There is a Cross-Site Scripting (XSS) vulnerability here. The key variable, which comes directly from user input, is used to construct the label which is then inserted into the DOM using innerHTML. A malicious user could provide input like <img src=x onerror=alert(1)> to execute arbitrary JavaScript. You should escape the user-provided content before rendering it as HTML. A safe way is to build the DOM nodes and set their textContent instead of using innerHTML with template strings containing user data.

Constructing shell commands with f-strings can be risky if any variable comes from an untrusted source, which can lead to shell injection vulnerabilities. While chunk seems to contain safe data (commit hashes) in this context, it is a best practice to avoid shell=True and pass arguments as a list to subprocess functions.

This would require modifying run_git to accept a list of arguments instead of a string. For example:

# in run_git
def run_git(cmd_list):
    # shell=False is the default
    output = subprocess.check_output(cmd_list, ...)

# here
cmd_list = ["git", "show", "-s", "--format=%H|%B%n--END-COMMIT--"] + chunk
raw_logs = run_git(cmd_list)

The tag_info parameter is populated here but its value is never used anywhere in the script. It can be removed from the function signature and this assignment. You should also remove the variable initialization and its use in the calls to this function within main().

The chunk_size is a magic number. It would be better to define it as a constant at the top of the file (e.g., COMMIT_CHUNK_SIZE = 1000) for clarity and easier modification.

This line performs a linear search over all commit hashes in the index by creating an array of keys first. If the number of commits is large, this could be slow and cause a noticeable delay in the UI. While this is a good fallback for partial hashes, consider if there's a more performant way to handle prefix searches, for example by pre-processing the commit hashes into a more search-friendly data structure like a Trie. However, for the expected scale, this might be an acceptable trade-off.

Using innerHTML with unescaped data from git tags creates a Cross-Site Scripting (XSS) vulnerability. A malicious tag name (e.g., <script>alert(1)</script>) could execute arbitrary code in the user's browser. To fix this, you should construct the DOM elements programmatically using document.createElement and set their content with .textContent, which automatically escapes any HTML.

        resultDiv.innerHTML = ''; // Clear previous results

        for (const tagRef of tagRefs) {
            const tagInfo = getTagInfo(tagRef);
            const dateStr = formatDate(tagInfo.date);
            const tagUrl = `${repoUrl}/releases/tag/${tagInfo.name}`;
            const badgeClass = tagInfo.type === 'gateway' ? 'badge-gateway' : 'badge-main';

            const resultCard = document.createElement('div');
            resultCard.className = 'result-content result-success';
            resultCard.style.marginBottom = '0.75rem';

            // Release row
            const releaseRow = document.createElement('div');
            releaseRow.className = 'result-row';
            const releaseLabel = document.createElement('span');
            releaseLabel.className = 'result-label';
            releaseLabel.textContent = 'Release';
            const releaseLink = document.createElement('a');
            releaseLink.href = tagUrl;
            releaseLink.target = '_blank';
            releaseLink.className = 'tag-link';
            releaseLink.textContent = tagInfo.name; // Safely sets text
            releaseRow.append(releaseLabel, releaseLink);

            // Date row
            const dateRow = document.createElement('div');
            dateRow.className = 'result-row';
            const dateLabel = document.createElement('span');
            dateLabel.className = 'result-label';
            dateLabel.textContent = 'Date';
            const dateValue = document.createElement('span');
            dateValue.textContent = dateStr;
            dateRow.append(dateLabel, dateValue);

            // Module row
            const moduleRow = document.createElement('div');
            moduleRow.className = 'result-row';
            const moduleLabel = document.createElement('span');
            moduleLabel.className = 'result-label';
            moduleLabel.textContent = 'Module';
            const moduleBadge = document.createElement('span');
            moduleBadge.className = `badge ${badgeClass}`;
            moduleBadge.textContent = tagInfo.type;
            moduleRow.append(moduleLabel, moduleBadge);

            resultCard.append(releaseRow, dateRow, moduleRow);
            resultDiv.appendChild(resultCard);
        }

Using short SHAs as keys here can lead to collisions if two different commits share the same prefix. This would cause data for one of them to be lost. To fix this, let's use the full SHA as the key within this function. The conversion to short SHAs and collision checking will be handled later in main.

To complete the fix for potential SHA collisions, we need to adjust the main function. First, we'll rename commit_map to commit_map_full to reflect that it uses full SHAs. Then, after processing, we'll create the final commit_map with short SHAs, performing a collision check at that time.

After applying the suggestion below, insert this block of code right after (after line 152):

    # Convert full SHAs to short SHAs, checking for collisions
    commit_map = {}
    short_to_full_map = {}
    for full_sha, data in commit_map_full.items():
        short_sha = full_sha[:SHORT_HASH_LEN]
        if short_sha in short_to_full_map and short_to_full_map[short_sha] != full_sha:
            print(
                f"CRITICAL: Short SHA collision detected for '{short_sha}'\n"
                f"  Commit 1: {short_to_full_map[short_sha]}\n"
                f"  Commit 2: {full_sha}\n"
                "Please increase SHORT_HASH_LEN and re-run.",
                file=sys.stderr,
            )
            sys.exit(1)
        commit_map[short_sha] = data
        short_to_full_map[short_sha] = full_sha

The rest of the function can then use commit_map as before.

The current implementation has a Cross-Site Scripting (XSS) vulnerability. The renderResult function constructs HTML using string concatenation and sets it with innerHTML. The tagInfo.name is taken directly from a git tag name and included in the HTML. Since git tag names can contain arbitrary characters, including < and >, a malicious tag name like v1.0<script>alert(1)</script> could lead to arbitrary JavaScript execution on this page.

To fix this, you should avoid building HTML with strings. Instead, use DOM manipulation APIs like document.createElement and set dynamic content using textContent, which automatically escapes any special HTML characters. A good approach is to use a hybrid method: use innerHTML for the static template, then populate the dynamic, untrusted parts using textContent.

        resultDiv.innerHTML = ''; // Clear previous results

        for (const tagRef of tagRefs) {
            const tagInfo = getTagInfo(tagRef);
            const dateStr = formatDate(tagInfo.date);
            const tagUrl = `${repoUrl}/releases/tag/${tagInfo.name}`;
            const badgeClass = tagInfo.type === 'gateway' ? 'badge-gateway' : 'badge-main';

            const container = document.createElement('div');
            container.className = 'result-content result-success';
            container.style.marginBottom = '0.75rem';

            container.innerHTML = `
                <div class="result-row">
                    <span class="result-label">Release</span>
                    <a href="${tagUrl}" target="_blank" class="tag-link"></a>
                </div>
                <div class="result-row">
                    <span class="result-label">Date</span>
                    <span>${dateStr}</span>
                </div>
                <div class="result-row">
                    <span class="result-label">Module</span>
                    <span class="badge ${badgeClass}">${tagInfo.type}</span>
                </div>
            `;
            container.querySelector('.tag-link').textContent = tagInfo.name; // Set name safely
            resultDiv.appendChild(container);
        }