Skip to content

Instantly share code, notes, and snippets.

@assimovt
Last active September 20, 2026 12:04
Show Gist options
  • Select an option

  • Save assimovt/f2ad460739215b2706e23fbca689f205 to your computer and use it in GitHub Desktop.

Select an option

Save assimovt/f2ad460739215b2706e23fbca689f205 to your computer and use it in GitHub Desktop.
nito: Quality Clouds challenge defense

Defending nito's code

nito reviews AI-written UI against existing components and approved Figma designs. We used Norma to review nito itself, then fixed, tested, merged, and rescanned.

Scan evidence

The September 19, 22:57 baseline reported 46/100, Not Ready, with 1,660 issues and 43 security findings, including 19 high-severity findings.

The final September 20, 00:31 scan reported 72/100, CERTIFIED on main, after merge 095a231421a99bfd17f3d73c8c798cf6efcd88a8. Its tree matches the tested revision exactly. Security reached 78%, with zero high-severity findings and 24 medium findings remaining. Maintainability reached 98%, with five findings. Architecture scored 100%, manageability 93%, and performance 94%.

Scalability remains at 5% and is explicitly deferred. The scan still reports 1,756 issues overall, including 1,698 scalability findings. Certification is the tool's overall rating, not a claim that every finding is resolved.

The repository changed throughout the hackathon, so score and issue-count changes cannot be attributed solely to this work. Norma does not expose the scanned commit SHA in this view; these are branch-level checkpoints.

Fixed

Rule: rct-unsafe-href-binding-1.0, Dynamic Value Bound to href Without URL Validation.

File: src/components/reviews/review-detail.tsx.

The approved Figma link was bound directly to a generated URL. We added safeNavigationHref(...) at rendering, alongside validation at the data boundaries. Unsafe URL schemes are rejected. The final scan reports zero high-severity security findings. The fix is included in PR #4.

Other fixes

Norma's dynamic-link warnings exposed inconsistent validation between Figma candidate creation, saved records, and browser responses. We aligned those boundaries and added a final rendering guard. GitHub links also receive path and host validation. Plain email links reject injected headers and parameters.

We sanitized gallery HTML with DOMPurify, replaced a fixed synthetic signing-test key with per-test keys, and tested rejection of mismatched signatures.

The async audit found real missing deadlines in source font loading, a sandbox policy request, and server-side SDK calls. Those are now bounded. Convex HTTP requests abort; authentication SDK waits fail after a deadline, although the SDK's underlying request may finish later. Timeouts do not silently retry mutations or mark an already-claimed review failed.

We also removed nested ternaries from production source, preserved the distinction between findings and unavailable evidence, and made failed retry refreshes visible.

Changes: initial validation, security pass, link and deadline follow-up, and readability and async fixes.

Left

Rule: rct-open-redirect-1.0, Potential Open Redirect via Dynamic Navigation.

File: src/lib/analysis/checks/rules/contract-rule.ts, in runContractRule.

Why

The flagged findings.push(...) appends an analysis result to a typed Finding[] array; it does not navigate or redirect a browser.

The source is ctx.baselineRecords.get(obs.componentId), a lookup in a Map<string, ComponentRecord>. The rule's generic .get() source and .push() sink patterns mistake this Map-to-array flow for URL parameters reaching a router. There is no navigation API at the flagged sink. We left the code unchanged and ask that these inspected findings be considered false positives when scoring.

Other accepted findings

We also retained the selector formatter's small membership lookup: its preferred order is the fixed list ['variant', 'size'], so that lookup is linear in selector keys, not quadratic. Sorting has its separate cost.

An await without a local catch is not proof of a hang. Rejecting tests must fail, and production helpers may propagate errors to their callers. We fixed actual missing deadlines instead of adding catch blocks that conceal failures.

Verification and limits

494 tests across 83 files, TypeScript, and the production webpack build passed. Biome reports 11 existing warnings. Regression tests cover unsafe links, malicious gallery markup, SDK timeouts, sandbox cancellation, authentication failure, and retry handling.

Chrome verified component groups, filters, collapsed passed results, review-list navigation, and public links using disposable synthetic data. This was not a new hosted provider review. No approved baseline, Norma rule, severity, exclusion, or suppression was changed to obtain a better score.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment