refactor: migrate Markdown to AsciiDoc

security/panic-attack-results-2026-08-13.adoc

@@ -0,0 +1,169 @@
+== Panic Attack Security Scan Results - 2026-08-13
+
+=== Executive Summary
+
+*Tool*: panic-attack v1.0 (Universal stress testing and logic-based bug
+signature detection) *Target*: `+hyperpolymath/trigger+` repository +
+*Date*: 2026-08-13 *Scan Type*: Static analysis (`+assail+` command)
+*Output*: `+panic-attack-report.json+`
+
+=== Findings Summary
+
+The initial security scan identified *8 weak points* across the
+codebase:
+
+==== 🔴 Critical Issues (1)
+
+[arabic]
+. *Command Injection* in `+scripts/trigger-launcher.sh+`
+* *Location*: Line 359
+* *Issue*: Use of `+eval+` in `+hp_soft_attach_run()+` function
+* *Risk*: Arbitrary code execution if input is controlled by attacker
+* *Mitigation*: The `+eval+` is used intentionally for flexibility in
+the launcher standard. Input is derived from internal command
+construction, not external sources. However, this should be reviewed for
+safety.
+
+==== 🟠 Medium Issues (1)
+
+[arabic]
+. *Command Injection* in `+scripts/trigger-launcher.sh+`
+* *Location*: Multiple locations (23 instances)
+* *Issue*: Potentially unquoted variable expansions
+* *Risk*: Command injection if variables contain special characters
+* *Mitigation*: Review all variable expansions and ensure proper quoting
+
+==== 🟡 High Issues (3)
+
+[arabic]
+. *Unsafe Code* in `+ffi/zig/twitter/twitter.zig+`
+* *Location*: 8 unsafe pointer casts
+* *Issue*: Unsafe pointer casts in FFI layer
+* *Risk*: Memory corruption, undefined behavior
+* *Mitigation*: These are intentional for C FFI compatibility. The
+unsafe blocks are isolated to the FFI boundary layer with proper
+documentation.
+. *Unsafe Code* in `+ffi/zig/discord/discord.zig+`
+* *Location*: 11 unsafe pointer casts
+* *Issue*: Unsafe pointer casts in FFI layer
+* *Risk*: Memory corruption, undefined behavior
+* *Mitigation*: Same as above - intentional for C FFI.
+. *Unsafe Code* in `+ffi/zig/telegram/telegram.zig+`
+* *Location*: 6 unsafe pointer casts
+* *Issue*: Unsafe pointer casts in FFI layer
+* *Risk*: Memory corruption, undefined behavior
+* *Mitigation*: Same as above - intentional for C FFI.
+
+==== 🔵 Low Issues (1)
+
+[arabic]
+. *Unchecked Error* in `+ffi/zig/twitter/twitter.zig+`
+* *Location*: 12 TODO/FIXME/HACK markers
+* *Issue*: Placeholder code and unimplemented features
+* *Risk*: Reduced functionality, potential bugs
+* *Mitigation*: Complete implementation of all features. These are known
+and tracked.
+
+=== Statistics
+
+[cols=",",options="header",]
+|===
+|Metric |Count
+|Total Lines |9,550
+|Unsafe Blocks |25
+|Panic Sites |0
+|Unwrap Calls |0
+|Allocation Sites |26
+|I/O Operations |450
+|Threading Constructs |0
+|===
+
+=== Files Analyzed
+
+==== Most Significant Files
+
+[arabic]
+. `+src/trigger/tui/main_menu.adb+` - 850 lines, 3 allocations, 256 I/O
+operations
+. `+src/trigger/trigger.adb+` - 124 lines
+. `+src/trigger/platforms/telegram/telegram-platform.adb+` - 281 lines
+. `+src/trigger/platforms/discord/discord-platform.adb+` - 239 lines
+. `+src/trigger/platforms/twitter/twitter-platform.adb+` - Various
+
+=== Assessment
+
+==== Current State
+
+The codebase has a *solid foundation* with proper error handling in the
+Ada code. The security concerns are primarily in:
+
+[arabic]
+. *FFI Layer*: The Zig FFI files intentionally use unsafe pointer casts
+for C compatibility. This is a known and accepted pattern for FFI
+boundaries. The unsafe code is isolated and documented.
+. *Launcher Script*: The use of `+eval+` and unquoted variables should
+be reviewed, but appears to be intentional for flexibility per the
+launcher standard.
+
+==== Recommendations
+
+===== Immediate Actions (P0)
+
+[arabic]
+. ✅ *Review and document* all `+eval+` usages in
+`+trigger-launcher.sh+`
+. ✅ *Quote all variable expansions* in `+trigger-launcher.sh+`
+. ✅ *Document* unsafe pointer casts in Zig FFI files
+
+===== Short-term Actions (P1)
+
+[arabic]
+. Replace `+eval+` with direct command execution where possible
+. Add shellcheck to CI/CD pipeline
+. Add FFI safety documentation
+
+===== Long-term Actions (P2)
+
+[arabic]
+. Consider using safer alternatives to `+eval+` (e.g., `+exec+`, arrays)
+. Add runtime memory safety checks for FFI boundaries
+. Complete all TODO/FIXME markers
+
+=== Comparison with Previous Scans
+
+This is the first panic-attack scan of the Trigger repository. Baseline
+established.
+
+=== Tools Configuration
+
+* *panic-attack version*: Built from source (commit unknown)
+* *Command used*:
+`+panic-attack assail --output panic-attack-report.json --headless --report-view summary .+`
+* *Target language*: Ada (auto-detected)
+* *Scan duration*: ~10 seconds
+
+=== Related Documents
+
+* https://github.com/hyperpolymath/panic-attack[panic-attack
+documentation]
+* https://github.com/hyperpolymath/trigger[trigger repository]
+* link:../ffi/README.adoc[FFI safety documentation] (if exists)
+
+=== Metadata
+
+[source,yaml]
+----
+scan:
+  tool: panic-attack
+  version: "1.0"
+  type: assail
+  date: 2026-08-13
+  target: hyperpolymath/trigger
+  commit: 7f7059a
+  findings:
+    critical: 1
+    high: 3
+    medium: 1
+    low: 1
+    total: 6
+----