Severity: low · Type: tech-debt · Confidence: high
Location:scripts/syncDecorations.mjs:106-114
Problem
The script parses avatarDecorations.ts with brittle regex patterns to extract slugs and remove entries. The regex assumes exact formatting (e.g., { slug: '...' on specific indentation, specific array closure syntax). If the file is reformatted or the catalog structure changes slightly, the regex won't match and entries won't be removed, silently leaving stale entries.
How to trigger
Running npm run sync:decorations after reformatting the file with a different indentation style or splitting lines differently will fail silently — no error, but missing entries won't be removed.
Suggested fix
Parse the file as JSON or TypeScript AST instead of using regex, or add explicit validation that confirms the number of entries removed matches expectations and fail if the count is unexpectedly low.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** low · **Type:** tech-debt · **Confidence:** high
**Location:** `scripts/syncDecorations.mjs:106-114`
### Problem
The script parses `avatarDecorations.ts` with brittle regex patterns to extract slugs and remove entries. The regex assumes exact formatting (e.g., `{ slug: '...'` on specific indentation, specific array closure syntax). If the file is reformatted or the catalog structure changes slightly, the regex won't match and entries won't be removed, silently leaving stale entries.
### How to trigger
Running `npm run sync:decorations` after reformatting the file with a different indentation style or splitting lines differently will fail silently — no error, but missing entries won't be removed.
### Suggested fix
Parse the file as JSON or TypeScript AST instead of using regex, or add explicit validation that confirms the number of entries removed matches expectations and fail if the count is unexpectedly low.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:35 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low · Type: tech-debt · Confidence: high
Location:
scripts/syncDecorations.mjs:106-114Problem
The script parses
avatarDecorations.tswith brittle regex patterns to extract slugs and remove entries. The regex assumes exact formatting (e.g.,{ slug: '...'on specific indentation, specific array closure syntax). If the file is reformatted or the catalog structure changes slightly, the regex won't match and entries won't be removed, silently leaving stale entries.How to trigger
Running
npm run sync:decorationsafter reformatting the file with a different indentation style or splitting lines differently will fail silently — no error, but missing entries won't be removed.Suggested fix
Parse the file as JSON or TypeScript AST instead of using regex, or add explicit validation that confirms the number of entries removed matches expectations and fail if the count is unexpectedly low.
Filed from the September 2026 client audit (branch
lotus@4bea4895).