I’m a security person in my day job, so I know about the limitations of static analysis, and I totally get raising awareness. But the way this check works, it doesn’t feel to me that this is what’s happening here: Why is there no finding if I simply say websocket: true instead of websocket: [...options...] in the socket call? Case in point: the default socket "/socket" ... two lines up does not get flagged:
socket "/socket", CaplaWeb.UserSocket,
websocket: true,
longpoll: false
This is why I’m confused: If one of these lines needs awareness, then surely both of them need it? Or am I missing the point?
