xss_prescan report — 3 file(s), 9 finding(s)

HIGH   XSS-DOM-SINK         app.jsx:4  non-literal reaches raw-HTML DOM sink
       | el.innerHTML = user.bio;                       // HIGH XSS-DOM-SINK
HIGH   XSS-STRING-EVAL      app.jsx:15  string argument is evaluated as code/markup
       | setTimeout("show(" + msg + ")", 300);          // HIGH XSS-STRING-EVAL
MEDIUM XSS-JS-URL           app.jsx:7  URL scheme position attacker-controllable
       | return <a href={user.homepage}>{user.name}</a>;// MEDIUM XSS-JS-URL
MEDIUM XSS-RAW-TEMPLATE     mail.ejs:2  template raw-output bypasses autoescaping
       | <div><%- bodyHtml %></div> <!-- MEDIUM XSS-RAW-TEMPLATE -->
MEDIUM XSS-ECHO             view.php:2  PHP emits a variable without an escaper
       | echo $comment;                        // MEDIUM XSS-ECHO
MEDIUM XSS-RAW-TEMPLATE     view.php:5  template raw-output bypasses autoescaping
       | <div>{!! $trustedHtml !!}</div>       <!-- MEDIUM XSS-RAW-TEMPLATE -->
LOW    XSS-DOM-SINK         app.jsx:5  non-literal reaches raw-HTML DOM sink
       | el.innerHTML = DOMPurify.sanitize(user.bio);   // downgraded LOW
LOW    XSS-POSTMESSAGE      app.jsx:16  postMessage with wildcard target origin
       | window.postMessage(msg, "*");                  // LOW XSS-POSTMESSAGE
LOW    XSS-ECHO             view.php:3  PHP emits a variable without an escaper
       | echo htmlspecialchars($title);        // LOW (escaper)

scope: deterministic pre-scan — flags patterns for review; not an audit, clean != XSS-free