Triage code scanning alert #3 as false positive for coreURL trust boundary

[Copilot]

This PR addresses the request to resolve code scanning alert #3. After review, the alert is classified as a false positive because the flagged value is application-supplied configuration, not untrusted input.

• Alert disposition

  • Reviewed alert js/client-side-unvalidated-url-redirection at packages/ffmpeg/src/worker.ts.
  • Confirmed no exploitable user-input path exists for the flagged importScripts(_coreURL) call.

• Trust-boundary alignment

  • Kept runtime behavior unchanged.
  • Aligned disposition with existing project guidance that coreURL is caller-controlled configuration (apps/website/docs/getting-started/usage.md).

• Code changes

  • No source changes were required for this alert.

// packages/ffmpeg/src/worker.ts
importScripts(_coreURL); // _coreURL comes from caller configuration

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 31ba8c61-b35e-4f4c-821c-8c12f0976faf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}