools\\session_process_unix.go","pkg\\tools\\session_process_windows.go","pkg\\tools\\shell.go","pkg\\tools\\shell_process_unix.go","pkg\\tools\\shell_process_windows.go","pkg\\tools\\skills_install.go","pkg\\tools\\skills_search.go","pkg\\tools\\spawn.go","pkg\\tools\\spawn_status.go","pkg\\tools\\spi.go","pkg\\tools\\spi_linux.go","pkg\\tools\\spi_other.go","pkg\\tools\\subagent.go","pkg\\tools\\sysproc_unix.go","pkg\\tools\\sysproc_windows.go","pkg\\tools\\toolloop.go","pkg\\tools\\tts_send.go","pkg\\tools\\types.go","pkg\\tools\\validate.go","pkg\\tools\\web.go","pkg\\utils\\bm25.go","pkg\\utils\\context.go","pkg\\utils\\download.go","pkg\\utils\\http_client.go","pkg\\utils\\http_retry.go","pkg\\utils\\markdown.go","pkg\\utils\\media.go","pkg\\utils\\skills.go","pkg\\utils\\string.go","pkg\\utils\\zip.go","README.fr.md","README.id.md","README.it.md","README.ja.md","README.md","README.my.md","README.pt-br.md","README.vi.md","README.zh.md","ROADMAP.md","scripts\\build-macos-app.sh","scripts\\icon.icns","scripts\\setup.iss","scripts\\test-docker-mcp.sh","scripts\\test-irc.sh","web\\backend\\.gitignore","web\\backend\\api\\auth.go","web\\backend\\api\\auth_login_limiter.go","web\\backend\\api\\channels.go","web\\backend\\api\\config.go","web\\backend\\api\\gateway.go","web\\backend\\api\\gateway_host.go","web\\backend\\api\\launcher_config.go","web\\backend\\api\\log.go","web\\backend\\api\\model_status.go","web\\backend\\api\\models.go","web\\backend\\api\\oauth.go","web\\backend\\api\\pico.go","web\\backend\\api\\router.go","web\\backend\\api\\session.go","web\\backend\\api\\skills.go","web\\backend\\api\\startup.go","web\\backend\\api\\tools.go","web\\backend\\api\\version.go","web\\backend\\api\\wecom.go","web\\backend\\api\\weixin.go","web\\backend\\app_runtime.go","web\\backend\\embed.go","web\\backend\\i18n.go","web\\backend\\icon.ico","web\\backend\\icon.png","web\\backend\\launcherconfig\\config.go","web\\backend\\main.go","web\\backend\\middleware\\access_control.go","web\\backend\\middleware\\launcher_dashboard_auth.go","web\\backend\\middleware\\middleware.go","web\\backend\\middleware\\referrer_policy.go","web\\backend\\model\\status.go","web\\backend\\systray.go","web\\backend\\systray_icon_nonwindows.go","web\\backend\\systray_icon_windows.go","web\\backend\\systray_stub_nocgo.go","web\\backend\\tray_offers_copy.go","web\\backend\\tray_offers_copy_stub.go","web\\backend\\utils\\banner.go","web\\backend\\utils\\onboard.go","web\\backend\\utils\\runtime.go","web\\backend\\winres\\winres.json","web\\frontend\\.editorconfig","web\\frontend\\.gitignore","web\\frontend\\.prettierignore","web\\frontend\\components.json","web\\frontend\\eslint.config.js","web\\frontend\\index.html","web\\frontend\\package.json","web\\frontend\\pnpm-lock.yaml","web\\frontend\\prettier.config.js","web\\frontend\\public\\apple-touch-icon.png","web\\frontend\\public\\favicon-96x96.png","web\\frontend\\public\\favicon.ico","web\\frontend\\public\\favicon.svg","web\\frontend\\public\\lark.svg","web\\frontend\\public\\logo_with_text.png","web\\frontend\\public\\site.webmanifest","web\\frontend\\public\\web-app-manifest-192x192.png","web\\frontend\\public\\web-app-manifest-512x512.png","web\\frontend\\scripts\\ensure-backend-gitkeep.cjs","web\\frontend\\src\\api\\channels.ts","web\\frontend\\src\\api\\gateway.ts","web\\frontend\\src\\api\\http.ts","web\\frontend\\src\\api\\launcher-auth.ts","web\\frontend\\src\\api\\models.ts","web\\frontend\\src\\api\\oauth.ts","web\\frontend\\src\\api\\pico.ts","web\\frontend\\src\\api\\sessions.ts","web\\frontend\\src\\api\\skills.ts","web\\frontend\\src\\api\\system.ts","web\\frontend\\src\\api\\tools.ts","web\\frontend\\src\\components\\agent\\hub\\hub-page.tsx","web\\frontend\\src\\components\\agent\\hub\\market-skill-card.tsx","web\\frontend\\src\\components\\agent\\hub\\results-panel.tsx","web\\frontend\\src\\components\\agent\\hub\\search-panel.tsx","web\\frontend\\src\\components\\agent\\hub\\tool-support.ts","web\\frontend\\src\\components\\agent\\hub\\use-hub-marketplace.ts","web\\frontend\\src\\components\\agent\\skills\\delete-dialog.tsx","web\\frontend\\src\\components\\agent\\skills\\detail-sheet.tsx","web\\frontend\\src\\components\\agent\\skills\\filter-bar.tsx","web\\frontend\\src\\components\\agent\\skills\\import-dialog.tsx","web\\frontend\\src\\components\\agent\\skills\\origin-badge.tsx","web\\frontend\\src\\components\\agent\\skills\\origin-utils.ts","web\\frontend\\src\\components\\agent\\skills\\page-skeleton.tsx","web\\frontend\\src\\components\\agent\\skills\\skill-card.tsx","web\\frontend\\src\\components\\agent\\skills\\skills-list.tsx","web\\frontend\\src\\components\\agent\\skills\\skills-page.tsx","web\\frontend\\src\\components\\agent\\skills\\stats.tsx","web\\frontend\\src\\components\\agent\\skills\\types.ts","web\\frontend\\src\\components\\agent\\skills\\use-skills-page.ts","web\\frontend\\src\\components\\agent\\tools\\tools-page.tsx","web\\frontend\\src\\components\\app-header.tsx","web\\frontend\\src\\components\\app-layout.tsx","web\\frontend\\src\\components\\app-sidebar.tsx","web\\frontend\\src\\components\\channels\\channel-config-page.tsx","web\\frontend\\src\\components\\channels\\channel-display-name.ts","web\\frontend\\src\\components\\channels\\channel-forms\\discord-form.tsx","web\\frontend\\src\\components\\channels\\channel-forms\\feishu-form.tsx","web\\frontend\\src\\components\\channels\\channel-forms\\generic-form.tsx","web\\frontend\\src\\components\\channels\\channel-forms\\slack-form.tsx","web\\frontend\\src\\components\\channels\\channel-forms\\telegram-form.tsx","web\\frontend\\src\\components\\channels\\channel-forms\\wecom-form.tsx","web\\frontend\\src\\components\\channels\\channel-forms\\weixin-form.tsx","web\\frontend\\src\\components\\chat\\assistant-message.tsx","web\\frontend\\src\\components\\chat\\chat-composer.tsx","web\\frontend\\src\\components\\chat\\chat-empty-state.tsx","web\\frontend\\src\\components\\chat\\chat-page.tsx","web\\frontend\\src\\components\\chat\\model-selector.tsx","web\\frontend\\src\\components\\chat\\session-history-menu.tsx","web\\frontend\\src\\components\\chat\\typing-indicator.tsx","web\\frontend\\src\\components\\chat\\user-message.tsx","web\\frontend\\src\\components\\config\\config-page.tsx","web\\frontend\\src\\components\\config\\config-sections.tsx","web\\frontend\\src\\components\\config\\form-model.ts","web\\frontend\\src\\components\\config\\raw-config-page.tsx","web\\frontend\\src\\components\\credentials\\anthropic-credential-card.tsx","web\\frontend\\src\\components\\credentials\\antigravity-credential-card.tsx","web\\frontend\\src\\components\\credentials\\credential-card.tsx","web\\frontend\\src\\components\\credentials\\credentials-page.tsx","web\\frontend\\src\\components\\credentials\\device-code-sheet.tsx","web\\frontend\\src\\components\\credentials\\logout-confirm-dialog.tsx","web\\frontend\\src\\components\\credentials\\openai-credential-card.tsx","web\\frontend\\src\\components\\credentials\\provider-status-line.tsx","web\\frontend\\src\\components\\logs\\ansi-log-line.tsx","web\\frontend\\src\\components\\logs\\log-level-select.tsx","web\\frontend\\src\\components\\logs\\logs-page.tsx","web\\frontend\\src\\components\\logs\\logs-panel.tsx","web\\frontend\\src\\components\\models\\add-model-sheet.tsx","web\\frontend\\src\\components\\models\\delete-model-dialog.tsx","web\\frontend\\src\\components\\models\\edit-model-sheet.tsx","web\\frontend\\src\\components\\models\\model-card.tsx","web\\frontend\\src\\components\\models\\models-page.tsx","web\\frontend\\src\\components\\models\\provider-icon.tsx","web\\frontend\\src\\components\\models\\provider-label.ts","web\\frontend\\src\\components\\models\\provider-section.tsx","web\\frontend\\src\\components\\page-header.tsx","web\\frontend\\src\\components\\secret-placeholder.ts","web\\frontend\\src\\components\\shared-form.tsx","web\\frontend\\src\\components\\tour\\tour-guide.tsx","web\\frontend\\src\\components\\ui\\alert-dialog.tsx","web\\frontend\\src\\components\\ui\\button.tsx","web\\frontend\\src\\components\\ui\\card.tsx","web\\frontend\\src\\components\\ui\\collapsible.tsx","web\\frontend\\src\\components\\ui\\dialog.tsx","web\\frontend\\src\\components\\ui\\dropdown-menu.tsx","web\\frontend\\src\\components\\ui\\field.tsx","web\\frontend\\src\\components\\ui\\input.tsx","web\\frontend\\src\\components\\ui\\label.tsx","web\\frontend\\src\\components\\ui\\scroll-area.tsx","web\\frontend\\src\\components\\ui\\select.tsx","web\\frontend\\src\\components\\ui\\separator.tsx","web\\frontend\\src\\components\\ui\\sheet.tsx","web\\frontend\\src\\components\\ui\\sidebar.tsx","web\\frontend\\src\\components\\ui\\skeleton.tsx","web\\frontend\\src\\components\\ui\\switch.tsx","web\\frontend\\src\\components\\ui\\textarea.tsx","web\\frontend\\src\\components\\ui\\tooltip.tsx","web\\frontend\\src\\features\\chat\\controller.ts","web\\frontend\\src\\features\\chat\\history.ts","web\\frontend\\src\\features\\chat\\protocol.ts","web\\frontend\\src\\features\\chat\\state.ts","web\\frontend\\src\\features\\chat\\websocket.ts","web\\frontend\\src\\hooks\\use-chat-models.ts","web\\frontend\\src\\hooks\\use-credentials-page.ts","web\\frontend\\src\\hooks\\use-gateway-logs.ts","web\\frontend\\src\\hooks\\use-gateway.ts","web\\frontend\\src\\hooks\\use-log-wrap-columns.ts","web\\frontend\\src\\hooks\\use-mobile.ts","web\\frontend\\src\\hooks\\use-pico-chat.ts","web\\frontend\\src\\hooks\\use-session-history.ts","web\\frontend\\src\\hooks\\use-sidebar-channels.ts","web\\frontend\\src\\hooks\\use-theme.ts","web\\frontend\\src\\i18n\\index.ts","web\\frontend\\src\\i18n\\locales\\en.json","web\\frontend\\src\\i18n\\locales\\zh.json","web\\frontend\\src\\index.css","web\\frontend\\src\\lib\\ansi-log.ts","web\\frontend\\src\\lib\\launcher-login-path.ts","web\\frontend\\src\\lib\\utils.ts","web\\frontend\\src\\main.tsx","web\\frontend\\src\\routes\\__root.tsx","web\\frontend\\src\\routes\\agent\\hub.tsx","web\\frontend\\src\\routes\\agent\\skills.tsx","web\\frontend\\src\\routes\\agent\\tools.tsx","web\\frontend\\src\\routes\\agent.tsx","web\\frontend\\src\\routes\\channels\\$name.tsx","web\\frontend\\src\\routes\\channels\\route.tsx","web\\frontend\\src\\routes\\config.raw.tsx","web\\frontend\\src\\routes\\config.tsx","web\\frontend\\src\\routes\\credentials.tsx","web\\frontend