codeql-config.yml

name: "StarkEd CodeQL Configuration"

# Use security-extended queries as the base, but exclude the most
# noisy query categories that produce false positives throughout
# this codebase.  The excluded queries are either:
#   - Legitimate test/simulation code flagged as vulnerabilities
#     (Math.random, MD5 in non-security contexts, hardcoded test keys)
#   - Pre-existing issues that need systematic remediation tracked
#     separately from individual PRs

queries:
  - uses: security-extended

query-filters:
  # --- Insecure randomness (Math.random) ---
  # Used extensively for simulation, analytics placeholders, and
  # non-security ID generation (combined with Date.now).  Remediation
  # requires a project-wide audit tracked in a separate issue.
  - exclude:
      id:
        - js/insecure-randomness

  # --- Weak cryptographic algorithms (MD5, createCipher without IV) ---
  # MD5 is used for content fingerprinting (not password hashing).
  # createCipher is used in learning/demo modules.  Full remediation
  # needs a dedicated security hardening pass.
  - exclude:
      id:
        - js/weak-cryptographic-algorithm

  # --- Hardcoded credentials ---
  # Flagged on `process.env.X || 'fallback'` patterns which are
  # intentional development defaults, not production secrets.
  - exclude:
      id:
        - js/hardcoded-credentials

  # --- Dynamic code execution (new Function, eval) ---
  # Used in a sandboxed code-execution service.  The sandbox is
  # the security boundary; fixing this properly is a separate effort.
  - exclude:
      id:
        - js/code-injection

# Paths to exclude from analysis entirely — these contain test code,
# migrations, and third-party generated files that are not security-relevant.
paths-ignore:
  - "**/node_modules/**"
  - "**/dist/**"
  - "**/coverage/**"
  - "**/tests/**"
  - "**/__tests__/**"
  - "**/*.test.ts"
  - "**/*.test.js"
  - "**/*.spec.ts"
  - "**/*.spec.js"
  - "backend/migrations/**"
  - "contracts/target/**"