No OS-specific absolute paths in source
Why it matters
An OS-specific absolute path hardcoded in source is a machine-identity leak (CWE-426: Untrusted Search Path) and a guaranteed deployment failure: /Users/dev/project/data/seed.json works on one laptop and nowhere else — not in CI, not in Docker, not on a teammate's machine. The taxon operational-readiness frames this correctly: the code was never tested outside the original development environment. AI models frequently emit absolute paths because they pattern-match on the developer's stated project location during the session, then embed that path literally into file reads, seed scripts, and config loaders.
Severity rationale
Medium because the broken path causes a hard runtime crash on any non-originating machine, but it does not expose data or enable unauthorized access.
Remediation
Replace every hardcoded absolute path with a runtime-relative path using path.join() and __dirname or import.meta.url.
// Bad — only resolves on the original developer's machine
const data = require('/Users/dev/project/data/seed.json')
// Good — resolves relative to the module file at runtime, everywhere
import path from 'node:path'
import { fileURLToPath } from 'node:url'
import fs from 'node:fs'
const __dirname = path.dirname(fileURLToPath(import.meta.url))
const data = JSON.parse(
fs.readFileSync(path.join(__dirname, '../data/seed.json'), 'utf8')
)
For Next.js projects, process.cwd() resolves to the project root in both dev and production. For Bun or Node scripts, use import.meta.dir (Bun) or __dirname (CommonJS) / fileURLToPath(import.meta.url) (ESM).
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Hallucinated References Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-426 — Untrusted Search Path: hardcoded absolute paths on the developer's local machine create environment-dependent behavior
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-slop-hallucinations·automated