# Review oracle

The fixture contains 12 concrete issues used to score the reviews:

1. `jobs` is read and written concurrently without synchronization.
2. `req.Name` allows path traversal and arbitrary file overwrite.
3. Caller-controlled URLs allow SSRF.
4. The background goroutine inherits a request context canceled when `ServeHTTP` returns.
5. Download and write failures are ignored before the job is marked `done`.
6. Unix-second job IDs collide.
7. Concurrent requests can truncate or corrupt the same output file.
8. Response bodies are deferred inside the loop and accumulate until the job ends.
9. Downloads have no byte or URL-count limit.
10. Full URLs, including query credentials, are written to logs.
11. HTTP error status responses are copied as successful content.
12. `http.DefaultClient` has no overall timeout.

Equivalent findings were merged before scoring. A finding counted as a false positive only when it did not map to one of these issues and lacked another concrete failure path supported by the diff.