# agent-vfc candidate recipes from agent-trailer security-fix commits (build_recipes.py).
# reviewer = "pending" means a human has not yet confirmed the vulnerability and mechanism.

[[recipe]]
name = "academic-based-qoder-app-a79ddb"
host = "github"
repo = "1173591564/academic-based-qoder"
parent = "8170f0377fe64d1ec2e35769d4ce3d0634d97cef"
commit = "a79ddb90def54e91f7507cbf6b1548b224d642aa"
path = "services/proxy-hub/backend/proxy_hub/app.py"
mode = "hunk"
language = "python"
relpath = "services/proxy-hub/backend/proxy_hub/app.py"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "academic-based-qoder"
trailer = "Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>"
reviewer = "pending"
evidence = "fix(hub): allow DSH token validation CORS"
commit_url = "https://github.com/1173591564/academic-based-qoder/commit/a79ddb90def54e91f7507cbf6b1548b224d642aa"
split = "train"

[[recipe]]
name = "anastasios-pw-session-14ec1a"
host = "github"
repo = "Anas329796/Anastasios"
parent = "adb7b0d5d6b81c46d56451c709e7eac9d0dc93fb"
commit = "14ec1ac50f9e4e255d875236d30129c6207401d4"
path = "extensions/browser/src/browser/pw-session.ts"
mode = "hunk"
language = "typescript"
relpath = "extensions/browser/src/browser/pw-session.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-918"
class = "server-side request forgery"
mechanism = "source_reaches_sink"
provenance = "agent"
origin = "github-agent-trailer"
project = "Anastasios"
trailer = "Co-authored-by: Devin Robison <drobison@nvidia.com>"
reviewer = "pending"
evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)"
commit_url = "https://github.com/Anas329796/Anastasios/commit/14ec1ac50f9e4e255d875236d30129c6207401d4"
split = "holdout"

[[recipe]]
name = "arsnova-eu-httpcors-9bcba4"
host = "github"
repo = "kqc-real/arsnova.eu"
parent = "2ae60c434f3fb80f91807a2ec485ee1a7ec76bd2"
commit = "9bcba4f442aecc6a5e16ef2dc6115177cfc2b6df"
path = "apps/backend/src/lib/httpCors.ts"
mode = "hunk"
language = "typescript"
relpath = "apps/backend/src/lib/httpCors.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "arsnova.eu"
trailer = "Co-authored-by: Cursor <cursoragent@cursor.com>"
reviewer = "pending"
evidence = "fix(security): Produktions-CORS auf Same-Origin begrenzen (#143)"
commit_url = "https://github.com/kqc-real/arsnova.eu/commit/9bcba4f442aecc6a5e16ef2dc6115177cfc2b6df"
split = "train"

[[recipe]]
name = "astroclaw-pw-session-1553a8"
host = "github"
repo = "P1R4N351/astroclaw"
parent = "d3eed2dc01328f21dd404477bb28e2740fa371a4"
commit = "1553a8adf123913cf7f1f1c75be4c4e5cd6c796b"
path = "extensions/browser/src/browser/pw-session.ts"
mode = "hunk"
language = "typescript"
relpath = "extensions/browser/src/browser/pw-session.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-918"
class = "server-side request forgery"
mechanism = "source_reaches_sink"
provenance = "agent"
origin = "github-agent-trailer"
project = "astroclaw"
trailer = "Co-authored-by: Devin Robison <drobison@nvidia.com>"
reviewer = "pending"
evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)"
commit_url = "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b"
split = "holdout"

[[recipe]]
name = "capgo-app-apptabs-7d73fd"
host = "github"
repo = "Cap-go/capgo.app"
parent = "415ea4e19d7da19a3f8b0cd0bba541d60b902522"
commit = "7d73fd21a59eaa3a4e20c6dc0d280e73e47435b7"
path = "src/constants/appTabs.ts"
mode = "hunk"
language = "typescript"
relpath = "src/constants/appTabs.ts"
license = "AGPL-3.0"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "capgo.app"
trailer = "Co-authored-by: Cursor <cursoragent@cursor.com>"
reviewer = "pending"
evidence = "fix(notifications): harden API CORS and mark console tab as beta (#2623)"
commit_url = "https://github.com/Cap-go/capgo.app/commit/7d73fd21a59eaa3a4e20c6dc0d280e73e47435b7"
split = "train"

