Verified repository proof
FieldBase used file-and-line evidence to remove eleven XSS paths
CodeCordon first found 15 high-severity WEB003 matches. FieldBase reviewed the evidence, fixed the genuine dynamic HTML injection paths, then rewrote four static uses that were safe but noisy to the scanner.
38/100 · F
Initial scan: 15 high findings across 26 scanned files.
77/100 · B
After the XSS fix: four remaining WEB003 matches.
100/100 · A
Current commit: zero findings matched the present rule set.
What changed
Eleven genuine paths fixed
Commit 33288ad replaced unsafe dynamic HTML construction in five templates with escaped text, DOM construction, or sanitized rendering paths.
Four false positives removed
Commit f8435d2 rewrote the remaining static innerHTML assignments so the intent was explicit and the scanner stayed quiet.
Verification method
On July 15, 2026, the current CodeCordon scanner was run independently against three checked-out FieldBase commits: aaba01d (before fixes), 33288ad (XSS fix), and f8435d2 (current). The reproduced results were 38/F with 15 high WEB003 findings, 77/B with four high WEB003 findings, and 100/A with zero matched findings, respectively. Each scan covered 26 source files.
A 100 score means no pattern in CodeCordon's current deterministic rule set matched this snapshot. It does not prove FieldBase is vulnerability-free and is not a certification.
Get evidence from your own repository
Start with a free public-repository preview. Inspect every match before deciding whether it is a vulnerability or scanner noise.
Scan a public repository free