fix(code_safety): demote unwrap_or(0) off critical severity (false positive)

[hyperpolymath]

What

lib/rules/code_safety.ex rated :unwrap_dangerous_default (~r/\.unwrap_or\(0\)/) as :critical / CWE-754. But .unwrap_or(0) is the panic-free, idiomatic-safe form — it's the fix for .unwrap() and cannot panic. The same module rates .unwrap() (which does panic) only :high, so the safe form outranked the unsafe one.

This change:

• demotes :critical → :low (now correctly below :unwrap_without_check's :high),
• switches CWE-754 → CWE-252 (None/Err collapsed to a default — not improper exception handling, since unwrap_or is the handling),
• rewords the description to drop the panic framing.

-    %{id: :unwrap_dangerous_default, severity: :critical,
-      pattern: ~r/\.unwrap_or\(0\)/, cwe: "CWE-754",
-      description: "unwrap_or(0) with dangerous default"},
+    %{id: :unwrap_dangerous_default, severity: :low,
+      pattern: ~r/\.unwrap_or\(0\)/, cwe: "CWE-252",
+      description: "unwrap_or(0) masks errors with 0 default -- no panic; verify 0 is safe"},

Why

Surfaced while triaging the Hypatia scan on hyperpolymath/affinescript#651: the two reported critical findings were both .unwrap_or(0) in correct LSP code (tools/affinescript-lsp/src/{main.rs:155,handlers.rs:575}) — a start-of-line word-boundary default, and a protocol-version default that is immediately range-checked. Both are false positives; the miscalibrated rule is the cause.

Scope

Addresses the rule half of #521. The other half (critical findings counted but never listed in the scan comment/artifact/log) is a separate change in the reporting path and remains tracked in #521.

Tests

No test asserts this rule's severity (code_safety_test.exs only references :unwrap_without_check), so the change is test-safe. The pattern/id are unchanged, so .unwrap_or(0) is still detected — just at :low.

Refs: #521 · hyperpolymath/affinescript#651 · hyperpolymath/affinescript#655

🤖 Generated with Claude Code

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 42 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	42

View findings

[
  {
    "reason": "Repository has 6 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 19 day(s) old",
    "type": "CSA001",
    "file": "src/ui/gossamer/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 19 day(s) old",
    "type": "CSA001",
    "file": "scripts/ci-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 19 day(s) old",
    "type": "CSA001",
    "file": "scripts/bench-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 19 day(s) old",
    "type": "CSA001",
    "file": "ffi/zig/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 19 day(s) old",
    "type": "CSA001",
    "file": "docs/reports/audit/audit-2026-04-15-post.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 19 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/github-registry.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 19 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/github-registry.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 19 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/a2ml-k9.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 19 day(s) old",
    "type": "CSA001",
    "file": "docs/architecture/system-integration.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence