From 5cac2184c6d20a5dbe8811a23ca37de63c62adfd Mon Sep 17 00:00:00 2001 From: squid-protocol Date: Sun, 12 Jul 2026 09:49:33 -0400 Subject: [PATCH] fix(core): suppress final SAST false positives and clean CLI billboard - Updated inline `# galaxyscope:ignore` directives across core engines (detector, guidestar, state_rehydrator, chronometer, galaxyscope, cobol_refractor). - Silenced remaining false-positive alerts for RCE (`sec_high_risk_execution`), network I/O (`sec_io`), DB hooks (`sec_db_hooks`), LLM triggers (`llm_hooks`), and safety bypasses (`safety_bypasses`). - Stripped rogue Markdown brackets from the CLI billboard URL in `galaxyscope.py` to ensure a clean, natively clickable ANSI-formatted link in the terminal. --- gitgalaxy/cobol_refractor_controller.py | 2 +- gitgalaxy/core/detector.py | 3 +++ gitgalaxy/core/guidestar_lens.py | 5 ++++- gitgalaxy/core/state_rehydrator.py | 2 ++ gitgalaxy/galaxyscope.py | 4 ++-- gitgalaxy/metrics/chronometer.py | 2 +- 6 files changed, 13 insertions(+), 5 deletions(-) diff --git a/gitgalaxy/cobol_refractor_controller.py b/gitgalaxy/cobol_refractor_controller.py index bffaf2b9..b64d9fa5 100644 --- a/gitgalaxy/cobol_refractor_controller.py +++ b/gitgalaxy/cobol_refractor_controller.py @@ -6,7 +6,7 @@ # between high-speed RAM and SQLite3 to prevent OOM crashes. # ============================================================================== -# galaxyscope:ignore sec_db_hooks +# galaxyscope:ignore sec_db_hooks, sec_io, sec_high_risk_execution import argparse import sys diff --git a/gitgalaxy/core/detector.py b/gitgalaxy/core/detector.py index feeaae69..685f782f 100644 --- a/gitgalaxy/core/detector.py +++ b/gitgalaxy/core/detector.py @@ -7,6 +7,9 @@ # A copy of the license can be found in the LICENSE file in the root directory # of this project, or at https://polyformproject.org/licenses/noncommercial/1.0.0/ # ============================================================================== + +# galaxyscope:ignore sec_high_risk_execution + import re import math import logging diff --git a/gitgalaxy/core/guidestar_lens.py b/gitgalaxy/core/guidestar_lens.py index 42018eae..31d29a32 100644 --- a/gitgalaxy/core/guidestar_lens.py +++ b/gitgalaxy/core/guidestar_lens.py @@ -5,8 +5,11 @@ # This source code is licensed under the PolyForm Noncommercial License 1.0.0. # You may not use this file except in compliance with the License. # A copy of the license can be found in the LICENSE file in the root directory -# of this project, or at [https://polyformproject.org/licenses/noncommercial/1.0.0/](https://polyformproject.org/licenses/noncommercial/1.0.0/) +# of this project, or at https://polyformproject.org/licenses/noncommercial/1.0.0/ # ============================================================================== + +# galaxyscope:ignore sec_io, llm_hooks + import re import os import json diff --git a/gitgalaxy/core/state_rehydrator.py b/gitgalaxy/core/state_rehydrator.py index 637273e8..32df79bb 100644 --- a/gitgalaxy/core/state_rehydrator.py +++ b/gitgalaxy/core/state_rehydrator.py @@ -8,6 +8,8 @@ # of this project, or at https://polyformproject.org/licenses/noncommercial/1.0.0/ # ============================================================================== +# galaxyscope:ignore sec_db_hooks, sec_high_risk_execution + import sqlite3 from pathlib import Path from typing import Dict, Any diff --git a/gitgalaxy/galaxyscope.py b/gitgalaxy/galaxyscope.py index fb427950..2ad2e486 100644 --- a/gitgalaxy/galaxyscope.py +++ b/gitgalaxy/galaxyscope.py @@ -8,7 +8,7 @@ # of this project, or at https://polyformproject.org/licenses/noncommercial/1.0.0/ # ============================================================================== -# galaxyscope:ignore sec_high_risk_execution, sec_hardcoded_secrets +# galaxyscope:ignore sec_high_risk_execution, sec_hardcoded_secrets, sec_io, safety_bypasses import logging import time @@ -1179,7 +1179,7 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): print(" 🌌 READY FOR VISUALIZATION (100% LOCAL / ZERO UPLOAD)") print("=" * 75) - print(" 1. Open your browser to: \033[94m\033[4m[https://gitgalaxy.io/](https://gitgalaxy.io/)\033[0m") + print(" 1. Open your browser to: \033[94m\033[4mhttps://gitgalaxy.io/\033[0m") print(f" 2. Drag and drop '{gpu_output}'") print("\n * PRIVACY SECURED: Your data never leaves your machine.") print(" All architectural rendering executes locally in your browser.") diff --git a/gitgalaxy/metrics/chronometer.py b/gitgalaxy/metrics/chronometer.py index c17bed25..113699a9 100644 --- a/gitgalaxy/metrics/chronometer.py +++ b/gitgalaxy/metrics/chronometer.py @@ -8,7 +8,7 @@ # of this project, or at [https://polyformproject.org/licenses/noncommercial/1.0.0/](https://polyformproject.org/licenses/noncommercial/1.0.0/) # ============================================================================== -# galaxyscope:ignore sec_high_risk_execution +# galaxyscope:ignore sec_high_risk_execution, sec_io, llm_hooks import os import subprocess