\\src\\routes\\index.tsx","web\\frontend\\src\\routes\\launcher-login.tsx","web\\frontend\\src\\routes\\logs.tsx","web\\frontend\\src\\routes\\models.tsx","web\\frontend\\src\\routeTree.gen.ts","web\\frontend\\src\\store\\chat.ts","web\\frontend\\src\\store\\gateway.ts","web\\frontend\\src\\store\\index.ts","web\\frontend\\src\\store\\tour.ts","web\\frontend\\tsconfig.app.json","web\\frontend\\tsconfig.json","web\\frontend\\tsconfig.node.json","web\\frontend\\vite.config.ts","web\\Makefile","web\\picoclaw-launcher.desktop","web\\picoclaw-launcher.png","web\\README.md","workspace\\AGENT.md","workspace\\memory\\MEMORY.md","workspace\\skills\\agent-browser\\SKILL.md","workspace\\skills\\github\\SKILL.md","workspace\\skills\\hardware\\references\\board-pinout.md","workspace\\skills\\hardware\\references\\common-devices.md","workspace\\skills\\hardware\\SKILL.md","workspace\\skills\\skill-creator\\SKILL.md","workspace\\skills\\summarize\\SKILL.md","workspace\\skills\\tmux\\scripts\\find-sessions.sh","workspace\\skills\\tmux\\scripts\\wait-for-text.sh","workspace\\skills\\tmux\\SKILL.md","workspace\\skills\\weather\\SKILL.md","workspace\\SOUL.md","workspace\\USER.md"]},"time":{"rules":[],"rules_parse_time":2.3305416107177734,"profiling_times":{"config_time":6.415969610214233,"core_time":16.03564476966858,"ignores_time":0.002691030502319336,"total_time":22.488075017929077},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":104.16233086585999,"per_file_time":{"mean":0.05138743505962508,"std_dev":0.05220474903836141},"very_slow_stats":{"time_ratio":0.24261806069453226,"count_ratio":0.00493339911198816},"very_slow_files":[{"fpath":"web\\backend\\api\\oauth.go","ftime":1.5096302032470703},{"fpath":"pkg\\channels\\weixin\\media.go","ftime":1.7587566375732422},{"fpath":"web\\backend\\api\\skills.go","ftime":1.8493969440460205},{"fpath":"pkg\\providers\\antigravity_provider.go","ftime":1.8835182189941406},{"fpath":"web\\backend\\api\\gateway.go","ftime":1.901230812072754},{"fpath":"pkg\\tools\\shell.go","ftime":2.1514546871185303},{"fpath":"pkg\\tools\\web.go","ftime":2.420888900756836},{"fpath":"pkg\\config\\config.go","ftime":3.6164705753326416},{"fpath":"pkg\\channels\\feishu\\feishu_64.go","ftime":3.727969169616699},{"fpath":"pkg\\agent\\loop.go","ftime":4.452346563339233}]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\agent\\loop.go:1653:21 [rules: 3, first: go.lang.security.injection.tainted-sql-string.tainted-sql-string]","location":{"path":"pkg\\agent\\loop.go","start":{"line":1653,"col":22,"offset":52620},"end":{"line":1653,"col":29,"offset":52627}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\agent\\loop.go:3077:21 [rules: 1, first: go.lang.security.injection.tainted-url-host.tainted-url-host]","location":{"path":"pkg\\agent\\loop.go","start":{"line":3077,"col":22,"offset":99376},"end":{"line":3077,"col":38,"offset":99392}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\agent\\loop.go:857:21 [rules: 1, first: go.lang.security.injection.tainted-sql-string.tainted-sql-string]","location":{"path":"pkg\\agent\\loop.go","start":{"line":857,"col":22,"offset":27597},"end":{"line":857,"col":30,"offset":27605}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\agent\\loop.go:972:21 [rules: 1, first: go.lang.security.injection.tainted-url-host.tainted-url-host]","location":{"path":"pkg\\agent\\loop.go","start":{"line":972,"col":22,"offset":31849},"end":{"line":972,"col":45,"offset":31872}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\audio\\asr\\elevenlabs_transcriber.go:42:32 [rules: 1, first: go.lang.security.injection.tainted-sql-string.tainted-sql-string]","location":{"path":"pkg\\audio\\asr\\elevenlabs_transcriber.go","start":{"line":42,"col":33,"offset":859},"end":{"line":42,"col":43,"offset":869}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\channels\\matrix\\matrix.go:642:24 [rules: 1, first: go.lang.security.filepath-clean-misuse.filepath-clean-misuse]","location":{"path":"pkg\\channels\\matrix\\matrix.go","start":{"line":642,"col":25,"offset":16532},"end":{"line":642,"col":43,"offset":16550}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\channels\\qq\\audio_duration.go:140:5 [rules: 1, first: go.lang.security.injection.tainted-sql-string.tainted-sql-string]","location":{"path":"pkg\\channels\\qq\\audio_duration.go","start":{"line":140,"col":6,"offset":2990},"end":{"line":140,"col":19,"offset":3003}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\channels\\telegram\\telegram.go:545:26 [rules: 1, first: go.lang.security.filepath-clean-misuse.filepath-clean-misuse]","location":{"path":"pkg\\channels\\telegram\\telegram.go","start":{"line":545,"col":27,"offset":16195},"end":{"line":545,"col":40,"offset":16208}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\channels\\wecom\\wecom.go:478:23 [rules: 1, first: go.lang.security.injection.tainted-sql-string.tainted-sql-string]","location":{"path":"pkg\\channels\\wecom\\wecom.go","start":{"line":478,"col":24,"offset":11433},"end":{"line":478,"col":40,"offset":11449}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\channels\\weixin\\media.go:516:24 [rules: 1, first: go.lang.security.filepath-clean-misuse.filepath-clean-misuse]","location":{"path":"pkg\\channels\\weixin\\media.go","start":{"line":516,"col":25,"offset":13907},"end":{"line":516,"col":46,"offset":13928}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\providers\\anthropic_messages\\provider.go:152:5 [rules: 1, first: go.lang.security.injection.tainted-url-host.tainted-url-host]","location":{"path":"pkg\\providers\\anthropic_messages\\provider.go","start":{"line":152,"col":6,"offset":4482},"end":{"line":152,"col":22,"offset":4498}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\providers\\antigravity_provider.go:666:5 [rules: 1, first: go.lang.security.injection.tainted-sql-string.tainted-sql-string]","location":{"path":"pkg\\providers\\antigravity_provider.go","start":{"line":666,"col":6,"offset":19803},"end":{"line":666,"col":28,"offset":19825}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\tools\\i2c_linux.go:147:18 [rules: 1, first: go.lang.security.injection.raw-html-format.raw-html-format]","location":{"path":"pkg\\tools\\i2c_linux.go","start":{"line":147,"col":19,"offset":4683},"end":{"line":147,"col":29,"offset":4693}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\tools\\web.go:1197:23 [rules: 2, first: go.lang.security.injection.tainted-sql-string.tainted-sql-string]","location":{"path":"pkg\\tools\\web.go","start":{"line":1197,"col":24,"offset":31992},"end":{"line":1197,"col":31,"offset":31999}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at pkg\\tools\\web.go:805:30 [rules: 1, first: go.lang.security.injection.tainted-sql-string.tainted-sql-string]","location":{"path":"pkg\\tools\\web.go","start":{"line":805,"col":31,"offset":20176},"end":{"line":805,"col":37,"offset":20182}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at