packages/codex/src/components/icon/Icon.test.ts 
     javascript.browser.security.insecure-document-method.insecure-document-method
        User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an
        anti-pattern that can lead to XSS vulnerabilities
        Details: https://sg.run/LwA9

         82┆ wrapperDiv.innerHTML = wrapHtml;
          ⋮┆----------------------------------------
     javascript.browser.security.insecure-innerhtml.insecure-innerhtml
        User controlled data in a `wrapperDiv.innerHTML` is an anti-pattern that can lead to XSS
        vulnerabilities
        Details: https://sg.run/8y0q

         82┆ wrapperDiv.innerHTML = wrapHtml;
          ⋮┆----------------------------------------
     typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property
        User controlled data in a `wrapperDiv` is an anti-pattern that can lead to XSS
        vulnerabilities
        Details: https://sg.run/70Zv

         82┆ wrapperDiv.innerHTML = wrapHtml;


  packages/codex/src/components/icon/Icon.vue 
     javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html
        Dynamically rendering arbitrary HTML on your website can be very dangerous because it can
        easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never
        on user-provided content.
        Details: https://sg.run/0QEw

         17┆ <g
         18┆  v-if="iconSvg"
         19┆  fill="currentColor"
         20┆  v-html="iconSvg"


  packages/codex/src/utils/stringHelpers.ts 
     javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
        RegExp() called with a variable, this might allow an attacker to DOS your application with a
        long-running regular expression.
        Details: https://sg.run/gr65

         32┆ const match = new RegExp(
         33┆  // Per https://www.regular-expressions.info/unicode.html, "any code point that is not a
         34┆  // combining mark can be followed by any number of combining marks." See also the
         35┆  // discussion in https://phabricator.wikimedia.org/T35242.
         36┆  sanitizedQuery + COMBINING_MARK + '*',
         37┆  'i'
         38┆ ).exec( title );


  packages/codex-docs/docgen.config.js 
     javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-
     traversal
        Possible writing outside of the destination, make sure that the target path is nested in the
        intended destination
        Details: https://sg.run/OPqk

         39┆ return path
         40┆  .join( config.outDir, componentPath )


  packages/codex-docs/docs/templates/methods.js 
     javascript.browser.security.raw-html-concat.raw-html-concat
        User controlled data in a HTML string may result in XSS
        Details: https://sg.run/4xAx

         25┆ paramsString += '</ul>';


  packages/codex-icons/buildIconsJson.js 
     javascript.lang.security.audit.detect-non-literal-fs-filename.detect-non-literal-fs-filename
        A variable is present in the filename argument of fs calls, this might allow an attacker to
        access anything on your system.
        Details: https://sg.run/8RNQ

          6┆ if ( !existsSync( iconsFile ) ) {
          ⋮┆----------------------------------------
         18┆ writeFileSync(
         19┆  path.resolve( __dirname, 'dist/codex-icons.json' ),
         20┆  JSON.stringify( allIcons ),
         21┆  { encoding: 'utf-8' }
         22┆ );
          ⋮┆----------------------------------------
     javascript.lang.security.detect-non-literal-require.detect-non-literal-require
        Detected the use of require(variable). Calling require with a non-literal argument might
        allow an attacker to load an run arbitrary code, or access arbitrary files.
        Details: https://sg.run/zvNn

         10┆ const iconsExport = require( iconsFile );