High
Export path escapes its base
sample_before.py:9A parent-relative filename resolves outside the configured export directory. The fix resolves and constrains the candidate path.
Medium
Mutable default shares state
sample_before.py:12–15Tags leak between otherwise independent calls. The fix allocates a new list for each default call.
Medium
Zero total crashes calculation
sample_before.py:20An empty dataset raises an unexpected division error. The fix validates the total and reports a descriptive error.
Medium
Negative quantities pass validation
sample_before.py:25–27Invalid negative values enter the domain unchanged. The fix rejects them immediately.
Low
CSV fields are not escaped
sample_before.py:31A comma inside a value changes the apparent column count. The fix delegates serialization to the standard CSV writer.
Run the evidence locally
0 likes · 5 views · Jul 29, 2026
Five exact file-and-line findings, executable reproduction, corrected code, and seven passing regression tests.
