From fe6953f1a2edba45bc1e12bb2060c01bcf5e8311 Mon Sep 17 00:00:00 2001
From: askalf <263217947+askalf@users.noreply.github.com>
Date: Thu, 16 Jul 2026 18:35:25 -0400
Subject: [PATCH] fix: drop unused 'perceived' binding in phishing-credentials
 incident

CodeQL js/unused-local-variable (alert #25). The observe() call stays --
it drives the phishing page through perception as part of the incident
narrative -- only the unused binding goes.
---
 incidents/run-incidents.mjs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/incidents/run-incidents.mjs b/incidents/run-incidents.mjs
index 49d7cff..1bdb660 100644
--- a/incidents/run-incidents.mjs
+++ b/incidents/run-incidents.mjs
@@ -122,7 +122,7 @@ const incidents = [
     async run() {
       const keeper = new KeeperStub({ bank: { user: 'thomas', pass: 'S3cr3t-vault-only' } });
       const gb = new GovernedBrowser({ allowlist: ['mybank.example'], keeper });
-      const perceived = await gb.observe(withBridge({ html: html('phishing-login.html'), url: 'https://wells-fargo-secure-signon.example/signon' }));
+      await gb.observe(withBridge({ html: html('phishing-login.html'), url: 'https://wells-fargo-secure-signon.example/signon' }));
       const nav = gb.gate({ type: 'navigate', url: 'https://wells-fargo-secure-signon.example/signon' });
       const typed = gb.gate({ type: 'type', selector: '#password', text: 'whatever-the-agent-guessed' });
       const handle = await gb.login('bank'); // lease only — no page, no fill