[ralyodio]

Node's fetch sends the user agent node, so threatcrush.com can't tell CLI versions apart, or tell the CLI from any other Node script. The new threatcrush-nightly report (profullstack/scripts#35) counts CLI users from nginx and needs the version.

• apps/cli/src/core/user-agent.ts: installUserAgent() wraps globalThis.fetch once and is idempotent. Requests to the configured API host (THREATCRUSH_API_URL) or to threatcrush.com and its subdomains that set no User-Agent get threatcrush/<version> (node <ver>; <platform>). Third-party hosts (abuse.ch, Discord, PagerDuty, scan targets) keep Node's default, so nothing new goes to anyone else. A User-Agent set by the caller is never replaced.
• Called at startup in both src/index.ts (the CLI) and src/daemon-entry.ts (threatcrushd).

Tests: new user-agent.test.ts covers host matching, header merging, idempotence and leaving third parties alone. The full CLI suite passes (71 files, 672 tests), as do tsc --noEmit, tsup and the pre-commit hook. The built dist/index.js orgs list against a local server sent threatcrush/0.13.51 (node v24.22.1; linux).

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

22 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 12 | LOW: 9

Severity	Rule	Location
HIGH	secret-aws-access-key	prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
MEDIUM	sql-string-concatenation	.github/workflows/migrate-dev2.yml:128
MEDIUM	js-uninitialized-buffer	apps/cli/src/core/log-tail.ts:58
MEDIUM	js-open-redirect	apps/web/src/app/auth/login/page.tsx:67
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:111
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:115
MEDIUM	js-open-redirect	apps/web/src/app/invite/[token]/invite-client.tsx:55
MEDIUM	js-open-redirect	apps/web/src/components/CheckoutPanel.tsx:99
MEDIUM	js-open-redirect	apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM	js-unescaped-html-sink	apps/web/src/components/GuideReader.tsx:265
MEDIUM	js-unescaped-html-sink	apps/web/src/components/PitFooter.tsx:17
MEDIUM	js-regex-from-input	apps/web/src/lib/credit-codes.ts:567
MEDIUM	js-uninitialized-buffer	packages/scan/src/node-rules.ts:456
LOW	secret-generic-credential	apps/cli/src/daemon/workers/auto-update.ts:155
LOW	secret-generic-credential	apps/web/src/app/api/auth/refresh/route.ts:17
LOW	secret-generic-credential	apps/web/src/app/api/auth/reset-password/route.ts:26
LOW	secret-generic-credential	apps/web/src/app/api/auth/reset-password/route.ts:27
LOW	secret-generic-credential	PRD.md:269
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
LOW	sh-remote-script-execution	scripts/smoke-test.sh:72
LOW	secret-aws-access-key	scripts/smoke-test.sh:150

Snippets are redacted; ThreatCrush never prints matched credential material.