[[recipe]]
name = "capgo-app-hono-4dadd2"
host = "github"
repo = "Cap-go/capgo.app"
parent = "8c0ac7e233946abd8dc26581b871e9fcd0928899"
commit = "4dadd2580d02213d227a331eee0232aa59859b59"
path = "supabase/functions/_backend/utils/hono.ts"
mode = "hunk"
language = "typescript"
relpath = "supabase/functions/_backend/utils/hono.ts"
license = "AGPL-3.0"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "capgo.app"
trailer = "Co-authored-by: Cursor <cursoragent@cursor.com>"
reviewer = "pending"
evidence = "fix(api): CORS for Capacitor localhost WebView (#3105)"
commit_url = "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59"
split = "holdout"

[[recipe]]
name = "dailyforge-server-ed1470"
host = "github"
repo = "Annamdevula-Nissi-Grace/Dailyforge"
parent = "adc164d6e87ff735a3ea5637a2febfd3217e168a"
commit = "ed1470814a108bd725c8b27bd9d86cf95a979a96"
path = "backend/src/server.js"
mode = "hunk"
language = "javascript"
relpath = "backend/src/server.js"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "Dailyforge"
trailer = "Co-authored-by: Copilot <copilot@github.com>"
reviewer = "pending"
evidence = "Fix:  add localhost fallback for CORS origin (#172)"
commit_url = "https://github.com/Annamdevula-Nissi-Grace/Dailyforge/commit/ed1470814a108bd725c8b27bd9d86cf95a979a96"
split = "train"

[[recipe]]
name = "dnf-plugin-anyrepo-config-26d19a"
host = "github"
repo = "jfut/dnf-plugin-anyrepo"
parent = "33cde479d0db8f45dd89fbdcfb2bc0f1be66bd7a"
commit = "26d19aeb8884f244e34ccfdc4f49f07055adc4d0"
path = "dnf_plugin_anyrepo/config.py"
mode = "hunk"
language = "python"
relpath = "dnf_plugin_anyrepo/config.py"
license = "Apache-2.0"
cve = ""
year = 2026
cwe = "CWE-22"
class = "path traversal"
mechanism = "path_join_user_input"
provenance = "agent"
origin = "github-agent-trailer"
project = "dnf-plugin-anyrepo"
trailer = "Co-authored-by: Codex <noreply@openai.com>"
reviewer = "pending"
evidence = "fix(config): prevent path traversal in repository names"
commit_url = "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0"
split = "holdout"

[[recipe]]
name = "edutrace-page-ee7ba2"
host = "github"
repo = "jardimdesoftware/edutrace"
parent = "c4dc6ddcc5492c77c8a5ad7369c87dea29c001fd"
commit = "ee7ba25fb23ea89cc1b67549cb5e32c8ead92739"
path = "front/src/app/editar-anamnese/page.tsx"
mode = "hunk"
language = "typescript"
relpath = "front/src/app/editar-anamnese/page.tsx"
license = "Apache-2.0"
cve = ""
year = 2026
cwe = "CWE-1321"
class = "prototype pollution"
mechanism = "prototype_pollution"
provenance = "agent"
origin = "github-agent-trailer"
project = "edutrace"
trailer = "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>"
reviewer = "pending"
evidence = "fix(front): impedir prototype pollution nos handlers de formulário aninhado"
commit_url = "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739"
split = "train"

[[recipe]]
name = "etoj-index-605274"
host = "github"
repo = "Eternity-Sky/_ETOJ"
parent = "b0c020fd9ca0204630fca8a857d6fc1b1497bd5b"
commit = "6052743d477eeff62e32553c2790785d3f52c641"
path = "api/src/index.ts"
mode = "hunk"
language = "typescript"
relpath = "api/src/index.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "_ETOJ"
trailer = "Generated with [Devin](https://devin.ai)"
reviewer = "pending"
evidence = "Fix CORS: Add PATCH method to allowed methods"
commit_url = "https://github.com/Eternity-Sky/_ETOJ/commit/6052743d477eeff62e32553c2790785d3f52c641"
split = "holdout"

