security: 15 Critical/High panic-attack findings need human triage (Track C)

[hyperpolymath]

panic-attack estate sweep — Track C tracking issue

panic-attack assail flagged the findings below in this repo on 2026-05-26. They are aggregated here for human triage rather than as individual PRs because each requires judgement (supply-chain pin choice, schema-design call, mutation-test gap, etc.).

PA001/PA007 UnsafeCode/UnsafeFFI findings are NOT in this list. Findings already suppressed in audits/assail-classifications.a2ml are also excluded.

Estate tracker: hyperpolymath/panic-attack#32.

DynamicCodeExecution (5 findings)

file:line list

High  claude-integrations/gecko-browser-extension/src/content/content.js:?  DOM manipulation (innerHTML/document.write) in claude-integrations/gecko-browser-extension/src/content/content.js
High  claude-integrations/gecko-browser-extension/src/popup/popup.js:?  DOM manipulation (innerHTML/document.write) in claude-integrations/gecko-browser-extension/src/popup/popup.js
Critical  claude-integrations/firefox-mcp/extension/content/bridge.js:?  eval() usage in claude-integrations/firefox-mcp/extension/content/bridge.js
Critical  claude-integrations/firefox-mcp/extension-mv3/background.js:?  eval() usage in claude-integrations/firefox-mcp/extension-mv3/background.js

### `HardcodedSecret` (1 findings)

file:line list

### `SupplyChain` (1 findings)

file:line list

### `UnboundedAllocation` (7 findings)

file:line list

Critical  did-you-actually-do-that/src/main.rs:?  Potential unbounded allocation pattern detected in did-you-actually-do-that/src/main.rs
Critical  did-you-actually-do-that/src/verifiers/semantic.rs:?  Potential unbounded allocation pattern detected in did-you-actually-do-that/src/verifiers/semantic.rs
Critical  did-you-actually-do-that/src/verifiers/attestation.rs:?  Potential unbounded allocation pattern detected in did-you-actually-do-that/src/verifiers/attestation.rs
Critical  did-you-actually-do-that/src/verifiers/dependency.rs:?  Potential unbounded allocation pattern detected in did-you-actually-do-that/src/verifiers/dependency.rs
Critical  did-you-actually-do-that/src/verifiers/syntactic.rs:?  Potential unbounded allocation pattern detected in did-you-actually-do-that/src/verifiers/syntactic.rs
Critical  did-you-actually-do-that/src/verifiers/completeness.rs:?  Potential unbounded allocation pattern detected in did-you-actually-do-that/src/verifiers/completeness.rs

### `UnsafeDeserialization` (1 findings)

file:line list

---

🤖 Discovered during the panic-attack estate sweep (2026-05-26). See hyperpolymath/panic-attack#32 for campaign tracker.