Skip to content

Add read-only remove-debug-statement patches for JS/TS #110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
braedonsaunders merged 7 commits into from
Oct 20, 2026
Merged

Add read-only remove-debug-statement patches for JS/TS #110

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6cb94eb
Add read-only patches for removable JS/TS debug statements
cursoragent Oct 19, 2026
9192b47
Stop persisting debug patches and mislabeling unsafe removals
cursoragent Oct 19, 2026
5204930
Preserve CRLF in debug patches and shadow TS console namespaces
cursoragent Oct 19, 2026
9f48d30
Keep tagged templates and escaped console bindings report-only
cursoragent Oct 19, 2026
54508d9
Keep directive comments and direct eval out of debug patches
cursoragent Oct 20, 2026
3b9ea6b
Keep statement joins and console reassignment out of debug patches
cursoragent Oct 20, 2026
9b89768
Keep aliased console calls out of debug patches
cursoragent Oct 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,8 @@ Automatic detection of:
- Dangerous `eval()` usage
- Debug statements in production code

For JavaScript and TypeScript, a standalone `console.log`, `console.debug`, `console.info`, or `debugger` statement can be downloaded as a unified diff (`.patch`) and applied from the repo root with `git apply`. The JSON report adds a `patch` field on that debug-statement finding when a safe removal exists. Statements inside an expression, or in a one-line `if` or arrow without braces, stay report-only. Codeflow never writes to your files.

Test files, fixtures, `docs/`, and common tooling directories (`.github/`, `.claude/`, `scripts/`) are excluded from the XSS/shell-execution checks, since findings there don't reflect the shipped product's attack surface. The hardcoded-secret check exempts only tests, fixtures, and docs: CI workflows, hooks, and deploy scripts are executable code, so a real credential there is still a real leak.

### Pattern Detection
Expand Down
Loading
Loading