Summary
Sonar flags HTTP URI strings used as schema identifiers in dashboard, CycloneDX and Adaptive Card output. These fields are serialized identifiers, and no network call was identified.
Reproduction steps
Inspect go:S5332 findings in internal/dashboard/format.go, internal/report/format_cyclonedx.go and internal/notify/webhook.go. Run the existing serializer/schema tests with network transport blocked.
Expected behavior
Serialized schema identifiers remain compatible with their published contracts; no insecure transport occurs; any false-positive disposition is backed by evidence.
Actual behavior
Three HTTP identifier constants are marked as vulnerabilities although the values are not passed to an HTTP client.
Logs and output
Sonar issue keys: AaCKtNClot68TiTTknTM, AaCKtM4-ot68TiTTknTL, AaCKtNHiot68TiTTknTN.
Version / commit
ff07368 (main baseline).
Environment
SonarQube Cloud project ben-ranford_lopper; baseline analysis 5a0cdcfb-5c8c-4dae-a90d-d0de97975465, inspected 2026-09-15.
Scope and acceptance criteria
Verify primary CycloneDX and Adaptive Card schema identifier contracts. Assert each serialized field and demonstrate local schema validation with all network transport blocked. Do not change identifiers to HTTPS just to silence Sonar; resolve only after the proof, or repair actual transport if discovered.
Release assignment
This is a bounded evidence and analysis-disposition task assigned to the next patch milestone, v1.8.9. It is outside the acceptance criteria of the current v1.8.8 PRs.
Live Sonar findings
Summary
Sonar flags HTTP URI strings used as schema identifiers in dashboard, CycloneDX and Adaptive Card output. These fields are serialized identifiers, and no network call was identified.
Reproduction steps
Inspect go:S5332 findings in internal/dashboard/format.go, internal/report/format_cyclonedx.go and internal/notify/webhook.go. Run the existing serializer/schema tests with network transport blocked.
Expected behavior
Serialized schema identifiers remain compatible with their published contracts; no insecure transport occurs; any false-positive disposition is backed by evidence.
Actual behavior
Three HTTP identifier constants are marked as vulnerabilities although the values are not passed to an HTTP client.
Logs and output
Sonar issue keys: AaCKtNClot68TiTTknTM, AaCKtM4-ot68TiTTknTL, AaCKtNHiot68TiTTknTN.
Version / commit
ff07368 (main baseline).
Environment
SonarQube Cloud project ben-ranford_lopper; baseline analysis 5a0cdcfb-5c8c-4dae-a90d-d0de97975465, inspected 2026-09-15.
Scope and acceptance criteria
Verify primary CycloneDX and Adaptive Card schema identifier contracts. Assert each serialized field and demonstrate local schema validation with all network transport blocked. Do not change identifiers to HTTPS just to silence Sonar; resolve only after the proof, or repair actual transport if discovered.
Release assignment
This is a bounded evidence and analysis-disposition task assigned to the next patch milestone, v1.8.9. It is outside the acceptance criteria of the current v1.8.8 PRs.
Live Sonar findings