web\\backend\\api\\config.go:376:5 [rules: 1, first: go.lang.security.injection.raw-html-format.raw-html-format]","location":{"path":"web\\backend\\api\\config.go","start":{"line":376,"col":6,"offset":11602},"end":{"line":376,"col":31,"offset":11627}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at web\\backend\\api\\oauth.go:173:18 [rules: 1, first: go.lang.security.injection.raw-html-format.raw-html-format]","location":{"path":"web\\backend\\api\\oauth.go","start":{"line":173,"col":19,"offset":5334},"end":{"line":173,"col":35,"offset":5350}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at web\\backend\\api\\skills.go:171:18 [rules: 1, first: go.lang.security.injection.raw-html-format.raw-html-format]","location":{"path":"web\\backend\\api\\skills.go","start":{"line":171,"col":19,"offset":5374},"end":{"line":171,"col":37,"offset":5392}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at web\\frontend\\src\\components\\agent\\tools\\tools-page.tsx:29:16 [rules: 1, first: javascript.express.security.cors-misconfiguration.cors-misconfiguration]","location":{"path":"web\\frontend\\src\\components\\agent\\tools\\tools-page.tsx","start":{"line":29,"col":17,"offset":879},"end":{"line":29,"col":26,"offset":888}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at web\\frontend\\src\\components\\channels\\channel-forms\\generic-form.tsx:83:16 [rules: 2, first: javascript.express.security.injection.raw-html-format.raw-html-format]","location":{"path":"web\\frontend\\src\\components\\channels\\channel-forms\\generic-form.tsx","start":{"line":83,"col":17,"offset":2163},"end":{"line":83,"col":28,"offset":2174}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at web\\frontend\\src\\components\\config\\config-sections.tsx:214:16 [rules: 1, first: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration]","location":{"path":"web\\frontend\\src\\components\\config\\config-sections.tsx","start":{"line":214,"col":17,"offset":5773},"end":{"line":214,"col":28,"offset":5784}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at web\\frontend\\src\\components\\models\\add-model-sheet.tsx:64:16 [rules: 1, first: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration]","location":{"path":"web\\frontend\\src\\components\\models\\add-model-sheet.tsx","start":{"line":64,"col":17,"offset":1392},"end":{"line":64,"col":30,"offset":1405}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at web\\frontend\\src\\components\\models\\edit-model-sheet.tsx:46:16 [rules: 1, first: javascript.express.security.injection.raw-html-format.raw-html-format]","location":{"path":"web\\frontend\\src\\components\\models\\edit-model-sheet.tsx","start":{"line":46,"col":17,"offset":1098},"end":{"line":46,"col":31,"offset":1112}}},{"error_type":"Fixpoint timeout","severity":"warn","message":"Fixpoint timeout while performing taint analysis at web\\frontend\\src\\components\\tour\\tour-guide.tsx:28:16 [rules: 1, first: javascript.express.security.injection.raw-html-format.raw-html-format]","location":{"path":"web\\frontend\\src\\components\\tour\\tour-guide.tsx","start":{"line":28,"col":17,"offset":601},"end":{"line":28,"col":26,"offset":610}}}],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":0.9904360571637962,"rules_selected_ratio":0.04873580065958227,"rules_matched_ratio":0.04873580065958227},"targets":[],"total_bytes":0,"max_memory_bytes":1438573760},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]}
\ No newline at end of file