# Prototype-pollution / unsafe-merge pre-scan

- target: `sample-repo`
- JS/TS files scanned: 2
- findings: HIGH 7 · MEDIUM 7 · LOW 2 · INFO 0

_Deterministic pre-scan — not an audit. Line/window-based; no dataflow. A clean report is not proof the codebase is pollution-free._


## HIGH

- `sample-repo/vulnerable.js:8` **PP-WRITE** — direct write to __proto__/constructor.prototype — prototype pollution sink
- `sample-repo/vulnerable.js:9` **PP-WRITE** — direct write to __proto__/constructor.prototype — prototype pollution sink
- `sample-repo/vulnerable.js:10` **PP-WRITE** — direct write to __proto__/constructor.prototype — prototype pollution sink
- `sample-repo/vulnerable.js:15` **PP-PATH-SET** — dynamic path setter fed an attacker-derived path — `a.b.__proto__.c` shapes reach Object.prototype
- `sample-repo/vulnerable.js:16` **PP-PATH-SET** — dynamic path setter fed an attacker-derived path — `a.b.__proto__.c` shapes reach Object.prototype
- `sample-repo/vulnerable.js:26` **PP-MERGE-REQ** — merge/extend call fed an attacker-controlled source — deep merges copy __proto__ keys to Object.prototype
- `sample-repo/vulnerable.js:27` **PP-MERGE-REQ** — merge/extend call fed an attacker-controlled source — deep merges copy __proto__ keys to Object.prototype

## MEDIUM

- `sample-repo/vulnerable.js:21` **PP-PATH-SET** — dynamic path setter with non-literal path — verify the path cannot carry __proto__ / constructor segments
- `sample-repo/vulnerable.js:32` **PP-MERGE-LIB** — deep-merge library call — these merge implementations copy __proto__ keys; verify the source is never attacker-shaped
- `sample-repo/vulnerable.js:33` **PP-MERGE-LIB** — deep-merge library call — these merge implementations copy __proto__ keys; verify the source is never attacker-shaped
- `sample-repo/vulnerable.js:34` **PP-MERGE-LIB** — deep-merge library call — these merge implementations copy __proto__ keys; verify the source is never attacker-shaped
- `sample-repo/vulnerable.js:38` **PP-DEEPMERGE** — hand-rolled recursive/deep merge with no __proto__ / constructor / prototype deny guard — special keys reach the target
- `sample-repo/vulnerable.js:50` **PP-DEEPMERGE** — hand-rolled recursive/deep merge with no __proto__ / constructor / prototype deny guard — special keys reach the target
- `sample-repo/vulnerable.js:58` **PP-ASSIGN-REQ** — Object.assign copies attacker keys via [[Set]] — a __proto__ own-key invokes the prototype setter on the target

## LOW

- `sample-repo/vulnerable.js:64` **PP-FORIN-COPY** — key-enumeration copy into another object with no own-property/special-key guard — __proto__ own-keys from parsed input write to the target's prototype
- `sample-repo/vulnerable.js:72` **PP-SPREAD-REQ** — object spread of an attacker-shaped object — the __proto__ own-key survives and feeds downstream merges