A real report, written by 01 · Bug Hunt, run against this repo — dogfood output, committed unedited. This is the artifact every brief ends in: findings that cite their evidence, ranked by severity, with a fix sketch each.
Produced by brief 01 · Bug Hunt, run against this repo (goal-prompts, v0.4). Part of the sample-report gallery.
5 findings: 0 × S1, 3 × S2, 2 × S3 — all now closed (three in the 0.4 audit cycle, the two forward-compat S3s in 0.8). Scariest: the empty-state XSS, because it was the only place user input met innerHTML.
1. Copy-button label race — S2 · certain · FIXED in 0.4 Location: template.html, feedback(). Trigger: tap Copy twice within 1.6s; the second call captured "Copied ✓" as the restore label, so the button stuck on "Copied ✓" forever. Expected: label always restores. Root cause: restore text read from live textContent instead of a stored original. Fix shipped: original cached in dataset.label, timer cleared on re-entry.
2. Self-XSS in the empty state — S2 · certain · FIXED in 0.4 Location: template.html, render() empty branch. Trigger: type <img src=x onerror=…> into search with zero matches. Expected: query rendered as text. Root cause: query interpolated into innerHTML. Impact was self-only (no URL parameter feeds search), but it was one refactor away from reflected. Fix shipped: built with textContent.
3. Deep-link target hides under the sticky toolbar — S3 · likely · FIXED in 0.8 Location: template.html, .card{scroll-margin-top:120px} vs the sticky .toolbar. Trigger: open /#30 on a narrow screen where search + family chips + playbook chips wrap to ~180px tall. Expected: card top visible. Fix shipped: 0.8 cleared the toolbar at any width (f8ffa35); the current storefront redesign carries .card{scroll-margin-top:130px} (template.html:240).
4. Hash router caps at two-digit ids — S3 · certain · FIXED in 0.8 Location: openFromHash(), regex ^\d\d$. Trigger: none today (ids run 00–45); becomes real at id 100. Fix shipped: openFromHash() now tests ^\d{2,3}$ behind the existing byId guard (683dff5, template.html:1029), so ids 100–999 route. Filed as forward-compat.
5. Installer silently overwrites local command edits — S3 · likely · FIXED in 0.4 Location: install. Trigger: user customizes a file under .claude/commands/goal/, re-runs the installer, edits vanish. Fix shipped: explicit warning line when goal/ already exists.
Finding 3: load /#30 in a 390px viewport, check card top offset against toolbar height.
1, 2, and 5 shipped in 0.4; 3 and 4 (the two that were still open) shipped in 0.8. No open findings remain.
Report only — which remaining bugs should be fixed?