security: 18 Critical/High panic-attack findings need human triage (Track C)

[hyperpolymath]

panic-attack estate sweep — Track C tracking issue

panic-attack assail flagged the findings below in this repo on 2026-05-26. They are aggregated here for human triage rather than as individual PRs because each requires judgement (supply-chain pin choice, schema-design call, mutation-test gap, etc.).

PA001/PA007 UnsafeCode/UnsafeFFI findings are NOT in this list. Findings already suppressed in audits/assail-classifications.a2ml are also excluded.

Estate tracker: hyperpolymath/panic-attack#32.

CommandInjection (1 findings)

file:line list

### `DynamicCodeExecution` (5 findings)

file:line list

High praxis/SymbolicEngine/dashboard/js/symbol-inspector.ts:? DOM manipulation (innerHTML/document.write) in praxis/SymbolicEngine/dashboard/js/symbol-inspector.ts
High praxis/SymbolicEngine/dashboard/injector/js/injector.ts:? DOM manipulation (innerHTML/document.write) in praxis/SymbolicEngine/dashboard/injector/js/injector.ts
High resurrect/state/lib/state-utils.scm:? eval usage in resurrect/state/lib/state-utils.scm
High journal-theme/tests/accessibility_test.js:? DOM manipulation (innerHTML/document.write) in journal-theme/tests/accessibility_test.js

### `HardcodedSecret` (4 findings)

file:line list

Critical praxis/Core/db-schema/config/dev.exs:? Possible hardcoded secret in praxis/Core/db-schema/config/dev.exs
Critical secured/php-aegis/validation/run-validation.sh:? Possible hardcoded secret in secured/php-aegis/validation/run-validation.sh
Critical plugin-conflict-mapper/bin/install-wp-tests.sh:? Possible hardcoded secret in plugin-conflict-mapper/bin/install-wp-tests.sh

### `SupplyChain` (1 findings)

file:line list

### `UnboundedAllocation` (7 findings)

file:line list

Critical resurrect/src/socp-tui/src/config.rs:? Potential unbounded allocation pattern detected in resurrect/src/socp-tui/src/config.rs
Critical project-wharf/crates/wharf-core/src/config.rs:? Potential unbounded allocation pattern detected in project-wharf/crates/wharf-core/src/config.rs
Critical project-wharf/crates/wharf-core/src/integrity.rs:? Potential unbounded allocation pattern detected in project-wharf/crates/wharf-core/src/integrity.rs
Critical project-wharf/crates/wharf-core/src/nebula.rs:? Potential unbounded allocation pattern detected in project-wharf/crates/wharf-core/src/nebula.rs
Critical project-wharf/crates/wharf-core/src/fleet.rs:? Potential unbounded allocation pattern detected in project-wharf/crates/wharf-core/src/fleet.rs
Critical project-wharf/bin/yacht-agent/src/ebpf.rs:? Potential unbounded allocation pattern detected in project-wharf/bin/yacht-agent/src/ebpf.rs

---

🤖 Discovered during the panic-attack estate sweep (2026-05-26). See hyperpolymath/panic-attack#32 for campaign tracker.