QNSQY billing-API CodeQL summary  (sanitized)
=============================================
Tool   : CodeQL (GitHub semantic code analyzer)
Pack   : javascript-security-and-quality
Target : billing-API TypeScript (Cloudflare Worker), 94 source files
Date   : 2026-06-15

Severity breakdown
------------------
  error   : 0
  warning : 0
  note    : 22      (note = the lowest CodeQL severity tier)

By rule class (note-level only)
-------------------------------
  js/polynomial-redos ...................... 10
  js/incomplete-multi-character-sanitization  8
  js/clear-text-logging .................... 3
  js/double-escaping ....................... 1

Disposition (no high/critical, all reviewed)
--------------------------------------------
  - polynomial-redos: regexes in request input validation. Catastrophic
    backtracking is bounded in this environment: Cloudflare Workers enforce a
    hard per-request CPU limit and a maximum request-body size, so a crafted
    input cannot consume unbounded CPU. Tracked for hardening (linear-time
    rewrites / explicit length caps) but not exploitable as a DoS here.
  - incomplete-multi-character-sanitization / double-escaping: string handling
    in email/templating paths. Output is not rendered into a trusted HTML sink
    that would make these XSS-relevant in the worker context; tracked for tidy-up.
  - clear-text-logging (3): all three are structured "CRITICAL_ADMIN_ACTION"
    SIEM alert lines that record an admin user-id as a deliberate audit trail.
    An admin user-id in an audit event is not a secret; this is by design.

No secrets, credentials, tokens, or private keys appear in these results.
Exact file/line locations are withheld; none of the 22 items is a security
defect requiring remediation before release.