[[recipe]]
name = "etude-lexical-markdown-editorconfig-c61a8b"
host = "github"
repo = "dayflower/etude-lexical-markdown"
parent = "0a2184f59e79a04b1365cd49200026e8f2ffdbd5"
commit = "c61a8bf78fe20d6ae0eab2e4b8b02004508525ed"
path = "src/config/editorConfig.ts"
mode = "hunk"
language = "typescript"
relpath = "src/config/editorConfig.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-1321"
class = "prototype pollution"
mechanism = "prototype_pollution"
provenance = "agent"
origin = "github-agent-trailer"
project = "etude-lexical-markdown"
trailer = "Co-Authored-By: Claude <noreply@anthropic.com>"
reviewer = "pending"
evidence = "fix: guard deepMergeInto against prototype pollution"
commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/c61a8bf78fe20d6ae0eab2e4b8b02004508525ed"
split = "train"

[[recipe]]
name = "etude-lexical-markdown-editorconfig-db4f54"
host = "github"
repo = "dayflower/etude-lexical-markdown"
parent = "1c865815d05b072f4973388c3ac66b6696d9efde"
commit = "db4f54b1ab80ad596de6425e84f90aa781c49999"
path = "src/config/editorConfig.ts"
mode = "hunk"
language = "typescript"
relpath = "src/config/editorConfig.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-1321"
class = "prototype pollution"
mechanism = "prototype_pollution"
provenance = "agent"
origin = "github-agent-trailer"
project = "etude-lexical-markdown"
trailer = "Co-Authored-By: Claude <noreply@anthropic.com>"
reviewer = "pending"
evidence = "fix: make prototype pollution guard recognizable by CodeQL"
commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999"
split = "holdout"

[[recipe]]
name = "gitim-git-cors-proxy-e4c3a4"
host = "github"
repo = "CiferaTeam/GitIM"
parent = "8afa34d45e119164abec0b76ed77a56f442749a8"
commit = "e4c3a4794dbe9fbcce679f7df1ecd2b09b40f9d6"
path = "products/gitim/frontend/src/lib/git-cors-proxy.ts"
mode = "hunk"
language = "typescript"
relpath = "products/gitim/frontend/src/lib/git-cors-proxy.ts"
license = "Apache-2.0"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "GitIM"
trailer = "Co-authored-by: Codex <codex@openai.com>"
reviewer = "pending"
evidence = "fix(frontend): use gitim cors proxy by default"
commit_url = "https://github.com/CiferaTeam/GitIM/commit/e4c3a4794dbe9fbcce679f7df1ecd2b09b40f9d6"
split = "train"

[[recipe]]
name = "lensops-kubernetesmanagement-fe4910"
host = "github"
repo = "amitknigam84/lensops"
parent = "9b87ecc3a44a7fe2a5185cca1fe52441647d5748"
commit = "fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84"
path = "components/KubernetesManagement.tsx"
mode = "hunk"
language = "typescript"
relpath = "components/KubernetesManagement.tsx"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-862"
class = "missing authorization"
mechanism = "missing_auth_guard"
provenance = "agent"
origin = "github-agent-trailer"
project = "lensops"
trailer = "Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>"
reviewer = "pending"
evidence = "Fix missing auth header on namespaces API call"
commit_url = "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84"
split = "holdout"

[[recipe]]
name = "market-cap-route-4f8ae9"
host = "github"
repo = "navaneethbv/market-cap"
parent = "fec6f024ce72c9c47b61cbac6ce7a35cb2280602"
commit = "4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6"
path = "app/auth/confirm/route.ts"
mode = "hunk"
language = "typescript"
relpath = "app/auth/confirm/route.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-601"
class = "open redirect"
mechanism = "source_reaches_sink"
provenance = "agent"
origin = "github-agent-trailer"
project = "market-cap"
trailer = "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>"
reviewer = "pending"
evidence = "Fix open redirects on the auth next param"
commit_url = "https://github.com/navaneethbv/market-cap/commit/4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6"
split = "train"

[[recipe]]
name = "melodix-playerprovider-089931"
host = "github"
repo = "alexshao3/melodix"
parent = "c074fc7413338aefcbea3170ef4d3ba486a8a4b7"
commit = "089931ef71ea1e5b7586520baf1a5498e2f05b13"
path = "apps/miniapp/src/components/PlayerProvider.tsx"
mode = "hunk"
language = "typescript"
relpath = "apps/miniapp/src/components/PlayerProvider.tsx"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "melodix"
trailer = "Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>"
reviewer = "pending"
evidence = "Merge pull request #17 from alexshao3/devin/1777216143-fix-audio-cors"
commit_url = "https://github.com/alexshao3/melodix/commit/089931ef71ea1e5b7586520baf1a5498e2f05b13"
split = "holdout"

[[recipe]]
name = "mercado-do-vale-news-catalogmetadataservice-9b5fcf"
host = "github"
repo = "handielson/Mercado-do-vale-news"
parent = "70ca282b819ac1d60f4b5e665d224b1043ff1ccc"
commit = "9b5fcf2dae41e56f5f97952266f2d6ba59598598"
path = "services/catalogMetadataService.ts"
mode = "hunk"
language = "typescript"
relpath = "services/catalogMetadataService.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "Mercado-do-vale-news"
trailer = "Co-Authored-By: Codex <noreply@openai.com>"
reviewer = "pending"
evidence = "fix(catalog): avoid metadata cors preflight"
commit_url = "https://github.com/handielson/Mercado-do-vale-news/commit/9b5fcf2dae41e56f5f97952266f2d6ba59598598"
split = "train"

[[recipe]]
name = "money-track-category-icons-4d4a5b"
host = "github"
repo = "andrebubniak/money-track"
parent = "add96df6d6a6b61506635c23dbacf6c6cfe24dc2"
commit = "4d4a5b063278c8b6697c3faae133d7c39fcd01c0"
path = "src/lib/category-icons.ts"
mode = "hunk"
language = "typescript"
relpath = "src/lib/category-icons.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-1321"
class = "prototype pollution"
mechanism = "prototype_pollution"
provenance = "agent"
origin = "github-agent-trailer"
project = "money-track"
trailer = "Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>"
reviewer = "pending"
evidence = "fix(category-icons): use Object.hasOwn to prevent prototype pollution in type guard"
commit_url = "https://github.com/andrebubniak/money-track/commit/4d4a5b063278c8b6697c3faae133d7c39fcd01c0"
split = "holdout"

[[recipe]]
name = "nestjs-filter-normalizer-aa0e60"
host = "github"
repo = "DavideCarvalho/nestjs-filter"
parent = "d899b40d3466f2ffbe9f01c4d49267412401f078"
commit = "aa0e600d05997ea3d77538ea1c2db427c439f2e8"
path = "packages/core/src/input/normalizer.ts"
mode = "hunk"
language = "typescript"
relpath = "packages/core/src/input/normalizer.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-1321"
class = "prototype pollution"
mechanism = "prototype_pollution"
provenance = "agent"
origin = "github-agent-trailer"
project = "nestjs-filter"
trailer = "Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>"
reviewer = "pending"
evidence = "fix(core): add prototype pollution guard to normalizeInput"
commit_url = "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8"
split = "train"

[[recipe]]
name = "new-erp-final-app-6e9644"
host = "github"
repo = "Sachin-Salgar/NEW_ERP_FINAL"
parent = "08976c5d7a07b0663669b875b4507446199f85d7"
commit = "6e9644c81ce3fb356669157182a5ef09a70c4b59"
path = "src/presentation/http/app.ts"
mode = "hunk"
language = "typescript"
relpath = "src/presentation/http/app.ts"
license = "Apache-2.0"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "NEW_ERP_FINAL"
trailer = "Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>"
reviewer = "pending"
evidence = "fix: allow patch requests through cors"
commit_url = "https://github.com/Sachin-Salgar/NEW_ERP_FINAL/commit/6e9644c81ce3fb356669157182a5ef09a70c4b59"
split = "holdout"

