Backlog/threatintel data

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

✅ architecture (gemini-3-flash-lite) — clean

Summary: Frontend refactor to advanced search/lookup in threat-intel; no backend or agent contract changes.

No findings.

🛑 bugs (gemini-3-flash-lite) — high/critical — please review

Summary: Potential race condition in search results state management and missing dependency in useEffect

• high frontend/src/features/threat-intel/pages/ThreatIntelPage.tsx:81 — The useEffect hook depends on 'size' and 'query', but these are not included in the dependency array. This will cause the search to trigger with stale values if 'query' or 'size' changes.
• medium frontend/src/features/threat-intel/pages/ThreatIntelPage.tsx:100 — The 'modeRef' is used to determine if results should be appended or replaced, but it is set outside the mutation callback. If multiple mutations are in flight, the mode might be incorrectly applied to the wrong response.
• low frontend/src/features/threat-intel/components/FiltersPanel.tsx:133 — The reputation logic uses hardcoded values (-3, 3) and accuracy uses (0, 3). If the backend schema changes, these magic numbers will cause silent UI/logic mismatches.

🛑 security (gemini-3-flash-lite) — high/critical — please review

Summary: Introduces new search and lookup endpoints and complex query composition logic in the threat intelligence feature.

• medium frontend/src/features/threat-intel/components/FiltersPanel.tsx:137 — Potential for XSS or injection if the 'tags' input is not sanitized before being used in backend queries. While the frontend splits by comma, ensure the backend validates that tags do not contain malicious characters.
• medium frontend/src/features/threat-intel/services/advanced-query.ts:10 — The mergeAdvancedRequests function constructs complex query objects. Ensure that the backend strictly validates the structure of these objects to prevent NoSQL/Elasticsearch injection attacks.

🟢 go-deps — up to date

No pending Go dependency updates.

[AlexSanchez-bit]

size and query dependencies are needed since user can use those values to change filters and data retrieveral