# Sobelow per-finding skips. Enabled by `--skip` in `app/Makefile`.
#
# Rule: every entry is preceded by a rationale comment saying what the check
# cannot see and why the protection is real (or why the finding is a false
# positive). An unexplained skip is a defect; `scripts/check-lens-sensors.sh`
# enforces this. Fingerprints are sobelow's own; a code change that moves a
# skip's line invalidates it and the sensor fails loudly rather than staying
# quiet.
#
# Baseline 2026-10-28, sobelow 0.17.0: 3 findings (2 High, 1 Low), all skipped.

# Config.CSP - High - lib/firehose_web/router.ex:13 (pipeline :browser)
# No CSP exists. put_secure_browser_headers does not set one and the root
# layout has an inline theme script with no nonce, so choosing a policy is a
# design decision rather than a mechanical fix.
# Follow-up yak: app: add a Content-Security-Policy (sobelow Config.CSP)
Config.CSP: Missing Content-Security-Policy,lib/firehose_web/router.ex:13,486EC13

# Config.HTTPS - High - config/prod.exs
# No force_ssl: production TLS is terminated by the Dokku proxy. Whether the
# endpoint should also force SSL/HSTS (and trust X-Forwarded-Proto) is a
# deployment decision, not a mechanical fix.
# Follow-up yak: app: enforce HTTPS in production (sobelow Config.HTTPS)
Config.HTTPS: HTTPS Not Enabled,config/prod.exs:0,2B5C077

# Traversal.FileModule - Low - lib/firehose_web/live/microprints_live.ex:331
# False positive: the client path is only read after Enum.find matches it
# against the server-scanned microprint list, and source_dir comes from
# @source_dirs. Both Path.join inputs are server-computed, never client text.
Traversal.FileModule: Directory Traversal in `File.read`,lib/firehose_web/live/microprints_live.ex:331,7ED2FE5