[[recipe]]
name = "nimestream-route-d17f53"
host = "github"
repo = "Irnhakim/nimestream"
parent = "0c37bfd9e5292b15b1d7af51f52793d9bdf1cef0"
commit = "d17f535bf3012041b056ff3aa991ff6cfa198e43"
path = "app/api/img/route.js"
mode = "hunk"
language = "javascript"
relpath = "app/api/img/route.js"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-918"
class = "server-side request forgery"
mechanism = "source_reaches_sink"
provenance = "agent"
origin = "github-agent-trailer"
project = "nimestream"
trailer = "Co-Authored-By: Claude <noreply@anthropic.com>"
reviewer = "pending"
evidence = "fix: resolve command injection and SSRF/Open Redirect security issues in multiScraper and image proxy API"
commit_url = "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43"
split = "train"

[[recipe]]
name = "onlook-helper-57ce1c"
host = "github"
repo = "zhcndoc/onlook"
parent = "cb97e012729eca441e09b1503282cb4bc2f4bcfb"
commit = "57ce1ccfacc7e8484cae59013a2b1e34518560e5"
path = "apps/web/client/src/server/api/routers/project/helper.ts"
mode = "hunk"
language = "typescript"
relpath = "apps/web/client/src/server/api/routers/project/helper.ts"
license = "Apache-2.0"
cve = ""
year = 2025
cwe = "CWE-862"
class = "missing authorization"
mechanism = "missing_auth_guard"
provenance = "agent"
origin = "github-agent-trailer"
project = "onlook"
trailer = "Co-Authored-By: Claude <noreply@anthropic.com>"
reviewer = "pending"
evidence = "Fix CVE-2025-63783: Add authorization checks to project mutation APIs (#3062)"
commit_url = "https://github.com/zhcndoc/onlook/commit/57ce1ccfacc7e8484cae59013a2b1e34518560e5"
split = "holdout"

[[recipe]]
name = "openniw-jobs-0fc947"
host = "github"
repo = "HHHHHejia/openniw"
parent = "4d91ed82fa9a5ec6bf5ef96da1d221fc187700dc"
commit = "0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10"
path = "backend/app/routers/jobs.py"
mode = "hunk"
language = "python"
relpath = "backend/app/routers/jobs.py"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-639"
class = "insecure direct object reference"
mechanism = "identity_from_request_body"
provenance = "agent"
origin = "github-agent-trailer"
project = "openniw"
trailer = "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>"
reviewer = "pending"
evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership"
commit_url = "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10"
split = "train"

[[recipe]]
name = "openniw-jobs-b74de3"
host = "github"
repo = "ziyuzuo/openniw"
parent = "98a0c392ba96cd2c4aa746dd6fc2b183f385225e"
commit = "b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68"
path = "backend/app/routers/jobs.py"
mode = "hunk"
language = "python"
relpath = "backend/app/routers/jobs.py"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-639"
class = "insecure direct object reference"
mechanism = "identity_from_request_body"
provenance = "agent"
origin = "github-agent-trailer"
project = "openniw"
trailer = "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>"
reviewer = "pending"
evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership"
commit_url = "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68"
split = "holdout"

[[recipe]]
name = "overleaf-with-claude-exportscontroller-3980b9"
host = "github"
repo = "ZUENS2020/overleaf-with-claude"
parent = "5a886aa9fb9fe4e2203f3cb1d62c91f4be0525ed"
commit = "3980b9e5806defb63e45ae2696e6c1899f3a8431"
path = "services/web/app/src/Features/Exports/ExportsController.mjs"
mode = "hunk"
language = "javascript"
relpath = "services/web/app/src/Features/Exports/ExportsController.mjs"
license = "AGPL-3.0"
cve = ""
year = 2026
cwe = "CWE-639"
class = "insecure direct object reference"
mechanism = "identity_from_request_body"
provenance = "agent"
origin = "github-agent-trailer"
project = "overleaf-with-claude"
trailer = "Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>"
reviewer = "pending"
evidence = "Fix IDOR in exports by adding token verification (Issue #31637) (#32883)"
commit_url = "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431"
split = "train"

