I submitted a side-project extension for review and an AI bot found 4 real security bugs in it

Description and use

An automated reviewer found four security bugs in a Raycast extension: unescaped HTML, Markdown injection, null-item crash, and silent file overwrite. Adding sanitization and checks fixed the issues.

Problem

A Raycast extension that renders invoice JSON into HTML/Markdown preview contained four security bugs discovered by an automated reviewer.

Outcome

Four security vulnerabilities were identified and fixed: unescaped HTML, Markdown injection, null item crash, and silent file overwrite.

Workflow

• 1. Paste invoice JSON into extension
• 2. Render HTML/Markdown preview
• 3. Save preview to file

Evidence

Within a few minutes, an automated reviewer (Greptile, which Raycast runs on every incoming PR) left 9 comments. Four were tagged P1/security.

Source

Paste "tax_rate": "0"><script>alert(1)</script>" and it reaches the HTML template unescaped

Source

A notes value like  turns into an image markdown tag that fires a real HTTP request

Source

Two invoices with numbers like INV/001 and INV:001 both sanitize to the same filename. Saving the second one silently overwrote the first

Source