docs(security): SonarQube triage inventory (86 issues)

[marlon-costa-dc]

Triagem SonarCloud — inventário

86 issues — BLOCKER 1, CRITICAL 24, MAJOR 35, MINOR 26
Tipos: VULNERABILITY 4, BUG 1, CODE_SMELL 81

Bead: mro-2wjm.1

Conteúdo

docs/security/sonarqube-triage.md: severidade, tipo, regra, componente e linha de cada issue, com coluna de decisão (corrigir / falso-positivo / risco-aceito).

Nenhuma alteração de código.

Prioridade: BLOCKER → CRITICAL → VULNERABILITY → MAJOR. CODE_SMELL em volume sugere correção de padrão na causa raiz, não issue a issue.

Dados brutos: ~/sonarqube-violations/by-repo/flext-sh_flext-cli.json

---

Summary by cubic

Added a SonarCloud triage inventory for 86 issues with per-issue decisions, now including numbered code snippets, full rule messages, CWE categories, and estimated effort. Documentation only; no code changes.

• New Features
  • Added docs/security/sonarqube-triage.md with a per-issue table (severity, type, rule, component, line, decision) and enriched entries (code snippet with sink marker, full rule message, CWE/class, effort).
  • Included triage order and guidance for false positives and accepted risk, plus the raw dump path for traceability.

^{Written for commit 9bd10ee. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

@marlon-costa-dc, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 108026a2-1137-40c2-abb8-1585a7dbfaa8

📥 Commits

Reviewing files that changed from the base of the PR and between c61c971 and 9bd10ee.

📒 Files selected for processing (1)

• docs/security/sonarqube-triage.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Adds a documentation-only SonarCloud/SonarQube triage inventory for flext-sh/flext-cli, intended to track and prioritize remediation decisions for the current set of static-analysis findings across the codebase.

Changes:

• Introduces docs/security/sonarqube-triage.md with a per-issue listing (severity/type/rule/component:line) and embedded code excerpts pointing at the reported lines.
• Provides a summary section with totals and a rules breakdown intended to help prioritize work.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.