fix(spine): the platform's only CRITICAL self-finding was permanent and benign #5495
1 changed file+13−3
Modifiedsrc/lib/spine-alert-fanout.ts+13−3View fileUnifiedSplit
@@ -120,9 +120,19 @@ export async function detectAndAlertNewErrorSpike(
120120 })
121121 .from(platformErrors)
122122 .where(
123 sql`${platformErrors.firstSeenAt} > now() - interval '${sql.raw(
124 String(SPIKE_WINDOW_MINUTES)
125 )} minutes' AND ${platformErrors.resolvedAt} IS NULL`
123 // `make_interval(mins => $1)` binds the window as a parameter.
124 //
125 // This was `interval '${sql.raw(String(SPIKE_WINDOW_MINUTES))} minutes'`,
126 // which selfcheck reported as a CRITICAL raw-sql-interpolation on every
127 // run. It was never exploitable — SPIKE_WINDOW_MINUTES is a module
128 // constant, not user input — but an unfixable-looking CRITICAL that is
129 // actually benign is worse than no signal: it held the self-score at
130 // 75/100 indefinitely and taught every reader to scroll past the one
131 // line the rule exists to make them stop at.
132 //
133 // Cleared by construction rather than by a suppression comment, so the
134 // rule keeps its teeth for a real interpolation here later.
135 sql`${platformErrors.firstSeenAt} > now() - make_interval(mins => ${SPIKE_WINDOW_MINUTES}) AND ${platformErrors.resolvedAt} IS NULL`
126136 )
127137 .limit(10);
128138 if (rows.length < SPIKE_THRESHOLD) return null;
129139
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts