# Sobelow skip file — triaged 2026-07-26.
# All entries below are accepted false positives with documented rationale.
# Regenerate with: mix sobelow --mark-skip-all

# CSP is set dynamically via ContentSecurityPolicy plug. Sobelow cannot detect it.
Config.CSP: Missing Content-Security-Policy,lib/aprsme_web/router.ex:24,47E7962

# Traversal: seed_from_json reads hardcoded test fixture. No user input reaches this path.
Traversal.FileModule: Directory Traversal in `File.read`,lib/aprsme/devices_seeder.ex:8,1BF74FD

# SQL injection: quoted identifiers validated by regex + quote_identifier, no injection vector.
SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:221,228A588
SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:208,7DAAF2F
SQL.Query: SQL injection,lib/aprsme/partition_manager.ex:190,483C26

# SQL injection: timeout_seconds is div(milliseconds, 1000), an integer. Safe.
SQL.Query: SQL injection,lib/aprsme/release.ex:131,2F4FAB0

# XSS: Vendor heroicons SVG from priv/, name constrained to known icons — not user input.
XSS.Raw: XSS,lib/aprsme_web/components/core_components.ex:50,5E7AE1F

# Traversal: icon Path.join rooted in priv_dir. Not user-controllable.
Traversal.FileModule: Directory Traversal in `File.read`,lib/aprsme_web/components/core_components.ex:38,1721FC3

# XSS: style already escaped via Phoenix.HTML.html_escape() before raw() — safe double-unwrap pattern.
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:554,1B04D86
XSS.Raw: XSS,lib/aprsme_web/live/info_live/show.ex:549,47D20CE

# SQL injection: queries use parameterized $1/$2 via Repo.query(query, [val, val]), not interpolation.
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:521,4DCE646
SQL.Query: SQL injection,lib/aprsme_web/live/info_live/show.ex:427,9779A6

# DOS: mix_unused is a compile-time dev tool. Not a runtime atom table vector.
DOS.StringToAtom: Unsafe `String.to_atom`,lib/mix_unused/analyzer.ex:99,1828283