[[recipe]]
name = "popmark-editorconfig-e5ac40"
host = "github"
repo = "dayflower/popmark"
parent = "31d1ac79b4cfa3118597348e79800a6561115149"
commit = "e5ac407cef37c37178d440541ede301c838640fb"
path = "src/lexical-markdown/config/editorConfig.ts"
mode = "hunk"
language = "typescript"
relpath = "src/lexical-markdown/config/editorConfig.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-1321"
class = "prototype pollution"
mechanism = "prototype_pollution"
provenance = "agent"
origin = "github-agent-trailer"
project = "popmark"
trailer = "Co-Authored-By: Claude <noreply@anthropic.com>"
reviewer = "pending"
evidence = "fix: guard deepMergeInto against prototype pollution"
commit_url = "https://github.com/dayflower/popmark/commit/e5ac407cef37c37178d440541ede301c838640fb"
split = "holdout"

[[recipe]]
name = "rag-pipeline-utils-config-handler-76e5f0"
host = "github"
repo = "DevilsDev/rag-pipeline-utils"
parent = "ba587867118f703632ff2dc63c4feb8ad6793420"
commit = "76e5f0a94d6803d0e463d26a61cedb7da90857a7"
path = "src/cli/handlers/config-handler.js"
mode = "hunk"
language = "javascript"
relpath = "src/cli/handlers/config-handler.js"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-1321"
class = "prototype pollution"
mechanism = "prototype_pollution"
provenance = "agent"
origin = "github-agent-trailer"
project = "rag-pipeline-utils"
trailer = "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>"
reviewer = "pending"
evidence = "fix(security): prevent prototype pollution in config-handler"
commit_url = "https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7"
split = "train"

[[recipe]]
name = "registry-proxy-worker-426847"
host = "github"
repo = "agents-repo/registry-proxy"
parent = "6d5937972510cdb5ebca30607b538fdc2e280094"
commit = "426847899eb2ee94ae4e5a3aacc50423e36d2dc8"
path = "src/worker.js"
mode = "hunk"
language = "javascript"
relpath = "src/worker.js"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "registry-proxy"
trailer = "Co-authored-by: Cursor <cursoragent@cursor.com>"
reviewer = "pending"
evidence = "fix: handle CORS OPTIONS preflight for catalog fetches (#10)"
commit_url = "https://github.com/agents-repo/registry-proxy/commit/426847899eb2ee94ae4e5a3aacc50423e36d2dc8"
split = "holdout"

[[recipe]]
name = "rls-alembic-rls-d2b6af"
host = "github"
repo = "DelfinaCare/rls"
parent = "670123485f1c657e9faeb18e633339b6a79e696f"
commit = "d2b6af47347fb285b7a3820a7f2d5dded20907ec"
path = "rls/alembic_rls.py"
mode = "hunk"
language = "python"
relpath = "rls/alembic_rls.py"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "rls"
trailer = "Co-authored-by: aebrahim <1380168+aebrahim@users.noreply.github.com>"
reviewer = "pending"
evidence = "Guard against ENABLE ROW LEVEL SECURITY on tables with no policies (#143)"
commit_url = "https://github.com/DelfinaCare/rls/commit/d2b6af47347fb285b7a3820a7f2d5dded20907ec"
split = "train"

[[recipe]]
name = "supplieradvisor-mvp-route-387bcf"
host = "github"
repo = "bigfivefoods/supplieradvisor-mvp"
parent = "a7a9bc260d649ea2e582c07435bfd7d93100647b"
commit = "387bcf40e984a2ee1832ab7beabf0284c5b627d8"
path = "app/api/customers/claims/route.ts"
mode = "hunk"
language = "typescript"
relpath = "app/api/customers/claims/route.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-639"
class = "insecure direct object reference"
mechanism = "identity_from_request_body"
provenance = "agent"
origin = "github-agent-trailer"
project = "supplieradvisor-mvp"
trailer = "Co-authored-by: bigfivefoods <265166842+bigfivefoods@users.noreply.github.com>"
reviewer = "pending"
evidence = "Brief 62: Fix IDOR on customer_claims PATCH/DELETE (#156)"
commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8"
split = "holdout"

[[recipe]]
name = "supplieradvisor-mvp-route-a69e8f"
host = "github"
repo = "bigfivefoods/supplieradvisor-mvp"
parent = "8558538471e4fb10856f8d9a17d2be5ab5c4fb9c"
commit = "a69e8f27c0f4d402573d16f0612b51155bbc46e1"
path = "app/api/customers/opportunities/route.ts"
mode = "hunk"
language = "typescript"
relpath = "app/api/customers/opportunities/route.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-639"
class = "insecure direct object reference"
mechanism = "identity_from_request_body"
provenance = "agent"
origin = "github-agent-trailer"
project = "supplieradvisor-mvp"
trailer = "Co-authored-by: bigfivefoods <265166842+bigfivefoods@users.noreply.github.com>"
reviewer = "pending"
evidence = "Brief 60: Fix IDOR on opportunities GET/PATCH/DELETE (missing company membership checks) (#148)"
commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1"
split = "train"

[[recipe]]
name = "tools-cli-tools-a96bc0"
host = "github"
repo = "D-sorganization/Tools"
parent = "e735d28b82dd1fbc42c0ae01157b38d1b4c7c864"
commit = "a96bc0502a3dcdac303e4f0152508886e5c35c0a"
path = "src/shared/python/ai/tools/cli_tools.py"
mode = "hunk"
language = "python"
relpath = "src/shared/python/ai/tools/cli_tools.py"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-78"
class = "command injection"
mechanism = "source_reaches_sink"
provenance = "agent"
origin = "github-agent-trailer"
project = "Tools"
trailer = "Co-authored-by: dieterolson <198168927+dieterolson@users.noreply.github.com>"
reviewer = "pending"
evidence = "🛡️ Sentinel: [CRITICAL] Fix command injection in ShellTool (#3307)"
commit_url = "https://github.com/D-sorganization/Tools/commit/a96bc0502a3dcdac303e4f0152508886e5c35c0a"
split = "holdout"

[[recipe]]
name = "tools-wsgi-e18686"
host = "github"
repo = "D-sorganization/Tools"
parent = "f34c44a0842ac983e2a984fe7fd985be3ccaf747"
commit = "e18686aaa174a8a4843c07b4727771c92e0f179e"
path = "src/web_applications/unit_converter/wsgi.py"
mode = "hunk"
language = "python"
relpath = "src/web_applications/unit_converter/wsgi.py"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-22"
class = "path traversal"
mechanism = "path_join_user_input"
provenance = "agent"
origin = "github-agent-trailer"
project = "Tools"
trailer = "Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>"
reviewer = "pending"
evidence = "fix(security): validate mesh filenames against path traversal in _download_meshes (#2077) (#2107)"
commit_url = "https://github.com/D-sorganization/Tools/commit/e18686aaa174a8a4843c07b4727771c92e0f179e"
split = "train"

[[recipe]]
name = "trackly-cli-path-diagnostics-1c1aed"
host = "github"
repo = "trackly-app/trackly-cli"
parent = "8d240ad8d7fc114c8f941ad956a2fdf32391ff60"
commit = "1c1aed89b07edb04051830c8f086e02b65e961c6"
path = "lib/path-diagnostics.js"
mode = "hunk"
language = "javascript"
relpath = "lib/path-diagnostics.js"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-22"
class = "path traversal"
mechanism = "path_join_user_input"
provenance = "agent"
origin = "github-agent-trailer"
project = "trackly-cli"
trailer = "Co-authored-by: Codex <codex@openai.com>"
reviewer = "pending"
evidence = "fix(apply): report blocked path traversal"
commit_url = "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6"
split = "holdout"

[[recipe]]
name = "upstreamdrift-local-server-c3a078"
host = "github"
repo = "D-sorganization/UpstreamDrift"
parent = "e28d1da5e103d93951ef11b78a6e9b89ac1fa2bc"
commit = "c3a0787080489b30e2ed0abfac03b51e45da184b"
path = "src/api/local_server.py"
mode = "hunk"
language = "python"
relpath = "src/api/local_server.py"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-22"
class = "path traversal"
mechanism = "path_join_user_input"
provenance = "agent"
origin = "github-agent-trailer"
project = "UpstreamDrift"
trailer = "Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>"
reviewer = "pending"
evidence = "fix(api): harden local server path traversal (#2805) (#2839)"
commit_url = "https://github.com/D-sorganization/UpstreamDrift/commit/c3a0787080489b30e2ed0abfac03b51e45da184b"
split = "train"

[[recipe]]
name = "vantalk-firebase-16c3b0"
host = "github"
repo = "NiSeullent/VanTalk"
parent = "7d442bdf537df96c756d47cfc6ce0ccdb3cd8ea7"
commit = "16c3b02875b1f51c3cac1dc185e199978a35985c"
path = "web/src/firebase.ts"
mode = "hunk"
language = "typescript"
relpath = "web/src/firebase.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-798"
class = "hardcoded credentials"
mechanism = "secret_in_client"
provenance = "agent"
origin = "github-agent-trailer"
project = "VanTalk"
trailer = "Co-authored-by: Cursor <cursoragent@cursor.com>"
reviewer = "pending"
evidence = "fix(security): load Firebase API key from env, remove hardcoded secret"
commit_url = "https://github.com/NiSeullent/VanTalk/commit/16c3b02875b1f51c3cac1dc185e199978a35985c"
split = "holdout"

[[recipe]]
name = "waggledance-swarm-ssrf-host-guard-9a4548"
host = "github"
repo = "Ahkeratmehilaiset/waggledance-swarm"
parent = "934b939f1cca5259eaf807db3319eb97b90d8d80"
commit = "9a454843aa35332ff2eb3106023eee0c4b5e444b"
path = "waggledance/core/v3_13_0/ssrf_host_guard.py"
mode = "hunk"
language = "python"
relpath = "waggledance/core/v3_13_0/ssrf_host_guard.py"
license = "Apache-2.0"
cve = ""
year = 2026
cwe = "CWE-918"
class = "server-side request forgery"
mechanism = "source_reaches_sink"
provenance = "agent"
origin = "github-agent-trailer"
project = "waggledance-swarm"
trailer = "Co-authored-by: codex-lead-1 <codex-lead-1@example.invalid>"
reviewer = "pending"
evidence = "fix(ssrf): reject bare-string allowed hosts (#1460)"
commit_url = "https://github.com/Ahkeratmehilaiset/waggledance-swarm/commit/9a454843aa35332ff2eb3106023eee0c4b5e444b"
split = "train"

[[recipe]]
name = "workers-research-utils-209444"
host = "github"
repo = "G4brym/workers-research"
parent = "eab923ad3099c01b002fbd6be7cf994614bbdee4"
commit = "209444eb61cc564c2d6b43267256f85fe3e5e30e"
path = "src/utils.ts"
mode = "hunk"
language = "typescript"
relpath = "src/utils.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-89"
class = "sql injection"
mechanism = "source_reaches_sink"
provenance = "agent"
origin = "github-agent-trailer"
project = "workers-research"
trailer = "Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>"
reviewer = "pending"
evidence = "Fix SQL injection in search by using parameterized queries (#41)"
commit_url = "https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e"
split = "holdout"

[[recipe]]
name = "zoonk-origin-bfbf67"
host = "github"
repo = "zoonk/zoonk"
parent = "2604269350bff51f58572c133b45010cb0976a5a"
commit = "bfbf670ccb41d63c407d32c51bd26e626a174f31"
path = "packages/utils/src/origin.ts"
mode = "hunk"
language = "typescript"
relpath = "packages/utils/src/origin.ts"
license = "MIT"
cve = ""
year = 2026
cwe = "CWE-16"
class = "permissive default"
mechanism = "permissive_default"
provenance = "agent"
origin = "github-agent-trailer"
project = "zoonk"
trailer = "Co-authored-by: Codex <noreply@openai.com>"
reviewer = "pending"
evidence = "fix(api): allow staging cors from previews (#1559)"
commit_url = "https://github.com/zoonk/zoonk/commit/bfbf670ccb41d63c407d32c51bd26e626a174f31"
split = "train"