TPTBusiness 2126062edf fix(security): nosec for B608/B701 false positives in UI and template code ...

B608: Bandit flags any f-string containing "select" as potential SQL
injection. All four cases (app.py, ds_trace.py, llm_st.py, merge.py)
are Streamlit UI labels or log messages — not database queries.

B701: Jinja2 autoescape=False warnings in coder.py and utils.py are
false positives — these render Python code and plain-text templates,
not HTML. Enabling autoescape would corrupt the rendered code.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-30 09:35:09 +02:00

..

app

fix(security): replace eval() with ast.literal_eval and add request timeouts (B307, B113)

2026-04-30 09:35:09 +02:00

components

fix(security): replace shell=True subprocess calls with list args (B602)

2026-04-30 09:35:09 +02:00

core

feat: unified backtest engine, LLM error handling, strategy refactor

2026-04-17 22:52:07 +02:00

log

fix(security): nosec for B608/B701 false positives in UI and template code

2026-04-30 09:35:09 +02:00

oai

fix(loop): prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages

2026-04-26 21:33:24 +02:00

scenarios

fix(security): nosec for B608/B701 false positives in UI and template code

2026-04-30 09:35:09 +02:00

utils

fix(security): replace shell=True subprocess calls with list args (B602)

2026-04-30 09:35:09 +02:00