Why this verdict
- inconclusive: unresolved question on unknown class
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions and coverage gaps below; 1 candidate finding was refuted on review.
Open questions 1
What the analysis could not settle from the code alone.
Line ranges of rule.md not included in this pass (lines 1-8 before the code example, 59-72 between the Playwright config and test examples, and 330-340 between the CSS and polyfill sections) could contain additional runnable commands or credential-handling instructions; only the BrowserStack env-var residue detectors fired, so these gaps are presumed prose but unverified.
Refuted findings 1
Candidates the review stage examined and rejected, kept for transparency.
Credential access
criticalRefutedlow confidenceThe BrowserStack integration example instructs reading BROWSERSTACK_USERNAME and BROWSERSTACK_ACCESS_KEY from the environment and embedding them into a wss URL sent to cdp.browserstack.com, an undeclared-in-frontmatter credential-handling capability; the destination is the official BrowserStack endpoint and the pattern is the vendor-documented integration, so this is at most contextual risk.
'browserstack.username': process.env.BROWSERSTACK_USERNAME
Why it was refuted
The example is the vendor-documented BrowserStack Playwright integration: BROWSERSTACK_* env credentials are read only to authenticate to BrowserStack's own official endpoint, which is the accepted carve-out for env API keys of the wrapped service, so the harm gate fails. The undeclared-residue hits are accurate, but residue alone cannot sustain a finding whose only behavior is a carved-out credential pattern.
Coverage gaps 4
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
apps/web/public/projects/indie-dev-toolkit/indie-dev-toolkit.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/audits/2026-10-04-mcp-validation/assets/checklist-interaction.webm
context:unanalyzable_binary binary content is only byte-scanned
docs/audits/2026-10-04-mcp-validation/assets/mcp-tab-interaction.webm
context:manifest_unparseable yaml: YAML node count exceeds 20000
pnpm-lock.yaml
