Test: does the zomb action catch this?

[ravixalgorithm]

Deliberate: a GitHub token in code and a @ts-ignore. The check should fail and a comment should appear.

Summary by CodeRabbit

• Security
  • A credential-related value is now exposed by the application. No other end-user-facing changes are indicated.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 60ff183a-dac9-430c-8e1c-773f97f070d2

📥 Commits

Reviewing files that changed from the base of the PR and between 60eacef and b621c34.

📒 Files selected for processing (1)

• src/demo-leak.ts

Open-Dev-Society is on CodeRabbit Free, which includes PR summaries. Ask your admin to upgrade for code reviews.

• Ask an admin to upgrade

Open in CodeRabbit

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: c8f29229-acff-4657-8364-e737ff256e00

📥 Commits

Reviewing files that changed from the base of the PR and between 60d1e8e and 60eacef.

📒 Files selected for processing (1)

• src/demo-leak.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

src/demo-leak.ts suppresses a TypeScript diagnostic and exports token as a string initialized with a hard-coded credential.

Changes

Token export

Layer / File(s)	Summary
Token declaration and initialization src/demo-leak.ts	The file suppresses a TypeScript diagnostic and exports token, initialized with a hard-coded credential string.

Estimated code review effort: 2 (Simple) | ~5 minutes

Architecture Summary

Architecture risk: 🔵 Low · up to 60eac

The change affects 1 system.

Changed systems: src

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — src (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in src/demo-leak.ts: Added a TypeScript diagnostic suppression and exported token, initialized from a hard-coded credential string.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

zomb: 3 findings in this change (since 60d1e8e)

1 high · 1 medium · 1 low

	Area	Finding	Where
🔴 high	security	GitHub token in the code	src/demo-leak.ts:2
🟠 medium	shortcuts	Silences the type checker	src/demo-leak.ts:1
⚪ low	zombie	Delete src/demo-leak.ts (3 lines)	src/demo-leak.ts

1 finding can be fixed automatically: run /zomb-clean in Claude Code.

[ravixalgorithm]

Action verified: comment posted and updated in place, gate failed on the high finding.