Qualified static finding recorded.
CodeVetter · local evidence export
Open redirect via unvalidated URL in Express
codevetter-public-benchmark/js-open-redirect
detected · medium confidence
Verification
No exact-current runtime evidence is included.
No audience validation occurred.
Finding
open redirect
The next query parameter is passed directly to res.redirect without an allowlist or same-origin check, enabling phishing redirects off the trusted domain.
source.js:9