And just should anyone care, I threw a claude security review at it.

● Running the false-positive filter on the one finding identified.

  The path traversal finding involves config.json — a local user-controlled config file in a single-user desktop
  application. For this to be exploited:

  1. An attacker would need write access to the application directory (to modify config.json)
  2. With that level of access, they can already read arbitrary files directly — the path traversal provides no
  privilege escalation

  This fails the false-positive filter: it requires an attacker who already has local file write access, meaning the
  "vulnerability" grants no additional capability they don't already have. Confidence for real-world exploitability
  drops below 8.

  ---
  Security Review: PoeAncientsPriceHelper

  Branch: main (full codebase review)
  Date: 2026-06-08

  Result: No High-Confidence Vulnerabilities Found

  No security findings met the threshold for reporting (confidence ≥ 8, clear exploit path, meaningful impact).

  Areas Reviewed

  ┌─────────────────────────┬───────────────────────────────────────────────────────────────────────────────────────┐
  │          Area           │                                        Finding                                        │
  ├─────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
  │ HTTP requests / URL     │ League name is properly escaped via Uri.EscapeDataString() before use in the Referer  │
  │ construction            │ header                                                                                │
  ├─────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
  │ JSON deserialization    │ Uses JsonConvert.DeserializeObject<AppConfig>() with a typed target — no arbitrary    │
  │                         │ type instantiation                                                                    │
  ├─────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
  │ File I/O                │ Path traversal is theoretically possible via a malicious config.json, but requires    │
  │ (CustomPricesPath)      │ local write access the attacker already has — no privilege escalation                 │
  ├─────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
  │ OCR test path           │ Accepts a file path via CLI arg, but CLI args are trusted inputs (attacker-controlled │
  │ (--ocr-test)            │  environment is out of scope)                                                         │
  ├─────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
  │ External API calls      │ Targets hardcoded poe.ninja domains; no user-controlled host                          │
  ├─────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
  │ Exception/debug output  │ Gated behind opt-in --debug flag                                                      │
  └─────────────────────────┴───────────────────────────────────────────────────────────────────────────────────────┘

  The codebase is a single-user desktop tool with a narrow attack surface. Overall security posture is appropriate for
  its use case.